{ "Event": { "published": true, "date": "2023-05-07", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-05-07", "timestamp": 1683504181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "03717033-7814-4017-98fe-1d2cc2f4fc0b", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31e2963f-ecba-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683451996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683451996, "uuid": "0e36e2cf-cf9b-4a14-9600-536d4961ec17", "comment": "Malware payload (RedLineStealer)", "value": "831623d9a83531a572325d5ccb7e333a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683451996, "uuid": "8c06e66c-abc4-4614-9946-ca3c2d10ad03", "comment": "Malware payload (RedLineStealer)", "value": "000edd06cbd5c2a07384d239fbb8fcb51df5a7d7a5fbe81629057e73ba33bc5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683451996, "uuid": "d532a840-7754-43ad-8e36-02e4ef381dca", "comment": "Malware payload (RedLineStealer)", "value": "0e374dce6ccdfe7f1252c713b245881fedafc6ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683451996, "uuid": "7f4f2011-1bf0-4a94-8be8-09bd1c0985c9", "comment": "Malware payload (RedLineStealer)", "value": "083f7a78af5a3efc7f5636e1cba319780a16c065e5867f2e542823081d161e54c2537327c976ac5c52b77e5e9d77555b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683451996, "uuid": "3f98a831-55ed-4491-addf-03d2859f258c", "value": "T111E41207A7ED8072CCB127B029FA17D30B3B7DA14A74C2162756940A4D73AD8A93677F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683451996, "uuid": "1ac611f8-f1e2-4d22-9329-0a9fe4d4ee28", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683451996, "uuid": "9b996f0d-4d5e-4b7c-8ecf-a76c875b1c02", "value": "12288:9MrXy90OIsJ6cwuVZKqzo5Rns52fRqxWJIuwI9u1UDMsWcpPJle+Pzz4pL:KyKchPho5RC2fCS19u1UfWcnle+PH4pL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683451996, "uuid": "d1b63ea5-06ab-4d8c-a9f0-938081c0aae6", "value": 711680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683451996, "uuid": "ceaf366b-eb7e-4d83-ad85-dfc40f962799", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683451996, "uuid": "ab8b81c5-11a3-4455-a223-91ff7f8bdc3d", "value": "831623d9a83531a572325d5ccb7e333a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a36b58a4-ed0a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mekotio)", "timestamp": 1683486546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683486546, "uuid": "e080c4a6-c842-44d5-a79d-7c570b005222", "comment": "Malware payload (Mekotio)", "value": "5b3d63597f12ff65cf89a4de062aa5cb", "object_relation": "md5", "Tag": [ { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683486546, "uuid": "416ceddb-84a0-40f9-984c-7b0c0eaaf06b", "comment": "Malware payload (Mekotio)", "value": "00a8cd120fc7b04b5958107af78c965e5e132d6585bd585ad5b16421edc8456a", "object_relation": "sha256", "Tag": [ { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683486546, "uuid": "6190d0fd-4ef7-400a-b52b-ee1f7056e250", "comment": "Malware payload (Mekotio)", "value": "e9b223b601bd7f9a7863d40bb2de808edb6559fb", "object_relation": "sha1", "Tag": [ { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683486546, "uuid": "9a99b1f5-82ac-45e6-acf1-9b68c5b02933", "comment": "Malware payload (Mekotio)", "value": "c19c53e9242fb76e7e39604390eed1d603df6f75c065d520f7c2522993c9953f6febf9725e345209823efee7a9b103e2", "object_relation": "sha3-384", "Tag": [ { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683486546, "uuid": "c3d38863-6a17-41ad-bd0b-f8d1b249c517", "value": "T126C633AD5D9176903CC4D001995BA9C31289FA9B56EC728FB2BD1FDBE3905432F8D832", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683486546, "uuid": "8bda7820-727a-4f33-855e-14a0456fe6d7", "value": "196608:oKUlzE7YWY23+oig7ZlkhrcGRkjDiZduSjKtcguZ7NXtD2HcNiz2KRg4NBHLXGTT:oK2473nOa7Z0rjRkjeZhKtcTJXtD2Hc9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683486546, "uuid": "3b34ef0c-7104-4d87-8b9d-5e7c89073022", "value": 12378595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683486546, "uuid": "d06d2607-c912-403e-95dd-91800faf1278", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683486546, "uuid": "02b27681-56b0-4cc4-a566-5d768f2b8651", "value": "mekotio1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3f2fda2-ec85-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683429531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429531, "uuid": "fe76a87e-b1ff-4120-8cb7-1b9cdea62727", "comment": "Malware payload", "value": "98d4a021d297fc479a7badbb378907a0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429531, "uuid": "96335ce1-8296-4b95-908f-4b96735c1e94", "comment": "Malware payload", "value": "00ace607a44cbcd3e0bcdfb0a6b5f27c834fce66b95ee987c28eb651da9c2464", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429531, "uuid": "29d73760-9911-4952-ae56-8570e88d5a29", "comment": "Malware payload", "value": "ff8fa169a1727ad4529f0e9ab957bb3a3a119b40", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429531, "uuid": "4d96cbb4-50b3-4c91-93bd-04f102f19525", "comment": "Malware payload", "value": "645c564b41befd1d8eee9ade4576e6f66336283e70ad19429ac7896eed918283fd383413fc172dbe9b442652ed086cd8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683429531, "uuid": "5c73c96d-07ef-42ed-bced-4beb98c836a2", "value": "T1B016CF403BD0ADBBD1EE6775912681FC4FBCD0866BD7A31B5604A56C0EDE3820E5E287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683429531, "uuid": "e5609d00-ad52-4ba7-aefa-78655d71db0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683429531, "uuid": "d37c1b3c-6118-4ae1-8b8a-d9b9e6301992", "value": "98304:oXB4uluJRmMg6QWlIpgi0rHqsih/mCqJ4B4uluP:ovsJR0TW6yiIKRhzqOsP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683429531, "uuid": "8e735891-42c7-41ca-a7c7-c55f30a88db3", "value": 4388056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683429531, "uuid": "34d8a1fe-a7d4-4df5-8461-304f9860c6b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683429531, "uuid": "5f303f66-580d-4cae-9457-f5387b37f019", "value": "VirusShare_98d4a021d297fc479a7badbb378907a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ff7b763-ecca-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683458972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683458972, "uuid": "f9fcb44c-f3f1-493f-aab6-aad546e44fe9", "comment": "Malware payload", "value": "26e7de58e729c6a533a009a43869c6d4", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683458972, "uuid": "a0982cb8-f968-4769-bc27-0a4d2449ba2d", "comment": "Malware payload", "value": "022c44ff60f93df9d32e09fdb12ad92a9d090d70f823bba9adc34e57d2cc6da3", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683458972, "uuid": "c140d14f-bf3f-4241-aeed-21512731ac6e", "comment": "Malware payload", "value": "31b65a5f4a54254e6b362939380fc262c502fb9e", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683458972, "uuid": "606e7ca3-bf1d-4eac-8309-0d2189d99ae2", "comment": "Malware payload", "value": "de6b7e4c02a66ae8b30891647f1074a20b2d421c017e432abfb68dd2737a6b375a95f434d5c94a460f64bc982e28e77e", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683458972, "uuid": "bd4fa25d-f6c2-4a0f-b07e-e338b9c43e8c", "value": "T148672261F7D7DA26C3A75239423D2E7316268CD542C39687190B3A281873FF85B47ABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683458972, "uuid": "91115d18-df67-4b1c-8679-0fe04ff460eb", "value": "786432:vTSgd3VEKz8HJ0NqntKous2UwmLqTI9scDn49Nn:v2g54CNqntKous2ULqT1sKNn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683458972, "uuid": "34269e21-57cf-46b0-8ae8-ca2688eb7a13", "value": 31846772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683458972, "uuid": "19c5da6e-a468-43d8-bef3-4cb8da1e111f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683458972, "uuid": "176a39af-3afe-47dc-ac2c-b1b0171228ba", "value": "MetaMask.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d3203b5-ecc6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683457115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683457115, "uuid": "2bc0af5b-505f-4cd8-816f-850a1e9ada1d", "comment": "Malware payload (Mirai)", "value": "0dfe26283eed9e0edf0e01efded216a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683457115, "uuid": "19202c4e-0624-4c16-93b9-90dcf88d13b8", "comment": "Malware payload (Mirai)", "value": "02b42fb4773ab43bb069bec833593c8e60375cbae1adbcc34af63bb130f2f2f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683457115, "uuid": "8c75ce9e-bb70-42a0-809b-7bb0a8f4f7c0", "comment": "Malware payload (Mirai)", "value": "4df9cd6e60d9387f05fea2a2ab905381023b081a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683457115, "uuid": "c32001a7-c0aa-4d80-8c46-b9af9c7f279f", "comment": "Malware payload (Mirai)", "value": "2c67bf37e0cd867308951f12ec24761997592b96614cc9f6d8a9991cb4341ac9b15e1735864292f861c0b389b679216a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683457115, "uuid": "53da1b51-7e37-4b5b-9098-e44ae05a2a16", "value": "T18CB2D03471EAA4F0CD316434F87DC947AB9A40FD90FD7721226750E85E9A88D25EC6D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683457115, "uuid": "3db1b5ad-b6e3-47cd-a3f1-0d3a592b1528", "value": "384:joBE5aNSS75BOI+ypZ5vTlYIwcvsdTf5MF1iAUgefoeDYbZXGcH1i83hymdGUopK:7aNSq5sOHpTqncvsdDePiAUgefoeDeXL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683457115, "uuid": "57cb32e8-3c63-4558-b051-eebd031414da", "value": 23728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683457115, "uuid": "000f2735-8e84-49bc-9113-6d495654aae8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683457115, "uuid": "6ceff9b7-c73d-48db-b069-88fd4b710cd6", "value": "0dfe26283eed9e0edf0e01efded216a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d3a49e1-ecc6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683457088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683457088, "uuid": "35cdc129-b995-4877-a3be-9094bebb892a", "comment": "Malware payload (Mirai)", "value": "704e0307db04c71a278f1d1a3c46917a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683457088, "uuid": "301027cb-dbba-4e25-96c2-c11b68b7b917", "comment": "Malware payload (Mirai)", "value": "033e1dfdbce4441e736aac6ae7348b27f340f4ed20649e405d0354b714174fb5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683457088, "uuid": "82e3044f-6094-4c77-9d51-167e7a896e7e", "comment": "Malware payload (Mirai)", "value": "47a2e9ac30b08d3bc603f507ab0141e31dfc6db5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683457088, "uuid": "4a851ba8-8281-443b-ac5b-cad2c142a657", "comment": "Malware payload (Mirai)", "value": "114f5d53302ab3cf93c47c519512032279f288abff993a9f13d7d4c123e2ce69ab4687dfac95e3e722ac25c2e2ffc6b7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683457088, "uuid": "cc1bd91e-27c7-49b6-bfc2-b522811ca80b", "value": "T1D6533B99F4029E3DF88FE9BA84160E05B93023D212931B2767ABFDE37D331659D12D45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683457088, "uuid": "2a6c45ef-a3b7-4011-8e58-337b1d798443", "value": "768:me4gpsM204GEkRbjveXd/nQi122EQtBSv3gFHn1eu48B8vB6J7EzNfXQuJpoz8yS:mo3EkRbDmoiz6IFn1X48B2SEzNfAuJMS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683457088, "uuid": "bdcbaa6f-061e-4db3-ae95-7c8b9ae58c80", "value": 65100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683457088, "uuid": "3da6547d-00e0-45ee-8756-f9a85355d0be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683457088, "uuid": "e67a23d7-9e37-4267-8b61-0647204c7710", "value": "704e0307db04c71a278f1d1a3c46917a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ec6ca4e-eca7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683443857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443857, "uuid": "49537b3d-3843-46ae-804e-ad770707dec0", "comment": "Malware payload (RedLineStealer)", "value": "59aed2b56692440215cef03771f75174", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443857, "uuid": "024503c7-5a4b-4f5b-86a1-acb0badeb0dc", "comment": "Malware payload (RedLineStealer)", "value": "053ae4f38b75a72d7e7331a61bf288148bee7e692b20a5035bacff23ca3539e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443857, "uuid": "c034ad00-f157-4178-8202-0b4f776d3452", "comment": "Malware payload (RedLineStealer)", "value": "c186c8598ca0fe964c265213dcf060ed782883b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443857, "uuid": "f656fcb3-2c75-4af6-94d1-71063ae68d0b", "comment": "Malware payload (RedLineStealer)", "value": "8e58d6d767d4a64efb041c698998e4193aa681c26cd8bf9525c8a427ea2c393a83ce3661ffafa30da2950f368e4fcab5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443857, "uuid": "07e69e74-cc27-417c-a73d-bb3295f2d3c1", "value": "T1B045D001B4E2C472D47225310AE4DB768A7DBD304B615AEF67E40F6E4F303D29771AAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443857, "uuid": "8baae5d9-f980-48ea-9a2e-8ec25634306b", "value": "73de971797ab27b065ec1845590dbafb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443857, "uuid": "f74e211c-b89c-4ad5-9499-cfcf1a09c277", "value": "12288:RW1ip1iWqmPqIE2QZZ7jOwZY/GnrHPPy:RW1Ci6bE2QP7jOkYyjn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683443857, "uuid": "a02550cc-a219-4b24-9efe-75bb012add7a", "value": 1225216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683443857, "uuid": "78902abb-621e-40be-ba6b-18493038b2b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443857, "uuid": "be5ca61c-aeba-45b8-baa8-3753b7d73486", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c1f542f-ec6a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1683417707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683417707, "uuid": "e2e6dc1f-1986-4071-9abf-02cbc51fcd40", "comment": "Malware payload (CoinMiner)", "value": "70ae62b899677b72567b2783429dda8d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683417707, "uuid": "f4f5ca67-601e-48dc-9d47-c1bb659bef7f", "comment": "Malware payload (CoinMiner)", "value": "05cbc7acf9459b56e1682f7d6f5389445f68b26749da081e03425100d138ccff", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683417707, "uuid": "43402cf6-8701-41f5-980d-37962ba07bf8", "comment": "Malware payload (CoinMiner)", "value": "af5909cf1feebc4008ebeeea1d2da39dcf37b35c", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683417707, "uuid": "e415bab3-c1c7-4712-a135-84c5942013cc", "comment": "Malware payload (CoinMiner)", "value": "98a9d95679d7b39ea0f543dce3c386badf5d51d15655352a5837aa882defb19d017ce5c4423fb5db40058e4266a7d1dc", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683417707, "uuid": "73ddb26e-e551-4491-a9be-e03ef8ae707d", "value": "T11CB6BF31D37A586AA00B35BC97FC2C6F78B4F76F5325660E7339529E04AA80EBF41458", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683417707, "uuid": "5a3c49fa-db19-41d1-8f4c-167f3db5ee7e", "value": "d3be2dc19ba54f7225d7679c3f791cf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683417707, "uuid": "416a26e4-4a8c-4046-9cda-9d5f645a6b3a", "value": "196608:BO7tauhixdS1Qx4TbCuJFMxIz6VgWwTi9KKz1drIZUvI6eCAaNLDx+fGCXmRY:B4QuEuTbHsxIz2gWv0ZUvIk7NLDx+uCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683417707, "uuid": "d212e86e-a56a-48cb-ad70-ebe8d7c489f2", "value": 10429208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683417707, "uuid": "be6cab4a-6e91-4e64-a946-49924cd1f5b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683417707, "uuid": "5116d150-1fe2-49e2-96b5-5bbbbc434d78", "value": "updater.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b784609-ecf2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1683476117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683476117, "uuid": "d411a97a-88a3-486f-a391-2ccdcdf52a61", "comment": "Malware payload (RemcosRAT)", "value": "e2b6f13bd85b42e00589b5f012194164", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683476117, "uuid": "21bb3cd5-57d3-4ea2-8afa-9376725d7a8a", "comment": "Malware payload (RemcosRAT)", "value": "0633f8de50f6208c3fa3ae353d742391c432264fbc1264a4f299119ff669859b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683476117, "uuid": "588e502d-3e96-4621-8567-fd9c6811595d", "comment": "Malware payload (RemcosRAT)", "value": "d1a8ad2d37befc6e5035c4df1f899ae6e649efec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683476117, "uuid": "93b2d68e-6400-48d2-b806-264bb9e0d402", "comment": "Malware payload (RemcosRAT)", "value": "b4b893596c225e2a4ac7d1eca0836eefbc94b22db2be28e60245ecbdc0e354eef2569058e76b54247a46fb99ce671d0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683476117, "uuid": "baf5da36-defe-4787-aa70-7ed92f84b962", "value": "T15E0502841DF2D17AEC325CBE1A3154DFBFFAAD27D3196E25E95E7E2304F12018818A16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683476117, "uuid": "c829427c-8132-47e8-a3ee-acab23ba5531", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683476117, "uuid": "061de432-58e2-47e6-a071-e821330fe645", "value": "12288:96vCij8vWoivGq5pgMhdNIme1hc15xtPC8TyQibW80IZ/3WV54rS:9gCiXoivxnNE1hc15xtdTyb8INqe2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683476117, "uuid": "c205ce17-b083-4eb9-8f9a-82abd0fb1ea3", "value": 823700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683476117, "uuid": "e4ac325e-a737-4fdb-a06d-230776dd3fbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683476117, "uuid": "218d31ed-177d-4611-8894-8343dccf7150", "value": "PO 331385674200010.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "755f120c-eca7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1683443949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443949, "uuid": "f24fe9db-e54a-416f-a230-8dbcab3746cd", "comment": "Malware payload (Smoke Loader)", "value": "8baf8b638b046fcda2652f65ac00baa8", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443949, "uuid": "1c3eb740-e3a7-4885-8641-a997523c2a80", "comment": "Malware payload (Smoke Loader)", "value": "0705c1208231b77f1a4026190ff995caff2c3778ebdcf1d8840dfce590a12efd", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443949, "uuid": "2f6264d1-219a-4c87-997c-2e16126a23b7", "comment": "Malware payload (Smoke Loader)", "value": "7674ff8d44d8ef1ccef310e641afe75762efee40", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443949, "uuid": "1d7da8b3-8d29-42ad-83ef-f1ac5b6a1fd9", "comment": "Malware payload (Smoke Loader)", "value": "adda54ac5be74bdc0fd5e2b2a03dd4295da846f064553e0a3040a79b04d26e6d1fe0b9d6384181e289a1521bd6e794ff", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443949, "uuid": "17c89322-9e46-4a45-98c5-34e8e8210620", "value": "T15864D70392F17D55E9264F729E1FC6E8F62EF2508F5977AA12199E2F04B02B2C273711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443949, "uuid": "f72a15dd-c53b-4472-b4f5-c52b772eed92", "value": "bb88f4adba9a887009b468960699d154", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443949, "uuid": "b10d7870-47fb-4bfe-82de-8f34b8f090af", "value": "6144:emeX+1EvLk9iAok6Y/mTag4AnLsfEMSr:9eOig936CBwsfSr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683443949, "uuid": "11d5f785-51e2-4f9c-b92c-7c8d33c68b13", "value": 317952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683443949, "uuid": "18a78a2b-e2a3-4c06-ac3e-53c500d9c681", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443949, "uuid": "0f022ebc-f1d9-475f-af3e-68e072022281", "value": "8baf8b638b046fcda2652f65ac00baa8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "623433a0-ec9a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683438333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683438333, "uuid": "b16ab85e-d16f-4ca3-b4ce-91448495a3ed", "comment": "Malware payload (RedLineStealer)", "value": "e1381e4b7f223ab0662453ddb6337292", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683438333, "uuid": "f43e0cca-3b17-46bc-a6e6-9c1ead9171c2", "comment": "Malware payload (RedLineStealer)", "value": "08acabd3d1e9da7fa9fffd9ca89518f9570571b100eb106394df94ad1a30154c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683438333, "uuid": "02858496-515f-49ad-af50-a2daf707c6e1", "comment": "Malware payload (RedLineStealer)", "value": "24d6b691130565d2e2f55bf93ae049dd6b0062bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683438333, "uuid": "f7b21c72-fb14-4bbf-9227-833f4c8d28cb", "comment": "Malware payload (RedLineStealer)", "value": "0fa7038e24019025900fe6cf189de254b95350ab8500406c3e876c531f0d08ae6ac056e5c22da9d9a23cd4276184184c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683438333, "uuid": "a3b6e16f-bed1-4a56-bb90-a8f6ae59834e", "value": "T1C6A41216EBC94133ECB61B7008F607830A36BDE16A78535F27986D4B1D72AC4A53637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683438333, "uuid": "3d5b222e-2646-440d-ba32-356a5abbb9ec", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683438333, "uuid": "edc8fdb0-d42b-488b-b81a-e2d22703ef4a", "value": "12288:lMrsy90E0GnYarYfVAA07foipZOhMfMyyPB:xyUirKngyPB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683438333, "uuid": "ca81a9a2-1612-44d9-822c-6b77b17e6f34", "value": 490496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683438333, "uuid": "e54e19d8-d0cf-4260-814e-3df8ad6faeab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683438333, "uuid": "0a05d24c-7194-4779-b0c6-ac9d4ab15288", "value": "e1381e4b7f223ab0662453ddb6337292.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1dc1769-ecda-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683466035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466035, "uuid": "ed650321-d4e4-42ef-b312-ac6060b7483f", "comment": "Malware payload (AgentTesla)", "value": "422ccd40034e44004294a5d6efef2486", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466035, "uuid": "b3114b70-98be-4f45-8921-cbd9bdb8b410", "comment": "Malware payload (AgentTesla)", "value": "0c4d54f4b79f728d51547af59f56e59eee4507ff960f8ae6bf712aa9388a1ea2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466035, "uuid": "4707802f-73db-4923-8bcf-58166899eea9", "comment": "Malware payload (AgentTesla)", "value": "e563a68956ec4081a58d86caa0c6a4469b670bb5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466035, "uuid": "b20692aa-a3a5-4414-b221-7a3326a1b61b", "comment": "Malware payload (AgentTesla)", "value": "a2e6f3da5d718f81c5293f5e407f956e83b4bc04995ab364b9a33a75965839fb51c51e36deba71f6de15afa56bd0784f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466035, "uuid": "44d15a27-2bdf-4058-8428-c2d3ad118e11", "value": "T142F4E12633B8B7A1FCF683F86604D0016FB46D605776E6E80DCAA0C95594F18FB6079B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466035, "uuid": "24908bb5-e7a9-49b9-85cc-94d56c4687a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466035, "uuid": "c03bda4c-fd52-4c2a-b8be-b51f127509bd", "value": "12288:Q511KrWvJ0IwsKkxJoH5wTKn2Sk4DilZs+cmh8s+x66aI6kC3mlMtQjlXaBxE:6PKI0IDKoJUWiiDs66y7WlMtQjlIxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683466035, "uuid": "74a25e8f-60bc-4498-bd50-3e70900ba533", "value": 775168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683466035, "uuid": "ec737b1a-2b45-47c4-8f5e-23f3d5e369d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466035, "uuid": "f820d510-13c5-49ce-824a-b2f408e6f72f", "value": "SecuriteInfo.com.Trojan.PackedNET.2010.2973.17359", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fae5d52f-eca6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1683443743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443743, "uuid": "e372512b-878e-4dba-be08-5cab8c406047", "comment": "Malware payload (DCRat)", "value": "d5868189cb764e6d72856a7ae5dfe153", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443743, "uuid": "f7dcc72e-3021-4533-98dd-d5b965de02da", "comment": "Malware payload (DCRat)", "value": "0c9b34be698836b2b86f86ddc19b52174c2a436a4ace9e05ae28b29d59601f7e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443743, "uuid": "57e7cf75-1cbc-4bc2-bd27-0d33a2eff35d", "comment": "Malware payload (DCRat)", "value": "a5e2743e62e40e2b184328db4d25124916734ca4", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443743, "uuid": "a25156ea-0d78-46da-8eaa-077fdee0ab15", "comment": "Malware payload (DCRat)", "value": "d99f9e978597de04d9ccda60b909d0c7d6353a113b21b6380140e10f161697623895ca6c931ae3f56ceac6ea59fe2bd9", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443743, "uuid": "50e68cee-10fa-4b18-a956-378ef562caca", "value": "T1140507027E44CE11F0181633C2EF454887BAA9516AA6E32FBDBA376D55523E77C0C9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443743, "uuid": "494f0c94-e02e-4e19-bfd4-e6002b72dce8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443743, "uuid": "006ed297-d86e-4fec-a43a-0ce02fc67d06", "value": "12288:TaCAo1uUPoc3V2HZBPWOPKmmL/QyYEOGuLAPwfpvd/ECuXFN:TPAo1F3FArWOPKmmL/2HpNEvXFN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683443743, "uuid": "b1679f90-32a7-494a-84dd-50071050890e", "value": 848384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683443743, "uuid": "245d0179-4746-4c41-8d83-e5731d4b04d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443743, "uuid": "ca897533-c3ba-42d2-b502-f40fec37e110", "value": "0C9B34BE698836B2B86F86DDC19B52174C2A436A4ACE9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00c1a52a-ecc6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683457067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683457067, "uuid": "24f59cff-bdb9-462d-b1ca-723297757165", "comment": "Malware payload (Mirai)", "value": "446014d45318c2906094f1ca77d30934", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683457067, "uuid": "2fdda295-5c7d-4f14-885a-18eaba67a33f", "comment": "Malware payload (Mirai)", "value": "0cc1ed4e0354fa6f10270d7c92da185c7c4a4e13bd35bd4d1ecf856def6c2314", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683457067, "uuid": "c660b4a1-807b-4e5b-82a7-c7c7a3053ec3", "comment": "Malware payload (Mirai)", "value": "0ba9531cc3b34a0c3cb837a19ec75edcb09513d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683457067, "uuid": "80dd59a2-a551-4b96-b790-ba8bf24a8317", "comment": "Malware payload (Mirai)", "value": "3c9569788c257e7bd96707e3360779b6faeb33e20882b849dd1893ae1d5c294b38678a7cc274c912699656cd510d33d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683457067, "uuid": "6b42dbbd-e55b-4787-8e0b-3def0a24c03a", "value": "T1A6E2E1D55576A878DEB11D7AFC63074E252AC6FD89FB103267F8372423B09A64BB0443", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683457067, "uuid": "8276bde8-d467-449d-bbca-72d10ca7a592", "value": "768:n8Lm6COq1fewdHy62pud4yNOYSOyB8Lr669q3UELd8:8LJCmjpkcMKU2Li", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683457067, "uuid": "029adda4-b8bc-44af-b635-b779f8fe71e1", "value": 31872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683457067, "uuid": "050e534c-7d70-4ba7-882c-a3b5663f930e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683457067, "uuid": "d2010c2e-cd47-40b3-a726-4b6e32cf125b", "value": "446014d45318c2906094f1ca77d30934", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc1ade63-ece3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683469944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469944, "uuid": "b3ac5604-a5c7-41ee-a843-f04ab3376d02", "comment": "Malware payload (Formbook)", "value": "f1b00f25f827bf0a2e5dc3e1e589f9e5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469944, "uuid": "edbae50d-1ada-4a42-b0db-6b4b04dd9f29", "comment": "Malware payload (Formbook)", "value": "0d1bdb6dc44779d3cb54b12a6a97e30d513b3bebe0a8a0832b4aeadf06fc9e60", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469944, "uuid": "08dab204-7431-4cd0-aeb6-88c0de63d3d7", "comment": "Malware payload (Formbook)", "value": "101ccccd56f84e495e18db10a861acdd3c3a5662", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469944, "uuid": "b386caab-d3b2-4e71-9933-ab3a6bfebfaa", "comment": "Malware payload (Formbook)", "value": "e62a7f0a27fce6f6e3b536e22074550306b77de65ceb8a9dd977e005044c94ea7a451da0659965513bb2d0bfba38fcb2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683469944, "uuid": "a40170a9-bb29-40bd-85c6-be1e948a7096", "value": "T10F3423353BDB1BA58D4BF279255BD4D029928C81EBE5080F418617B88DD993EAF432F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683469944, "uuid": "6451fb15-5a32-4aa5-9094-c7c769e734ff", "value": "6144:OpkIUdhCXdIYIOE2tpT4gb6Lyvoz1I3UA8H/qV8AOF:OpfUdh7VytpEgb6Lyoz6UA8HyV89F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683469944, "uuid": "8cb0b6b4-24fe-43b4-ac68-030fc98ddd48", "value": 242395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683469944, "uuid": "e494f7c3-92f7-4493-9b36-660cd98a3007", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683469944, "uuid": "093c20bb-56c1-44c0-8c08-b13a81169cf3", "value": "SHIPMENT GEORGIATIBILISI FCA-BUSSY ST GEORGES-FR NUXE APRIL PO 23.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64937b8c-ecdb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GandCrab)", "timestamp": 1683466254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466254, "uuid": "e8f89f0b-5c66-4ae1-bdae-cedc7d14fe60", "comment": "Malware payload (GandCrab)", "value": "6569fd60f73e5705f4c28ab59d86fb39", "object_relation": "md5", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466254, "uuid": "28472073-494e-4ead-905e-8b09e466c67d", "comment": "Malware payload (GandCrab)", "value": "0e98661ea680708e9bb55f32131f743811108e826b91cae99d69a8fc1856d429", "object_relation": "sha256", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466254, "uuid": "00aa7ccc-e07f-4192-8bd0-71406e9ad3c5", "comment": "Malware payload (GandCrab)", "value": "7159be53512f91b2aeabe5c15a54d95955eb4d6a", "object_relation": "sha1", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466254, "uuid": "a7eac23a-c869-4324-8b69-c6675534cba6", "comment": "Malware payload (GandCrab)", "value": "5af719feb8dfe69e334c2447b9f63157bd427d3f5f4b5ccade87f47ce83eb51b416453365de8f6d2961fe58af9b5457d", "object_relation": "sha3-384", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466254, "uuid": "3384973d-bdb7-4d3e-8f6a-9feabbabb9cd", "value": "T1DA77CF00B1D191B6E9F64A3998F8AB45552DFDA01BE039B773B62A4F09310D35E31BB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466254, "uuid": "0219c744-a2c6-41cf-be49-f6c1d4e50b1b", "value": "6144:ScytwbnTTSdBgQqqDL6SK+iZz+FF4X4sYN+Qaf3AVwbLW:vyinTqn6r+iZz+v4+9M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683466254, "uuid": "a814a8f2-3ba2-4986-8387-5bc6216ab821", "value": 33058816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683466254, "uuid": "1d13b279-712c-4984-b2b7-d2e22e5b496c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466254, "uuid": "0e5ec90e-419c-4d5e-aa37-41b10834cb8c", "value": "2023-05-06_6569fd60f73e5705f4c28ab59d86fb39_gandcrab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d1d55bd-ecba-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683452015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452015, "uuid": "f5f4563d-5a8c-432d-8078-820da13bc0a4", "comment": "Malware payload", "value": "1720d63c71a0e839611b9aae7c0834e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452015, "uuid": "27cf0a56-68c4-4c0e-a20d-41d54efc4d54", "comment": "Malware payload", "value": "120cdb96926a4eb1bbc810a5c1a2bd5f0d384f7a7fa3267f66c72fbbfdf233ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452015, "uuid": "646d85d2-4cee-4b2c-91ab-d864542f755b", "comment": "Malware payload", "value": "3944e642c8f5ddd1239dc24f3a0f97fa82c9a75b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452015, "uuid": "d0e7f862-0693-44eb-b34a-5855f009ac38", "comment": "Malware payload", "value": "a6f87a02d0154dcd9720faeb05c77ccd5d421282ed812275f7916dc5181ed28d31e5c5cc0458d2a276aa4ba59f292186", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683452015, "uuid": "a46bc370-a145-4324-a773-63f86781d65f", "value": "T1E8657C327A8064B6C3637930D74EA37AB3ED86324A79574756501E303F74993A22CB6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683452015, "uuid": "ae3049df-f0fc-4e15-a382-f2aaab2ce465", "value": "24576:fWnAxrOgeSAYvPYzqD2AQOLPiL+Wgck2nPC4YEK1ZAs9HuT1p96rQZ/grb9Hwx8g:fWnAteSAYvPsqD2AQLRgcTPC4YEeZB9E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683452015, "uuid": "ac9c638a-2152-42a9-bbc2-3d764bfa9ac0", "value": 1505556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683452015, "uuid": "2b149f3b-f311-411e-9976-36e7a012d293", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683452015, "uuid": "77582fb5-4085-4a7f-bbf7-ae2e32080daa", "value": "1720d63c71a0e839611b9aae7c0834e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebe8a551-ed03-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1683483661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683483661, "uuid": "43db31a4-0644-4b64-a0c7-79c86cbda7e4", "comment": "Malware payload (Vidar)", "value": "d330beb155e519e8a8f4968695716c41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683483661, "uuid": "e4edc133-535c-49f5-9a4f-f90ba5183d29", "comment": "Malware payload (Vidar)", "value": "13eb578533117f116142d75633ad3f5fcd8366a145da5e60754139fefd495e98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683483661, "uuid": "4af95ddc-8174-417c-b0c9-15a33c4f18f3", "comment": "Malware payload (Vidar)", "value": "689c55972bcaf9795daf19278842c95846acc1fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683483661, "uuid": "c4d19b18-550c-4ff9-9fc7-5633de670526", "comment": "Malware payload (Vidar)", "value": "790515ba768c3483df6b6657eb1e89f873d1b934b8c8f2e1ed7dfcf7e33f9a2f1a466de5b3f4bf430e3c228f16e0c197", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683483661, "uuid": "62628380-716c-4b22-b0c6-b47c483e9f70", "value": "T18AF45B9C726072EFC86BD472DEA81C64EA5174BB971F4217A02716ADDE0D89BCF140F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683483661, "uuid": "beea321f-3ec1-4230-b5bd-1e5ad4af0a59", "value": "12288:JgVfMhtLc4aGr2kz3jGu+weChWs3pySVJSJsh86paP6kqdWhtLqMy8mXJvgylcTQ:eEXLNaMvmGTRV4GpaVqh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683483661, "uuid": "cd27ef48-ca26-4bec-a8d5-ee392cfed40f", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683483661, "uuid": "494c537a-f931-408f-a4e1-a50bb375c007", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683483661, "uuid": "58a55f77-dfa3-4335-8458-434381108073", "value": "Kiddions M\u043ed Menu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "162bde4f-ecc6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683457103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683457103, "uuid": "52c64d70-0c54-444d-b3de-9c6c9f5171a2", "comment": "Malware payload (Mirai)", "value": "a1a7764513e84fa3b364e44f61cfdac2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683457103, "uuid": "44e7a65b-ad0b-4c56-91ec-97f5a418ceaf", "comment": "Malware payload (Mirai)", "value": "146ce7b0b3d2a4744a8e2bfb807926489c4c1a5fcb360e3c2135d748377d7c41", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683457103, "uuid": "70c8ac1e-769d-49bc-9dec-950ca6db4a03", "comment": "Malware payload (Mirai)", "value": "2298b6d00a9f764264dac989fb1c00b3239878d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683457103, "uuid": "3cb51052-7892-4e39-af24-cb7b3c688b43", "comment": "Malware payload (Mirai)", "value": "b30c114725f1f28d5ec6c1739b61ddf6c63865d4b3f3d5f8849770334156eb0119648c68124cf1fc69cddc0841b935c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683457103, "uuid": "14ea74f4-3b4e-40a7-942b-a57210c21c0c", "value": "T12B732A26B97A1E26C0D4B57E60FB8B11F6E1278E26B4C50A7D720E5EEF147006502EF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683457103, "uuid": "71f83409-b332-4104-8b0b-c8897d67e853", "value": "1536:hD/B6f6UD5hAS7mo0DCCAXpSKV6v3G78nN9WL:927jqCt8v3GI/k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683457103, "uuid": "c4015bf2-5175-420e-a14b-5b5092aee93a", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683457103, "uuid": "ae0a6e98-9e5e-45ec-a6e7-a2f7d7589e59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683457103, "uuid": "73ec8b60-05d0-48cc-88d3-5127a594bad0", "value": "a1a7764513e84fa3b364e44f61cfdac2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c86849b-ec6f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683419855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683419855, "uuid": "33f54d89-9b5d-42db-8ecd-e8865fd11ce5", "comment": "Malware payload (AgentTesla)", "value": "80aa4d31a2a0e45c6be34d1c9431aa58", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683419855, "uuid": "3fb6ce6a-a63c-4ebf-8622-e4a851fe9be0", "comment": "Malware payload (AgentTesla)", "value": "14b4f36af1e77933e2f869e534832b03a81c3c75862e3912800c322dccd387fa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683419855, "uuid": "053edd00-f9a2-44f7-a701-9b6fd3d54ff7", "comment": "Malware payload (AgentTesla)", "value": "590036c501b546ed1baf44d481728c58a6b29b16", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683419855, "uuid": "49ee8b9b-bb56-4c71-8747-2f0ca4d64b65", "comment": "Malware payload (AgentTesla)", "value": "e47b0c006e14a9e4de146eccd4b8c470e2e0bfbef0ebf5e2bf764550cdb4ae8a6f84bd29097f6b1ec8f57342e6f89851", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683419855, "uuid": "1e0a88fc-119a-4641-b3b9-8e92d223a10e", "value": "T156F4F12523B9BB91FCB683FC7608E4016FB46D1057BAE6D84CCAB0CA5148F18F650B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683419855, "uuid": "0134b2fc-a0ff-4a85-a4e3-5f8b82aa4d17", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683419855, "uuid": "ddfc72c4-a223-473c-9975-8248e144a951", "value": "12288:vB11KupS8gQQDwQALXSgeHJnVHqzd4LxvdRdSEmg:5PKupS8gHk5LSh+JOdR0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683419855, "uuid": "ed8c1230-78cf-4f29-98c6-d84f8dffcdb0", "value": 775680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683419855, "uuid": "30ff8598-9e85-4730-b653-312126949cee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683419855, "uuid": "fb4fc468-1453-4d5e-8656-9beca351dad2", "value": "80aa4d31a2a0e45c6be34d1c9431aa58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07327c7f-ecdb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683466098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466098, "uuid": "d04914e7-0ba4-4c62-a28c-218f13be129e", "comment": "Malware payload (Mirai)", "value": "694abee5490ee93fc21895917fd70b34", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466098, "uuid": "73cd4df5-94eb-4f8a-8014-dbe1e787ae88", "comment": "Malware payload (Mirai)", "value": "1571f6069654cb6f75541a7ccbc6354b025da4d3d3afca1d28ba407329f29ec9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466098, "uuid": "e92c211d-85b9-4c00-92c9-1e4b433899c6", "comment": "Malware payload (Mirai)", "value": "50cc936ed4fcd4f5be1d67dffd6aa88728da889d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466098, "uuid": "26e8a436-d3c7-44b8-9b12-f14e8f283a44", "comment": "Malware payload (Mirai)", "value": "5f1d709af053194e248054557cb4df72145e44e4a9453b0b2acf64514245cbc3a11d58c47cd01e6429c500ff3d15427e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466098, "uuid": "f0ee7eb3-a700-4a7f-b98c-f2a3bd0f81a8", "value": "T106332B97F601AD3EF99BEA7F8413460AF13077950093073A63B6FD935D322949D16E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466098, "uuid": "74e8fd3f-cdc7-4922-a4f1-bcd7b2efbdd2", "value": "768:O2eNjCsDZxwjehgzQoXRrpw6QqgObkI8uCQwrxhbBwJG/cT88bq0R7:zQjRwjN8MR9zyI1CQ6hbBiG/O887R7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683466098, "uuid": "433fdd61-7eaa-4d07-9611-61565c42cb02", "value": 53164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683466098, "uuid": "965e741b-a078-4f6a-bb62-7da52e509167", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466098, "uuid": "bc3d5d20-cb7f-4d6e-8513-5717d5eb4679", "value": "694abee5490ee93fc21895917fd70b34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd784862-ed02-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683483261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683483261, "uuid": "24ba7d42-9aaa-4131-bfa7-4fb75443453d", "comment": "Malware payload", "value": "0ad824c9898657a25c9fc6d2239764d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683483261, "uuid": "2f153509-4e21-4b50-9c5c-95182b4acdb6", "comment": "Malware payload", "value": "159376c3144f2abccd38d80c5cd69d18cd45232ae807b64292f213634f2087c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683483261, "uuid": "5c1bc99a-9b72-478f-afc6-8bf72f17f70a", "comment": "Malware payload", "value": "491739333a928871bd1ec9c86f46116ad9ca1bdc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683483261, "uuid": "c8b6bb0a-fd3a-4ffe-a663-9db1974b13b0", "comment": "Malware payload", "value": "502821f847507b2663f078582f56f738354dd66457a668ec5ed638ac01869e9f55f2c7ed9c615747bc3c6148c6f00d16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683483261, "uuid": "8b880e96-d690-45ec-8e3d-c0d0c59adb73", "value": "T107D5E0B17FE57DAAE5AE2AB8F4A640847D74EC6B578C924D7C8C34D90F713448422EB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683483261, "uuid": "462e1d77-be5e-4f8e-858e-84231c5b1461", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683483261, "uuid": "da51b496-d3bd-451f-a90c-37368719843b", "value": "49152:hKQ9qcpXi6MSrzysY4bpzrLgAA8NRJFRgT/g:hKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683483261, "uuid": "afe42930-a04d-4529-b95e-a3e7dee718fd", "value": 2915328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683483261, "uuid": "0dd685cb-af5b-48ae-9e6b-77e2cdd32cb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683483261, "uuid": "45b40634-af92-4587-a868-cc10fa25f1e0", "value": "0ad824c9898657a25c9fc6d2239764d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dc6a247-ec9c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683439158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683439158, "uuid": "08be21e6-c50f-4d03-8a34-083a5095d2a3", "comment": "Malware payload (Formbook)", "value": "7d44c6ee46d6a16fc6b6994933b24d76", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683439158, "uuid": "babd5330-2427-42ea-ad12-5c2f5856e503", "comment": "Malware payload (Formbook)", "value": "162ee7ccabbc7bfc629b8f05cecde2e0a24ec55064b1e42ddf2bf507db7c103d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683439158, "uuid": "b7e3359c-cece-488f-9da4-da8ed2e857ee", "comment": "Malware payload (Formbook)", "value": "ba71e90fd95289d3542d5a396d1417809e3de0c0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683439158, "uuid": "86900886-b0f4-4e2b-9638-c7425b2c5fbe", "comment": "Malware payload (Formbook)", "value": "ad51bcccfd8458a72c9f83020410b5a20a548cfc3e1ce1770503a77038fdcf98f36faf3b7da1589adec3f7a8030f052e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683439158, "uuid": "edf27740-a0a7-4b76-adbd-b825e1c0ce15", "value": "T1E84423E7D93F2274BE3957964CFA3B6CD88B90420392168D33A4C7E2514D1F590DE2AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683439158, "uuid": "2b4143a2-0979-44f5-923b-cd8db17fe85c", "value": "6144:vctCHqXlJMJ3/Hr7sim9C++fAX3BM9aEEWGFJN3B:UtjXDMJ3/Lg6+enWB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683439158, "uuid": "16b231dc-05b6-464f-83fa-22368da24086", "value": 274634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683439158, "uuid": "ab92bad7-fb07-446f-90ee-906feee7e8a3", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683439158, "uuid": "ad989848-0cc2-4e09-8091-35ece6231241", "value": "Quote_Request_pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c711afb-ec98-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Pony)", "timestamp": 1683437438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683437438, "uuid": "740a466c-0ecd-4a4d-abe9-5e3310b170d0", "comment": "Malware payload (Pony)", "value": "cc14c8910cf29442d5d483e287451a49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683437438, "uuid": "91c03e57-06e4-4011-be27-853750d0aa99", "comment": "Malware payload (Pony)", "value": "16703b5bcfae534545be4485a526b0d13c1fc39ce4112be436d48c6edd799144", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683437438, "uuid": "10cb305d-1bc6-4e26-a564-393438c256ad", "comment": "Malware payload (Pony)", "value": "db845c3a55a15dbc6f8b9cbd477fcb194cf2e12b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683437438, "uuid": "050fe3f8-7768-41d7-9ef1-eaf9adc6cf66", "comment": "Malware payload (Pony)", "value": "eb5dd9d20020532a68ece1aa9f00b4f02c9159d8cebe68f70ad3a44f1433f51e8443ba9d7326b8fa3755988450e95003", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683437438, "uuid": "4e9b551d-13f2-45d8-9481-03bcd65333f3", "value": "T1F9C48F22F6F06B33D2331638AC1B5768D8367DD13B285A466BD71CCD9F39281352A297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683437438, "uuid": "443f7675-c2d9-4849-a4c8-9884e1c98539", "value": "877a4cbbec66063c32f5145250204058", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683437438, "uuid": "2b480b9f-ed41-4d47-a3c8-20669b6ca278", "value": "12288:0VrcJRSD7dEJDI7CvfftNKSoQomRkOuuRntrpkFzDvSwn/j:6e8dEJDI7C/t4ltOuufrqzOej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683437438, "uuid": "b795b62e-5f69-4aa6-a85b-73899be9c5cc", "value": 594432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683437438, "uuid": "2cb0f514-0311-425f-850f-ed71166ab611", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683437438, "uuid": "c47a2c43-e7a2-48ea-896f-684a15ba98c5", "value": "16703B5BCFAE534545BE4485A526B0D13C1FC39CE4112.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "237fb216-ecd7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Pony)", "timestamp": 1683464427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683464427, "uuid": "cf7f5c71-fc59-44b7-8a10-7e968d2495e2", "comment": "Malware payload (Pony)", "value": "f6536f7fe9feef17adc493638395555b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683464427, "uuid": "f9e9c84d-ea44-4883-ba06-b5a361d217c5", "comment": "Malware payload (Pony)", "value": "16f0f3dac1f5860d2d6ed940a3c20c070e22a913a847d7b0be0aa2e18181d599", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683464427, "uuid": "40612806-f4a1-44ae-b1be-b2ebc2d94ef0", "comment": "Malware payload (Pony)", "value": "157307ead7905b1844dcc69458f0531e66b31fb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683464427, "uuid": "0d5a7a7c-99d1-41dc-b356-1791a3c85236", "comment": "Malware payload (Pony)", "value": "41399344db5b9e22c9e6cf1ec9686b4a67b7f48098a7f75d4e67864de5b0f8d24cc7f04fbbf74b421773dac02c292012", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683464427, "uuid": "30e78fa8-bada-47ea-95ca-d8e53ff4db56", "value": "T1D043D04FB66118A6F211097114B3B66E86B58215E33CB7DFEFC24C1A62B2FE01971729", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683464427, "uuid": "a472f202-80a0-4480-a039-9057033a9b70", "value": "1487c4c5076ffe9457791bd5690f2a3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683464427, "uuid": "e90aae81-a2bc-4fdd-943f-b00af17bb4cb", "value": "1536:+tzqxvhrplLk9h8egJPfWunoGh4R17mZDLn845OUKMkQKFoNek+5UD:+T8N3WuoGh4KZDL1gmKF0ek+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683464427, "uuid": "3227eaac-985e-40c0-839c-6b4e0acfa85f", "value": 57455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683464427, "uuid": "7e105d91-db11-4bb5-b120-6350d839f12e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683464427, "uuid": "a0072ba5-b2e5-4094-8689-4f89d06dcf13", "value": "16F0F3DAC1F5860D2D6ED940A3C20C070E22A913A847D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8e9d4d2-ecda-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683466074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466074, "uuid": "f89ed3ab-e95e-4e49-aefd-0b30051ea7fc", "comment": "Malware payload (Mirai)", "value": "3362de5b8543fca0d2cc10a8de0d21ff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466074, "uuid": "1708ebfa-d0ae-438c-bda2-4e5e45cbcf30", "comment": "Malware payload (Mirai)", "value": "17a2187e4658852077db7903a240ca74fac4d8b43dd76035418893ce60286e01", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466074, "uuid": "e90ad9e7-15fb-450b-ab5d-1d3d8772256d", "comment": "Malware payload (Mirai)", "value": "f4d7f4856a60112f604c6ca50306681aae475d12", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466074, "uuid": "265c7bc7-4ad5-4000-9b34-f2975e14084e", "comment": "Malware payload (Mirai)", "value": "57938cadeddc00913f8670bbfff6c7c33a5822f90d7abc51c402bfee21ab318846f835b8f30ef51286a99be1b27b445c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466074, "uuid": "ac0cbfe5-2d7f-47e4-93f9-06c0bb5ce056", "value": "T1C8333A21AE762E27C0D1B87A21F74724B2F6578A21E8C72E7D720E4EFF145C061576B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466074, "uuid": "c2f66bc7-70be-4eda-b29d-31a48db04900", "value": "1536:ewe48SM/Pvl32OoH8pq2lTkhNQR8z+TwJ:ez45CCHY2h88z+Tc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683466074, "uuid": "4c85ea21-18c3-4818-af49-cb01b381312c", "value": 54608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683466074, "uuid": "74786638-99d1-4023-b1d7-e237b1798da3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466074, "uuid": "5df998f8-0b7f-434b-b197-2047974bf21f", "value": "3362de5b8543fca0d2cc10a8de0d21ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78a4e0f7-ecf2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683476166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683476166, "uuid": "15008bde-98a4-4711-a66e-9f22789ecf69", "comment": "Malware payload (Formbook)", "value": "8f534a0853dc956ab3f8fd3acb47e79b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683476166, "uuid": "72549b46-24c7-45cf-a32a-f3442d18f3f0", "comment": "Malware payload (Formbook)", "value": "19beeb39bb23ab829e9729a0c7b40f217ff775a2b5e09bb3d039ad91c8d41e0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683476166, "uuid": "340c11e8-a190-42a5-89cb-3198e13b6bfe", "comment": "Malware payload (Formbook)", "value": "77aeb631d52be4e23fa38122293fbb1573e92ebb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683476166, "uuid": "f0e68874-d237-43bf-8080-8b0cf9988427", "comment": "Malware payload (Formbook)", "value": "f09ae51678793da8e8b582548a59647de67d0da1017cec57e7d7be4b2bbb0f7e312831a29fd38e6193185a72342c0762", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683476166, "uuid": "c8a7e45a-b1bd-4af1-ac0d-2bf8436afc56", "value": "T11FD4236E37B4C0E7DD6381330EBCFE1A2A9AD61934745A816714B708BBF5280D498B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683476166, "uuid": "d1804aff-58b3-41d0-a0d4-43c699dc27ad", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683476166, "uuid": "ba51838b-6018-4657-a7f2-084c8a56075f", "value": "12288:ZYDD4hfoT1lFb8TJ9WIwMmA/PymT6mkKyRNNRTy4AKH8XAfjw+1bFF+6zW:ZYDD4hfOP8+yF6jNlFHHxfjpxVzW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683476166, "uuid": "776577df-0d90-4236-acdb-37869da5f476", "value": 640544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683476166, "uuid": "5817b59a-17d6-40fd-96d8-fac6baea74aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683476166, "uuid": "5a7cfe55-9d6f-4abd-9243-891c413e193f", "value": "REQ - KINV000196.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bd3aad4-eca7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683443933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443933, "uuid": "8c115b25-2cdd-4613-9ccd-d4821459cffd", "comment": "Malware payload (SnakeKeylogger)", "value": "23a1f61ba07f8af3e0b379e15ee42d61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443933, "uuid": "8a53e408-1c13-427b-a88c-281970b9eda3", "comment": "Malware payload (SnakeKeylogger)", "value": "1a6f98c2107fd310ce83b4e6fe93635f9f82a8a2cd5ed746aa630b6580d83ed6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443933, "uuid": "57709ae5-3eae-42f9-a5a3-fb92e212e8c6", "comment": "Malware payload (SnakeKeylogger)", "value": "cc6fa54ce4a0b0338aa2b575c217c6923f4474b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443933, "uuid": "2f66a0d8-1430-468e-b901-d9d27a5888c4", "comment": "Malware payload (SnakeKeylogger)", "value": "6daea09ca80b45e8b5335e3ca202c82e7fa97e7a26e8d7db140fdc62d205577d2c484bc1771d5a7cdc3b71f89a52ac9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443933, "uuid": "c1690643-6122-42ae-953d-42c626ca3fd1", "value": "T182E4F1726298D725E39907FE5A0C8D05037C2111BF7FDB28299E51C8EC76760B226EDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443933, "uuid": "457735fd-d895-483c-8586-18afcd0a1ea6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443933, "uuid": "396c5e7f-d18d-46a1-bc2a-c78fb4ac96d4", "value": "12288:XV2iN1Bzn85RByi+Ztq+Gre/InTJGYdRtMlDE+UkBxTEFA9KLp:l1p85yi+ZtgreQTAORsOA63Lp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683443933, "uuid": "56d435f4-ccd3-44f6-bfdd-da149391a41c", "value": 662528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683443933, "uuid": "1359805d-0b9c-4d9c-9295-c5e5195379f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443933, "uuid": "3276e9d6-d4e3-444c-bc4f-2dd53287c102", "value": "Voyage Order Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dc726f9-ecf2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683476148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683476148, "uuid": "951485ed-dc02-4eea-9c93-65c910b0ee28", "comment": "Malware payload (AgentTesla)", "value": "2bca97438ef4da3d9dc19ba8305fdfe1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683476148, "uuid": "6ccbe89e-1f13-4ba1-af9b-a79f3329d081", "comment": "Malware payload (AgentTesla)", "value": "1c0216850dbb0c54ac0530096791d93e6b2309a72171c933c2f633d49a5eabc4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683476148, "uuid": "f9060ffb-868d-48f8-a623-948b8dcb90bb", "comment": "Malware payload (AgentTesla)", "value": "5548243b9f3dcfa1e58f30ae6eac74093e969096", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683476148, "uuid": "677f81a5-72ff-4b13-8451-2fb23a904a94", "comment": "Malware payload (AgentTesla)", "value": "7d37ec9c9115541c3d427495a1b547a7c9d76ad93fd86c2b218907f69df583486d52c308abf712b461b024219f6fc5ab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683476148, "uuid": "e3ace977-0b75-495a-b4ca-4f6433a8a220", "value": "T19EF4E1262379B7A1ECF283FC7614A4016FB06D6153B6D6D84CCAF0C95594B09FB20BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683476148, "uuid": "6230f2bc-4dbe-4af0-ab83-ea0cdae7ae90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683476148, "uuid": "bb580f71-7e77-4159-b614-0b4471af4be5", "value": "12288:Owi911KxyiwDIWyfnY6bO1YbFsjIjR+4F2aHT00VE3MTDYSeN9e4rEB:ONPKz4yfnYkOWbF3laaqMY5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683476148, "uuid": "19177566-f213-4a2e-a0aa-f5082a2f2e4c", "value": 784384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683476148, "uuid": "197631a1-47f5-47ee-b004-6129215481eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683476148, "uuid": "d43403cd-7bcc-4dd0-bb7e-fe6cf85dc0e8", "value": "Pago transferencias-20230404.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a2a711b-ec90-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683434132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683434132, "uuid": "8bb94de2-43b7-4cab-bb0c-e4544583ae47", "comment": "Malware payload (RedLineStealer)", "value": "241fd04146a05179100ca32da4bf37f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683434132, "uuid": "2af27203-388d-499a-8781-4095b92cd056", "comment": "Malware payload (RedLineStealer)", "value": "1d2863c00ad2486e183f7acd9f88dd36ea404d2479ad77b7364f2ed3523ba4c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683434132, "uuid": "bc17f02e-f783-476d-baba-210e7c883ed1", "comment": "Malware payload (RedLineStealer)", "value": "c4ba93556463b340b26b2930e3d538942aa9dd3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683434132, "uuid": "5222dcf4-7937-4ed0-891e-a411cc464b2f", "comment": "Malware payload (RedLineStealer)", "value": "42d1fdcfe47ed55c0061139a52f6e7cc9c89f07d3c7e02efd1ce83dc49e0bb96ceb0095d95b636308dc82bbd2e7ed3cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683434132, "uuid": "bfe8ab6e-57db-47dc-a10b-5ad63a58200c", "value": "T119A40223ABE99072E9B517B458FB43830B36FC908935929F23419D1E5CB26D0B47277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683434132, "uuid": "13774383-334b-4c3d-adfe-8773d7f7ee18", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683434132, "uuid": "2bab0283-0ca5-4914-bdcb-99ea37c5e025", "value": "12288:FMr/y90vI3C9YRi9WfO6aWHyAd+jtsPsnedR:eyeISwi9pTKuthedR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683434132, "uuid": "bacc3299-5b3e-4c18-b735-814926c4a968", "value": 490496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683434132, "uuid": "fba33dfd-906b-48c4-9da6-c9e928f1ee97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683434132, "uuid": "7127c02a-8589-4b75-be6d-2fdd51695076", "value": "241fd04146a05179100ca32da4bf37f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0105a9b0-ece4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683469953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469953, "uuid": "1e7d3951-fca8-48cb-b4ea-1f9fd3646327", "comment": "Malware payload (AgentTesla)", "value": "f1def168fe55172c9edd4ad893385e19", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469953, "uuid": "0aaec88f-f297-417b-8aac-2a6eaab1a46b", "comment": "Malware payload (AgentTesla)", "value": "1fb184234c3e3f411d9b26255805d97d1cc95ea9f541a29bf6f185a32131f065", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469953, "uuid": "267394f0-d259-4984-bf00-108b55e13df9", "comment": "Malware payload (AgentTesla)", "value": "d3c59ae8d6c0845dc6eaa46bde14d59394c4b856", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469953, "uuid": "00aeab87-816a-42a8-871f-6762262d1e38", "comment": "Malware payload (AgentTesla)", "value": "b7c2dab8080d8cf45cf734a8063511bd7847d599598d3f566a0c264a9f105994e5940ddb18135f7292520687d0286aa1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683469953, "uuid": "4dffc3b3-cde9-4c5e-8fe7-6a5fa88866c1", "value": "T14DD423707D779CE4DB876CEBC54AE8002C3181238B38F81A5119ADC5199FB716AEF5AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683469953, "uuid": "fb26ed80-43cd-48a2-bd06-78419a6620c0", "value": "12288:Ct5uZST+Ocb7wfA39P6cHIEOXl3nzg7qI4HYUZKSKK6tQ/3zlpCfRvKHWP2:CtSi+OQ7wyV9I1z0qpYUZP4tQ/3zCRv6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683469953, "uuid": "46d687ae-e950-43ae-9efd-f3d50a81f837", "value": 643233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683469953, "uuid": "88a9d8f7-5181-4595-9b37-42d53fc4128e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683469953, "uuid": "0988ecf9-8635-461a-815b-84e7b1bbf442", "value": "swift mesaji_PDF.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2512813-ec6a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683417878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683417878, "uuid": "102dfe2b-25b1-45d5-b7d6-7c07b9ae4ec5", "comment": "Malware payload (RedLineStealer)", "value": "051b433b3846e14a148d2057afe05ed8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683417878, "uuid": "268e3177-0f8b-40a8-a8c1-392fab9b8a1c", "comment": "Malware payload (RedLineStealer)", "value": "1fb341c2dcdeaf85b4bd89c4d9aabb86c94b1940d479c376483847f791dbe34d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683417878, "uuid": "f1fa9879-eb74-4c2e-af2e-404d9b1da619", "comment": "Malware payload (RedLineStealer)", "value": "938f27457a3d85784960b40a5790f27a3e6239b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683417878, "uuid": "8c63a33f-d0d2-46a7-9d58-89890b8115ce", "comment": "Malware payload (RedLineStealer)", "value": "a7434205d154a0c4250049e44325d7f810ff37a492c33c112c794ca83354151e284004ac619944008b82c3841e989fc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683417878, "uuid": "2b2d3047-084a-4d1c-9014-8a14829848f7", "value": "T135F3C568364B697EC97F887D9C600CD0667CAC922242A7479C8FF0E8793B7919F151F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683417878, "uuid": "d1be658a-286b-4400-8f92-a4936a25779a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683417878, "uuid": "270d5691-0f8e-45b9-80d5-06f176f45466", "value": "3072:URhnnGhZsW6PqV4QQAtT33mPltVC+8e8hG:U3neO3aT33mPltVC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683417878, "uuid": "b35d6d08-33ac-410b-bb82-6425b3e167f8", "value": 172567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683417878, "uuid": "4b6af092-e2c1-402a-a5b2-280e5f299d14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683417878, "uuid": "19d508f5-0c7d-44c1-a44c-65a46de5edbb", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e496a913-ecda-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683466040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466040, "uuid": "d081a8c8-c72a-4fa4-9901-a26414a9706c", "comment": "Malware payload (AgentTesla)", "value": "175bf8ff7c456cd1e057daa4a8c03483", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466040, "uuid": "09c09f09-ed4c-4440-b886-4e346c3894a6", "comment": "Malware payload (AgentTesla)", "value": "2049b0a5716f0e29412d9520ae2e06ac4105754d4470eaa0e09c496e299911be", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466040, "uuid": "ffebd0a8-50a3-45ba-9ac5-46cd5b463847", "comment": "Malware payload (AgentTesla)", "value": "6db3bf8c6b113cbc4bf54e91b1a0510a844c0397", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466040, "uuid": "58b07c2f-43c5-4843-815d-50d8e71e2d69", "comment": "Malware payload (AgentTesla)", "value": "9d859f2d250416e68bb18551cac300eadec59782a433573a0408cfda0cd4124937b98213d1a8246aa5079a6fe2c5c8e6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466040, "uuid": "136adc69-4f5c-4a28-8881-a3bfc71f6528", "value": "T1C9158DAC3210B6EECC57CD76DA586C10EE202C76935BD293905715EC9A4CA9BEF241F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466040, "uuid": "98805422-f320-43d5-86b6-deddc8cd4020", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466040, "uuid": "8025f021-88d9-440e-be96-3507222e1b9f", "value": "24576:E/vdSBeiYzZkXIHTaWTXax9x4JWoyJ61oA/W:VHXIHTaWDaxn9J6uJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683466040, "uuid": "c4ffa78f-504e-4249-8c07-d79f4867797e", "value": 898048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683466040, "uuid": "cbec370c-0fb9-4a5a-8e61-e5f1ba573b8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466040, "uuid": "f6b94dec-9a73-4485-8a1f-fd41578bbd82", "value": "SecuriteInfo.com.Trojan.GenericKD.66890718.14257.32468", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db9796fb-ec71-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683420927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683420927, "uuid": "68fbe55e-befd-4a58-b894-9d2f0fd57e13", "comment": "Malware payload (RedLineStealer)", "value": "ac2038277417a506d6331a9a329611a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683420927, "uuid": "167d5308-36f3-4088-92f5-294384e9fa2c", "comment": "Malware payload (RedLineStealer)", "value": "21ac43b45a8b4ec019fa3567178dc33d00035db0d4c5e55c796200668ac3f9ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683420927, "uuid": "0904c62f-232d-47af-a4a4-2610c5f68f69", "comment": "Malware payload (RedLineStealer)", "value": "786cacd2431ecc512d8fa941a6990c828c9cb3ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683420927, "uuid": "a5bcea63-3ca6-455a-9911-d2587b7f98b6", "comment": "Malware payload (RedLineStealer)", "value": "cf5882a22259a6bcc7ad59908e55836fb8bacb9feef844a8a1dbc8c4ca64db92ed5b652c5bb97fd64c8dbc5a2209806a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683420927, "uuid": "2a60d1ef-45a6-481a-8607-851dc1c52f00", "value": "T10EA40252EBD81033ED761BB029F713C31B36BCB15D38829A3685694F1CB25D4A67236B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683420927, "uuid": "e461fc69-68f0-4b11-95f0-e414384a5c89", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683420927, "uuid": "27e94056-8ec9-4b79-85d7-c321a175a7fc", "value": "12288:zMrYy90i92rBxbmpTS+q03LqxwBqt1ek:Xy9cBIpTPjexwUt1ek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683420927, "uuid": "ae968cc0-f0e6-4807-b41a-2c10a897fb6c", "value": 489984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683420927, "uuid": "43b5d0c8-25d2-4a67-99f7-97cc342dde9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683420927, "uuid": "63e2608b-384f-4285-8a5f-3b3d17cf9460", "value": "ac2038277417a506d6331a9a329611a0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "309a57ec-ec96-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683436532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683436532, "uuid": "b57d16b6-79ba-492c-88e1-af22621fe6bd", "comment": "Malware payload (RedLineStealer)", "value": "e661854ed91582b4f12ba2a79ae0697e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683436532, "uuid": "781258f9-5fcc-4625-8a89-960f70fa99ad", "comment": "Malware payload (RedLineStealer)", "value": "2217c772d745894e8c2ec9fb8feadf525bc3cf0704b1b7a1b2042cf30451acc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683436532, "uuid": "cbd3d880-5453-48c4-af0a-733dcdf705a7", "comment": "Malware payload (RedLineStealer)", "value": "4c47d433517d9016abb38967ec37311036a73d3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683436532, "uuid": "77cc3452-be2e-47a1-9c62-7c6eb422baed", "comment": "Malware payload (RedLineStealer)", "value": "09302a62d1458f9372896ca799fcad024aff1e32714c8c3bae79888a6e6c91d9b10c7ca87b26a2cdf3641ec83921ccb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683436532, "uuid": "910c4718-10e2-4ef5-b09d-b7b07e401aa3", "value": "T181A4021296D88032D9B5177058F70AC30A3A7DA65E79832B3746799E0CB3AD4F57233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683436532, "uuid": "853cd939-ff93-4a11-8e28-09a42db2aa6a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683436532, "uuid": "7cdbd6e6-593a-4ff1-b93f-5413a89494d8", "value": "12288:ZMr0y90JWeZrMMZhjq1bXA0lFLbP9mmeC7kJ:VyGWwZUDFLblheP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683436532, "uuid": "1e4cb0b6-665e-4059-9a71-17c4705b625f", "value": 491008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683436532, "uuid": "5b9daba7-d4ef-45f4-8cfe-937929aece7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683436532, "uuid": "d6a7b188-3140-4047-84a1-8324ebee4a89", "value": "e661854ed91582b4f12ba2a79ae0697e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3349223c-ec8f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683433530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683433530, "uuid": "a767ab84-4e08-48c0-bc8f-2703e2359fd3", "comment": "Malware payload (RedLineStealer)", "value": "d40649b5a07d02241bbfbffd030f73a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683433530, "uuid": "97206024-3624-4a4a-9ccd-75b862a4fa0f", "comment": "Malware payload (RedLineStealer)", "value": "225a0d387499f8cd44463c67ff3504b5f47c5372af9f9ffa4ed7af2d9ded95fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683433530, "uuid": "49c59bca-0225-4c70-842e-f0b896307178", "comment": "Malware payload (RedLineStealer)", "value": "7732bada0cb195853e8b30e444f50a9ec39f2750", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683433530, "uuid": "07a19876-3c47-48f2-ae34-cdfdb074fb72", "comment": "Malware payload (RedLineStealer)", "value": "5792d7fe0e6d833cae505b6b901c8fa8f55b281e284bb71bf8ca02714c4c238739b252b9d879791b035b4b9a564883c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683433530, "uuid": "f146d06f-2f19-4f64-8a70-757efcfe44c0", "value": "T1D5B40257A6F98132D8B01B7098FA03831F357CA25A74572F2781AC5E1CB26C4F43A72B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683433530, "uuid": "a706cf68-9941-4647-88b0-9a140eab0b9e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683433530, "uuid": "1f25f2a8-9d12-4f9d-bd80-e2844acba960", "value": "12288:5Mrey90LRhddWQQFuTs9A3WWEOxtsFv83sXnXs6qKec3tJ2XeO:vywu9FuYnO4FvnXs6/ejXeO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683433530, "uuid": "be649fee-4e79-49cf-8f84-5003e6635dc0", "value": 503296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683433530, "uuid": "9096404b-e443-497d-a73b-0169a53f6690", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683433530, "uuid": "8d4a5d8b-eb2a-45ee-86a0-8e56b263e0cb", "value": "d40649b5a07d02241bbfbffd030f73a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d27e712-ecb9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1683451612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683451612, "uuid": "3874440c-4c5f-4b19-b5ae-62d4ffc2c926", "comment": "Malware payload (AsyncRAT)", "value": "03b37c277c152991ed53911c70618935", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683451612, "uuid": "5a80cceb-0185-4f93-852d-95e459aa581b", "comment": "Malware payload (AsyncRAT)", "value": "244360a27dc0378ffb7518cb6451bcd007e7a3def6589c07cd2e7cf3d39df139", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683451612, "uuid": "ade982d3-458b-442b-930f-86e2c22dbb36", "comment": "Malware payload (AsyncRAT)", "value": "0fda81f22bc2b02ba0692f67e4bd18f0a3b5b29f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683451612, "uuid": "770c4927-39a3-4d7b-bb00-77af80209b77", "comment": "Malware payload (AsyncRAT)", "value": "ed6c110d358e97bc9efafbd5b7f42e0e20be8977da5d5d8d9c20c82ba5438472e947da5cf27f22659e05b23f1eb001ae", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683451612, "uuid": "d2620753-3920-4427-9cb9-a292983e294b", "value": "T1A4A24ACFE28313B710985ACFC608D0E36A43EB86D53B4938827D835F466459D47EA672", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683451612, "uuid": "852a288c-cce5-481d-b2c9-3482641bb6f3", "value": "384:7///////////X///////////4///////////X///////////B:4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683451612, "uuid": "9a28c192-bda6-41c4-b4e1-2562b1bbabee", "value": 23050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683451612, "uuid": "40f69a13-300f-4fb8-9be8-f651d4181520", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683451612, "uuid": "044feb7e-f087-44c6-8791-727e36231e6b", "value": "Q3761-6182-3841.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0980251-ece3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683469925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469925, "uuid": "23563cbf-c7d0-493d-93a9-52c50d2c476b", "comment": "Malware payload (SnakeKeylogger)", "value": "0ace70c2bc94f4ca950dcb66753293fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469925, "uuid": "56d401ee-ed1c-4d33-9834-a2243947a5b0", "comment": "Malware payload (SnakeKeylogger)", "value": "25c432720e7e86454a3156b83a485e94fcea7ae77f791a0c0d5810e5ab72ebea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469925, "uuid": "b8ff3df3-7e86-4274-837c-3bc442bec1a3", "comment": "Malware payload (SnakeKeylogger)", "value": "a0a04a509017336fe23b2506c31dbfcb2b5a86d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469925, "uuid": "74291d79-db16-42ef-96ed-ba56ff02da73", "comment": "Malware payload (SnakeKeylogger)", "value": "bd0b3d62183adccb90ab3872868ff7620de49b5fc25c109a3a6ffb16ed42359028f2ffcd0dc9cfe09ada36f11079f20d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683469925, "uuid": "a9e2ef2e-aa81-43a1-a048-96aefab58485", "value": "T1A3E4E01023B6BB5DDCA1CFF87208E101AF656D71A3BAE7E48DCBF0C56058B05B6546A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683469925, "uuid": "ec5e4fce-ecbd-4dea-8384-65064056f198", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683469925, "uuid": "8b6ffe7e-055a-43ea-83d7-79023fdd16dc", "value": "12288:wDGPjDjEBh9nvTmzGTU3YB73NnYdaZKj4J7ueCDIDpRqSh96J/yyM+:wS/Gh9vTmGA3YB79YdI04BuJDIDp4W65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683469925, "uuid": "d84c7870-5f7c-4b80-b3d2-acf8bf66195c", "value": 706560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683469925, "uuid": "e15ecc0e-8feb-4d24-aca4-10366c55059f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683469925, "uuid": "5ec181c6-ce32-4baf-a2a9-5c4960789c8e", "value": "DMStioshPWWQJWm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96fcaf98-ed1b-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683493827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683493827, "uuid": "6cf19a93-9717-490e-aa0f-6c5af124e63a", "comment": "Malware payload", "value": "097bc3c7d6f6f50a503fdb7a56e22a34", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683493827, "uuid": "1e010112-a84a-4b9c-8d8f-460ea0922f2b", "comment": "Malware payload", "value": "25ed67b390cafbd1ebcebed4c9cad13c38e6998c45e501e23d6652ac04bb69ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683493827, "uuid": "bf73e93a-ce27-454d-b17a-fc9bfa0e1645", "comment": "Malware payload", "value": "bc801204c76b73ee9e66a9a7bdffd856965604e0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683493827, "uuid": "05870be1-b5a3-4af8-999e-8feb109a7d3d", "comment": "Malware payload", "value": "cbc08ffc3001abf5da6c61a362919e1884fbc15de0ca439a953c53664685b1d9475a2f06985b7a8411a343753169a722", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683493827, "uuid": "d35e9e77-9995-476b-bc02-47d2155bfe4f", "value": "T144641A1382E1FDC4EA268B729F1FC6E8779EF2508F597B6912189A2F44B01B2C177711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683493827, "uuid": "3bbf00cf-3d3a-4547-8c83-6c1109422ddb", "value": "774eae4c41c92ea810347ae7a14e6cdb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683493827, "uuid": "27dbc8b7-b88a-441e-83f5-86f09f2456ea", "value": "3072:6AX8ODio3+FCLQbFK+OCQ/KbqAjxBn7UJIdg6hO3Vd+eVRg/5wcw3P3XqT:vPDl5L0FKBDKbzBYd6upvG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683493827, "uuid": "836ee428-751d-4f15-b365-32029dcb8713", "value": 320000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683493827, "uuid": "145390b0-c061-433c-8bf7-2a8365568b63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683493827, "uuid": "b36bb030-fbbb-49e4-a63f-cc210e8c38a6", "value": "097bc3c7d6f6f50a503fdb7a56e22a34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "526d6af9-ec9c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683439166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683439166, "uuid": "ec4d0933-a67b-4d11-bd10-a1e9d7737953", "comment": "Malware payload (Formbook)", "value": "4d410d03ad7bba87afdf5316ab7fc21b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683439166, "uuid": "11ac591b-0da3-4661-9b8a-4a3779b6e984", "comment": "Malware payload (Formbook)", "value": "25f2836e6f4bae031ac689a1110ff0416a104f3cf92f7278905ff9050a614ccc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683439166, "uuid": "22c8325c-c028-41e1-9b10-50c37259752a", "comment": "Malware payload (Formbook)", "value": "eab9e2e8c101838a19c7012eabd2fec96040d662", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683439166, "uuid": "7fc1e436-8310-45f1-8251-b940e0f59264", "comment": "Malware payload (Formbook)", "value": "fdb4d2a72a9c1348f053b51f01ca2e9ab7e113b4f1fcb680bc9a79ebdaaabf032521039f65e26974b1311b31eac6db6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683439166, "uuid": "86e70945-e5e5-4700-98a7-ab11eea73bdb", "value": "T19284E04940F988EAD179D0B20CA4F99C76177D2D9C245E474E23F4ADE8336822673E6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683439166, "uuid": "861125e6-e2a2-4b0a-9d6d-a85888eeb337", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683439166, "uuid": "fb8b1d0d-2342-48e7-82ff-ae9a0ed6b566", "value": "6144:8Ya6U8ItHP+sliEQ9bO3YS1f70Zn9gMii+l5hpR25Iux:8Y+8Wv+so9cYS1z0ZWBnl/EIK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683439166, "uuid": "808a3815-b8ba-4ba4-acea-b9978e34de58", "value": 375101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683439166, "uuid": "a17a96c3-9e7b-468f-802c-daedb481b257", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683439166, "uuid": "e2f78731-37c9-4566-ab5b-f0afe87000c4", "value": "Quote_Request_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b6385b9-ecb3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683449140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683449140, "uuid": "2052b7ff-25fb-4aae-947b-05debb2da36c", "comment": "Malware payload (RedLineStealer)", "value": "c9ace0f463ed394b84fc1bdb79fbc4b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683449140, "uuid": "c57713ca-ebd9-4815-bd4a-7efba31d7896", "comment": "Malware payload (RedLineStealer)", "value": "2748a5a8326a6b19ab5f6d95a46092905ec64ea137b10434e10d825eedc1ea4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683449140, "uuid": "e534dbae-711f-4cb1-86b2-9bcc85f64ab8", "comment": "Malware payload (RedLineStealer)", "value": "de6b1f3226209fd5034cca4794911580fd216d6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683449140, "uuid": "baef91e6-51d1-44e9-8e31-3bacbd88effc", "comment": "Malware payload (RedLineStealer)", "value": "85f8e0ebdd367c2eef14944a99042d4af9cd174983ed6b2cccdcf17843832ff6863c4ee0dc4c4923f077bab7eb50feea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683449140, "uuid": "20fe7b9a-2ffa-476c-a184-027013236ddd", "value": "T1F8A40213AAE88072EDFA17B05CF702D31B36BC629539825B3741AD5A1D72A80E53537F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683449140, "uuid": "622b7c45-4018-4aa4-85ac-74aef7c4a620", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683449140, "uuid": "24957f06-3928-4639-bf72-de0981a44f52", "value": "12288:YMr0y902ZWGs3NCbU6GkxI9kcx+wlNf+Hrku:8yRw4ukY21", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683449140, "uuid": "18368b72-09b0-4736-8091-672fb41e9904", "value": 492032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683449140, "uuid": "52a92af7-9e4b-45e7-905c-1b0c8b719e88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683449140, "uuid": "c4eca010-bb30-4723-be47-f07198f71d4b", "value": "c9ace0f463ed394b84fc1bdb79fbc4b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bea01ae7-ecb0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683447937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683447937, "uuid": "95a7c7fd-6f29-4ae9-b551-0b47a9e31c2f", "comment": "Malware payload (RedLineStealer)", "value": "f48e681e654d9d5076b466ac1bf53f70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683447937, "uuid": "db7aefb0-eabf-4fd1-b18b-0832dd04602d", "comment": "Malware payload (RedLineStealer)", "value": "274ddb56b7eaecc9484be72db2f4640e56b49e47489bcdf58eec65ae9070fd84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683447937, "uuid": "becb3a14-754b-4dd3-ae0c-041e14259194", "comment": "Malware payload (RedLineStealer)", "value": "939c3af02faf2a6c1a84cf8c0620ecb0a5a85d27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683447937, "uuid": "72a4e91e-c031-41b5-8afa-4c4d9fe9784e", "comment": "Malware payload (RedLineStealer)", "value": "20af8850b10960d80c42156369d441a61341e72abf9cbbc3936603caf9eb230753c9257e12ae7802b5aff8f8315af9b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683447937, "uuid": "2f0b40d4-b125-4936-a0db-b67b22e9c2e6", "value": "T1E7A402129ADC4433DDB61B7098FB07830B39BD954D75961F2789A89F1CB3680A93237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683447937, "uuid": "91f40dc7-9480-45f9-9ab5-ec17b10b33b6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683447937, "uuid": "002c6eec-e347-4e98-bdec-f3985797a8b7", "value": "6144:Kxy+bnr+0p0yN90QEG1kTjhL6Lfg1EReNIKAIHQ4Rw/kca4C14+jL0tOFZiW4CYC:/MrQy90fZb1ErKAIwIjca4Cq+30PHC5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683447937, "uuid": "61d0702f-ecf7-4168-b65a-2cd2b9f9db95", "value": 491008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683447937, "uuid": "cb34e982-b3cf-4807-82ef-46bc368c3536", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683447937, "uuid": "7f2e21c2-4a82-4442-bfec-789f38ed119d", "value": "f48e681e654d9d5076b466ac1bf53f70.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1372c223-ec86-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683429611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429611, "uuid": "7e563c23-2c5d-4d24-9fac-d2b604d212a4", "comment": "Malware payload", "value": "4755656e64a4cb4ee7ae5846acc1bbc1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429611, "uuid": "22fd8a96-899c-42f8-b5bc-ada5b64eb2ce", "comment": "Malware payload", "value": "2c2aa8458f3d138a2cfaa38b2da75b541ccdad655b5db374733e4cecfb24833d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429611, "uuid": "a4128ffe-27e5-431e-a112-03664e08a186", "comment": "Malware payload", "value": "fd8f5007141ac941fcac77c6565ccb1ec86b1391", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429611, "uuid": "bd239b51-3bcc-4537-ae46-1770b302a7a5", "comment": "Malware payload", "value": "8f56b50fb958f1ee6373bfc1f6e993c05d2025cb2cea82b7ad87b505d21a363f96b6545a0697e1f36200d42ffc5e7565", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683429611, "uuid": "4646df37-c07b-40d2-a327-2bc747287fcf", "value": "T1B116CF403BD0ADBBD1EE6775912681FC4FBCD0866BD7A31B5604A56C0EDE3820E5E287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683429611, "uuid": "2c0a1f35-640c-4523-8d63-691da276921c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683429611, "uuid": "2d4a9100-1906-4a83-9948-c65eaa83a06c", "value": "98304:oXB4uluJRmMg6QWlIpgi0rHqsih/mCqJ4B4ulur:ovsJR0TW6yiIKRhzqOsr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683429611, "uuid": "0e52d069-e6ea-40f5-83ae-5f4ada569533", "value": 4387965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683429611, "uuid": "2665d44c-bd8e-4bee-b010-6410d490e8e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683429611, "uuid": "b1e897b1-9dcc-4857-a82b-9e96e6b33d85", "value": "VirusShare_4755656e64a4cb4ee7ae5846acc1bbc1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c591104-ecdb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GandCrab)", "timestamp": 1683466267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466267, "uuid": "0e4be0d0-7311-4d60-a099-0e1df4ffb055", "comment": "Malware payload (GandCrab)", "value": "e678f3089a497782524e0f6787e26691", "object_relation": "md5", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466267, "uuid": "f240a1b5-b408-418e-84c6-fa4b6d2504d1", "comment": "Malware payload (GandCrab)", "value": "2c467cc6bed546dc5adae1df0833767883142b3dca9b757a414c21b5ccd15ad5", "object_relation": "sha256", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466267, "uuid": "51cd4e0f-ed34-4934-aa4d-59555f36c3d6", "comment": "Malware payload (GandCrab)", "value": "65ab4af31ad2221e2fef3de0da212b1310fabc5c", "object_relation": "sha1", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466267, "uuid": "4843486e-2497-47f6-8e9b-8c3904a877db", "comment": "Malware payload (GandCrab)", "value": "c00558b49352265dd1525d36f696a13cf481b781ff6e97bf58591b09bbeb3bb6d05ee8b64d1c62f58697f26d52aa670c", "object_relation": "sha3-384", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466267, "uuid": "4deb4f53-e633-4884-9b30-7063fa3ab64c", "value": "T1EC77CF00B1D191B6E9F64A3998F8AB45552DFDA01BE039B773B62A4F09310D35E31BB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466267, "uuid": "d4a022a1-143c-4d15-8c04-79301423f8c5", "value": "6144:Scytwb+TTSdBgQqqDL6SK10Zz+FF4X4sYN+Qaf3AVwbLW:vyi+Tqn6r10Zz+v4+9M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683466267, "uuid": "4bd66c6d-d866-4a0f-accb-97d877f527df", "value": 33058816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683466267, "uuid": "8f41d4c1-4244-4b42-8cfc-8db237ebd5e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466267, "uuid": "4904c915-069b-449e-bf7a-d28b5c9eea95", "value": "2023-05-06_e678f3089a497782524e0f6787e26691_gandcrab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3e30161-ecda-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683466038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466038, "uuid": "418c2367-18af-44fa-937b-3bd4dee91ebf", "comment": "Malware payload", "value": "52e6401373986094aca9e582ec7a488a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466038, "uuid": "d861abc3-0a78-49dd-b0e2-1d064f902a76", "comment": "Malware payload", "value": "2c5231c2f7068ff4ed5a01f86e247e12de24a9c428548d6df56cbb1dd46807d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466038, "uuid": "0a26761b-8b2f-4609-b7e6-d924d6db42d8", "comment": "Malware payload", "value": "c640414bf7e169e9c6855c6058f5d8ef52cc625b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466038, "uuid": "037b68c9-453a-4ff6-8591-b2764c3e3dac", "comment": "Malware payload", "value": "6ff8091fbdaf80974c7d907fb13eb1917b4cddbe0dcfb39a40b008b2e896512e009b0029b0c42bb4d642736a3595c33e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466038, "uuid": "889314cd-8c32-465c-94e1-a4157940b9e6", "value": "T16DF49F45F2F2C4B9E7A1323087B5A73BB9BB7D564B369BDB1644CA1C85B28902C35331", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466038, "uuid": "925a4fff-dcf8-4aa8-925a-264e66bc8f39", "value": "12288:H9IwNCgXb+y8CS75lmZml+lWlJVG9OVep2Vd2sgRtBzr+8d+8oUgvOC6yUL3iL7:H+6j8btgRtFy8d+8oUgmsE3iL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683466038, "uuid": "1cb3e966-1fd1-44d6-91a4-c75865784ab9", "value": 774144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683466038, "uuid": "5aa86772-0ad5-4078-b3b3-4fc7fdafd64b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466038, "uuid": "835b2139-aba1-4be6-9aaa-2f379b97e573", "value": "SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.7249.6231", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a7f3f98-ecdb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GandCrab)", "timestamp": 1683466264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466264, "uuid": "0888038d-e172-4943-83af-6c99bfebba12", "comment": "Malware payload (GandCrab)", "value": "e17ffffb36b1c6f9363802b823c8ad1b", "object_relation": "md5", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466264, "uuid": "d5ac100c-c00a-4586-a1dd-363dedaa0686", "comment": "Malware payload (GandCrab)", "value": "2cf5bd986cf3cf6cae8b5e4d163fc923d34abad5f82a456234aa1ca3b3327a19", "object_relation": "sha256", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466264, "uuid": "ad190de3-a14a-4130-b6d4-86b8cd306fcb", "comment": "Malware payload (GandCrab)", "value": "b0cd5346e4e514c14fe0a283be22d713eb7fa61c", "object_relation": "sha1", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466264, "uuid": "64f4c4b9-ef60-4d28-90ff-f566f436ea97", "comment": "Malware payload (GandCrab)", "value": "f785991627061730744317b931860ca6f351353d6c8ebf7b50d60ced90da3005a21c07935314182b2789c9d01acfe2c7", "object_relation": "sha3-384", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466264, "uuid": "3df1ed68-aca1-464f-9ee2-14edb9c1f608", "value": "T1CFF68D18B1D1A0B2E4F34576D5B4AF11446DFC211BB07CDBB2E62A9E19320E39E39B53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466264, "uuid": "bb5bfdf2-264f-40b7-8b8c-66253668bcfa", "value": "3072:S5K/B0toLOSNJXlxwsx89TSdBgjMqqDL2/TOK4hGl:ScytwbKTTSdBgQqqDL6SKv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683466264, "uuid": "380136d5-af28-4c09-a035-b6ea0f6e6567", "value": 16777216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683466264, "uuid": "5d00c827-08dc-4635-85d0-c010b7211b3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466264, "uuid": "ddce9cc1-d7e2-47d9-8482-41f15a520ce9", "value": "2023-05-06_e17ffffb36b1c6f9363802b823c8ad1b_gandcrab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c82b62bf-ecb5-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683450100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683450100, "uuid": "e19c4b70-df75-4d86-99ea-7d42896062bb", "comment": "Malware payload", "value": "7e76acaf84f51d2f4bdadd9b9ab2fc90", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "FakeKOTA", "colour": "#00CD36", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683450100, "uuid": "163dbae4-da5f-442d-8d97-b342201acb3c", "comment": "Malware payload", "value": "2d0dda75bfc90e7ffda72640eb32c7ff9f51c90c30f4a6d1e05df93e58848f36", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "FakeKOTA", "colour": "#00CD36", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683450100, "uuid": "c0ce96e7-2647-4a54-b4c3-31d198ff9ae1", "comment": "Malware payload", "value": "917bd0dfcc3b68f72cf44abc5e2b7ba0acadc44a", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "FakeKOTA", "colour": "#00CD36", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683450100, "uuid": "1dac3a45-e3bc-46df-94c6-bccae5f0f2e8", "comment": "Malware payload", "value": "6c316ac0c51a9b3472545f6252d628423886e697b94bbae830f3d0370b29d7209a687d3ed7137541b51fa4cbca0e617b", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "FakeKOTA", "colour": "#00CD36", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683450100, "uuid": "d6a1aa29-6856-4d49-afe5-5418e043ae05", "value": "T1BF4702D5B95C6952DAC8AAB43B3443C0B331FC499F81C7267614FBAEADF23549F22250", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683450100, "uuid": "a214ccb7-3912-424f-8e84-8aa41ce7964c", "value": "786432:2r/Q/sZpv3x5Xvvz/yV9UOS3R4JBtkO+TMqdIFd:242pv3xJvz/yV9UOSB4JBmO+TKf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683450100, "uuid": "0f71d67a-7e43-4343-abed-e63899f3f4ec", "value": 26178530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683450100, "uuid": "f2ae4568-7fb0-4444-a410-c9da87147762", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683450100, "uuid": "ed9a22b8-9486-4952-b7ab-84c6160e8334", "value": "My Go Application.app", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4968d58-ecb0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683447947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683447947, "uuid": "158d9635-3385-493d-b630-d7b15daf6b43", "comment": "Malware payload (Amadey)", "value": "0748a99e893f178c0a27f59fed7e8998", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683447947, "uuid": "46c198d1-4875-448c-b471-0840931e7e85", "comment": "Malware payload (Amadey)", "value": "2d46060078a180d844d5c466209b357fecab66cf3bbd01f81222bcb5cc08906f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683447947, "uuid": "0f29766e-61ea-41ad-902d-e00e2ca0bd7f", "comment": "Malware payload (Amadey)", "value": "03e21d755bab006ffbf11fdfe62ea660f7c195f7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683447947, "uuid": "08757998-af47-4703-931c-b5d806509219", "comment": "Malware payload (Amadey)", "value": "b58f9aee3fe1b0051476d2027b5759584c185fd552ff5e8fc4d6c24ab486e0a7f6e497ab0557b48dbe1f432623869b43", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683447947, "uuid": "99ee5db2-a1af-4fc1-80d3-8a8741bd48fe", "value": "T102649E1372D0B870E6624B31CE2AE6F42A2FFC618F55E6EB16546A2F09701F1C572793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683447947, "uuid": "7d41fa1c-3237-4065-b03f-1c1e9fb2fed8", "value": "00bbabcc49bda3cf5b939545bfd2c2f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683447947, "uuid": "179cc319-0e73-43f2-a565-c4ed686afe08", "value": "3072:5F6cffIJNFruXDhDee5Z3KQv7ZnBjsiBEYr8aS6wTtRc1p+CRGTVXW7/2aNOt/P2:Ocnsruoe/jB40HDyq1pxRSVs2iCJKL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683447947, "uuid": "02542d45-33f2-457d-b272-6a47df860b6b", "value": 334336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683447947, "uuid": "be243760-8f67-44fb-ad8d-d77e69fed567", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683447947, "uuid": "072228cc-727c-48ef-9210-8c3e8133abbf", "value": "0748a99e893f178c0a27f59fed7e8998.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42e8e66e-eca7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1683443864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443864, "uuid": "9c2240bf-7554-479e-9970-172b6ca0d54d", "comment": "Malware payload (Vidar)", "value": "f049ffdb9c677e1e180bcb97f22ec7ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f049ffdb9c677e1e180bcb97f22ec7ee", "colour": "#ADFCCE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443864, "uuid": "61becddf-9f12-47b3-993a-2ae6d428f7ee", "comment": "Malware payload (Vidar)", "value": "2dab1637305e37e24d70c35fa8540a5272ed29c722a8bc0fe53cbb5ff5b40329", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f049ffdb9c677e1e180bcb97f22ec7ee", "colour": "#ADFCCE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443864, "uuid": "13a4405a-a281-4e55-836e-df0dcfa4f84e", "comment": "Malware payload (Vidar)", "value": "a4d5c9eccfc29f3aa29b9fc167889b45e45b5528", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f049ffdb9c677e1e180bcb97f22ec7ee", "colour": "#ADFCCE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443864, "uuid": "2333407b-b6d3-4274-9d4d-913138891f9a", "comment": "Malware payload (Vidar)", "value": "1ec499b7f8ad40d11e165bbf8977c3066c0dff04a0848b65a0aa0fed34852d187b2e8319a5e0e2fc6cd815ab02ce8da5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f049ffdb9c677e1e180bcb97f22ec7ee", "colour": "#ADFCCE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443864, "uuid": "dce4a475-be8a-4b69-ac7d-266cc92500af", "value": "T1C616232176EF3898F439F5F617EAC2BE875EB5E9A1470B3B1148224B8B507023E53536", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443864, "uuid": "21ab7f05-fbcb-4c75-b1e4-96f2601c5424", "value": "8d2cd9dce0359e2ab71ef91998c4cb76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443864, "uuid": "c8413a12-3718-4995-8029-6eeedfb1bdc5", "value": "98304:o8AOuopHIyiZpIzKQ1z1tEA0OHxvjxCp0EEkeGKqgzmu/V47:xPnoyu+z5z/7bxANKPzmu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683443864, "uuid": "1998a121-f840-4a2d-8c29-27cbd68a0d5b", "value": 4020736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683443864, "uuid": "a483fe6c-4592-4a46-bfe2-7c17e68d083b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443864, "uuid": "d31474e7-7c82-4457-a901-729a0d2d55f1", "value": "f049ffdb9c677e1e180bcb97f22ec7ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a506510-ec75-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683422428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683422428, "uuid": "5d37a4b1-fd9c-4c2e-8131-69a9acf12b66", "comment": "Malware payload (RedLineStealer)", "value": "75ab6aa45de2a8dc0d4f457caa7c2f1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683422428, "uuid": "fd1915dd-d480-42cb-bf7d-ae381e62bfcb", "comment": "Malware payload (RedLineStealer)", "value": "30841adf2755eac3ce3f6f00cb586466ee303f6ad6424cf82bd73217234fe845", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683422428, "uuid": "cfd0495e-aec1-4dbf-8aae-e3b83a2d478b", "comment": "Malware payload (RedLineStealer)", "value": "73f386abf6e398b164edf6610965aecf9187a463", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683422428, "uuid": "54a217c8-d7f2-4ffc-8030-eb9b7abaa073", "comment": "Malware payload (RedLineStealer)", "value": "c79225e932ed2ef7edd9181f80bebc8e003c58b9270b30db87e352ac8e4f825c13277a60d0517540b8585330d6d4b651", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683422428, "uuid": "2e4ee140-5cf6-4ea2-8feb-351fe2ab03f9", "value": "T15FA41202AAC84133D8B12BB858F722C31B35BCB6997883D72740AE5E5C73A94757573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683422428, "uuid": "90426a4e-b2fe-4f39-a3d5-263e82907d92", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683422428, "uuid": "0cc181b8-7da9-4631-b0e9-3c78daca6c47", "value": "12288:+MrCy904AOe9rbbCNC73cxEtE86lGUFO:4y0j9DC8jtIa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683422428, "uuid": "6dc01b21-4cdd-4a04-93e9-a10d90fc101f", "value": 490496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683422428, "uuid": "137dc0ce-6a23-411d-90c8-8bb7f9ed4f3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683422428, "uuid": "de9772d0-ce0e-4a26-a883-b5aa649842cc", "value": "75ab6aa45de2a8dc0d4f457caa7c2f1d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd8d579f-eca4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683442835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683442835, "uuid": "df92db5a-c6bb-483a-afaa-540e62bfac15", "comment": "Malware payload (Amadey)", "value": "6f811aa830fc710bee13a310df339e9b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683442835, "uuid": "7aba02ba-ba8a-4ead-9846-95f301275221", "comment": "Malware payload (Amadey)", "value": "3101bf5156c5cb4e30fc6840917e4704f015221ae42af6254a51cc83ff88005c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683442835, "uuid": "af7bba31-7865-4489-98c4-97feb19e3718", "comment": "Malware payload (Amadey)", "value": "8ce71dd8cc05bf761a4d0cf4d4350c8b54213c12", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683442835, "uuid": "1cd9b092-b960-4d85-8a83-4fc6c18980fe", "comment": "Malware payload (Amadey)", "value": "919821d818719d1e070d7b7c4f09ad21b1700b129122c6410ecb9ce2ae505873ccdbf2c35a98094f24c0ece2f047a490", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683442835, "uuid": "1cd86697-fbde-4aba-8493-5e06ba9a0819", "value": "T1C2A40202F7D84023DD751B7058FA02930E36BCA29DB4935F2B56689A1C73E90B93677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683442835, "uuid": "bc2c457f-5499-47fc-a07a-185d62756bd5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683442835, "uuid": "6a10f5f0-1f4e-4096-9746-0128bef495d2", "value": "12288:wMr9y90MnfSOFAV1wI0gv3BhHUxBx/sz:dyF6EXPgph4/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683442835, "uuid": "c33b2874-fd02-4bb0-9540-0257a822f0e8", "value": 490496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683442835, "uuid": "0c5bfde0-1e37-416a-a5ed-949d75fbb150", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683442835, "uuid": "c660123d-785e-4a3f-b94a-521b1628b649", "value": "6f811aa830fc710bee13a310df339e9b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d7866e6-ecaf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683447344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683447344, "uuid": "822274bd-ded4-478d-8e00-da4dacbf4735", "comment": "Malware payload (RedLineStealer)", "value": "de9ba2a4409d550cde54abb7f5509613", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683447344, "uuid": "a11bee5d-4a92-465d-b9d3-f3f5f1f4b53c", "comment": "Malware payload (RedLineStealer)", "value": "3277c3408648ff1db750aaabc759b56c84d70b2503d425900e51a56c075e989d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683447344, "uuid": "ece52aad-ca7d-4ac9-abe5-27b7a94a7679", "comment": "Malware payload (RedLineStealer)", "value": "68b16f522f3f26cf1933beb47b38d7c8728d0a68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683447344, "uuid": "d0d5b7e1-e5fb-4f86-bc18-32cb4003d1b5", "comment": "Malware payload (RedLineStealer)", "value": "0677c4c8633d4d5c12e7fdae8ccf27d156099cd6cbae23d3f2ab62ffe24553581842403b36276f2b5e02b980f0a9a1af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683447344, "uuid": "00d4e4dc-fbea-45fd-9c83-99da3d524cc3", "value": "T145B42768A87FC019C4E3EEB52DDCA4BAD89A55F3650C70370174632B8B91B88DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683447344, "uuid": "ee1f1c4d-b517-42b0-b525-92e5452be915", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683447344, "uuid": "e5dca7b0-a6e7-43ba-af7d-8d037cc7dad8", "value": "12288:OklT97Es1V7MjhV/teca1XLglm8Ovzuf8G1t3hiY/owTRFih2wWL5y:dMjhPs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683447344, "uuid": "45312b8e-2986-4610-8425-a53f4e79daa4", "value": 542720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683447344, "uuid": "27a4cc33-4ca6-43cc-af6e-c07e32745bc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683447344, "uuid": "e8886d33-5cd9-4cb5-96ec-bd2da6bd863c", "value": "3277C3408648FF1DB750AAABC759B56C84D70B2503D42.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d7a5f8a-ecdb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Autorun)", "timestamp": 1683466269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466269, "uuid": "a1910233-c99f-4064-b720-48f9158ba32a", "comment": "Malware payload (Autorun)", "value": "eb03c3404322ce8258b6b87adb17231a", "object_relation": "md5", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466269, "uuid": "ae203195-b415-4c0a-b845-cf505ac80c89", "comment": "Malware payload (Autorun)", "value": "32f7738ad02e024fba65f005bd2b4e7000164c58ad5f4f67419a59e43291c926", "object_relation": "sha256", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466269, "uuid": "7365e0c0-fc06-404c-ae7b-14d3fe106ded", "comment": "Malware payload (Autorun)", "value": "394d2f8e32517125b04ae0de5590367f7085f671", "object_relation": "sha1", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466269, "uuid": "94e42742-28ad-43ff-af4b-543e78eff412", "comment": "Malware payload (Autorun)", "value": "0b0f899e723e1177cf3350cc8808cb2aa25b0d07e4b7ac9fb6ad9b5e6f6c6040657e56f10d537c8497b58ee1e065186b", "object_relation": "sha3-384", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466269, "uuid": "191bdf49-47b1-4192-9509-04d07b4ccdea", "value": "T136D53A689340DCB5F2D9D578200D7F2918E27D5627C32E8D6098BB645FF1EF4EAB2290", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466269, "uuid": "493dc862-22d0-4437-ac87-051a2dd5b3d3", "value": "12fcd3183e0fb67f1e38925ed5c0c47c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466269, "uuid": "00179169-a712-4850-95f0-09a4a10a7b0a", "value": "12288:sp4pNfz3ymJnJ8QCFkxCaQTOlPes5Z76k/L/KB8NIpYJTCihq82WFpXKEVFA2MCc:eEtl9mRda12sX7hKB8NIyXbacAfn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683466269, "uuid": "e8d724ae-e63f-42a9-a20a-a0280f988d78", "value": 2995457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683466269, "uuid": "1f45f1de-ce88-4b3b-9b90-5689d2d677d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466269, "uuid": "339cb120-55c6-4e5a-802c-655bf970cf4f", "value": "2023-05-06_eb03c3404322ce8258b6b87adb17231a_ryuk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd342a29-ecb8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1683451371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683451371, "uuid": "b6fdc179-d08e-4766-8287-a61c3e457811", "comment": "Malware payload (RemcosRAT)", "value": "a4621f28223c964294c5d7d9c1687546", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683451371, "uuid": "24b11c0d-6c8a-49d0-93cd-cf66352786fe", "comment": "Malware payload (RemcosRAT)", "value": "32fcd31207c5e310957801fca81578c9dcba9ed3515809f62a7d50d93ad033db", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683451371, "uuid": "75fea1fb-2258-4485-8448-07344d4a41d2", "comment": "Malware payload (RemcosRAT)", "value": "5a8a3a7bfb7f592cd34005b4351cc175dea19d9f", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683451371, "uuid": "50f07afb-ee63-45f6-a82a-5afcb711de14", "comment": "Malware payload (RemcosRAT)", "value": "4d666bef0e5ecf4e205a6f5fe162b04ee60271e53d1b167833ca444a2f9d688128fc806c6995375f9633945160578bac", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683451371, "uuid": "b7e669a1-31a7-47cd-8e0f-0aac82d55c65", "value": "T19F839062A3ED5118F2F33F50BCF955214A3BFEDA9C79C94D42841AAD42A2940DCB2773", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683451371, "uuid": "197f8d69-f139-438a-9aa2-3448503bd571", "value": "768:mnHGdUBDCKtfYjE3Luo4+eaWTR7YFPk9Wai2Y:OHGd+CKtfSo4+oR7YFNai2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683451371, "uuid": "77b916bf-f4b3-471a-bac6-76adefa2d52e", "value": 83644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683451371, "uuid": "837e9e5d-57be-4658-b187-8e9ebcb85029", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683451371, "uuid": "06eaa980-910d-4267-bec7-ddf070de6068", "value": "SOA & JRV 05 2023.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0540d323-eccc-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683459652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683459652, "uuid": "6a4c5561-d3e3-4b57-8e78-30f57c8a318f", "comment": "Malware payload", "value": "82be68d950849e22c5e6f2372aed3723", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683459652, "uuid": "a8b9838e-8279-4e81-9dc0-af89d3d9648e", "comment": "Malware payload", "value": "34bfa51c17efd3ddbfeb28f9cbc52433dd2bebf96897849f1f94b22264bda576", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683459652, "uuid": "8db42dd9-eaa7-4bba-a393-0b128f81c676", "comment": "Malware payload", "value": "dc14998d027e39a0a44f3bca88f1f04540abbeaa", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683459652, "uuid": "118e629e-bbb0-403f-87d0-4615280b0c05", "comment": "Malware payload", "value": "59183d81c2fefb8d94a66bc67ae5c501061bef5b18a22482c5ba4d866216325f77edf8ccbb2ce624e90a0ce5b35f35f2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683459652, "uuid": "6b4bf874-30a6-466b-be66-63bed227a14a", "value": "T1FDF39F13BFD1C0B6D3CD413E59678B35DBBF6930ADA05883AB640B8EAE71841D637252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683459652, "uuid": "7ef49dc3-6549-4ca1-9878-b20f6d7d0e1d", "value": "69848aae30ac862816f4d14423eb44e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683459652, "uuid": "2602ac66-1854-4cb6-bb98-1bb18f8bc10c", "value": "1536:LNQ6Y1DPm3ha1J3NT7HrV1aMvAKTLzFcZRw2iRJeLcn6xPjD5z/:O6wDPm3hQ9LPHFcwRJeLc6xPn5T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683459652, "uuid": "943760da-0f04-44c3-9f9d-28edb395dcc2", "value": 172390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683459652, "uuid": "e09e165a-1ffd-4ae4-9ac9-bfc359f550df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683459652, "uuid": "c67e3871-32a2-4d1e-85e0-f78169759c03", "value": "SecuriteInfo.com.Win32.Ramnit.Dam.22697.7217", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ffd812d-ec6a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683417767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683417767, "uuid": "b3149c52-95f1-4dee-ab9d-04e38a05e60b", "comment": "Malware payload (RedLineStealer)", "value": "b460dc73c807ec5855806b9b816ab66f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683417767, "uuid": "64913e59-17e2-48c9-85b7-567e009aa487", "comment": "Malware payload (RedLineStealer)", "value": "35e1480776a6b5ebfd1cdb76198494510f4c3a230e3c1921cda265d3a80d8487", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683417767, "uuid": "f1597f41-8151-4b75-b105-bda4440bec19", "comment": "Malware payload (RedLineStealer)", "value": "05fd32fa2ab5cd477274d1a509bf7c82889352ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683417767, "uuid": "419d4df2-3f06-4f66-82bc-dcded4bbfba1", "comment": "Malware payload (RedLineStealer)", "value": "4f415ad828dfaf63a2c9e25d43c266e8ee0faf8c3bbcc7cd740b287209f69f7ecfef17669faac9a49148eca2966244fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683417767, "uuid": "c268652c-a595-4bc8-99ff-7dbd87ae2931", "value": "T130B41212A7E84532E8B527B458F723931A34FCA16D78435B2B01AA2D1DF3285F53273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683417767, "uuid": "bcd38c6f-fa9a-402c-85a2-6e96d0c63f6a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683417767, "uuid": "5c7e2672-844a-4b8d-95f2-c42e7db5cc18", "value": "6144:Kby+bnr+Up0yN90QEALIHTZAJ4KY8/V4X8OAPxzz9pmZ9CtB+NZsOH4oaqSGz/Ew:xMrAy90IIzZA6KLPDYZ9Ct+hH4FqSV0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683417767, "uuid": "a99bb109-58b0-4bc8-a6b4-e8c011f2e45e", "value": 502784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683417767, "uuid": "1fb0305b-c3f5-489a-b142-85f74a1097a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683417767, "uuid": "5a0c98a5-26da-433b-8a04-5ce58873df02", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "098a18f5-ec7d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683425729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683425729, "uuid": "c6854a77-ccec-4d58-a0ee-43460887d9ea", "comment": "Malware payload (RedLineStealer)", "value": "9734a5a0c807733eacf7155632090a05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683425729, "uuid": "65f68b87-034f-41e2-be37-a6169ab6a95a", "comment": "Malware payload (RedLineStealer)", "value": "3714fa81b3666898abee2113279387a49f877759051116b68aa9c5f0315175e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683425729, "uuid": "5561954c-0702-4d0a-8b82-769143e8a75a", "comment": "Malware payload (RedLineStealer)", "value": "46bb632d89e5db1156233da455703f60b158b74b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683425729, "uuid": "691f4ba4-90f6-4d8a-8037-0894b2e5ccc5", "comment": "Malware payload (RedLineStealer)", "value": "8bb870b3ac24b0bf8108843358286f26c57ef9a88bc79a324c497d252f179358a6c6cbb63fb7ba988304bf39e9bb2959", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683425729, "uuid": "7d9ab7e6-6bda-4965-a1e1-d6d2867cac14", "value": "T1A9A41212E6DC1033EDB52B7059FA03C31E3ABC915978426B37D9990A0C736D5AA3177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683425729, "uuid": "2c57f598-985f-4fea-9fa6-3a80ccb00f54", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683425729, "uuid": "9c4be9f6-0a60-4566-bde0-8403e1cbfb6d", "value": "12288:GMr+y90vz688M5FJBg+MNLAC0pLKE42c+:syq8M5rBgsp542h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683425729, "uuid": "cefab99b-01c8-44d2-ab37-5e1c88d2dad0", "value": 491008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683425729, "uuid": "cf3cf701-eeb6-4347-aa9e-f200cdf931a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683425729, "uuid": "66b32918-aadd-4159-872e-55f3f21668c4", "value": "9734a5a0c807733eacf7155632090a05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62a34925-ecba-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1683452078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452078, "uuid": "f81ab8d3-790b-4977-ac18-617260d7e83d", "comment": "Malware payload (GCleaner)", "value": "2fc6218c0bd89dc0f2471c882a384a07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452078, "uuid": "83c40f39-d4de-4c87-a257-6865a076c6cf", "comment": "Malware payload (GCleaner)", "value": "37ccdde661e06ba2901c01b94c96a05e1ba77863ed75aceee5c89c7c402f9f39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452078, "uuid": "5cc0fdb6-aa01-4d57-b283-29aca3461b5d", "comment": "Malware payload (GCleaner)", "value": "8d89dea30c0dbef811065b5e47d9f5dc19573962", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452078, "uuid": "f00794cc-52a5-41fc-a24f-11f13a6114c6", "comment": "Malware payload (GCleaner)", "value": "ac84b54dc4ff7acbeef641f263c6a8d943483ae1b526c633070117f92abc1d37863dc7249b3471741e0868f29ca3fd95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683452078, "uuid": "e59fd3a2-16bf-4f72-a2fe-f698eac0d1a9", "value": "T11E9533A2114FD8B9D6868E7DDE639B400836F636B5BC809539DC454CBE3B2E2AC01773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683452078, "uuid": "de83e56e-47b1-4bf8-9b68-68b436c5a3a5", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683452078, "uuid": "f9c84520-56f6-4fd2-8c65-9f9aab1318ad", "value": "49152:ggZOE6pc0+8hAoxYo6kbLwiwmrUfU/fL7O+xSAG5cu:gBEgq8zxYo6AwwrVjpxSXcu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683452078, "uuid": "b153b36b-a10b-454a-93fd-b48810b9590f", "value": 2019983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683452078, "uuid": "2d29e50c-ea71-467f-b3df-e297aaad0def", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683452078, "uuid": "f7942c51-f8a3-404d-a115-6f65e33b22ef", "value": "2fc6218c0bd89dc0f2471c882a384a07.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "489e9934-ecba-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1683452034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452034, "uuid": "37a71cf3-5308-4db4-955b-a3e201dfd609", "comment": "Malware payload (Rhadamanthys)", "value": "05c7aef3bfef4d322efbca5c0cd94669", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452034, "uuid": "b197fbbc-4afb-4abc-87b4-6af543386988", "comment": "Malware payload (Rhadamanthys)", "value": "3b33d9480f3dcbcbcf663c6c66acb149ac118cd8cbef1a2603715b9df6b21551", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452034, "uuid": "1e7995df-65e6-4c94-94b2-af75a3d91c0c", "comment": "Malware payload (Rhadamanthys)", "value": "0f1f6ed446e23551c38db12a5d61a81fe9329242", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452034, "uuid": "8d49795b-245c-4804-92d6-bdc1ffc40642", "comment": "Malware payload (Rhadamanthys)", "value": "cb5e400d5052025b465f239f81006cc85e4b5ce7171f8c6beeb427a35b7b8ea859dbdde1628902b52d5c988cd311e17b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683452034, "uuid": "c54bebb8-c65f-4bc8-8111-90196ea8d540", "value": "T10584AF137690B875E5570A318E2ACEB46E2EFC908F2567EB2B147A1F08706E1C57271F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683452034, "uuid": "cbcd8cf8-8043-4101-baf7-2a2f6c1f2c48", "value": "cb0d32ad83907c8b5d9a97a27bcf3623", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683452034, "uuid": "a533c6d6-8a4a-4df0-8238-ea4c3ceec5c9", "value": "6144:stCzj7OQfLG0yRGR8uLDa9PewOUrk8kIinVHuxsZWL:Ss7OQfLcGR8UGdHFiH6TL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683452034, "uuid": "bc3d3c61-daf6-4162-a096-8dcb4f38d188", "value": 378880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683452034, "uuid": "6af34779-3d4f-4884-9510-329fe0bdf844", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683452034, "uuid": "f4faa1ca-257e-4d60-80fb-c5cd226a76e3", "value": "05c7aef3bfef4d322efbca5c0cd94669.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2ecad04-ece3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683469929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469929, "uuid": "ec4e8a41-aaa1-4987-bf4b-4ce482487a1a", "comment": "Malware payload (AgentTesla)", "value": "d788efd7d57409172c894fb3c2d0400d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469929, "uuid": "f28fc63a-dcea-432b-a595-3b71272ba318", "comment": "Malware payload (AgentTesla)", "value": "3d19690074df0c98a4088e0ca1f69969af9a65b7b260b7b71ac77a9bb89df6e6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469929, "uuid": "5df2636c-4e19-4e1e-857a-1df2d3582250", "comment": "Malware payload (AgentTesla)", "value": "ad2e1e5cdf4475642a910130cc1d94b2012b6bec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469929, "uuid": "d3479945-585f-4e4e-bba7-a8ed0da6a323", "comment": "Malware payload (AgentTesla)", "value": "1996d41b16f6f1521dc5597be410dc55986ab3fabe16fbd4151fc93897a12c0933b4879a8005598f0f8277f5b2c5d942", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683469929, "uuid": "2b4cc4a9-07e4-4f7c-9ec6-1f8137b8c75d", "value": "T1E8E4E115337AFBA1ECA583FC610CA4015F656C50A3FAE7E98DCBF0D85058B18FA54A93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683469929, "uuid": "719be49f-294f-450f-b40f-f20d6a33cf6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683469929, "uuid": "a0c27c7c-a5d9-498b-97b6-9b3058527ac7", "value": "12288:PcK0ZRQQlfhoErwEBmiP3fwK1fYM9OleMEKWJnFrS6Y:Pc3BlRwEBmiP3tfYM9bKmFOT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683469929, "uuid": "17d2996f-e6ab-4d5b-a526-736f2c93145f", "value": 708096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683469929, "uuid": "74a54e47-37b1-48ef-8fd8-f49e211ac5c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683469929, "uuid": "5e7683c1-8690-4fa6-ac69-5aa8fae4c3fb", "value": "ezLGJLXuftPIrq7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88a37036-ec9c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683439256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683439256, "uuid": "ae38fd74-419e-4274-817a-cc0371439890", "comment": "Malware payload (AgentTesla)", "value": "655751aaf9bf9f2d1eb7a8a4112fe463", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683439256, "uuid": "8d8a8be9-f3ed-4362-af84-0a75880c25d4", "comment": "Malware payload (AgentTesla)", "value": "3d769495075d2080a7dfd8f017f6cdcb403cfce9df8fdd92aecdc98fae45deb9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683439256, "uuid": "1ac723f5-c8b4-400f-8c3f-c644936319b4", "comment": "Malware payload (AgentTesla)", "value": "a466c99faca9dd12f00d01a54edeb2542e89006e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683439256, "uuid": "98a71bb9-cfc9-4728-aa73-5328487bd130", "comment": "Malware payload (AgentTesla)", "value": "18e2d4e09c992c1e73b7d382051243433ac1b97b30ffd03f9efa62c0131e55e7a3e00f555290f59481495b2dcf29abfd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683439256, "uuid": "2735489c-016f-4162-bf29-b3bc10897f5e", "value": "T184E4F1326299D755E39807BE6A5C4D06033C7210FF7FDA2C299D40C8FC76360A669E9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683439256, "uuid": "b7ea4b0f-7ddc-459b-a999-740bf4c081a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683439256, "uuid": "ba6d605f-1724-4087-b524-0bb7202e29e4", "value": "12288:uV2iN1Bzg1/ID50CHQu7oG64EYx3QUqShtKT311jI8JX6xhXs4R550ErF:c1K/ID5v3lA8htUA8Jc+4Rv0ErF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683439256, "uuid": "e701cc1b-e804-47aa-a80f-fd729d6aa9ad", "value": 704512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683439256, "uuid": "bf2412cc-afc1-4416-b94a-e0d07c342fde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683439256, "uuid": "40b90473-1fc7-43ba-942a-551346ee0c21", "value": "swift copy $37,000.00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a47cfe3-ec6c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1683418429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418429, "uuid": "bab97793-cf0b-427a-95d5-e2df5dc579ea", "comment": "Malware payload (Stop)", "value": "0886ebd9e5b7f5bda0393dfe8d5a893e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418429, "uuid": "d7c33b8e-f387-4eab-9cd5-8ac96a9e1478", "comment": "Malware payload (Stop)", "value": "3fc5ec3d73e71e85e59c72759b672017bd71f79e2f00b87635ecfecdaec9b3a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418429, "uuid": "f5049784-9bc3-4a18-82f2-6165b8258ecc", "comment": "Malware payload (Stop)", "value": "0326e12f82560cfb2f1f618dc61803c774be6d8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418429, "uuid": "3d10d863-c851-4fe6-96f1-0463d234ff2a", "comment": "Malware payload (Stop)", "value": "1bd5e9ba017c057a4ab9dad4184d511287dac2573744fcf9991cb1e4b2006ce1fb00309bd98a505bdb5bcbbccea3b360", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418429, "uuid": "e71e4e52-6e58-4ff1-b980-5f9ebbc4a938", "value": "T17705F20376E2B831EE130A324E1AC6A47A6EFD918F556ADB27557F1F0D705E0C632B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418429, "uuid": "3b27a93d-de36-422e-b3b1-ed2f1817b2a3", "value": "cb0d32ad83907c8b5d9a97a27bcf3623", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418429, "uuid": "ccb13107-91b4-4fd9-aff9-de7e77053afb", "value": "12288:lcaHLYlAMyVbaGFhTDKM+cT4IdwoSt36LMdEykfNQaA/VOPJJniGqrKzAvL:7HjMAbDhwcEIeXEV1QaAYbmKET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683418429, "uuid": "10bf6e43-9a28-4f3c-a2b5-1a13f5e90a99", "value": 824832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683418429, "uuid": "b576d355-2c72-4ef1-82fd-dc3be2f5aa98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418429, "uuid": "f86f7806-6972-41ae-b9a9-4b304c4f38a5", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b241aec-ecdb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Sfile)", "timestamp": 1683466265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466265, "uuid": "a372b162-3683-4e1c-a892-ec20f850aa03", "comment": "Malware payload (Sfile)", "value": "e471f1f13de4cd91e3d4139c98c045d4", "object_relation": "md5", "Tag": [ { "name": "SFile", "colour": "#61941B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466265, "uuid": "8dc30d2a-eb9d-4b76-ac28-05afd7fedda2", "comment": "Malware payload (Sfile)", "value": "40ec6eb75af3bf1c8406a121cbdeb4145c70f71e0523c1ffcc12265805d5441b", "object_relation": "sha256", "Tag": [ { "name": "SFile", "colour": "#61941B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466265, "uuid": "e98246dd-e5bc-4b79-8b20-54a2857d6cad", "comment": "Malware payload (Sfile)", "value": "e04760f670fab000c5ff01da39d4f4994011e581", "object_relation": "sha1", "Tag": [ { "name": "SFile", "colour": "#61941B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466265, "uuid": "8655e7d4-060b-4e0a-bb7c-7c2fcf66dbab", "comment": "Malware payload (Sfile)", "value": "a22fa8608868f27a0a434b7d78497daa071c302e01e529282e3d9d8aacc4ef34a0d19526d5f735493bd7c7e071af8600", "object_relation": "sha3-384", "Tag": [ { "name": "SFile", "colour": "#61941B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466265, "uuid": "e6084164-e62b-47ff-8a83-7ba12ca6d25a", "value": "T1C4445B00F5C0D239F6E205B9E3BF1A7BC55A9A10139990DB27D46C8DAA610D3BF34B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466265, "uuid": "4639ec4f-ba65-4a30-9b84-3211400822b9", "value": "9e0f92f874ddcc0d1e070026f86f7563", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466265, "uuid": "a6a0a8bc-ca83-4b39-8f4b-c5d8e1f80515", "value": "6144:D2k6zZt/xq0jNtmYWMIW6AeAXBpautlfz/Tvg1o8cJmWAJ1W:D2rZt/vNZ6tWBoIfz2XxWQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683466265, "uuid": "3ea2f315-87d0-4d3c-9c62-615960e21e8a", "value": 274432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683466265, "uuid": "d4a314c5-65d7-4cf8-ab7a-c8bd6179a232", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466265, "uuid": "2b7eabc1-8bba-4841-9e00-ca0754584ee4", "value": "2023-05-06_e471f1f13de4cd91e3d4139c98c045d4_sfile", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d9d20b9-eceb-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683473222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683473222, "uuid": "3397bab5-b4f6-47d9-be8b-2a5def831401", "comment": "Malware payload", "value": "268400bdc4e076f2fdf1305d3aed5c31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683473222, "uuid": "1a906d79-9da7-402c-abbf-98b3b7e23cc3", "comment": "Malware payload", "value": "415f411ae8bb1c41244b6b498957e8ebc548d2493956ce5ac04120b52c7a451f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683473222, "uuid": "cf6ca01c-8d03-4b1a-a1de-d5a7a28aff71", "comment": "Malware payload", "value": "a9bae75b0e38d90421bc3c0a82ea1e700cc82529", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683473222, "uuid": "0c2393d9-cebf-4a8f-9910-6c95f57e28f2", "comment": "Malware payload", "value": "8093fc5b43e86dd9336da699851b4a044be1d51eaa613686c43ab3aa17e660296f3e03c3d618fdd21dfb23726119a618", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683473222, "uuid": "23bce1bd-13fa-461c-9d59-2fa4ab7845d9", "value": "T19B742389F569EC3CC69F18320363C67F9768ECD52633BB8696603A673933DD20E64056", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683473222, "uuid": "861cbd76-de8a-47f1-8685-c13f28886992", "value": "b360ede31a68a0eb01ce1cd11830f66d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683473222, "uuid": "d01c210d-6cb2-4e08-a375-16fdcec63e54", "value": "6144:4tzHOVbxfP6wl3hbPptFDwaTTc57unFnDYiT6y7AjGdKBwy:STGxfD3hLpwaTuuFnDvT6BjkKN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683473222, "uuid": "9617c9d2-1532-4c52-984a-360176690ea9", "value": 339968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683473222, "uuid": "cbc7ebcd-fabc-4863-bdf6-85ae186ce97b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683473222, "uuid": "b5234f41-2303-4f7f-b240-8350f883c6de", "value": "SecuriteInfo.com.Trojan.StartPage.50125.6464.6246", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f0d67c5-eca1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683441334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683441334, "uuid": "014c8803-99c6-4791-adb1-268ce8f37151", "comment": "Malware payload (RedLineStealer)", "value": "dc97b1e234e41325083b01e363a6bc18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683441334, "uuid": "0d86b32d-08cc-4f16-8b8f-f2c65d6fe8f0", "comment": "Malware payload (RedLineStealer)", "value": "42230ae02ccf8f6754ae097e046a2c74f1b55d75f6a909944f41ab7660f833c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683441334, "uuid": "c855d811-2f47-4079-b2c5-2fba64764c15", "comment": "Malware payload (RedLineStealer)", "value": "e3ec90026d39938db4386dc42c75b86ff43fc046", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683441334, "uuid": "2d99d06c-ef21-46b2-9a69-e125ca4eff15", "comment": "Malware payload (RedLineStealer)", "value": "2f768931035246cadfca41a09907792e9825380e080e12585310aecd9a0c0c91f4c0039c341fd8ee629092cff09143ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683441334, "uuid": "bae9edfd-0709-4fec-a1c0-ee1ac09ef9da", "value": "T106A40212F6D88032CD761F7058F716C71B3ABCA19974536B2345A99E0CB3A98D83173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683441334, "uuid": "c902eb50-247d-4789-9e6c-63560c6768bb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683441334, "uuid": "b6247b0a-58d0-4ca4-a95f-e832c3676dab", "value": "12288:0Mruy90ysFLuG5QKroGtA5F5yXBJvjW2jk:6ytsFTOcoT5FkvjZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683441334, "uuid": "45503550-8901-45e1-bb1e-1f8571813d55", "value": 490496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683441334, "uuid": "f5e82f3d-1d9f-47c2-9c2f-da9701bfc650", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683441334, "uuid": "f6303967-38b4-43a9-b406-54102825ad5e", "value": "dc97b1e234e41325083b01e363a6bc18.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6086c75c-ecd7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683464529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683464529, "uuid": "b9cae668-c3d3-45e1-88c9-97005e4d7f9b", "comment": "Malware payload", "value": "4572fed852cd00d44c55c54dbed294c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "IRCBotnet", "colour": "#D0B572", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683464529, "uuid": "144c9c28-e607-4515-bf44-4e7b7518a04f", "comment": "Malware payload", "value": "42c69ce062cd8cb9aa7e323cf5cf2d293d2d22948c1ab3db50422066936bc805", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "IRCBotnet", "colour": "#D0B572", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683464529, "uuid": "3a27293b-1020-4516-864c-1f68b19f8af1", "comment": "Malware payload", "value": "c7c15ccf79e2743f068d24e892e670924fc32b53", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "IRCBotnet", "colour": "#D0B572", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683464529, "uuid": "d110940e-b3d4-4fb4-8b55-392d68781bfd", "comment": "Malware payload", "value": "27852a53fa29bdfd7080fba2f9c9b0923c891a7baf24f7020c686fc4f7a1584110e0a602183e18b40a7d91acc4101545", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "IRCBotnet", "colour": "#D0B572", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683464529, "uuid": "a3b3f912-723e-4993-864c-9283b2ada57e", "value": "T124668D50FECB54BAD9430E3044ABA26F57319C094F24EB97EA547F29EC7B6960D3620C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683464529, "uuid": "cdce471b-ec92-425b-b0b3-b7eed5e43d46", "value": "98304:YZjf9qK1rR9TtVhKyCFS6BbsJ0bu/3beA5QVo:nKPKyCFRuyKfyA5Ko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683464529, "uuid": "f66cceba-64fc-4f85-9b77-df69123ec053", "value": 6766272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683464529, "uuid": "90543bf4-2095-4f76-b2c4-d1c9a3910f19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683464529, "uuid": "fda582de-08d7-47cb-9a3d-f5de220d13d0", "value": "zboti686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28a32851-ec6b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683418050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418050, "uuid": "507bef16-8476-40ae-9eec-5d58a738cfcc", "comment": "Malware payload (RedLineStealer)", "value": "db7df5563cf79e51557ca2ffc91ef66d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418050, "uuid": "ec4b93ff-2791-444a-9729-48f70ebccf48", "comment": "Malware payload (RedLineStealer)", "value": "44ab913e6708ebdb117d4d0608fd14c7a3b5280db5425b0f4e4d3bdad8654f55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418050, "uuid": "dd4e4079-c313-49d2-938a-9a2ff7eaf230", "comment": "Malware payload (RedLineStealer)", "value": "f056684f1dd2759f5c064011302c7a07704a1c2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418050, "uuid": "7d73a902-561a-40fc-91aa-5caba13f87c4", "comment": "Malware payload (RedLineStealer)", "value": "7545c1ca78846ee2bf9bb9da653cd1b17b66a9f27466e721e213276141bc93e73117cfc46b6b9e9e6d64da85aada3b70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418050, "uuid": "5741c682-824d-4ade-a755-5449ec5d3926", "value": "T119A412539BD84073D9F11BB068FB07931A35BDA1CD78965F2381AAAB4C725C0A53236F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418050, "uuid": "d823eb03-7cab-4cb1-a468-b05975711b48", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418050, "uuid": "8e940602-1721-4172-afb8-a83f78b0b710", "value": "12288:WMr5y90ZFvL/Ne8zc5c1u31cTXH0EWKKtr34ThDXeN0hf:DyqNwycXGTXWKKtr34VKN0hf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683418050, "uuid": "f6bd5678-1efc-4eae-8d86-e54a7c699070", "value": 489984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683418050, "uuid": "f3d4830c-b1a5-4bb4-8f55-90188f0500c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418050, "uuid": "ce7e1f07-9e3c-4a31-a0b3-3e0c300b0b02", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19c0a634-ecc6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683457109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683457109, "uuid": "7c3a6a83-e31e-4683-aa60-5064e2729588", "comment": "Malware payload (Mirai)", "value": "a1111866b7c60fedb94832dbac7f0eb6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683457109, "uuid": "fe3d7523-f46d-4aaa-8882-a2da46363cfc", "comment": "Malware payload (Mirai)", "value": "4570dec9d68259f66700caeea49fc00bb3b1f5613e51c17aad5c19779ec3467f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683457109, "uuid": "f0bdb1d3-5fe5-4ea7-af18-6aa26904934c", "comment": "Malware payload (Mirai)", "value": "b9c7c2979057bea095faaade01347f661a09d89a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683457109, "uuid": "262c3707-b315-4310-835b-4eadda3b11ff", "comment": "Malware payload (Mirai)", "value": "1ee2d265b1797077a8931b9732cfeae92eca7e0dded095301e072080187cb43968a17e72861fced8fb090f8215cdcfe0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683457109, "uuid": "5a382707-842f-4848-9ccb-567a77259f98", "value": "T19FD2D07DE1B442D5ED8E0C7DC48C3BA10E19A681231BDBA577228C895732C9BF17A4B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683457109, "uuid": "8a055125-d497-4794-b663-153070b312d3", "value": "384:i8pVWtmRsLYEpB6V8S628FuRUuNJG9whQ3Cfbo6w+K95orjqhx8MCRWGVCz0NvW:HMYHb62x4ahQ3CfdwLjzhx87WH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683457109, "uuid": "68d79c9d-692b-4327-91a7-24e2fcbeb64a", "value": 29944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683457109, "uuid": "308d4738-5abd-46e7-994f-3f015ccb4b73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683457109, "uuid": "240f749a-00c5-49b6-8212-72a9ec0bd141", "value": "a1111866b7c60fedb94832dbac7f0eb6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84025940-ec9c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683439249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683439249, "uuid": "ad57198c-c72b-4ccb-9357-1bfbbd99773d", "comment": "Malware payload (AgentTesla)", "value": "6c6e8a11931cc1f397630eac0e70a917", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683439249, "uuid": "ae275f73-664b-474d-a181-3f99ca94ec2c", "comment": "Malware payload (AgentTesla)", "value": "45df4672d00125ae4245f3a12530a850dd0b057b0efd8dd90d09b1a4998d4836", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683439249, "uuid": "f7762963-5410-4db7-8ac5-5fee3eac4f74", "comment": "Malware payload (AgentTesla)", "value": "a271d89821ce611a016c7e296564be1ca66c0144", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683439249, "uuid": "52f0d051-1d9d-4417-b32a-493930f2ebcf", "comment": "Malware payload (AgentTesla)", "value": "d75352863dd45da0d66b793ceaa8fae592ba318a3b0ecac53dbb406f15c927025bb98002603f21f4f9396ff4ecd515ee", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683439249, "uuid": "6b7a4549-91c8-4ea7-b3ee-9cecfcabd52a", "value": "T1EFD4231EB1DD5AC054B1EABEBC7E3B4BC699F3503DE5CA464BE0C0802A8D16DD6DD890", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683439249, "uuid": "a49d2b6e-b82a-4ec5-bd11-6734c9a529a9", "value": "12288:Z6YW50SHWu7MG6EqYx3QUqEhtKl3p7Jd5XJX6bMuwtDdgpx:ZdW5RR5AChtQHTZpxgpx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683439249, "uuid": "6ba2b8bd-8aff-4b1d-9cfa-c78692ab70fd", "value": 624081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683439249, "uuid": "9b1346c4-0732-43fc-9277-d93b0439705d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683439249, "uuid": "20b5ef7e-3603-4d43-80bb-6a2a7dd22e44", "value": "swift copy $37,000.00.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4514ada4-ecba-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683452028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452028, "uuid": "0bec7377-1934-48a5-8e4c-bce13989db16", "comment": "Malware payload", "value": "373a230c0b759ea70a20a0e796e5d0f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452028, "uuid": "351834eb-f3d5-4491-b3bc-5ccd4be91a61", "comment": "Malware payload", "value": "461e73f38bd83edad486a474a66db000881fcc08200c1812b5e7da3247f062fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452028, "uuid": "ec1a34c7-3b66-440c-9a2a-d69619b5244f", "comment": "Malware payload", "value": "2b45355007e2065a76f9ceb9c8585dcb610ef20f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452028, "uuid": "b8af86c5-56a1-4f73-994d-d8073000a1d9", "comment": "Malware payload", "value": "9147513d93c7232ca3353b352fb440a529e0702dbba5d9ae1b23485311882390455b750faf47619acf87070c506d8428", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683452028, "uuid": "aee78d82-efe6-4c85-afc9-015e7c346499", "value": "T191953384144FF679E58C78BC520F5FD22B0393EA1B500A0781F6418FAFD5A6AA851BB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683452028, "uuid": "5c0ced08-12c5-40a8-a202-4754ce5ca31a", "value": "24576:zx5Zyqh+EG5Bk1UTxU3O2ZZgC/BwIPel7hFKKUdJm+72VoaW5xHc7qz7xG60Lw8r:xGTDTxU3bXgC/HUFKPD71J0s8lLpW4wG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683452028, "uuid": "0561cb84-de25-4e02-9ee0-e19cda886243", "value": 1975355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683452028, "uuid": "934c7c80-8b64-47bb-9ac7-020fcca3325a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683452028, "uuid": "a09d0767-ebeb-411e-aef9-db7d0dfd4d37", "value": "373a230c0b759ea70a20a0e796e5d0f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7b01ef6-eca7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683444033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683444033, "uuid": "12005ae4-a8e2-4279-b45d-f94dde54264b", "comment": "Malware payload", "value": "a9625534c25a4c39665dcf449f6d5c4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683444033, "uuid": "5b891e34-30be-46f8-84dd-639dde2047d2", "comment": "Malware payload", "value": "4855f9b27b69c263e5237e430bcbf6850b6fef233e8a614e01f46c87241b5ffe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683444033, "uuid": "0a2b75f4-b8b0-4502-94a1-50f0a6fed3dd", "comment": "Malware payload", "value": "28b24c5995043df813403e09f516d77de2df03ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683444033, "uuid": "ccc07331-c5a4-4ac1-8ac6-710d9fdbc78d", "comment": "Malware payload", "value": "b1761bd577a849a1b5c74e87c7af8968cd979d1cf3b1d54b916b285ce36c0f3d28ac3cf613ec13fc3c3036e293a5998c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683444033, "uuid": "d7436a74-0d2a-4ad0-9259-9a5ced8616c8", "value": "T112E64B07F89191F9C0BDD170CA369292FA303C485B3163D73A64FAB92B72BD45A79394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683444033, "uuid": "534a3287-b08b-43ea-a5f0-4bc6950621d6", "value": "57c9b357ae0cb2f414b0a5873e2f216d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683444033, "uuid": "69577ba0-efc9-4ff4-9388-6ce8e2b33002", "value": "98304:5VtaBiQbdYx2k3fc3w0xEh/4RYYqZRY7o/k:53Yi0dY14wxSRY+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683444033, "uuid": "a586f9b5-c8ec-4a5e-abac-bfade9eeae98", "value": 14533120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683444033, "uuid": "e2f3dfca-b0fa-4ae7-ac47-42fce296b0cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683444033, "uuid": "48e3fb52-8ac5-4564-baac-727744d19ef0", "value": "a9625534c25a4c39665dcf449f6d5c4a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f058aa2c-ec6c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1683418815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418815, "uuid": "8eacad55-e037-4a21-8c2f-2bac63c11a5f", "comment": "Malware payload (njrat)", "value": "9144991a84d998243f1cb83b4f92dcb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418815, "uuid": "253c21d4-f358-42f3-9138-901f0f31d7f4", "comment": "Malware payload (njrat)", "value": "48dd3141215e1b95b2be3fbce36d60dc904fb965fecdb98d3dea701985b58f6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418815, "uuid": "6e4b655f-5ef0-4794-b55d-b7b09f002e0b", "comment": "Malware payload (njrat)", "value": "9c63a475f887526641d0f4f3a681b369ed75c77b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418815, "uuid": "37d07c09-2c32-499b-a638-b06a9a198340", "comment": "Malware payload (njrat)", "value": "ca57f9d5c3ed6fe1de5e84808130215850b0196583fdf1f1bbb8623946c18c0f0ff675be55b48d544a0ed98eadd9ef67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418815, "uuid": "bfd9c35a-eb70-40ee-87fc-d68bc3fb4f58", "value": "T112145C6AD1C522E7C84C8B75B5378D734AB39CB716B2DA6B6884F22F2BF32004544B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418815, "uuid": "544dd49b-01e8-4c53-9265-1cce9414eaa8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418815, "uuid": "f9638221-8a85-405c-b1a6-b6ea944af01d", "value": "3072:SVsvdwvSaBqVjcH1K/3PhopXTL1aKSs08uKUFjav60eloQnnDaA:SV0dwKnwRaKSsxHUcSFdnnDa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683418815, "uuid": "44c5c46b-2b6e-4f27-b10a-274921b8c471", "value": 204288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683418815, "uuid": "b2f600ae-06cc-4fea-b5ce-ded95c844d37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418815, "uuid": "2fe18c68-bbcd-4c0b-b44d-b22bf272786c", "value": "Android USB Jailbreaker.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05e4498c-eccc-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683459653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683459653, "uuid": "da6de197-8cc9-4dfb-aa48-6513db901e80", "comment": "Malware payload", "value": "dc2b75cc965b3628da9c825233170aaa", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683459653, "uuid": "9e99a688-dffb-42de-bea4-f4426bee585b", "comment": "Malware payload", "value": "49db12b3461c259552828a46377d59749539912bccbfab035fe9dfedfa0799e2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683459653, "uuid": "197cb378-8fbe-4cf9-8270-3089409b3268", "comment": "Malware payload", "value": "d1c4989851eccf1731894601cad2c965c7aa8923", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683459653, "uuid": "5bcc2a11-3aeb-477f-b2af-e1c51a104163", "comment": "Malware payload", "value": "2fd17c6e60ac502bd35c7144e138765f21025476f0296f937a9320cac7350d532fa472953c44b556d274833c822d2594", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683459653, "uuid": "87497907-0a41-4288-98bc-20032823cbe9", "value": "T15664C711E616C58FE25D8635C8E21FF65BE27C5A8B610A32FEEE731D2475690AC06F0C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683459653, "uuid": "fd687f5c-ec5f-4aeb-b4b8-15e1d5e1b018", "value": "5c54715227e960c5019e7a45d4b9d02a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683459653, "uuid": "7b505612-78c6-4166-a930-2c76dacf3253", "value": "3072:cFnCQc7cskkkkknffCp5CrRb9YfMX0E9QsJB9cWe7Ka2c8btV0F0EpErbITT:c1TskkkkknffCp5CrRKluai80EH3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683459653, "uuid": "28b861c1-4b80-4f33-8cc6-62c92d238fba", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683459653, "uuid": "40b538b8-510b-4fdc-8ca2-53dbd0de8a51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683459653, "uuid": "6d5941fe-b0a7-45e7-9ec5-7970853d9813", "value": "SecuriteInfo.com.Win32.Ramnit.Dam.1137.18866", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61dcaae7-ecdb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Cerber)", "timestamp": 1683466250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466250, "uuid": "f36f9ff2-419c-4e3e-9255-07e2e474435c", "comment": "Malware payload (Cerber)", "value": "4f85eec9e23dc664c814cea272dcd5b8", "object_relation": "md5", "Tag": [ { "name": "Cerber", "colour": "#6E6D4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466250, "uuid": "f5b16778-3414-404c-b152-cec652747df7", "comment": "Malware payload (Cerber)", "value": "4a2ad49c934f9ae6ca6b5d0c7cc34f5e12d349640012fa8cf8eb7e2d3acd6c9f", "object_relation": "sha256", "Tag": [ { "name": "Cerber", "colour": "#6E6D4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466250, "uuid": "8b449992-d40c-423b-8cf6-114e97714f9a", "comment": "Malware payload (Cerber)", "value": "4eda594a01aee9622604924ffecfa9dbd6135bc0", "object_relation": "sha1", "Tag": [ { "name": "Cerber", "colour": "#6E6D4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466250, "uuid": "9c953529-4e1a-4333-a060-f1003fa58d87", "comment": "Malware payload (Cerber)", "value": "e3dc9bb25c876f64a318cde12f749761a21f9c4fae60372a88bca0d5c15e4e97870408e4f53124849f2fbc2660b45541", "object_relation": "sha3-384", "Tag": [ { "name": "Cerber", "colour": "#6E6D4E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466250, "uuid": "88cd8a8d-5d87-4957-889e-dad20fcda3d9", "value": "T1FC9573502AF85125F3FF7B35BEFB41299A35B8715E5F824E215C820D0932A90DDB1B2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466250, "uuid": "509ae044-a596-48c8-a288-8c6f265e5e94", "value": "ae80b4ecb14ba8e602aaba0e2180c87d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466250, "uuid": "9176ba91-43f4-4aec-afbd-ba801f7600c5", "value": "12288:6s2cBCtdB3+j+3EEQ5NX2l0Y/iaJDdI+VrzrzzczNzzE:6s2Jtn3aOEN5NX2l0Y/iaJDn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683466250, "uuid": "4173b1f5-45c9-4eb2-bfdd-04c1a1add0f4", "value": 1978368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683466250, "uuid": "bca93a62-1e52-45c7-a02c-69387baf9aa5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466250, "uuid": "1ea237f5-dc78-4c21-87c2-b92bf9d838ef", "value": "2023-05-06_4f85eec9e23dc664c814cea272dcd5b8_cerber", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0bd2bb0-ecd9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683465550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683465550, "uuid": "ac99027c-411a-4927-be21-ac98441fb30b", "comment": "Malware payload (RedLineStealer)", "value": "e07ae6351fc76f0c36563961429be020", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683465550, "uuid": "1407c032-b155-421c-a04d-e36d65e2dc46", "comment": "Malware payload (RedLineStealer)", "value": "4d7e90c3ef554bbaf8d3b84fd6b41ed706512052801a40b99f51827eae5781ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683465550, "uuid": "9c1f7a1b-eb10-4647-bc11-a574b6696ac5", "comment": "Malware payload (RedLineStealer)", "value": "1e43e2081d81309b6db9a999adb61799968ce93c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683465550, "uuid": "11373c9c-b4df-4a65-ba87-8427ca84bbbc", "comment": "Malware payload (RedLineStealer)", "value": "3a24669514dd3f5ac0a35a3b6b24b21b59f0f201271ae4e0c1f7ca7cd9efc655308be4b44ea9f45d0a612e6b36c14ef0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683465550, "uuid": "1ed822f3-b492-419b-907e-fb0d85393923", "value": "T1B8957C70E87190F0D8EAE43244E9972D292E6719FF6D33DF37991969CA260F05E39C12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683465550, "uuid": "84ec9052-2301-4435-8778-e8d96ac192a5", "value": "31379d8e4079161615a0383612464e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683465550, "uuid": "74b60428-c498-433a-9e41-4bf8f3e76c38", "value": "6144:f67sQHcE/P07lxzrZNVZtJl2S0AOELK4roMlBkZ1ahUubfJnp5+:y7szE/P07lxV0mBmohVtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683465550, "uuid": "0009956c-0ad0-4bf5-a5e7-069b956332df", "value": 2030592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683465550, "uuid": "81890ec9-287e-4202-9906-7a2dba9c7110", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683465550, "uuid": "9c8bde82-9246-4da8-8a28-df09df1eab5e", "value": "StormDEV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55f625b0-ec6f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1683419844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683419844, "uuid": "743dd100-5570-4087-afb8-3926f733e124", "comment": "Malware payload (Smoke Loader)", "value": "b105683fa395c3027cb72590f33dfa72", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683419844, "uuid": "7b30d3cc-9e86-4ab0-b979-3a1a25dc474b", "comment": "Malware payload (Smoke Loader)", "value": "4dfc1a29a46d73e82d985a6ee4b3108580b82c73e0aeb1d16cba214c2d194863", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683419844, "uuid": "d179eb83-43f7-43c8-94d4-41d08b8c0c82", "comment": "Malware payload (Smoke Loader)", "value": "875e2e24b07a030acd412018a24fe657e1ee6501", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683419844, "uuid": "d73a4fa3-1a2e-4bd2-a53e-3f0d8de2cfc6", "comment": "Malware payload (Smoke Loader)", "value": "30d817d718f83c76ce89c1a95402dcef11c456d700f6087d98e3d87287564f2dd2e3d4ff95311d81bb47422a621b51ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683419844, "uuid": "07052cd4-c743-480b-943f-0a03630221a1", "value": "T19A547E02F2D0B871E5160A3D8E1AD6E4AA2EFCA18F56E6DB17557E2F09F01E1C572703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683419844, "uuid": "3a2809f6-8ff3-42f1-b7d1-aa193f05353a", "value": "cb0d32ad83907c8b5d9a97a27bcf3623", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683419844, "uuid": "2fdc3a91-a892-4334-8799-8247be697996", "value": "6144:wdwbTWfSgUnPePdr+26JtT5DA+WslN8WL:2+WagUnKr2JtBDL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683419844, "uuid": "c1dffce0-7f9e-4b62-91c3-45de2aa6d888", "value": 305152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683419844, "uuid": "b33f62a1-f837-4df5-8e7e-fb6d55cd3057", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683419844, "uuid": "fe1e7789-f50a-4cfc-9692-cefe1f153116", "value": "b105683fa395c3027cb72590f33dfa72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9057708d-ecba-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683452154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452154, "uuid": "db069960-4262-4d4c-88cd-432180fa0081", "comment": "Malware payload (RedLineStealer)", "value": "b69fd7f498b35147bbdc536fd84b2430", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452154, "uuid": "449fb147-e745-4722-9759-926a841215ea", "comment": "Malware payload (RedLineStealer)", "value": "4e0929008bb1a10e0e05b3730c3258986d2631f6454383e7c184f319c4468f43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452154, "uuid": "6c0fbed2-de7f-4556-a289-de8dcf8520fc", "comment": "Malware payload (RedLineStealer)", "value": "3b5bd3a5f4eb295daf373ae9fdcf8bded23dc31f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452154, "uuid": "dd14598f-54da-4ec4-8401-f3fb2a6cf34f", "comment": "Malware payload (RedLineStealer)", "value": "68b5316fde93b519016a009d20725171eab1e7d53f9d21328dcaa52890d37e46470d05563b0cfdc2d7e51dedd79bfc45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683452154, "uuid": "4691fbd9-432b-4dfe-a193-2b914e725aae", "value": "T1BD640B0392E13D54FB264B729F2FD6E8769EF2608F59377922189A1F08B11B2C173725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683452154, "uuid": "cc51d483-cdeb-4554-83a2-12f2a3ab90c0", "value": "07392231fce6d1215d12aefe3ca2bec9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683452154, "uuid": "58c978d9-fbe1-4e3a-baa8-492f3e767a39", "value": "3072:WAXsGLPNtRzPLJ/Od5K371yuh5QnW6FR6HMDVz9O/nJ5I1qkxXTHEPBgRE7+B/l:Ls8N7LJWdgydj6HMDVgMRxjHE5j+B/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683452154, "uuid": "0cfb1d24-1291-4694-84ac-9c6ced1ab760", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683452154, "uuid": "918a3170-532d-4cc4-b0db-7b54c74feac1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683452154, "uuid": "33461b12-cf08-48f4-bd26-fe6c8d10caff", "value": "4e0929008bb1a10e0e05b3730c3258986d2631f645438.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25662fe0-ecba-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683451975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683451975, "uuid": "4f1048f2-61a3-4d98-97d7-563f93cfcae9", "comment": "Malware payload (RedLineStealer)", "value": "ce9fcaffb3d581ab683d17cf0839eee8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683451975, "uuid": "7b2ff22a-40b2-4e4e-8f0c-8d52cd575e1c", "comment": "Malware payload (RedLineStealer)", "value": "4f0ab1e8866b96101e5c27520c520f384532a078ef0dfc9c96a54a4623903652", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683451975, "uuid": "aaffa750-60de-48f0-93df-cdab54491779", "comment": "Malware payload (RedLineStealer)", "value": "ad2150eb6fa619e47b501ed5b9dea32f3df7ba86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683451975, "uuid": "60e6f318-98f5-43e2-b416-84f67116698f", "comment": "Malware payload (RedLineStealer)", "value": "31435481690c31af1e4ac5c1a222b43aa291c699618b5bc5382efeb4878ef0617f66bbcc98b90c9d0df6a644de54b174", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683451975, "uuid": "0e6c4c6a-6742-4d92-a19d-4da4244b9bad", "value": "T1CDA40253FBE84032C8B4173409F742871A36BEA1A978975B37496D4E0CB3AC5A87573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683451975, "uuid": "5d8ee187-499e-435e-b7de-9cc1898077d8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683451975, "uuid": "1d0badc3-1117-4b91-8c18-4b4417b634e9", "value": "12288:ZMrzy90FF5c1k+8+Kn7/Ya9e2ZoaNMSYzYNUX:qy0UY/DYWTZXNUX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683451975, "uuid": "64cf0c0b-2800-4962-9149-7abfc57f9859", "value": 490496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683451975, "uuid": "a47ad603-74c7-4c53-a7dd-cce74d311f8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683451975, "uuid": "dba5edde-7261-4cc7-820c-0f999dbba97d", "value": "ce9fcaffb3d581ab683d17cf0839eee8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f94ff45-ec6b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683418008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418008, "uuid": "76c34161-fa49-4c6b-b0e8-e261f48ec90a", "comment": "Malware payload (RedLineStealer)", "value": "ac1e515fbcc4b21cf86ddbbc8ca6c9ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418008, "uuid": "063d3c18-299c-47a7-85cb-2d4785f2155c", "comment": "Malware payload (RedLineStealer)", "value": "50c58a3f1be538a8b55a8ff669d0d1f95756a16e25a2e5850d7a5934cd5706d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418008, "uuid": "2b5a0a8d-71ad-46ec-a768-00139773f6f2", "comment": "Malware payload (RedLineStealer)", "value": "4832864a04f32c3fce20c20a14a1467ae9424512", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418008, "uuid": "c3745456-07f4-4b20-99fa-8c75c1fe6fd7", "comment": "Malware payload (RedLineStealer)", "value": "9b4408b3bb163588f2c0af24022f0b6e37dcdfd1d1e93be2bd7d77b1912860fc8b4d35d859974a36bfce105eb0908026", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418008, "uuid": "76efba05-2c1d-48fc-9b69-4521c3a7743d", "value": "T10DA40116A6EC5162DCB11B706EFA03931B37BC909D78866F3355AC894CB3690F93076B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418008, "uuid": "4ac1853b-c444-4071-baac-1db5f1d4e2cc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418008, "uuid": "b31f4b58-05ec-4f2b-a307-0fea73a239ad", "value": "12288:qMrBy90rZe+htbNStroGtmYYQrnNO0gP6/Zj4O:/yUpqNoCBO0+SZ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683418008, "uuid": "2309c89a-1ef7-4e9e-9974-f454f29062cf", "value": 491008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683418008, "uuid": "9a9d47a2-e5c1-4a7f-8e37-6b0ab48d760b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418008, "uuid": "439d761c-ce40-40df-aa5c-9ae497d7728b", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5a6b4f5-ec6c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1683418716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418716, "uuid": "3d3af67c-5193-4cf1-a81f-7aa655d96e1b", "comment": "Malware payload (DCRat)", "value": "78c3462dad9551e4c60ced9e147d26b5", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418716, "uuid": "67749de4-5901-4c02-9b14-801246c60e28", "comment": "Malware payload (DCRat)", "value": "51b3d59d59b618ade2fa6c244a0055219e718d32aaacbc61bf7ab964d0059b51", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418716, "uuid": "a5a2f772-60f1-4033-bbe5-af4c279e4c1a", "comment": "Malware payload (DCRat)", "value": "4a29ad226c3091ad73269cf8438bbee7208b42b9", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418716, "uuid": "a32de753-4742-40b8-9768-e3dbd9c280c1", "comment": "Malware payload (DCRat)", "value": "f1c1a9ba8cc8742590c3b3fb3ef557bdcf0a15637e33743b1510b4f0d132ccccb15b6727314b3676f4577ca002a3c6bb", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418716, "uuid": "082fefef-aa58-4fca-8e56-a8e6a16298e1", "value": "T1BCD38282E74A5E64C4E4247185EF513303A5BD8F2631F3727E0B4678CA451B3BBCA69B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418716, "uuid": "f683cee6-3109-4099-b3ed-ade1d2a935cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418716, "uuid": "249bf9b9-f734-4456-863e-2bdcd66fcd26", "value": "3072:22eVDUjXYMe2btqPO2V3WcC9/o1W34PY9:7eVDUjXYMe2bItC9/oj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683418716, "uuid": "851f726d-5a18-4d50-b0b4-36c45f3e223d", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683418716, "uuid": "45679349-ae4b-47bd-a69e-03e5a30cce1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418716, "uuid": "8ff76eb8-9c20-4aba-8cc5-d9a9f6699474", "value": "Auto-Teleport.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baa8b173-ecd5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1683463822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683463822, "uuid": "fed692a8-7732-4eeb-92de-5f4cdd186b8f", "comment": "Malware payload (njrat)", "value": "f4f5adf911372f7ad86fc4cc8a59e099", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683463822, "uuid": "ad77abd4-4d40-4182-9a9a-4159c0c8f8eb", "comment": "Malware payload (njrat)", "value": "536b6a44ed389ef02800c6e34371823afe6daa7ec6c0f7663ab3a2e1d83b2a62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683463822, "uuid": "eb300b42-bf4e-4c1c-aa56-82256a003dbd", "comment": "Malware payload (njrat)", "value": "68e84d3702671c065c632af360856477c18488a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683463822, "uuid": "7bb1cadd-7ffd-48b3-bae7-097d8533ad49", "comment": "Malware payload (njrat)", "value": "4b864975f3ead7a967c3d3eb61c19f6581ceaaf78a4604b8bd8d42a18f26eabd59df22a9816320303da747afacd0dbe5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683463822, "uuid": "d6a93bc9-ee81-4297-aacf-5e6bf2662579", "value": "T16F033B8D7BE18168C5FD057B06B3D41207BAE04F6E23D90E8EE5649A37636C48B54EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683463822, "uuid": "1d3d2b7a-cf19-44a8-bcf8-1ed5e2d8668d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683463822, "uuid": "8f624afc-94f5-437d-b5ea-62f81f048c2e", "value": "384:aLWpMiL7BndznNCyMGm/yevT1cmUBVhrAF+rMRTyN/0L+EcoinblneHQM3epzX7I:XtRNRMGm/fp1UzhrM+rMRa8NuFYt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683463822, "uuid": "08dcbe07-d6d7-4d12-8fc6-26f703bb6941", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683463822, "uuid": "e656cd33-8a51-4378-9638-98cc0a7a099f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683463822, "uuid": "2b84d624-da9a-4631-8529-69aa04450be3", "value": "536B6A44ED389EF02800C6E34371823AFE6DAA7EC6C0F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64170cf1-ecf2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683476132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683476132, "uuid": "7a0457a1-6951-4cb1-ae96-f530e8a2a382", "comment": "Malware payload (AgentTesla)", "value": "d81b1d5d5aa585ad72e9a339be4443fb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683476132, "uuid": "0048a872-539f-45a5-b618-0b2a43fa09b0", "comment": "Malware payload (AgentTesla)", "value": "53fbbfa7c900fab10b633ca89db69849bc154962eef764e87e76b8e2397da83e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683476132, "uuid": "07c1308b-acb9-434e-aec6-b53012460b31", "comment": "Malware payload (AgentTesla)", "value": "c406e375fee14f02e416fd7d0669da4f444955c8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683476132, "uuid": "f254ae4a-a1a5-4b7b-84d6-39f2afdf665b", "comment": "Malware payload (AgentTesla)", "value": "8204b556d6812bad6dff3f4b1e24600ed15a4cd80624dfca03c4cdc68705484b3b201bc1a0cae922a4bce37e9648736e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683476132, "uuid": "a0396524-0c78-4082-8692-b7eaf0e8335c", "value": "T17F842AB91DAA8CC0F91EF4388329E9BF5F526C12092582FC1C96BD214BB5351DE61E73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683476132, "uuid": "8711393b-3186-4f40-85d6-11eedeee3aa7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683476132, "uuid": "99e90017-cd6d-477e-98cb-869b0fbc174d", "value": "6144:0/1BRi+ewFGc4uFvL2Csgrpm4eAG9kziCHeLp:qRleX6an9EGSGww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683476132, "uuid": "d58c476d-1aec-4310-86e9-261eff241e2a", "value": 402432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683476132, "uuid": "063f5343-04a1-4bf1-ba4a-2203e6ed41e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683476132, "uuid": "b40355c9-1940-45e2-8b16-c00c95b9f6fc", "value": "product-specificationlist.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03f9e0dc-eccc-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683459650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683459650, "uuid": "8af8260c-e251-408f-941d-9535035fc432", "comment": "Malware payload", "value": "80226b233cf4c944dd1fa57920479801", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683459650, "uuid": "49195b03-31c2-4604-a458-1e3d38a11b7b", "comment": "Malware payload", "value": "5537dbe2f3daa9a73876ad1e55e8c384618065e6ccf01b7a73303c7fdebd9409", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683459650, "uuid": "c80e4925-0163-4f6e-8994-299e9de6ee71", "comment": "Malware payload", "value": "2837f809bd862d9af46911eaa4d2f56073e7bdd6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683459650, "uuid": "1387a7b0-7441-47f6-8ba3-31a16fe100e0", "comment": "Malware payload", "value": "d0e76b4f6ccd78d42be5a5d8e00dfcd40bb1f903209b37c18c5a700b4089c4c7f522163760239fec20fa191f9c05d504", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683459650, "uuid": "5f69e825-ab10-4198-8683-542be6c39e14", "value": "T16FF38D01F6C440B2F78D017D18AB6B39EB7A69A18F655AC3C334EF491D31261F93625B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683459650, "uuid": "272c6d72-1ff9-49ec-950a-fbededd853ec", "value": "6b2ded4342b002050c853403b34fc465", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683459650, "uuid": "2dffdc86-808c-4c85-998c-3b493d60b57b", "value": "1536:xrxde1oKG616ruhX5bsYG/W6LyhcnsTjJDw5GaypS61IcFzmaieWmz/:xbmG66QG/WIyDdCEF1IcFzmaijmT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683459650, "uuid": "992306c9-0dfd-44a7-8664-4abb9b9a0fd6", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683459650, "uuid": "fe45a7e4-1636-4508-b6fe-9cfe2efed1a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683459650, "uuid": "441bd931-8ffd-4357-9e71-8ee41d9e0dd6", "value": "SecuriteInfo.com.Win32.Ramnit.Dam.26999.18964", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14442c3a-ec86-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Dharma)", "timestamp": 1683429612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429612, "uuid": "ccb14259-be06-4f03-9470-f25374a1a98f", "comment": "Malware payload (Dharma)", "value": "5c36e305d926e55ef98d392176890cd2", "object_relation": "md5", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429612, "uuid": "ce7fc14b-7af7-4dc8-8415-939719ffea73", "comment": "Malware payload (Dharma)", "value": "5671112c276673ee5c4630994ac0034927cee2aa05a32ca6950edbc80c56e7e8", "object_relation": "sha256", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429612, "uuid": "b50c27ad-acb1-413b-95d3-32a55f051432", "comment": "Malware payload (Dharma)", "value": "64a15cdf89b6c8b85cba355b6944074614d810fd", "object_relation": "sha1", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429612, "uuid": "666da665-8a28-442a-adea-8410246e44db", "comment": "Malware payload (Dharma)", "value": "6ad88382f0c6a444e35e751bc727cbd1e1f12eafbcd40de2bd4380163d098a8112affa59760fb55048c63c622fba0c42", "object_relation": "sha3-384", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683429612, "uuid": "a1763c21-c512-4260-8725-ebb87f057a3d", "value": "T134357B0E66A900F8E0B7D1788953454AE7B2BC5A07718BDF16D1679B0F736E09E3E321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683429612, "uuid": "e3a86f6d-202d-41e3-b95f-0ee67f072d01", "value": "5315652999804b829ca220bd7b9a2592", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683429612, "uuid": "5f07e940-97f9-47a1-ad88-4699215b8e4c", "value": "24576:EoZZV7Uqi5inyhZQDkUzVDZJ2vH53GaJR38:HOqigyDQDZVq52wM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683429612, "uuid": "9b71fb44-0201-449a-abd8-6e86a49625af", "value": 1095680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683429612, "uuid": "e5b88232-2008-43d3-ba48-b0cd8d62e616", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683429612, "uuid": "d7e9cf64-f6f2-469c-b558-8d8fba96df25", "value": "VirusShare_5c36e305d926e55ef98d392176890cd2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4bd705e-ed02-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683483247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683483247, "uuid": "d09ff619-a54b-4f9f-b303-dfbff164b8c0", "comment": "Malware payload", "value": "5bf6dda87c399945bfdae0c390523f6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683483247, "uuid": "d8817f55-ff66-4549-aa90-71f61c888781", "comment": "Malware payload", "value": "56cb118f4caa1f3d0461faba24d9cb575843177b2a756622533ba00dbac10a2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683483247, "uuid": "4ee3a0b0-e0f2-4c54-a360-adcd42a324fb", "comment": "Malware payload", "value": "d0a455250331a626436f86818b8b3f428eb6aa03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683483247, "uuid": "680f8133-9293-435e-8c06-32bbf0faa956", "comment": "Malware payload", "value": "e736c90424f95654136b8dbeb525548a8a74db99d7daf38d4ffb26464425b0bf01d2c95b09c77cca6753ff306cae8dd9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683483247, "uuid": "e685e24d-f779-44df-9a5b-5108a2c2bfed", "value": "T1C5841947AB6585F4CC76D078CAA26623FA7178594334EBDB87508E131F23BE1A93E710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683483247, "uuid": "a1d5ceab-e491-41be-8d9c-01612b87e591", "value": "91f084f48f1a7d46fb0c1c59aeb26b0a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683483247, "uuid": "500e43f0-1541-4b08-873c-aeb253459a0a", "value": "6144:n34ElVxx2j9kwTX1/AmOK79elWexzUf/rBwIN2tiNsEj2OrAh5RYlyzro:Iy2j9F/AxYlk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683483247, "uuid": "88207b14-5336-4395-b2dd-a79a904cc48a", "value": 407552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683483247, "uuid": "0ba39302-e719-46fb-9648-cf73bb9d44be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683483247, "uuid": "10f7fe90-16a2-4a11-895a-13d4015723f7", "value": "5bf6dda87c399945bfdae0c390523f6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a4fb6d8-ecba-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683452037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452037, "uuid": "3283cf0e-656a-48dd-aa0a-3ddc6aa181f0", "comment": "Malware payload", "value": "15b2f8837b9b9f6e9b95081cb9323f83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452037, "uuid": "943aa9bc-5d9c-4fc8-b5a8-65d41c6776f7", "comment": "Malware payload", "value": "570a28cd494b30ee923caec58e06dd9f13a7d94b214018276b4bf47354f6a028", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452037, "uuid": "51ff0d44-82a8-48b9-917e-909f37627b40", "comment": "Malware payload", "value": "25f2fce0a0adc039ecd3582148400b8423f83bea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452037, "uuid": "ae17df0c-4ba9-44a4-91d0-156be0b1e2f4", "comment": "Malware payload", "value": "8bbe4eb24d1faabcea15ebfa8bc25ffe9e0c9f0cd14cd540cf85fe1e21c0be1fe0f12bf4dcd06863a74a5adeeee40de5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683452037, "uuid": "f469bd62-d6b2-48ec-8aca-19b671c9b4d4", "value": "T1A1B5D700D701621ADDBB25E94BAD313DB10CEAE0131464C785C86AFEDBEA6F13E3559B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683452037, "uuid": "682559f3-300b-4acd-8148-9244b31b3af3", "value": "24576:HBcO19SWdwWRhpHqPPWuPnhMlY+i31w+LGr7G13xSUHq8l/GIv4VJWo:HLz6va++B6xN2+o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683452037, "uuid": "825ba6f0-d8a4-44db-9ba6-4bf9229e5511", "value": 2280013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683452037, "uuid": "dad4a53a-ab11-42b2-b44a-82b116d1713f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683452037, "uuid": "8bc29e7b-1b62-4eef-b2ec-ce4a722d430b", "value": "15b2f8837b9b9f6e9b95081cb9323f83.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "664bb67d-ec6c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1683418583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418583, "uuid": "a9557975-3b7d-40c9-aad4-6528961efe8a", "comment": "Malware payload (Vidar)", "value": "ac164686374e5ff5426219b29981180b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418583, "uuid": "dc4140a9-3744-4cc7-b5c6-49c4dc441345", "comment": "Malware payload (Vidar)", "value": "5baeed7f0d2c2a37b79860d59c533fc387b9f2a36bde6268679e10ab86c08d83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418583, "uuid": "59f53b8a-a5b3-4d30-bf6b-b0423e9a36d0", "comment": "Malware payload (Vidar)", "value": "e45fed0ff497679334628b63de5ea7f9d2198802", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418583, "uuid": "3690a796-e74b-4be1-ac5a-ba9c61f0c7eb", "comment": "Malware payload (Vidar)", "value": "4df22a9f1add182a3e4cd80be97db6ef5820f95788c7d09499455369004a8ac816308009bf6547f4112a01468fb5842e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418583, "uuid": "58767ac5-30bb-4c47-9db5-d6b1735e4a25", "value": "T18EA4BE03A2D17870E91A4B718E2EDAE8661EF841CFE477DB3354AA2F0B711E1C572752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418583, "uuid": "0e46b561-d534-464d-94d2-997bd217a73d", "value": "10ab34837ef60af1edc59a7f73704998", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418583, "uuid": "514d208d-d327-4604-8f26-b6979d9ac4a6", "value": "6144:673sLGqlcuvilp4xxtw79ytHoV8db995AGs:678LGqlc534G9yZoyd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683418583, "uuid": "db1cffa1-b0ee-43f2-bd8b-dd92f2581e4f", "value": 484352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683418583, "uuid": "b4202c0e-0f1f-4e29-88b1-3832d4d882ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418583, "uuid": "0af14e15-66c8-4e11-8614-7b1a55054b2e", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "001d1c2a-ece4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683469951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469951, "uuid": "e1cd9935-99cc-4404-b029-ad0f986ee03c", "comment": "Malware payload (AgentTesla)", "value": "aa058eb119a4173cc235beadd3355951", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469951, "uuid": "56913d8e-14ac-4c11-a727-6ee281e5dad3", "comment": "Malware payload (AgentTesla)", "value": "5c76a96da653327e6693cf7b0cd13af04dccdc8cab2692fdb707b293c197c2ee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469951, "uuid": "588e46f2-8f08-49a5-b1b7-c0b85e3f150c", "comment": "Malware payload (AgentTesla)", "value": "eda0e844972090d3e57596267389c1a59558d7a2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469951, "uuid": "dbd4b098-d1db-40f2-8a1c-2aa3848296b3", "comment": "Malware payload (AgentTesla)", "value": "e14ca5ca9a850fb03e6f887c7da2d44a80c341c4465341167a870590c369e4fed54b482dce02c7ec8073b8639b6434dd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683469951, "uuid": "cd8f7408-4429-4b1b-ad4e-dd6d6754bc7a", "value": "T122F4E1212779F7A1DCE283FC7208A5014F746C51A3B9F7E98CCAE0D8D599B06F6146A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683469951, "uuid": "e9622c95-5859-436c-a40e-6fee81746474", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683469951, "uuid": "d3e461ff-4b19-4998-8a38-9ce62dfd8508", "value": "12288:H51Qn0QNy/SJN1l4H2JKTS/KAO4x8PhBP3AE/d09VIGe1NQcQoOrDA45HYsxqpO8:Z00QNeKN1lvMwKyxwjPPF8+vMHFx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683469951, "uuid": "a5ddff79-39e8-4e15-9e9d-a58b84583eaf", "value": 779776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683469951, "uuid": "3251ceb3-a59a-4584-9e1b-d0f94e122829", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683469951, "uuid": "2616cddf-3642-437b-9ba5-93ef5dbdafe8", "value": "swift mesaji_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "679c7e4a-ecdb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (BlackMatter)", "timestamp": 1683466259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466259, "uuid": "b9689115-fa8c-4edb-8450-344d40d2e4ff", "comment": "Malware payload (BlackMatter)", "value": "c875d16445496fb76a4da962ae737e7b", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466259, "uuid": "be16ae43-1442-460c-a719-10ce40e668eb", "comment": "Malware payload (BlackMatter)", "value": "5cab91388fe5cef5f43f2f06baedc4d6a46c5085515c0c187f2381b0b969bc23", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466259, "uuid": "e4fd189f-844f-4e73-8e7f-df1157e3489e", "comment": "Malware payload (BlackMatter)", "value": "82c3e764fd25d0997bf380c9032b99925cb0ba05", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466259, "uuid": "60e7941d-9264-4000-87d6-97c2e1d8d746", "comment": "Malware payload (BlackMatter)", "value": "a7d197ace09d6d6a771beeceb93095f332c011c521a9eae25e6739d41f658b53a0599dfc4abe5d0f1c89508a15d4b9a3", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466259, "uuid": "5dd03ea5-7220-423a-a216-e3442e3aadb2", "value": "T11CE36E21F212D0B3C83718F53736B572B39E4D2C19A96947EAE80F9DBC648232F15997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466259, "uuid": "e86d7326-9bbb-4efc-b778-3f0dffc73fd5", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466259, "uuid": "81ab7c0d-b791-4858-9eac-33023140be21", "value": "3072:46glyuxE4GsUPnliByocWep1uWNBDXa1qp3f/C:46gDBGpvEByocWe3zeqFf/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683466259, "uuid": "b71ebebe-0299-409f-b6ba-b08c66770dc8", "value": 151040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683466259, "uuid": "03c87078-a5f2-4f3c-8602-85b5ec64b99b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466259, "uuid": "944f4103-598a-4341-aaf4-4813a331cfcf", "value": "2023-05-06_c875d16445496fb76a4da962ae737e7b_darkside", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80793284-ec6b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683418197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418197, "uuid": "f4f6cf07-3b39-4f42-864a-ec27f5deae5d", "comment": "Malware payload (RedLineStealer)", "value": "dd1f49e1aabb874863e7bbfe2bc6ad20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418197, "uuid": "92829f21-5119-40d4-a28a-221ed803a6f9", "comment": "Malware payload (RedLineStealer)", "value": "5d32e92dcd62c91524aa8a86ac85620bf9b6308b56c5c3e2a20599664fcd70ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418197, "uuid": "c6bbf080-29fd-41c3-861e-1e4a6fd334f9", "comment": "Malware payload (RedLineStealer)", "value": "b4a33bc16baec12a768eeb5455097db0b9e55547", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418197, "uuid": "d4a67275-85d7-434a-82c6-6798bba771a6", "comment": "Malware payload (RedLineStealer)", "value": "2fa23108e8f57f695cdfc9a274c01959732f3fc5f6acd1b176c1b77330097e17f56af3b87a1adec3739a86ae9dc2d2d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418197, "uuid": "4dba6ed5-3f43-435e-9376-186d973ff864", "value": "T109A40206A3E44033D9B517B06DF607C31A3ABCD29A78939F7355A89F5C726C1A43272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418197, "uuid": "b5ffdf88-9894-4b17-ac0a-3df09ac2d889", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418197, "uuid": "a8c13c8f-f4b8-4b1e-84bc-c034f85e6975", "value": "12288:nMrSy90AzvZ++IhDBmmKAQE/yjUsUhf8Uou2F:tyxZHeBxKlUJx8ZvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683418197, "uuid": "e3756d52-9159-4950-9aa4-2fe3d62b06e5", "value": 490496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683418197, "uuid": "07336937-81b9-4aa3-b656-0745e2298615", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418197, "uuid": "95c2db07-9d28-4cbf-b1f2-890480e588cc", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15f01643-ec86-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683429615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429615, "uuid": "817d3700-f643-47b4-9e46-0c1120cb4e76", "comment": "Malware payload", "value": "82ee5feaa14f97c24a7029d35b164957", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429615, "uuid": "d4ef81b2-956f-489a-a7a1-b51f2700afbf", "comment": "Malware payload", "value": "5d559cd1a70c970c85176a79fc10398a5e0a306e3637d14381afecd9ac45693c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429615, "uuid": "479bf36d-6273-48ff-b9c0-003d5cf0ac80", "comment": "Malware payload", "value": "252ecf68cc7a2b5349a56bbaa159aea7faf1e04f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429615, "uuid": "5176f6b3-f05e-4088-8234-6a83bbac8945", "comment": "Malware payload", "value": "ffd3617f63fffc200a8ddc0f15974f50074e534df3237b97852bdb80b100e52e6ebce280d407182bb7ed2426a9d21b35", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683429615, "uuid": "6ea0f5f6-0b43-404c-8449-b61e0291caca", "value": "T1A416CF403BD0ADBBD1EE6775912681FC4FBCD0866BD7A31B5604A56C0EDE3820E5E287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683429615, "uuid": "74d3d994-595c-4b50-aa0f-f22cd06a25e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683429615, "uuid": "36604a80-c86c-4a60-9517-c69a2e7a9505", "value": "98304:oXB4uluJRmMg6QWlIpgi0rHqsih/mCqJ4B4ulu3:ovsJR0TW6yiIKRhzqOs3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683429615, "uuid": "eadb5f34-6985-44ba-aab7-62a029f05eeb", "value": 4387873, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683429615, "uuid": "4a7f0b9d-35f5-4a74-954c-1f85b889676e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683429615, "uuid": "88c18e3c-b8d1-4d40-8fec-c9d5e7e9587b", "value": "VirusShare_82ee5feaa14f97c24a7029d35b164957", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49d46f28-ecd9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683465350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683465350, "uuid": "d69f3670-96b9-43de-8efd-61ae8b3d1efc", "comment": "Malware payload (Mirai)", "value": "2e5537a1c3f8977d75cc0297af55b5ee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683465350, "uuid": "656084f8-76e6-4540-a0c4-3322c2fbf1f3", "comment": "Malware payload (Mirai)", "value": "5e2e7f80c0af641bc6210995323da644b4ed0afb6d49ed597245553f5424a940", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683465350, "uuid": "f407a33a-c9b2-455d-9653-ceb194273061", "comment": "Malware payload (Mirai)", "value": "a41bdf705eef88c6f319d887caea2360fbce24e8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683465350, "uuid": "801eab02-8993-48ec-8092-43caa74f2793", "comment": "Malware payload (Mirai)", "value": "5b879044f89fc4516de8e7c0f8d542ccc2751db35d37e21cd4f842a0aa26dc08b154962d5384eaeec06fa836a4f1f564", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683465350, "uuid": "a5fafc5f-3a08-4611-be3f-6bb56acdc46b", "value": "T1C4B39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657969791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683465350, "uuid": "f3192d5c-21bd-4ab7-a29e-f68888f2d124", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1a/LWy:c9sSyzz36YaWWgg1aq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683465350, "uuid": "4a3883a2-085e-4ac6-bcf2-f899b3c3a908", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683465350, "uuid": "965fec7b-0cc9-4f29-8c18-4f93b08c5e65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683465350, "uuid": "15ca9749-d8b3-4a49-8381-f8c2a56db679", "value": "2e5537a1c3f8977d75cc0297af55b5ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a0fc1fc-ec6c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1683418536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418536, "uuid": "00f3c0fa-7013-4e55-858a-8efdc88c7a9c", "comment": "Malware payload (Vidar)", "value": "8f2c9f0afc36de964044399238b4855b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418536, "uuid": "b8664dd9-069c-4b0f-8b6b-1d4d91cb48d9", "comment": "Malware payload (Vidar)", "value": "5f48a3234ca717ba4aaaea477802147f5d1a5a3d423b1929af024ca7d30d234a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418536, "uuid": "62050778-bf94-4ae8-b1a7-2ea1fc6d0c5f", "comment": "Malware payload (Vidar)", "value": "e9593d9a131ad8645fde1074160d648323c97223", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418536, "uuid": "2336b584-7c93-4651-9306-e24c270d44f2", "comment": "Malware payload (Vidar)", "value": "0ae344f95c6ba06afd6c8c557b4d223f41d46c87747eb68333f9ce304e266e40112e6cd97c8d35928bcfad82b47ebb67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418536, "uuid": "f5c46aaa-04a8-476a-9374-87b230bef0f5", "value": "T134A4BE1372947871EA1A5B328E2EC6E46A2EF9418FD57FDB37146A2F0B701E1C572702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418536, "uuid": "823c74db-29fa-40f3-a000-92e9e0a0bf42", "value": "10ab34837ef60af1edc59a7f73704998", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418536, "uuid": "e1b6822e-6bee-43ff-89bc-16ac9b92530a", "value": "6144:jTYtlUIxup5oaxT+DWEWPuhC68et8lTGGZitd0EayvzAxGK9j:jTGlUIxI5TTRkhhtsA0Eayv8xp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683418536, "uuid": "38762366-71fb-4860-a111-7aa377a1b432", "value": 483840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683418536, "uuid": "be1c3c64-5c3e-4a85-aaf3-3335cf689f52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418536, "uuid": "acbc2e4d-a183-4f66-8c03-998093c09718", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e6146f0-eca7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683443937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443937, "uuid": "2261d9b5-68c3-4ddc-a279-89b1119d8973", "comment": "Malware payload (SnakeKeylogger)", "value": "623f0ebaec76d49523c21c0479ea7d69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443937, "uuid": "9a2d81a3-146d-44c2-8d88-e272961874cd", "comment": "Malware payload (SnakeKeylogger)", "value": "5fa4736f2cc0d0643d02cb400a7be79acf2a4c7085d34b7837ecdd3a1c34b058", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443937, "uuid": "a4b6dc68-8e61-4e76-85fd-7caaf4c57470", "comment": "Malware payload (SnakeKeylogger)", "value": "6b961a655f34d11f2bdcf2e5ab2b7f7d5598a9dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443937, "uuid": "4ed3decd-d97b-4be2-99f5-21263ca80bba", "comment": "Malware payload (SnakeKeylogger)", "value": "8643555ed5f13dec7174b2c6ab33278df1d4e91d66ad694bbf9fc5379b7f5459e5bfc69e279c952d6331cdae6e645f2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443937, "uuid": "2f99a9b1-3762-4d9a-94dd-7aaf2f64199c", "value": "T1CDF4D094AA65F351DCF683FCE20CA0019F752C44E37AEAA88DCAB1D8514671CF590BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443937, "uuid": "821416ff-edd3-4798-b266-74e75ba28593", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443937, "uuid": "9b268019-88b5-464f-9fb9-a8ec3f1a6596", "value": "12288:TNRYC4v3JDM8WoxoYRSVY5NN8xTDOsfldsYQwmLvIdzfiOPa:JRYhv3e8WozoV7Vq4mcdzfTP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683443937, "uuid": "06abbd18-4dce-4be3-bf71-9ee0d5ddcd38", "value": 727552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683443937, "uuid": "a7a08d1a-7c88-4e2a-84d6-5460b4e1291d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443937, "uuid": "ed7583bc-0b7e-4f9f-b25d-9f49447e1f57", "value": "MIGNAJbHqqz0hqw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2416e758-ec6c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1683418472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418472, "uuid": "f7244952-34ac-4395-8534-3959ab6efa4b", "comment": "Malware payload (Smoke Loader)", "value": "2371db41ba66dd8a6ad9410edb59c558", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418472, "uuid": "acce1bd6-5a7b-4c33-8957-035f441ea1a3", "comment": "Malware payload (Smoke Loader)", "value": "612bf9c63e3fd53009c140e9f6b19b0ccb7308d07f9ad3be1ddec4e9f8a05fa1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418472, "uuid": "71eb0a85-2280-432e-9177-eb084b3b067c", "comment": "Malware payload (Smoke Loader)", "value": "1ecc6699cf5fc000c243e7cc928447edb6534374", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418472, "uuid": "9df6d888-f343-4c26-807f-cc67c58d617e", "comment": "Malware payload (Smoke Loader)", "value": "e850dcc9d1de4c4193263dc26f9f3e267b347f7d6278030dfa43c58a31d4f7dfb63aa9ee1316904f75fd75ab4d9ccb45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418472, "uuid": "558d95d5-fb03-472f-956b-81ce293351d2", "value": "T1B824D0127AD4E4B2F84344359460EBF8662ABC628786CA97735C3FAF3D31391676E314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418472, "uuid": "b705ac23-d8bc-4ab1-95de-5305c8a560fc", "value": "557304204f793bd25ef0de03ca7f808e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418472, "uuid": "26e1a7d1-a188-458d-8952-0617f9e8592a", "value": "3072:VSoR5YBJYtFO393e0WqJDF/Jy3scMLJb3Lq7t567JHlTd:d5jo3lzWmDvssccz2m7JHlT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683418472, "uuid": "9e559523-1ed5-49d8-94a5-2216c94da659", "value": 228352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683418472, "uuid": "078df19c-5fe1-4d1f-87e5-1e201a8398e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418472, "uuid": "7ed9c480-8fc5-4371-8640-ffa943f2ba3b", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5a3aaf6-ece3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683469934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469934, "uuid": "dbae3dcb-e090-40eb-9741-45ec504e0c76", "comment": "Malware payload (Formbook)", "value": "d0d6b0943fc4d714dad8c74d391d4556", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469934, "uuid": "1da04d78-66d7-4765-bfbb-6c5a683b6082", "comment": "Malware payload (Formbook)", "value": "6308a0bf3a5090421ad47cdf89f0582dd49d2e84431145e31dd042b73cda2776", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469934, "uuid": "a8d257ba-9d54-4d12-a942-b6cb5ead3cd1", "comment": "Malware payload (Formbook)", "value": "903f0028695485a4523eb724fee66e8569d51fab", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469934, "uuid": "10e6dd9e-2873-4343-b5d7-59482c50d47b", "comment": "Malware payload (Formbook)", "value": "7a15d5d0593820cf19ad825d66b42ccfc930fbcb998a48a99d38f8e776e4d0e604aa661c11e7b9ae82e92bbb0dbf21d9", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683469934, "uuid": "a8cfa5ee-b3ed-47f1-a803-a0bbfa998016", "value": "T162E423DA3C9C8AF5F2484C505B964A98D0ABAC1C33C57886CE35FAE2DE44F4B538D964", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683469934, "uuid": "fe95e2cb-5d1e-4a52-a996-796549e0b1c8", "value": "12288:m9FqqMOQKkGMGhLVWfchw/EeIWnHlMSaAHK39rwUrqwmPGt8qE:6qq9Jkmx4fow8e3nHl3K39vqe7E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683469934, "uuid": "c18ad49f-3e52-43f6-a04d-98b81146ddc3", "value": 682958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683469934, "uuid": "6bfe1972-1f38-4bd9-b573-94490ac3d54d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683469934, "uuid": "316a0689-b27d-499d-baa2-d5f5ff6ed0d1", "value": "PO2235AE3.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98eb4f69-ed0a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mekotio)", "timestamp": 1683486528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683486528, "uuid": "dcd46993-fd8b-419c-b47e-291cfb9d9e75", "comment": "Malware payload (Mekotio)", "value": "bbcf025c863816a96009cc1845ceb462", "object_relation": "md5", "Tag": [ { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683486528, "uuid": "33eae001-d493-45c5-9820-c169690d0a5a", "comment": "Malware payload (Mekotio)", "value": "67c6b6b43e4af18433b854081a5d746300502b07429fb5d73ce493fac26a3a8e", "object_relation": "sha256", "Tag": [ { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683486528, "uuid": "4248cefb-9e48-458d-a076-11a4cea866b0", "comment": "Malware payload (Mekotio)", "value": "a31812200c84d8de438c3c10ca1648a73a747e08", "object_relation": "sha1", "Tag": [ { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683486528, "uuid": "ba007e1f-da44-431e-99bb-7d43f5280bb3", "comment": "Malware payload (Mekotio)", "value": "e2f0740b9a575ff81fa5a5f85ac13fa4ddaa408ae72c0fa1992198d2c1eee1c3eaaa9ba985a713fbaf72d2fdf6027631", "object_relation": "sha3-384", "Tag": [ { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683486528, "uuid": "c3536495-ef0b-4588-a236-afaf192df66f", "value": "T101C6331AF0E774399FFB73842D1BD0FEE21C5250A63D5E1330EA1AE96A2705607B3964", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683486528, "uuid": "ddebc6a1-2c7a-435b-af18-8c2d8332f31e", "value": "196608:yKkMxuoLk0yNMHLqMq7Xqm5IxNCcb7htnjKWiOQYJLgnKj8Ns/GIYoPCy:yKluEk08MHW7P4NCcb7nKWDJLXgW/tCy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683486528, "uuid": "058ef859-ea73-441d-a36f-6d0541daa6bf", "value": 12212988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683486528, "uuid": "561ee8c7-f597-47e8-8384-4324b132cc6d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683486528, "uuid": "47b4f3f5-3761-4f03-b83f-5eecc445a114", "value": "mekotio2.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9747966a-ecd1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683462044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683462044, "uuid": "81408a2c-5368-4551-a8f6-d004454bdb6a", "comment": "Malware payload (RedLineStealer)", "value": "ec8cb4aaa325db2210427d0834ac1a2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683462044, "uuid": "3628bba2-1bba-4785-8c17-c04f5f4a32df", "comment": "Malware payload (RedLineStealer)", "value": "687b530fd4a6874fcf33be479f5eb039d370abb81896f2a967a455f17790b6f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683462044, "uuid": "099403db-ca1e-4a18-a811-18b7c5390a19", "comment": "Malware payload (RedLineStealer)", "value": "8a8f4b794b3ac86d0d906a8283a55b851a72b75f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683462044, "uuid": "0674eda9-fdaa-47f7-929c-34ccbc241c37", "comment": "Malware payload (RedLineStealer)", "value": "23ddc82bc97645b0b21c8273e009427041b131064c36266b317befb7692c425b3ff24d56b0161004346f9ff24ff0857f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683462044, "uuid": "502bf6e9-4e74-47cf-8b63-121ea23b393b", "value": "T16CA41203ABE44571D9B69B7028FA03A70E35BCE26938425B3795991E1CB32D8713673F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683462044, "uuid": "761b64ea-f4f3-446d-b34c-ab44f30f919b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683462044, "uuid": "5839202c-a1bb-4314-9a14-e39d236967d3", "value": "6144:K5y+bnr+pp0yN90QETUm88mEofexpygITdTYrBTR7PCQwd2qY48ALmP5qaR:3MrVy90lhV6f4pHIQTtZwd048TqG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683462044, "uuid": "a01df408-3670-44b2-8685-5de331622722", "value": 492544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683462044, "uuid": "c64c6ee2-8cf9-42bc-ad8f-bcd26ef67666", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683462044, "uuid": "fdbe486f-b891-41f2-9276-7a536edc5823", "value": "ec8cb4aaa325db2210427d0834ac1a2c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d699835-eca7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683443935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443935, "uuid": "b6a09a28-d58d-4c3a-a3cb-fb4583049e68", "comment": "Malware payload (SnakeKeylogger)", "value": "ed256b31a574ce51dbe1b5cfced0131d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443935, "uuid": "b5780c2d-a157-4edd-bbb6-a81df8170b0b", "comment": "Malware payload (SnakeKeylogger)", "value": "6a9dff8a983ef561c7495f67f263ed6e056816be9b76b346f279609113ae4de9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443935, "uuid": "e1deda9b-c0c3-4d01-b968-c7207d74c806", "comment": "Malware payload (SnakeKeylogger)", "value": "4dad29be4d091899bb562f278a032c8ed9e5fc27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443935, "uuid": "e7b871c1-076f-4a30-af31-7c4de6494763", "comment": "Malware payload (SnakeKeylogger)", "value": "6203818bbb88d059e85c7942e48ae0c18f5d83b3d3e404d3f69a366aff96042122a7220e6aff7bc5c43831bdb7790c9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443935, "uuid": "2d9eefbb-bac4-4478-8863-ffe2ca2b787a", "value": "T1CBE4D054223AF792DCF683FC7604A4019FB56C54E3BAE7A88DCAF0D85575704EA10BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443935, "uuid": "dc10f078-a5f5-4ba1-859e-eaa3749bba50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443935, "uuid": "6b6eeb68-8758-4d23-8463-cd1cb6a4bf37", "value": "12288:Xt3BqVVHImAd0p7TnJhnGoPg6nmAamaqYagPlB65xGUeG:vqbjAd8urAaeU0mG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683443935, "uuid": "0ca1325a-7aa8-4eee-a2fd-06c84be320cd", "value": 710144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683443935, "uuid": "2d4e9ebe-9145-4771-bcc6-272b5b451bf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443935, "uuid": "ede98ed2-f7da-4f3f-bd4b-8d20cd895b65", "value": "PO NICEHPH225.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c017805-ec6b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683418163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418163, "uuid": "69165561-22d4-4c42-a6c9-49af272fe67d", "comment": "Malware payload (RedLineStealer)", "value": "327159ee4ff1d6b32006371ccd7be00e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418163, "uuid": "29f4cafd-366d-4a78-a86e-7f3c2976032f", "comment": "Malware payload (RedLineStealer)", "value": "6cd1ad365accfd8b32628c1223c49997eca41dcd25a63fc8a0600dcc980d0722", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418163, "uuid": "3cd76592-999e-4567-895e-b3b793b49847", "comment": "Malware payload (RedLineStealer)", "value": "1611789826996158fb59e58964096113742cc619", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418163, "uuid": "b03ac745-2541-4331-8e86-60f988196df5", "comment": "Malware payload (RedLineStealer)", "value": "efd455dbf6b6120bcb9186bb0165bb2455a464bb5c3fdf5ec61243bb125c35d276d3fd62d8861897b9516561c3505415", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418163, "uuid": "0d46a8b3-7b31-495b-abf1-c160dff85d1e", "value": "T19EA40202B3D850B3D9B627704CF607D71E37BCA15C7893AB3745A59E1DB2680A93632B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418163, "uuid": "436c9709-8043-4181-aca9-7f0266879701", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418163, "uuid": "97a44c44-cdc4-45f4-8bb2-589db3b19b28", "value": "12288:pMrQy90MCvyuRPy1tTroGt/fRXmth8b0akAecL/DDZG0:xyNdu2tPoAxYub3ScPD1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683418163, "uuid": "22fda85e-30c3-480b-8a48-13aa7638c9ce", "value": 489984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683418163, "uuid": "92ddb10e-a9fe-4fb9-90ca-c0bfe8dc3c6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418163, "uuid": "e856ba18-418e-4835-943b-2bbcb0a3d017", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f84e458-ec6b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683418088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418088, "uuid": "afb8de1f-f728-4fa5-a53a-6eb1ed08081b", "comment": "Malware payload (RedLineStealer)", "value": "b34ef9f18b521dcda81f255bdc3b7acc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418088, "uuid": "0b65349e-78aa-4158-a3b1-c6bd40eab2ce", "comment": "Malware payload (RedLineStealer)", "value": "6dade75a4f43a5692c85263f08051b595f821fbf844eb71fc0efeb065526036d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418088, "uuid": "93feb356-8c82-41b7-a3c5-734158a61e13", "comment": "Malware payload (RedLineStealer)", "value": "4e42b8841ad1e6c5d5ddc1bf6346b231f3afc480", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418088, "uuid": "8d844e40-98fd-4ace-932c-9ab85a146876", "comment": "Malware payload (RedLineStealer)", "value": "97e559309d73cd85368292bf8a12c059aba5d3634678e8b9744453762585d5c3f16f245da843e08246d52c79c3b094f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418088, "uuid": "84116c6b-1d27-42db-9b44-2508e6c4838b", "value": "T1F3A40202B7D89573CCF51B7028F603830A3ABDA15938966B2351B96E1DB37D0693273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418088, "uuid": "e8cb0473-d5ce-4ca1-aa9b-2ec768741a88", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418088, "uuid": "73e5be07-c69b-4a38-8ad3-303107d61dc1", "value": "6144:Kdy+bnr+ip0yN90QE/s5uqWwjTWQbxmAskarO3qQDCCx0z1ZMkkPw/QfuZuU8FEq:/Mray90UewjiQlLaCHz0z16TxEmTN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683418088, "uuid": "1c6f55a1-6993-4fc7-af25-182de4973955", "value": 491008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683418088, "uuid": "f316ed77-13f2-4ebf-b85a-b691ae9b5960", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418088, "uuid": "73019fa1-0885-4df9-ba54-87fe6c2dd2ce", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38a531d0-eca7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1683443847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443847, "uuid": "a77f1928-6ccf-4169-9497-8f7297067e9b", "comment": "Malware payload (Vidar)", "value": "42404c1b1bb4a61648984542ab9ba2c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443847, "uuid": "d6b5cdca-ed01-44e2-b458-0b99470d0d54", "comment": "Malware payload (Vidar)", "value": "6ed10ccc014106f1ab80bf018eea27a3858c9ac7198b11fbe3a3d622146f4928", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443847, "uuid": "04ddc78b-5270-43f8-b046-8add69fd45f0", "comment": "Malware payload (Vidar)", "value": "01afdef860a44d2e20b2aaa88c1b600bf92adcee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443847, "uuid": "1fa21278-2085-401b-ac4e-706b6ab2ade7", "comment": "Malware payload (Vidar)", "value": "d38e4452c45010d1ff5336ca27f680f3832cecd1a3560618a23f075c9f915267499f304555eea3cfce7f36707d348b83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443847, "uuid": "d7e3a04a-410f-4f79-98a9-79ac6bf9fc38", "value": "T1E694BF137790B971E6274A318E2EC6F47A2EFCA18F5566DB1748AE1F09702F1C672312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443847, "uuid": "e2397c63-6554-4126-b18f-3085567c5749", "value": "7781d7f71fc1006ff6cb3831417c4bb2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443847, "uuid": "a6dd8b18-838d-4082-a63a-ace2385996d7", "value": "12288:ajKHij00PkgrNeH77a575GA8hLzuwFg6cK:A9j0/gr0k7gbhuW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683443847, "uuid": "9b32df83-6eaf-45f0-a1d7-1aaf2bd78f57", "value": 414208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683443847, "uuid": "f4ebc585-ef50-49d2-91ba-f3e674a312ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443847, "uuid": "92a1634c-a43d-4dc9-8e86-aa2100745ea7", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d906f07-ecaa-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683445224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683445224, "uuid": "72510f3d-24d9-4b3e-9188-afe8f4cdc828", "comment": "Malware payload (RedLineStealer)", "value": "3a0db5a823618cd4f6d0e3259c71079f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683445224, "uuid": "31e21287-f0df-4542-9b4f-63c797c58210", "comment": "Malware payload (RedLineStealer)", "value": "70c5ebc6d4f9aa1301b13f2317f263c296704ac4de4aff59e341a6ac73a496ed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683445224, "uuid": "b113d5b5-24a7-403c-b1a8-2bca5b92bb97", "comment": "Malware payload (RedLineStealer)", "value": "9f8bc57c6ad0e414d3c2a86200b2dcd5fbb85481", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683445224, "uuid": "17276c92-ca8f-4025-965d-137fc4ad6c3b", "comment": "Malware payload (RedLineStealer)", "value": "81bb2343165078dd70450a9c164481fc1fcfb78904750c3d6ad5e8124128509bcd0afc5a98b50950da3352db4ecb4a62", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683445224, "uuid": "a349a5b8-4f55-4769-ad87-2331800e6729", "value": "T125A40122F6D44463DCB4077008FB06970A327DA05E7883AB37697C9A1D73A94A87677F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683445224, "uuid": "bb95da6f-cac8-484f-b476-a6798d93d85d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683445224, "uuid": "11637194-eee8-4549-96ab-950d75803020", "value": "6144:Kmy+bnr+fp0yN90QEfQplGE58a9EuB5CZ+7lN6z6R1dhrqFfs+QKRAX2Nult6hk:CMrfy90VQbBOnGCZ+7TU6RNqfBk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683445224, "uuid": "0797a6e9-09a8-4fe7-82a1-020f59c4d312", "value": 490496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683445224, "uuid": "a15d810c-012c-4159-84e2-ce236eb18b79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683445224, "uuid": "f6ae244e-bff4-4f1e-a925-bfd88e96138c", "value": "3a0db5a823618cd4f6d0e3259c71079f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d8b5e37-ec86-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Kovter)", "timestamp": 1683429628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429628, "uuid": "835d7442-81b8-41c6-932d-6937f52eaf93", "comment": "Malware payload (Kovter)", "value": "c47a3df9ca691a68a65a5c86a8eef55e", "object_relation": "md5", "Tag": [ { "name": "Kovter", "colour": "#C8F4B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429628, "uuid": "7f4df1a8-0099-4f4f-9094-23310da78a3c", "comment": "Malware payload (Kovter)", "value": "70ca16e43bae633dadf54ea6f8b0797eac6d443c590dd09d7f49f98288ab385f", "object_relation": "sha256", "Tag": [ { "name": "Kovter", "colour": "#C8F4B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429628, "uuid": "e52cb606-d163-4504-82a2-0da5e9519aca", "comment": "Malware payload (Kovter)", "value": "b6472d1c70792f5578b1c7455814d26d8906ce3b", "object_relation": "sha1", "Tag": [ { "name": "Kovter", "colour": "#C8F4B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429628, "uuid": "9a9f8192-9742-4277-acb3-6e338c2a451e", "comment": "Malware payload (Kovter)", "value": "29a8d3e757d8880116095f084d5bf16524460a4093ef9d431065b3751890d3ebf817fea1c0b7d6debd869ea1038030f1", "object_relation": "sha3-384", "Tag": [ { "name": "Kovter", "colour": "#C8F4B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683429628, "uuid": "9f079483-5f04-48ec-9e6e-eccd77108553", "value": "T16A844939FA80D537D42118BCCE0FD2E5A569F2342D381957B6E45F4C48F9683AE2BA43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683429628, "uuid": "02dfbac7-6db6-4c15-9f49-af817ece82e7", "value": "c62ca0115b2faa73006dca641101cfb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683429628, "uuid": "46cd2076-283f-4034-9d85-4e860040303e", "value": "6144:ZE9yDzN5oqKVsJAC328uO6s1wQW877buWxjy/qj+aA/Fh:uEDJ5ofs9BuOB1wQW87XuWxMF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683429628, "uuid": "0b7760fb-3874-459b-ab22-e5575fede418", "value": 397312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683429628, "uuid": "a4a8ae16-3425-4f3e-8413-0f50ff3d17c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683429628, "uuid": "3df77f22-8536-4298-bdc3-c419fb8eb29f", "value": "VirusShare_c47a3df9ca691a68a65a5c86a8eef55e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "654b945b-ecdb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Cerber)", "timestamp": 1683466255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466255, "uuid": "05d99faf-fb24-476f-aa9b-3e6d4353fddd", "comment": "Malware payload (Cerber)", "value": "6a4025d67f9b2c8d8d44173eee98ece3", "object_relation": "md5", "Tag": [ { "name": "Cerber", "colour": "#6E6D4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466255, "uuid": "a377502a-cae0-4164-9ad7-4ad4c13a437e", "comment": "Malware payload (Cerber)", "value": "70d6105900816937f3c74dce0c044f03ac72df99485cc9f76bf4e0a47bc3e0da", "object_relation": "sha256", "Tag": [ { "name": "Cerber", "colour": "#6E6D4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466255, "uuid": "75e8f3cb-ed2f-48e1-89ec-2459d44b4941", "comment": "Malware payload (Cerber)", "value": "68003c3ce83b61e375aeb733c1a2fa026c9097e7", "object_relation": "sha1", "Tag": [ { "name": "Cerber", "colour": "#6E6D4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466255, "uuid": "3ccce3bf-0c61-485b-bab8-8ed15fde7f38", "comment": "Malware payload (Cerber)", "value": "c0194dc3d6add5181c1c589c4b7515b4deb3c6b477bfb4324d9b516434173504fe81bdc10f966ff964695be85b07b44b", "object_relation": "sha3-384", "Tag": [ { "name": "Cerber", "colour": "#6E6D4E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466255, "uuid": "346c2272-a3c6-4c37-b4ad-1f2c3d5bdd62", "value": "T164D3BF53BAE16033D5E65DB193759DB2C7BBFC351D36801B936846090FB0A82E93B287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466255, "uuid": "e657f6ed-83b0-4b23-9d84-c89bfa04bc28", "value": "ae80b4ecb14ba8e602aaba0e2180c87d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466255, "uuid": "69952236-ebe9-475c-a710-e9c8d478711f", "value": "3072:z+PkbTWYtBzNgnbRh6JuB/fdDkjjdqxEIe3D91+UB77:6s2cBCbRdB/fdDkjXIGRx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683466255, "uuid": "25b7beb3-a0a9-414f-8caf-68c8ec5c709c", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683466255, "uuid": "c78ef5be-0704-444b-ac00-b89933891925", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466255, "uuid": "07b1f8e8-4bf5-4761-be35-10456886789d", "value": "2023-05-06_6a4025d67f9b2c8d8d44173eee98ece3_cerber", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87e1e5d8-ec85-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683429377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429377, "uuid": "165efac5-bfca-4f3f-ba2d-073a9eba87f5", "comment": "Malware payload", "value": "dc159d07b8cdde55acebc57c1ca08e45", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429377, "uuid": "b8155718-6623-490c-9878-9d4be3b25c14", "comment": "Malware payload", "value": "70f051b880fe4c1ba666269ebc42be586904c8147d42355dc33fd0ad82b0a03f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429377, "uuid": "124a1888-2671-473c-8991-7b7f01922009", "comment": "Malware payload", "value": "2a6ed587472c53abf366e37fbf285ee86144870e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429377, "uuid": "91950efe-6935-45a1-8cfc-f7d846a0b8fe", "comment": "Malware payload", "value": "672bd4ebaf3f59fa236b57b825ca3873c78cab93ff29a124b3a44a6b2d92be4f2872a6ed1e65e873d9224b62466a8e47", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683429377, "uuid": "7636f903-ee25-4ecb-85de-a04c752d1b62", "value": "T101C50B16B14A957AC05B09374C2BDD94F83A76733B41CC577BEC079CCEBDA40AA2A50B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683429377, "uuid": "5ac589a5-d4fd-4d38-9ca9-fd0ca5e25563", "value": "7a407a2f1a899d49895c3da4ca25ebdd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683429377, "uuid": "d8e9df94-0a0a-4a92-a699-46aca8c63b0d", "value": "24576:TKgCA7Bl3nbpmdT2neHo4Y/fqfbePDDxYqJBUSbz9DuPyQjkbsGMV9Tq:O5A7BJbH7JTxXJeSbz9xQjXLVl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683429377, "uuid": "bdd8fe6f-54a5-47dc-b535-b2751b415279", "value": 2517504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683429377, "uuid": "8e953fa4-8a12-4658-8079-23fae14f7a36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683429377, "uuid": "0bbca4e5-c4e9-447b-b4cd-7da51ae6b431", "value": "dc159d07b8cdde55acebc57c1ca08e45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "786011cd-ecb8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1683451255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683451255, "uuid": "f8f5aafc-7025-4b05-96a8-606fa3bb30b0", "comment": "Malware payload (DCRat)", "value": "e5cec062d30d897e1cbb9d50e0fba58e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683451255, "uuid": "0e5f0f47-8b3f-4aca-9d25-7ef8d6f23dbd", "comment": "Malware payload (DCRat)", "value": "7164d2b799de1627a495db2ce15b26738705a2d1ad69b93ecec931ef509bae99", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683451255, "uuid": "e88b72a7-befe-4681-8a28-d1c0794b1d80", "comment": "Malware payload (DCRat)", "value": "a74238623081b5588ef051b93f0adada2dfcf2e1", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683451255, "uuid": "90d82ff4-64fc-44f2-bf19-89a59ae7ad52", "comment": "Malware payload (DCRat)", "value": "2c70eb1c22673de381b111b86ce163c6e87353921128e5663d0bf205e467f186574a5181250c290f0c2835daec6decd8", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683451255, "uuid": "6a44fd29-90f1-4bbe-baf5-ef6274804efa", "value": "T149557B017E848E12F01C1633C2EF590847B4A9516AE6E35B7DBA376D59123A73E2C9CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683451255, "uuid": "b8375096-edec-411b-b0a1-990ceda802ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683451255, "uuid": "4a9f68db-36c5-4bc9-a5f8-d3b757f9d349", "value": "24576:TO/5EbDzq0wkeFPEkgy5DuVfAX3DiOtenoBYThFYuw:TI5Eb/qakjn+OtenXP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683451255, "uuid": "2ebb4219-6c8b-4bcf-ac61-9f925468d9fa", "value": 1378304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683451255, "uuid": "e17f8dbb-bb8c-49f5-93ee-cd7cf2af7b68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683451255, "uuid": "5ee3411f-1aa5-4c69-a7e6-0e35a4b6b5de", "value": "7164D2B799DE1627A495DB2CE15B26738705A2D1AD69B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e332c902-ecda-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683466037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466037, "uuid": "748742c7-2876-4166-9d4b-0f5928aa67ea", "comment": "Malware payload (AgentTesla)", "value": "3217930a87bf8b38ba8d474862548853", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466037, "uuid": "e4ead3b4-f7a1-49e1-a1db-81636c3fa5c2", "comment": "Malware payload (AgentTesla)", "value": "7170058dac6c9006c7fd6273b4a824277cbac873f61c117b22279ce0cd425b62", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466037, "uuid": "bb729e35-c58f-4bf4-be6a-de4955d7fda5", "comment": "Malware payload (AgentTesla)", "value": "3ffc1d60ad13db9a291f03b0f8ff35c0281e7d5d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466037, "uuid": "16e24f03-78aa-4372-a7ce-d15e6ca64438", "comment": "Malware payload (AgentTesla)", "value": "f64243ea06dffe721115633a1f0b8b9665da8e87af4fc16973e487755c3efe47b1b2e40cb1c663729bec9182d0b903ff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466037, "uuid": "9706f30f-b16b-446d-a942-4772d8193a7d", "value": "T19B257BAD3211B6EECD57CE75DA982C24EE202C76531BE643900715ECDA0DA9BEF141E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466037, "uuid": "fa85fc0b-9131-4a86-88dc-951ce5b6d598", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466037, "uuid": "707c2a0e-2323-4be6-853f-56fc8fa057c6", "value": "24576:R7Q12srPK7afcfX/9e4+l2gNG82VDkB0+9ud:R+Iafcle4U2gNGnYB0z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683466037, "uuid": "4098d2c5-488e-4f45-ad8e-b052a10e12ff", "value": 985088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683466037, "uuid": "89a717d1-1fe4-498a-a0c7-6f9755c45fd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466037, "uuid": "31283e32-0618-4de9-b160-3dcf7ff1ea31", "value": "SecuriteInfo.com.Win32.PWSX-gen.8927.17433", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe04f7ff-ecbf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683454486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683454486, "uuid": "fd74a1d9-b275-4d4e-9221-ba94c9accb60", "comment": "Malware payload (Mirai)", "value": "b97bad82a026e34f3ad136af64dbac19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683454486, "uuid": "7800b100-f398-4142-b120-0917d570c677", "comment": "Malware payload (Mirai)", "value": "71e33db6119899d5f54b11f22bae9355559e073ede780c41e46c15dba607607f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683454486, "uuid": "cc38a16f-f118-4d05-9a3f-61dd6e1e4ae8", "comment": "Malware payload (Mirai)", "value": "0fe3fff5671d5f7c78051e5c1a4feacb21fec16e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683454486, "uuid": "9d8098c5-5de6-4616-8cc4-c5481175f277", "comment": "Malware payload (Mirai)", "value": "f9fb78822e3d2803d8a2ed086766b6a672321eae58c9bf6410999f5fc019b7206f307b8d9da8853070064afd87aebb88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683454486, "uuid": "36cae0ae-9746-493b-a79e-5266043a68fd", "value": "T104C2E06360B5CE03C8F3837B6A3D59B622605435A35EED2E73A94BC933460D4657ACCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683454486, "uuid": "33ab6461-baef-4aae-835e-bf8883a4e5a2", "value": "768:u5+Kcrb9VDJee2KTgdTHOBcK5ZCAy71iC:hlrb9veKTg9QB5V8L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683454486, "uuid": "4801914a-2611-4d98-970a-5ff45bdf1add", "value": 27712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683454486, "uuid": "c0421522-f7fc-46b0-a041-d7e586255fd6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683454486, "uuid": "6c453676-3ab4-4d1d-a078-5e8827066840", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "112cad2c-ecc6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683457095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683457095, "uuid": "593faacf-1cd9-4021-9653-d33bfb579ff8", "comment": "Malware payload (Mirai)", "value": "601048881e4d88b7eb40eeef56cfb1b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683457095, "uuid": "ff732dbb-481c-4b33-b8f1-9155a84e7e4f", "comment": "Malware payload (Mirai)", "value": "723fd9c74d2c5f1f08a21a4f58fb1e09808f1032f9c91387f5d78d6a86b066e0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683457095, "uuid": "205c89aa-4c7c-4cab-b005-713f62e36094", "comment": "Malware payload (Mirai)", "value": "f1efa6b4a853c796942715962e0259666f669ba8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683457095, "uuid": "0db58732-c90b-4e9f-b572-272c41a0ad9b", "comment": "Malware payload (Mirai)", "value": "b5d4eb4156ffcf112f65f02428ea9d8b1651f4d61658299153871cfac6f20bf8b8876c388551415ceb4e8c49bf2384ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683457095, "uuid": "30ae6ddb-4642-48d9-8747-ca832af2c5b9", "value": "T122C2D070F8C07DB6DEFEED78881185D03BF61E4937E1CDDA104DDE255212D329AA8A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683457095, "uuid": "eae6fff7-32a0-4072-9107-a33647e800f6", "value": "768:uKnqLiChP7gI5gBZw+LajRO4uVcqgw099:uKqL1h4Zwa6s4u+qgw099", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683457095, "uuid": "10a178c8-b0b9-4291-95a6-9a8eb2eb304f", "value": 26224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683457095, "uuid": "0c3ea54b-143d-4f59-84a7-ba1113455afa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683457095, "uuid": "28aff4a3-0328-42d4-b595-d1360ce427bd", "value": "601048881e4d88b7eb40eeef56cfb1b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "068b32d5-eccc-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683459654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683459654, "uuid": "ee999f29-a78a-4cfa-83fb-e178b6ff2ec4", "comment": "Malware payload", "value": "3710f978bcb349096edd198a42fc20d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683459654, "uuid": "4f81bfe2-c69c-4f3c-87ca-181a189e9a93", "comment": "Malware payload", "value": "727e828f06f5a97e7126130a87bff441f3a0efecd55deaaf565f6096d4efbba7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683459654, "uuid": "d93d7dc9-e5e4-42f7-9c2d-d92235e07101", "comment": "Malware payload", "value": "b8e388c18ca462e8cbb9ab6f90ea88b599ded20f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683459654, "uuid": "2a555d38-4453-407d-98f2-8181267b32e9", "comment": "Malware payload", "value": "bed1d0f0fbee265b5533a516ee6800e62d462a4ec9a0543bb6ac5a5efedd23d0803b308ebb05cb651fd33b26931583d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683459654, "uuid": "07bbee89-607c-46e2-8e9f-4e3df2010a67", "value": "T166A3912E6D930017E3554970C6E54EC25FFE1D1B3AE370BFCF00198919E259A68A5EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683459654, "uuid": "bd90f6cb-aaca-483c-8140-de07f7f0ed2c", "value": "4f5c6eb2e577003d67473ac2d4ca3f25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683459654, "uuid": "e2c57bf4-dda2-4b3d-a66c-6850defae184", "value": "384:2motnkKd0TlQCxfrwntajXjDWLi9k+7y/Q1nDcZFPIRaKmFnW1MEPnUYDEe/qQ:cnkpTBPJn7qcnDcUm4MEfUC7/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683459654, "uuid": "9a595674-a1fa-47be-97dd-558035658101", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683459654, "uuid": "8f89f1e1-0c16-4666-a719-f15b0e6d7d62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683459654, "uuid": "9108eea7-087a-4010-bd25-c636a3094de5", "value": "SecuriteInfo.com.Win32.Ramnit.Dam.17513.15042", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc0701ff-ecfc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (NanoCore)", "timestamp": 1683480628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683480628, "uuid": "a8fed39c-379e-440d-8a97-9570d0825fd1", "comment": "Malware payload (NanoCore)", "value": "04ce200d593f0d689d387bdcc800ee74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683480628, "uuid": "c7c06b6d-5ffb-4c1b-941b-5486138f74ff", "comment": "Malware payload (NanoCore)", "value": "74e1b871131e31459ad0aab5b7dd6f65923bf7efe4121b933276744a1e13f304", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683480628, "uuid": "770bf29e-cc54-4d2b-8fa8-e8672a09a5cf", "comment": "Malware payload (NanoCore)", "value": "c0b2478615ca850b40994088298bc86473cf2971", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683480628, "uuid": "618c1080-7c3b-49f5-bd74-d093a59aa2d5", "comment": "Malware payload (NanoCore)", "value": "5af6fbe92fef3bb0ed0530006174370d318dda766527b457635ae8d16c78d13ade39720beab7fa01dcb19116e97b23e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683480628, "uuid": "b5485896-641a-4806-af54-4a63a578b6f4", "value": "T1A8E4AE62F135CADFEE717764C14DE396BE60D412E050F1A17E0A24C8DAA57E21F8C1BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683480628, "uuid": "960ce911-373f-4b26-b1be-6e14ae4706a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683480628, "uuid": "7dae382c-80c6-4bcc-ba6f-0458bb5d92ee", "value": "12288:zJaS9/HdzhzsLm90OBpNdyJWu1SSnCXML6Lbnzr5iuI:dvZhzjdDN1S6PzrMx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683480628, "uuid": "1e6e6b4f-c613-42f5-9c95-a09eb5ad8b2b", "value": 685568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683480628, "uuid": "a5e5e676-f7f5-40f4-8cab-b62c8f524618", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683480628, "uuid": "fca482e7-cf1a-4021-bf92-2be301b1d69e", "value": "04ce200d593f0d689d387bdcc800ee74.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8e2df93-ece3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683469939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469939, "uuid": "688f067b-9305-45de-8db8-07e5706d5542", "comment": "Malware payload (AgentTesla)", "value": "d5a3e7a9a183bab58601ac56db594680", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469939, "uuid": "c9041f74-dfa1-48e8-a972-b6b2c9da59a8", "comment": "Malware payload (AgentTesla)", "value": "75fa9a5db7782cc413bc804d188f2cb084f5baaffedb9d3ea26948da21fbaa92", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469939, "uuid": "245280da-0445-4a41-859e-74aa63e5af4a", "comment": "Malware payload (AgentTesla)", "value": "e23604614fdc50ff325d8089fedf42a79b116049", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469939, "uuid": "9264f551-85ff-4f97-a1b7-e7aee76b1b35", "comment": "Malware payload (AgentTesla)", "value": "00debaf98c8ac7218d8f4a1e149341a387c7ba856bc62f165e7a3eb1721aeaaf719644dc3dca59e17d00ad7006b08344", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683469939, "uuid": "9727a503-69a1-4b1f-98c0-a9ca074be086", "value": "T142A423DF1A14FBD01416DE5E17C51B21E08F9D5BE3AEC2C92608261D40BD3F12EBAE56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683469939, "uuid": "b99ea3fa-cd52-42ae-add1-4737fdf73872", "value": "6144:VCgkvzpOBcTHAW0W91w3aVhcqLKDfu4z1ykyXqML/g8mvFSypQk1AUHYMHYl/Biv:AN4crdnwAhcqWSumHLgkeQ6TYnl/U/0Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683469939, "uuid": "0691343a-6cdc-48b1-92f3-b0766726648e", "value": 490555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683469939, "uuid": "9a9fc8d7-bdbd-4d94-ae1f-b8c3582c2b4a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683469939, "uuid": "8ef82a99-c466-452e-b56e-e7bdb03dc47f", "value": "QUOTATION.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4b90b0d-ece3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683469932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469932, "uuid": "39f19491-f91a-421b-9a2e-9f1a25bc8979", "comment": "Malware payload (Formbook)", "value": "d545cdef214d98a80e5ef01ac3367049", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469932, "uuid": "d645f7a8-22eb-4afb-a898-7595ae8c3309", "comment": "Malware payload (Formbook)", "value": "77133e6383dadf832cbb0e1add33a1aa440b7f280a69d65038323049d1a76bf4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469932, "uuid": "d311e237-1d11-46c8-8403-b776bc4148a7", "comment": "Malware payload (Formbook)", "value": "1c2571c105ff2fd47d1599d55c67f360c9f12ae3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469932, "uuid": "04dc70c6-ba95-42ee-b6c2-a136e5688504", "comment": "Malware payload (Formbook)", "value": "b556e2da61cdf8ed0c5d721b54711237d87c044ab7e11c32f7efd522c7823e0448cde65bfe4e0316793ac27a1b7478be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683469932, "uuid": "6beabdd3-428c-44ee-a3aa-29698a6f278f", "value": "T12105F12533B9B791ECF683F86608E4016FB46D6057B6D6E84DCAE0CD9194F18B700BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683469932, "uuid": "d81ec6de-ea64-48c7-8eb8-b4cf1e5b651c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683469932, "uuid": "5fe447cb-e08e-4c60-88be-8d341682d674", "value": "12288:Zs11KporyhvjBclcOzG8NqjN9HCyMpeiAPKH5r3laoayGqJEmK:yPKpoGhv6eOzRNmHCy1VyH5DlbG7m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683469932, "uuid": "0fd3f4d4-7818-491b-91bb-4d6b3d11f577", "value": 815616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683469932, "uuid": "657d0b84-b046-4b1e-947b-ee05f61abc0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683469932, "uuid": "6ca1fb70-80a4-466a-b437-de5527151981", "value": "PO2235AE3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "691845d0-ecba-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683452088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452088, "uuid": "4988d53e-892f-44aa-abdf-3d8d8648b7be", "comment": "Malware payload (Amadey)", "value": "de5cb59ff519da2f1bb531d0ee62d519", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452088, "uuid": "4de2367c-8f0c-41a5-ae11-8823f3cf9fdb", "comment": "Malware payload (Amadey)", "value": "77348361e60bd2f12aeb1d0928a38b8745de7e93069cfc7a9361a11f1c87d62a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452088, "uuid": "be90d567-b929-48a7-bdb5-f6ae3a477528", "comment": "Malware payload (Amadey)", "value": "4f781e6f0b96a752d88ef52ee7785aec9e4a9bb4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452088, "uuid": "b1c5715b-bdcb-4db6-994c-df7b7570bf2d", "comment": "Malware payload (Amadey)", "value": "6ade106fccae22eac05b0cc533c64e9a82f63b4569f0f0a3aa1d09116342df4103d3060c7cfcd32dd31b1c3ae81dac0d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683452088, "uuid": "40e1ae31-f726-4ed0-bbc4-2afa0cbfdab9", "value": "T139741A1392E13D54FB268B729F2FC6E8765EF2608F59377522299A1F04B01B2C273725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683452088, "uuid": "08fd8ef1-391b-4f0e-8b56-6343eb02bf47", "value": "07392231fce6d1215d12aefe3ca2bec9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683452088, "uuid": "23a10002-c64d-4be5-8852-8b173a5bab5d", "value": "6144:UW3VLg8VfqmPrdo32k95H858AA5VxQsJj+B/:UaBV7Prdod99Q8As/M/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683452088, "uuid": "749cf9f2-385a-4abf-930b-febeda3cf43d", "value": 345600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683452088, "uuid": "20c881f9-c581-432a-bb58-30138c846391", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683452088, "uuid": "b226a27c-04ef-4c67-9476-506066aca793", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02dbd0ae-ecdb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683466090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466090, "uuid": "48479961-b7f5-4bc7-8348-9eec15b733b6", "comment": "Malware payload (Mirai)", "value": "a4aa2b99a6c6164eb2a4243d5cf7bc66", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466090, "uuid": "eb3d352d-3177-417c-8536-135698bfe84d", "comment": "Malware payload (Mirai)", "value": "77f618107e6364776482dd55ead0bf54b29de558acf924acc02454462971bf2f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466090, "uuid": "51a6032e-296a-480f-ba98-424bfeee8d35", "comment": "Malware payload (Mirai)", "value": "088c30cb78ae989d232dc70082a25df8661451a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466090, "uuid": "20185719-4bed-47d3-be77-d0188ea9a920", "comment": "Malware payload (Mirai)", "value": "b5c90f8aca5590bb0d413d199d325b5069de12a05953179f514a0be5a8335dcf861c12b5064dab050d1149162025e5b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466090, "uuid": "4fe31531-0cf1-461d-9163-8a9e58510376", "value": "T107530856F8818E11C5D412BAFE2E118D331757A8E3DF7212DD206F247B8A86F0E7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466090, "uuid": "1e45c1c0-ed84-4872-b090-abc7fe3b4eb0", "value": "1536:Isn3I1ywIMwShSdj7gI5OTz/Icsi0mM/1z3:gMwISgj7gIPmM/1z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683466090, "uuid": "33b971cd-2e79-4ab6-9eb3-e0c6e198ce6d", "value": 62996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683466090, "uuid": "37e6e7b8-ad8b-40a3-b171-d08aac8043b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466090, "uuid": "9e96f77d-b4a0-4095-b1c2-e94d8f0caff4", "value": "a4aa2b99a6c6164eb2a4243d5cf7bc66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1fde0e5-ece3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683469928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469928, "uuid": "edda07d6-4141-43c9-bbcc-73b8bd31d7b1", "comment": "Malware payload (AgentTesla)", "value": "1350d609ee9ecf827251991d49641d42", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469928, "uuid": "c5051621-d7fb-4301-a817-e5b87e21bcf0", "comment": "Malware payload (AgentTesla)", "value": "7855024845204a63fe220da3cbb17b5b62e7d8c158f50876c16565a184ec316d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469928, "uuid": "28b7f57d-1c15-4b17-acd2-4fb20fcc9e3b", "comment": "Malware payload (AgentTesla)", "value": "fb9404897624e9852ecc52128b58e8546615c24a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469928, "uuid": "e349e7b8-f498-4468-8695-78df58c17cef", "comment": "Malware payload (AgentTesla)", "value": "8c28748e3cb9a0d99a123ffc8b5a1c73c212931660df7f294806012f09a42072b799d77d6b4422561b924d9bfb36a995", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683469928, "uuid": "9cffd02a-b31a-4ef9-8069-89deca5e31f7", "value": "T1B5E423FE8281D745C1E1AECE534D4A15956A37CCF5D9F84B3BA4C2C7CBAC602289B436", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683469928, "uuid": "72948451-3593-4d77-ad53-5aa4f81f17ef", "value": "12288:tT0abKfg9wl1wc0z5X+Sjr3t94h8O5z1W7BKx7vbijKTp/k5bze:VafgQ1nYX+Q3t95O5z16BCOjupkZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683469928, "uuid": "83da90ab-9f70-4b6d-8dd3-50bfee265ab8", "value": 666783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683469928, "uuid": "68b877df-f5ae-46f5-9f99-0702d2159b1d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683469928, "uuid": "76b49cbf-ea96-442f-b1a7-24037a9f0ba7", "value": "e-dekont_html.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b34b6f17-ed08-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683485714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683485714, "uuid": "edeb3f35-5818-4c82-99b3-a9c862284cdf", "comment": "Malware payload", "value": "624697ff71505e1e89d568995f2879a0", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "Geofenced", "colour": "#BCAA6B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683485714, "uuid": "f4e6cf67-7c70-45a4-b46b-cc36fc5dd370", "comment": "Malware payload", "value": "792e83448eabb8d50d4df4572ae66cc2092b0f40783c466d9ced32bc7bc0049d", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "Geofenced", "colour": "#BCAA6B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683485714, "uuid": "70510d62-fcf4-46b3-87c6-a154c81bc235", "comment": "Malware payload", "value": "ef62844d0201be82297583857354c5c84e2f87ea", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "Geofenced", "colour": "#BCAA6B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683485714, "uuid": "168e3b91-2bb6-4a4d-ab47-f77750250a46", "comment": "Malware payload", "value": "10f949ae4873f7b536cc7ca435d1f2bf2173abd5cad6d03887f095af97898c1e49e9234e84b00224f7e717e471cdea0a", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "Geofenced", "colour": "#BCAA6B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683485714, "uuid": "3785144f-3b6a-43d6-af8e-2a235a55ccf2", "value": "T115553361F7A7A1F0CF27D2967C093176B4E2A76AD6601CCD016047680F62EF13CBAD5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683485714, "uuid": "491c6ede-5734-43fd-8a51-7a78521097ee", "value": "24576:Ip4BUeYzwoQXyFD9wrAzeNAwxtqZ7OJgcT2nbQavtYUHt2:8qUn0pixwrdxhjT2bQalXw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683485714, "uuid": "047fdc63-00d5-4466-bef6-fccd6def636c", "value": 1343501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683485714, "uuid": "f1b82b81-0e90-473d-90dc-1401125c09b2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683485714, "uuid": "22fde1e2-1ab4-466f-a1b2-c5028d79a4f4", "value": "9600aKI077os.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7444aace-ecf2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683476159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683476159, "uuid": "0ef9a583-a8ea-4d38-bbe5-63f89ea7d1cf", "comment": "Malware payload (Formbook)", "value": "7006b484aa41dbad65a8459cb0679dd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683476159, "uuid": "f23148be-8f2b-4648-a015-28e2d6d21fd1", "comment": "Malware payload (Formbook)", "value": "7ac418e10cbd8062b5b900b436b1d8570bcf838cb374b90ec18e880f600efc67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683476159, "uuid": "8fa66a1c-781c-44c2-8455-48c467a9c7f3", "comment": "Malware payload (Formbook)", "value": "9417cc123c0f3b2f5c0275fba37d9beee3ffe518", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683476159, "uuid": "3555f784-c2c8-444b-ab51-ddc10b6f64a2", "comment": "Malware payload (Formbook)", "value": "b68367340e7c0dc94bc33ecf01eb9ce62137b31732475c0be11f071da485a8870f81f92ecae5b2b32f422b9216f28c57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683476159, "uuid": "1153f6a7-3482-44f0-abc7-1600f0730ccf", "value": "T137D4231832F4E097F457CAB142B5F5055BFD9A638DE5220F3B701EAE78229172A5EF02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683476159, "uuid": "38db72ab-0e09-4357-8115-334dbf704de1", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683476159, "uuid": "1b1b1f2e-8799-44f0-9863-c44a5e960abb", "value": "12288:ZYDaFBrJHDM4zxl8ne70AyyqoBRcR7ECr8beI3/R4mLO616LDz0LeTbCE4lN+M:ZYDoN5M4/D1HBRcR7B89/R4kO6YX0qfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683476159, "uuid": "3c7c3a1f-5e9b-46d7-be5d-53716bca409e", "value": 641336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683476159, "uuid": "1f77f094-a7f0-4218-bf5d-f689637e0ccd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683476159, "uuid": "48e90df9-d63c-477e-8707-6b602d380261", "value": "2E_MAR_230504_MAR-SP-23-019_Skand_28122602.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c182f05-ecb2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683448550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683448550, "uuid": "d0a3cb82-d230-41e7-a62f-979ad184ed2f", "comment": "Malware payload (Loki)", "value": "e0bd4e2eb564f766df9543226445aaaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683448550, "uuid": "9323c255-ae99-4744-961e-b53dc6a11863", "comment": "Malware payload (Loki)", "value": "7c9dc4cb41c60cc6a22d404c9ac64e96dbdcf89b12ed543e6db4a5e28c7a5338", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683448550, "uuid": "ec8b1753-7995-49b7-bc1d-934a8953fe2d", "comment": "Malware payload (Loki)", "value": "636eaf30b1d02ada23d8475076068be8d216dd49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683448550, "uuid": "a9b7ff03-eadb-4641-8a16-1cf75d3dd431", "comment": "Malware payload (Loki)", "value": "76dbbec48844e2ed42487fc5c2f68c0cc9648c239017120db24ac860158dc645dfe080363e5eacae3c51a2c08e8627c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683448550, "uuid": "8d1e9dea-18d1-4ea8-965b-d01bc2955223", "value": "T169A31942B2A5C030F7B74DB2BB73A5B7857E7C332D22C84E9352459A14215E1EB7AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683448550, "uuid": "8edcdaa0-e537-46ee-b0ab-6339f0fa129e", "value": "0239fd611af3d0e9b0c46c5837c80e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683448550, "uuid": "91e615d9-0cc1-4c00-93fe-ed6b1f54c7a3", "value": "1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqOIzmd:nSHIG6mQwGmfOQd8YhY0/EDUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683448550, "uuid": "31b26812-3e0d-4f01-9922-527ccb12e97b", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683448550, "uuid": "8fb0dc23-b320-445a-9795-d74f337bb2af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683448550, "uuid": "6ca4a73f-5425-4301-b434-67c667122f57", "value": "e0bd4e2eb564f766df9543226445aaaa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45f6079d-ec9f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683440433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683440433, "uuid": "611d0e1e-09ef-417e-9419-339f59d5375d", "comment": "Malware payload (RedLineStealer)", "value": "089cc1261bb5e1f0a380e7016c6f8eda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683440433, "uuid": "70c2af3a-1ebe-4282-b3bc-6c5215c3b629", "comment": "Malware payload (RedLineStealer)", "value": "7eb7de67ab5fb01dde85fa99ab91b71a11e1de29e83feb207d50340bfb57c9a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683440433, "uuid": "76f38b1c-8502-4049-b4fe-3b97336333a9", "comment": "Malware payload (RedLineStealer)", "value": "d5a0aaba30fa1d15ed95b0520d8bd0be10f2d899", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683440433, "uuid": "0409bd8f-0b18-4114-8cbd-c47c82c79006", "comment": "Malware payload (RedLineStealer)", "value": "f2ae6c88f815e28129983aea6ced6de2f7c30d5cab028487fefde2c0b1042baef6cf28021299e740a81f864931258d5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683440433, "uuid": "cdf7a91f-4fc3-4fc8-9b3c-86a3c404e0cc", "value": "T195A40212B6D88072DDB517B049F603D31E37BCA16D64976B3B85AD9B0CB2680B97073B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683440433, "uuid": "3ad4a6eb-2482-483f-9585-c9ee4322ecc0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683440433, "uuid": "f88d8eaf-53c3-4e34-918f-b146fa01a791", "value": "12288:TMrqy90WcAMom+BIudoFyCvxpXbYhSiCJT++n36O3FSx:9yc9OBdS9wSHK+n8x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683440433, "uuid": "91229c5e-c630-4de6-a86a-53186fa25b86", "value": 491008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683440433, "uuid": "87e5af3f-a4d3-4761-859d-535b850d4a69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683440433, "uuid": "2a9ce465-108b-4ba4-a19e-d9858b12aea3", "value": "089cc1261bb5e1f0a380e7016c6f8eda.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93b80526-ec8e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1683433262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683433262, "uuid": "60697802-67c1-498e-a4bb-cc5e9d760f1a", "comment": "Malware payload (AsyncRAT)", "value": "7bf0cf26aa0bb42776ffa79feb7ff3d0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683433262, "uuid": "1a677f34-e512-4a2f-a964-c008e3c0c942", "comment": "Malware payload (AsyncRAT)", "value": "80296fd8a32f5a02fd9d8ac1fb010df2736d89293b3a2a124f3062ef2ed9836a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683433262, "uuid": "dc54fcb3-e430-4554-a23c-1cef1668e00a", "comment": "Malware payload (AsyncRAT)", "value": "6ba11eb1f686e3fccd225d7bb162bd20f67037a5", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683433262, "uuid": "5ba4031d-3ff3-4a41-8d2d-9db14cdf245d", "comment": "Malware payload (AsyncRAT)", "value": "da329cecce4926deac3510e8b51433d4cd1800ec00a2fb07b4989d54fb8a55378a7ff33e5b46e3ead459160d32807f6d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683433262, "uuid": "e3c65be8-97c7-4a33-8cbc-472ad89897cb", "value": "T1B7E4D0293363FE91C9668379E28590005F329C01D37BE79B1FCA61D91A467EEB8147CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683433262, "uuid": "ad6f0a71-bd51-4950-a594-a40ecc817e14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683433262, "uuid": "874c2e4e-4b01-4789-aced-6a8954dfc90f", "value": "12288:eXJcu0qu2P4smwHO2Q3NOW1CetS0V7At+SRyG0o+VBYUk2gk0rYk4BTN:vuA4FuhgpM7EyGyUUk2gNStN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683433262, "uuid": "db1faed3-a344-45bb-83eb-585799d537ce", "value": 717312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683433262, "uuid": "3f814d36-e6e9-45ff-b2ff-eeecd3cb0cd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683433262, "uuid": "262fdb32-e28c-4beb-a49b-d9c9ebd20446", "value": "PO00045789632.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f37ef8a-ec86-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683429631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429631, "uuid": "fb864212-43ab-4b88-83b0-16ec8de2aff7", "comment": "Malware payload", "value": "e8b568302b46a52c83fcc0513f714506", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429631, "uuid": "81a2e297-54ee-4c18-b7e9-ede274f190af", "comment": "Malware payload", "value": "830b8bfd0fb3b9f0d69759509757fd615a043ef76f51c46f8b7132c87e405b17", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429631, "uuid": "bd04127f-312f-41b8-af04-8325f3678db1", "comment": "Malware payload", "value": "d590dc186859bdeb07e57743fe6adf6a7455181d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429631, "uuid": "f8dcd447-e15c-47e1-9760-de21600e4b39", "comment": "Malware payload", "value": "e9ef9a64ce4fc74ad0c47f44290c6d9b20037bbf0b19409aa34d8879798999ef67d3144a5bf890e2e89654dd76d3df05", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683429631, "uuid": "8e30567e-c4de-47e2-9c36-2958a5f07164", "value": "T12D16CF403BD0ADBBD1EE6775912681FC4FBCD0866BD7A31B5604A56C0EDE3820E5E287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683429631, "uuid": "75b7cdf8-fd50-457b-8b56-5b2f6a435e31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683429631, "uuid": "2cbf6072-2a74-4ec8-a9d1-bdae28f5a1da", "value": "98304:oXB4uluJRmMg6QWlIpgi0rHqsih/mCqJ4B4uluY:ovsJR0TW6yiIKRhzqOsY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683429631, "uuid": "d7c9ffbb-964d-4599-ad58-db19deb13204", "value": 4388053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683429631, "uuid": "8f9edadb-28ca-47ab-bc1b-9cc377de93b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683429631, "uuid": "210bfcff-a538-4d4d-afa7-63ad9055470c", "value": "VirusShare_e8b568302b46a52c83fcc0513f714506", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4b99ec0-ec6a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683417909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683417909, "uuid": "1d7a5345-dba3-4336-81da-5297e79e0d08", "comment": "Malware payload (RedLineStealer)", "value": "d2405d8fd633a65cdb7401b825243672", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683417909, "uuid": "5b91301e-f80b-472c-b2c9-7f95f402be41", "comment": "Malware payload (RedLineStealer)", "value": "85679ee9cb599e13b6aedfa5ebff97e8743e91df5186c0e87efb3e0e44a73ab5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683417909, "uuid": "c7f4ac19-6914-41c3-a218-75f862df75f5", "comment": "Malware payload (RedLineStealer)", "value": "e09ba0cd2ad57d5d5883be3d2b563c31b725d1c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683417909, "uuid": "798b78fa-5adb-41a1-90fe-e7e8f6ea0528", "comment": "Malware payload (RedLineStealer)", "value": "3ed45ca4d53a8ace0c1bc61b5d3128c58dc6f868cf4ba0c4ccc399b7998634f9aa4d0db0b7054925a48e36e5b7ed7f36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683417909, "uuid": "8084be40-ed99-4c88-8bbb-d3b647101458", "value": "T1ADA40222BBE99033D5B41B7098F703431A36BDD2AD78925A3B49E90A0C736D8713577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683417909, "uuid": "ba22416c-b530-4b7f-9e9c-7afae30acb72", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683417909, "uuid": "bbb67153-ba3b-4084-81f8-e984f07335c4", "value": "12288:tMrry90lMVFp29u44CU7AaouyNQDnxpS64UGsIM:myL3b/YKQUGsV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683417909, "uuid": "93a920b5-a0cf-4fe2-9375-f9818d105ab3", "value": 491008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683417909, "uuid": "d12d9694-59bf-402b-bfc1-00aa610cfef1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683417909, "uuid": "11207f47-feb9-4037-913e-c406d3d3a42a", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6c7de90-ec6b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683418342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418342, "uuid": "32b87451-536d-4d12-83f8-054def505afd", "comment": "Malware payload (RedLineStealer)", "value": "2536656821ece875da1b8ce2469425be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418342, "uuid": "1be98b5f-3b2e-475d-9c97-a24f92ce0710", "comment": "Malware payload (RedLineStealer)", "value": "868d21c6771a072be11ed95a3ea83e4db4b58d9d83ebf365afbc53b5d9994bff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418342, "uuid": "9965e03f-8ce2-4dc8-8d91-030cead7d483", "comment": "Malware payload (RedLineStealer)", "value": "1221da6b959dff65399b6853774fbbd10339876d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418342, "uuid": "6c81990b-a03f-46c7-9177-8a9905515958", "comment": "Malware payload (RedLineStealer)", "value": "140aef7240ea1fff59d96659f186697cc76cb80e4d4f9a522f31702956f4bec2c454b975ffe3226941c8a1b42e2f5eb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418342, "uuid": "2f5e5a02-787e-4409-8afa-149aa8769890", "value": "T152A4020AA7D89133D8A61B7018F707D30A36BCE14A38536B3746995F0DB27C4A97637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418342, "uuid": "15be0a5f-6235-47ae-93a6-42ca1937cc22", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418342, "uuid": "ea4c287b-893d-4523-9398-4a1e5cc1c5ee", "value": "12288:SMrgy90gQP8yZKafXL0tcW4+3K1rfToW32KFA:+yvQVZPYBK1rf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683418342, "uuid": "1f019084-b331-4fd6-bda5-064444cf51ae", "value": 491008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683418342, "uuid": "5fe929e3-5852-4318-99f9-40f78f087561", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418342, "uuid": "59b533e6-da7a-4508-86a2-d5f4df9ae5f1", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f04cb12d-ecc9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1683458758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683458758, "uuid": "669c419d-07a8-4475-9ffc-f8c0b4e52246", "comment": "Malware payload (DCRat)", "value": "e911740f704ad0478d1fbad3884bdeae", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683458758, "uuid": "c3adefc6-59f7-4956-ac91-3a90fcccecbf", "comment": "Malware payload (DCRat)", "value": "87f63e9ab34f80761254da92717e3deb0a49e59f6bc79b7e899c90a9e314177b", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683458758, "uuid": "f332e4d7-06a0-4acf-b3fd-fa264cdb22db", "comment": "Malware payload (DCRat)", "value": "f3f53dab2a08d493973b88aa5d8d82aee01e3239", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683458758, "uuid": "ff35ee63-c5bd-4b2d-9cca-0c5a6981b797", "comment": "Malware payload (DCRat)", "value": "c5adbd6e1585a6065cafea94e0109ee4228ebf63f2e090927a92f141c5071ba8245ee2feceeaf9cf1595f5fcbe93beee", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683458758, "uuid": "bc0257fd-20d5-4f35-98c6-095b1722bd5c", "value": "T113645A1837EC4B19F1FEABB5D4B351599770B85AFA7EEB0E1D8190DA1826340CD00BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683458758, "uuid": "519d77fd-3367-4bdf-a2ce-a438fff03eb3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683458758, "uuid": "2dfbea26-5f1f-4138-bafb-b09c57f72e5e", "value": "6144:opfy2oo7K+4v2LyH83nRw8ve4KMdxLpWd4QZD/q4i1dxsb0r9u:oU2N7Hy583m4KFuQZlydxhZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683458758, "uuid": "add079d0-1c24-4061-8d08-9cc56b008ce8", "value": 323072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683458758, "uuid": "73e08d08-7f40-4074-93fc-03e99b6731df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683458758, "uuid": "726de924-e8c0-4a75-a186-3530921e541e", "value": "87F63E9AB34F80761254DA92717E3DEB0A49E59F6BC79.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78a182df-ecb1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (TeamBot)", "timestamp": 1683448249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683448249, "uuid": "59cbd6b2-3bb3-4c88-9183-f8ade5070ddf", "comment": "Malware payload (TeamBot)", "value": "dfbea8d8c3d16c28ac13f1e9c03ebb4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683448249, "uuid": "86a9b6c1-7be0-4df7-9d1a-2cc61242f591", "comment": "Malware payload (TeamBot)", "value": "88881f150b1c82cbcec75df7952ebaa12cf40af107f31e72a219d1dd994822a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683448249, "uuid": "df9535a7-3b03-414f-91bd-65e3cb865776", "comment": "Malware payload (TeamBot)", "value": "056cba780230832fb43c737db1d0a38bf9289406", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683448249, "uuid": "3ebbe47d-a932-45ff-91ae-3071aa46a2af", "comment": "Malware payload (TeamBot)", "value": "edf867ddc420d3b77bb46185d48e42b9862f3c9f3fecade2adb7bbbbc4008ffcf210f34d4050416ff7a242a44fe97ddb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683448249, "uuid": "d6bf1140-18d8-4921-a006-913b091ad0be", "value": "T14324CF227A90C871DD9744308434DAF87ABABEB1875A868773982FAF2D317C15776303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683448249, "uuid": "1ae564a6-b7e4-4da8-94ce-c24b07420d86", "value": "9efb9bdbf9fba64042573bb65d0b56ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683448249, "uuid": "f97c20fb-cdfa-42a9-b6a2-03f7d0b98f1e", "value": "3072:xE2PUTCgj1f8WOjjO0/kMuUaK2EEE1H3uVZ+jEEk58WbuJZ6t5BWbW:xDPfgJ2q0kM3SEh++Zk5bqMh9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683448249, "uuid": "35f7f2ff-4061-4094-bb27-465fac3d177d", "value": 224768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683448249, "uuid": "0305f7bc-915a-4e36-824a-86ecfbe8aa28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683448249, "uuid": "2ef12724-c95e-409f-a6ef-e8bcb2ff2eed", "value": "88881F150B1C82CBCEC75DF7952EBAA12CF40AF107F31.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21c9e8f9-ec7f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683426629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683426629, "uuid": "dcd7716c-91ba-4089-8609-43afe06171c3", "comment": "Malware payload (Amadey)", "value": "f763cda0f8709bd60b1c6c85db613b0a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683426629, "uuid": "2b430f7f-59f2-4409-b9b1-d692f142575a", "comment": "Malware payload (Amadey)", "value": "894b73a46866ce0c71f9b62a7169bf816b44a4ce489eab5d08f28786ea645fa1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683426629, "uuid": "13334c7e-0e7d-4fb7-b5bd-0ccf78c24c02", "comment": "Malware payload (Amadey)", "value": "6199d09a64261a0ce0ca6d57d012cf53c2872bf0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683426629, "uuid": "26964ef1-28d5-4929-b400-9c9ff4de4138", "comment": "Malware payload (Amadey)", "value": "359a5b1a3b04925c8e6c5a64c8b6a27431b0ff7817f026731331250a9a99ade53974650e79cb9a176b8f72e4a4e1620d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683426629, "uuid": "b0a6e776-d2de-4227-aa89-c7b279fbfdda", "value": "T1EFA40216F3D84033D9B25B706CFB03C31A3ABD716820936F2356995A4C72AD1AA76377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683426629, "uuid": "598d21bc-8ffb-4764-95fc-59c955f2e73e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683426629, "uuid": "9a7928a7-fef3-4143-a218-5735112f2500", "value": "12288:fMrGy90AYFq995+LG5c1u312Tjq/xS836Q/CEJjY8/Q:Jy2SXETGxd7/lZA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683426629, "uuid": "d495e57b-d0d8-480e-9b03-fc74bdce26f2", "value": 490496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683426629, "uuid": "07ec05eb-70a7-4edf-83b3-424a07c4cff3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683426629, "uuid": "6da36218-42e5-4ade-81dc-a28484072988", "value": "f763cda0f8709bd60b1c6c85db613b0a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c6498b7-ec86-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683429626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429626, "uuid": "c5849be2-1b91-4afd-b289-ed0b2a729e92", "comment": "Malware payload", "value": "b9aaab8a484d7c55a491b074447bc8c1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429626, "uuid": "8844d125-f0d0-4f05-8702-34c187f364f9", "comment": "Malware payload", "value": "89b7998add68bcd4a20c9d05c8b530a4bcef0a764cda082ea3ddb6707b4a4467", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429626, "uuid": "15f4fd9a-f097-44ea-abe7-a6378670fe1b", "comment": "Malware payload", "value": "abbccd0c55af7c6eb77a7c5f6c62fbfe6d9824da", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429626, "uuid": "c75f038a-1aea-4631-a962-2f26462d0432", "comment": "Malware payload", "value": "877b037b2a81d55711497ba05b9d586ea092da66282bbfdf15ad6af25720c9ff7b74233e42e29c0e0ec42eca89ba1815", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683429626, "uuid": "0cd72e1b-a5a8-439e-bc08-3d37b032e869", "value": "T16F16CF403BD0ADBBD1EE6775912681FC4FBCD0866BD7A31B5604A56C0EDE3820E5E287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683429626, "uuid": "cb823ce5-6e7f-4122-911d-07012e7d2634", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683429626, "uuid": "1a50f758-2cd9-4a72-b97a-fd2e9e2eda1c", "value": "98304:oXB4uluJRmMg6QWlIpgi0rHqsih/mCqJ4B4uluS:ovsJR0TW6yiIKRhzqOsS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683429626, "uuid": "288a36db-9024-4aa3-a3b3-3b29e4ddf516", "value": 4388098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683429626, "uuid": "7556cccc-1264-4a79-836b-6f912ab6bc86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683429626, "uuid": "d941171c-770d-45ef-bb6b-f953d65d0af8", "value": "VirusShare_b9aaab8a484d7c55a491b074447bc8c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5409c75-ecda-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683466041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466041, "uuid": "907cb7c4-79be-42aa-98d1-5adba089c12e", "comment": "Malware payload", "value": "9c9f79c124cd71f194898aabce658c67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466041, "uuid": "46dfab1e-1701-43e3-ac5b-6cf40f0e4136", "comment": "Malware payload", "value": "8a6bdcd981331edbba2152d71cb4e900f7149fe22b6f19548da95407f2b48fba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466041, "uuid": "7841c064-6131-4f87-9cd7-99861a864c85", "comment": "Malware payload", "value": "a0352f9b304a1b49bedfe5c148ae48512246ee01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466041, "uuid": "17776a78-ccab-4137-8c1e-293c29130612", "comment": "Malware payload", "value": "998039940adb3f61ce8757cc1f28196e78818e674b0cc7ff04e59c23a643528887faa72554d0397d32639758cfbfbcbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466041, "uuid": "9ae8143a-17d9-4224-9424-0e37476a5f71", "value": "T19F143A1B37D0B84BEADB42B10BA7963AF3FBE3121771365B59101FB834196C74964AC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466041, "uuid": "00cd0ba4-8bca-4559-89fa-b096dbc778fb", "value": "384:hd5Kc7WSse4lDPSAKBvQu/QcxDaM55p4mgu7Sk1CrrkW+ZWHpjcuYSkyJ:hOMgj5P+BvQu/QA3P4mgWZMkWD2rSkG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683466041, "uuid": "d5f6e13c-9939-4743-8721-e14a15fbf5de", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683466041, "uuid": "bb6b2008-0b6b-469c-81b2-f3c5eff7266f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466041, "uuid": "92ec860f-2850-4cac-9f3c-6c3ab66e6f76", "value": "SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.4727.25036", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fea115da-eca6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683443749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443749, "uuid": "1ed7845f-1b80-43f2-8e5f-effd77e55d70", "comment": "Malware payload (RedLineStealer)", "value": "32e248d65deb8228119dcd2e23a75818", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443749, "uuid": "0525aa49-f3d3-4500-b767-a012881e7d42", "comment": "Malware payload (RedLineStealer)", "value": "8b7665e23a47d923acb8708467fac6d7033b34a8faf2f0d4769b091cf2b14f15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443749, "uuid": "bee647b1-3b82-41d3-80b9-1b4446b8a45c", "comment": "Malware payload (RedLineStealer)", "value": "be218f73583ca8cc6be381dedd285b4a05c322fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443749, "uuid": "bfbf5380-c6ad-4c42-bf6a-8422e839f030", "comment": "Malware payload (RedLineStealer)", "value": "bc8a24ab20ec589795924952349f22843a0fa1565a0e2c5ba0f4f886a1d0d550b29683884377eac59d61ebb46a35b3eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443749, "uuid": "e8840a92-0509-4173-a9b9-2457ff5e4bbf", "value": "T141551242BAD0D8F2D4B309361A649721657EBD312F75CEEFA3C06A1ED9225C0D7317A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443749, "uuid": "305220b8-87ec-4afd-b968-d6ab3da81f59", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443749, "uuid": "4136c7d6-bd88-49b0-9433-5ba4a3f4440b", "value": "24576:2TbBv5rUyXVUIzVABrehh5DsK0GWIAlwgeFTD7cC948Dlxjrz:IBJUhUjUGWIBR7LBDTjn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683443749, "uuid": "49d9a4e5-77b1-4ba4-9145-8e9d5410aaa6", "value": 1311676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683443749, "uuid": "276bcb9b-933c-4370-aa09-27475db3a43f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443749, "uuid": "ec5f0866-d5d0-41e4-b7c7-6043171c0816", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c662bf58-ecd6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683464271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683464271, "uuid": "dcdc324b-8d11-4b30-8be2-941bcf54350f", "comment": "Malware payload (RedLineStealer)", "value": "02e01f99331d49d6c0b7924b1b004d63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683464271, "uuid": "fee11400-d064-4334-9575-3d6f40eb5fbc", "comment": "Malware payload (RedLineStealer)", "value": "8bddb10753bd54d5d10e9a2c5b3598060f86c2320833689bbbf396f18ecaa297", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683464271, "uuid": "e02493b9-dd12-438a-a9f5-39c58cf049ee", "comment": "Malware payload (RedLineStealer)", "value": "eac10a46befefae9269e64ce0f20dfb3e05207eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683464271, "uuid": "b52c091e-2417-4caf-bbe4-ae6dc5851fec", "comment": "Malware payload (RedLineStealer)", "value": "4d06946eb93d44fc279fcb0be5f6fdb60656d6536cd8baf5324079443b69cc80ffaee099ecf312398459419e7670f26b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683464271, "uuid": "06805bfd-8fb1-4d3d-88c5-a60bff7dc6c5", "value": "T147446C2AFB08F2E5FE09523D39C3649F5DEE687905AF00516B05861B359AF703AE03B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683464271, "uuid": "b1307eb1-b32b-4bf6-931a-c1129252f88e", "value": "154732c40368f0c0508c3e38805e9321", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683464271, "uuid": "7636bb30-b5fe-4a34-b398-9f6f9baff6d0", "value": "6144:03dJeJ+9HPGKFHdx2a1NCinscgyVIfof38:03neJQPGUG8IinszLQfs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683464271, "uuid": "b247b1cc-97de-491b-86e6-bb4a3a7c3271", "value": 260192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683464271, "uuid": "e8003a7b-1f02-4559-8e7a-1426cada60fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683464271, "uuid": "01ee8f25-17f6-44cb-8681-c3293d94caac", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5b58660-ec6b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683418260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418260, "uuid": "74c1a2af-3b7e-477d-8d22-e0b2790fa5c1", "comment": "Malware payload (Amadey)", "value": "a1ca84c17785d18d36f43e7ae83cbc20", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418260, "uuid": "17323a8c-083e-4022-a6bb-553494485cad", "comment": "Malware payload (Amadey)", "value": "8e81011b7f0c98519417ddc3219b4f2a861788c916a8c9432565c3a8d38d4c53", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418260, "uuid": "415308a1-e829-4f78-bb91-3dd7ec54de90", "comment": "Malware payload (Amadey)", "value": "2e636477d97b5c93aca49d9878b5a69be974416e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418260, "uuid": "dd2514ab-3f62-4811-b89f-d76b0649f51d", "comment": "Malware payload (Amadey)", "value": "fcc12f99fe5dfaf41106c29713211b66b71f04de49db61ce9307481ecae2b502cb81cbf7a4ae1496d36e3fffa446d31e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418260, "uuid": "5ba5b26e-2d46-4a29-bfa2-7c9b567c812c", "value": "T102A40253ABE88073ECB56BF05CF612D31A36BC92997482672781A95F0C72A94F431377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418260, "uuid": "b376e873-8353-407c-a3dd-8c2c9d4df9fe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418260, "uuid": "4156414c-a91d-4a53-b0dd-03e6b210c3a1", "value": "12288:cMrqy90nL9nGs3KC3JyiMoaZVtTDjMG69/L8HGkZQ:OyY5ohnTDjMV8mF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683418260, "uuid": "07ce41da-7bdc-488f-bd92-688fed359a28", "value": 491008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683418260, "uuid": "a69d3925-c81e-46dc-a5d1-5d4f5838693a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418260, "uuid": "8be5c2c8-4394-4f88-9907-ac54d7155e92", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a69ef1e-ecca-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683459043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683459043, "uuid": "c1a91c16-6c3b-4346-819e-5b41a8c3a444", "comment": "Malware payload (RedLineStealer)", "value": "504ada1b00f36c69b7f9ffcd16a493f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683459043, "uuid": "1912f08d-670f-448e-91e8-2039d1117bb3", "comment": "Malware payload (RedLineStealer)", "value": "90bb4c682e5f0ebdb5626655a3e95a16a6ccf2b05cc4167964f98b0099f9bcf2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683459043, "uuid": "971f317f-8896-4afd-886c-00030b90ebc6", "comment": "Malware payload (RedLineStealer)", "value": "de26ec295bbae17e0e0f3306eeabbc4f149d80e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683459043, "uuid": "b501ff94-f5d5-4011-a84c-29a51f6f09ec", "comment": "Malware payload (RedLineStealer)", "value": "5f68bd90d62ef2ae9366c261c0a6ad8c231aced35fa4219d5a1d734961ad105905a6e5b0e5c5262157db32329fd2f2b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683459043, "uuid": "e8f5781f-e3f6-40aa-99a4-31e4bffd4fb4", "value": "T12CA40202BBE98433C8B91BB118F703D30F36BCA19D34C7AA6395A55A1CB36889571777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683459043, "uuid": "f042f234-0dcc-48c0-b463-0871ce5e37e4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683459043, "uuid": "30300647-1947-40c2-a130-79ab07e24173", "value": "12288:SMr8y908/QweT9zxdJ8raapLMEyMO8SzPKkfXXo:Ky/IZT9jhahOMO8yKMX4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683459043, "uuid": "8576565b-ab7f-4f98-aefd-b438e8088910", "value": 491008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683459043, "uuid": "173754a1-58f4-445f-a09f-9fb136f9f31d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683459043, "uuid": "95d5e857-551b-484a-8d08-13e2afda6d1d", "value": "504ada1b00f36c69b7f9ffcd16a493f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ce97a0f-ec76-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683422728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683422728, "uuid": "0744414d-7efe-445c-9299-6273eb862ea2", "comment": "Malware payload (RedLineStealer)", "value": "e1da00e1efc22b10cb8be85c7dedb49d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683422728, "uuid": "56364644-20af-465b-b5e2-c8db577052c8", "comment": "Malware payload (RedLineStealer)", "value": "96dfd6a34a66443699a8a889eeef4d81e6af42ee659c67928b3b716f55d27620", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683422728, "uuid": "ed913da8-a062-4056-9e50-c297cfabd81c", "comment": "Malware payload (RedLineStealer)", "value": "edce7c0f09ece6f6d3a6a456ed50d2634895e075", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683422728, "uuid": "c5e5c2be-e8c6-4d51-8266-6acedccca183", "comment": "Malware payload (RedLineStealer)", "value": "b5b9c5de012f3b496b87167dd11cedb9973d2295a9a32fedd3342f94961884a395c9314776181a57776f9975228be1bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683422728, "uuid": "22afe151-2f32-46d2-a2e8-9ade689478a2", "value": "T1E6A40252A7ED4473EDB227B018F702D3173A7CA12834536B2749A95E0C72AD8E4357BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683422728, "uuid": "978d7d8e-593e-405b-b408-767ecfcb4571", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683422728, "uuid": "236bc4fa-dbf4-4f6a-8593-45eb989aacb7", "value": "12288:CMrWy90DyOAynIVQB7AsXxvl4XC2JquGRKvHgeVoRz:YyDinwJsBqCqqJAvHgooRz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683422728, "uuid": "6cd80f4f-18ff-4e99-b96e-97ddb5e49a63", "value": 491008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683422728, "uuid": "649270eb-c56c-476c-9e24-73bf2cc7cd58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683422728, "uuid": "52ac945b-dab6-492b-96e8-87ec03208ffa", "value": "e1da00e1efc22b10cb8be85c7dedb49d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "669cbb5a-eccd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683460245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683460245, "uuid": "2eb52f13-08a1-4c61-8194-dbd3e76cba27", "comment": "Malware payload (Amadey)", "value": "25435c9b8b7dd0363e9ebdaa6f6a2c28", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683460245, "uuid": "db85b970-0146-4a84-ac69-7f2e6d189230", "comment": "Malware payload (Amadey)", "value": "98a32118d445096b3d1fbf1f1a10238a02941a7c779c9dbfad9d1cddc0e2a09b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683460245, "uuid": "ca8e7787-bf21-447f-9316-3697fff54c6a", "comment": "Malware payload (Amadey)", "value": "5db2d2af0dd491fb5904cf29a89da1bf04a4228a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683460245, "uuid": "b60c6e16-05d8-42e4-8187-a5f913ff083b", "comment": "Malware payload (Amadey)", "value": "d3543389dbfff7f15dbf21c1a0ca991377b3020a77026441b7e8fd046e1b6f5e42ef4e9a7a788e4ddb9a41efd9ba3f9f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683460245, "uuid": "d7947f97-401c-419f-8af5-86c7d9d8df99", "value": "T1CAA40217BBE95022ECB517B458FA0B930F31BCA29EB4935F37455A0B18B36C0A43176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683460245, "uuid": "b5726660-6f75-43c6-b3a5-4f30ede3094d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683460245, "uuid": "e620a689-2596-494d-989c-a0ebd7b78e02", "value": "12288:HMrwy90u42J/hYyC+HdQ5F5Lfru9T0RN2thcz8k:ryB4OapD5nu9RSzl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683460245, "uuid": "fb055b01-259b-435a-839f-92b5e3e8122d", "value": 492544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683460245, "uuid": "236f42f5-6a62-4782-b58b-d605c0b105ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683460245, "uuid": "46b39183-2302-4861-9efc-ff1b14b019bd", "value": "25435c9b8b7dd0363e9ebdaa6f6a2c28.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e635f10-ed15-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Cybergate)", "timestamp": 1683491128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683491128, "uuid": "bed29f6d-a523-4a88-b058-808bbfe5b4bd", "comment": "Malware payload (Cybergate)", "value": "6b5c6ba95c1a528f205ade408d389375", "object_relation": "md5", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683491128, "uuid": "43e26e0c-c9db-4764-8b0d-170ddb4bec8d", "comment": "Malware payload (Cybergate)", "value": "98abcc6f294bd8549a963bbeccb0e01013dd42cc61a07aa496793aa667630a2b", "object_relation": "sha256", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683491128, "uuid": "eca6ff48-102b-4a5b-adcc-500f1e2b5005", "comment": "Malware payload (Cybergate)", "value": "0b7972bc74825568ec8aa25764fb1396c36f35c7", "object_relation": "sha1", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683491128, "uuid": "2361b6eb-079f-429f-8d7b-fc5ebbb6f5d6", "comment": "Malware payload (Cybergate)", "value": "94c41e2ddaee35db85dfca3cc1c8f81ee06461658c91c08ad00ba0b48b2d2bb06e34e67355f08cd280e985a2846c02cb", "object_relation": "sha3-384", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683491128, "uuid": "fe3af84e-e0aa-4c09-ae3f-704c168dad67", "value": "T1F7C579012EB2BFD0DB86E3AFD43D689627D037A6517117552F9C1A9AFDA0B0C342A473", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683491128, "uuid": "706e09f8-f1f5-44a7-aff6-c2196c935a05", "value": "a9c887a4f18a3fede2cc29ceea138ed3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683491128, "uuid": "bde0dfce-242b-4396-a49b-7cac689fbc8e", "value": "49152:u8CPX4IJQJvrsIt5HNafWOt7lQzg4HhMQYAxJW5rhCuQJD0iPCwh:1rDsuQ78H9YAxJKhCbF0iF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683491128, "uuid": "1474259c-1520-4e4b-be5e-f3e242f1b3c8", "value": 2717184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683491128, "uuid": "665c5385-cab6-4c91-9344-64c634645e6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683491128, "uuid": "7bddd200-3949-4b99-a019-df941ab2e148", "value": "6B5C6BA95C1A528F205ADE408D389375.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a5672ee-eccc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1683459660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683459660, "uuid": "e39e2086-8bad-432b-b9fe-6470357045c3", "comment": "Malware payload (Stop)", "value": "eae0b33da6ca4b0f0e88d3169e20cc10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683459660, "uuid": "a7615ea7-b7c6-4d4e-b595-e60fc041e7b3", "comment": "Malware payload (Stop)", "value": "9b1752c0e5f980b01e81c3c75c9b7ff998f3006f7a7eb6bd3c40f079df4b1953", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683459660, "uuid": "4273a0b8-2d9b-4512-99ff-7778e189df10", "comment": "Malware payload (Stop)", "value": "9818be490af59f18c18fcbcaa92c0d6fb60def96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683459660, "uuid": "b1cc0360-dec1-486d-803b-b6b6b2e70f82", "comment": "Malware payload (Stop)", "value": "e9ae36521a0fa7aedd4d4080abdff64e645a2f03d119421db3d8027edbfaf50916dd58bac11ed9e2c10bbf3682e5a41c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683459660, "uuid": "27a00d4f-a8e6-4df9-9dca-fd0107057e38", "value": "T19EF4121577E1C0B2F16124349C6DE7E83B3AB9B266344D8B7BA11B6E6B613D04E6430F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683459660, "uuid": "f898a22e-8175-462a-873d-51ad81528a81", "value": "9f1c50433c092232aec71253e6e21bd6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683459660, "uuid": "fe045af4-2a29-42ca-8cd1-6d8e0041e566", "value": "12288:mldtQIw651DLYR9vUeDIW3kOBGT7dmS2JaBGdEqOkRGG5vW5+N/JpeS4EAHX:ml8IhvY/FNZB2ZmTaBuuCvE+D/xQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683459660, "uuid": "077ff31d-406d-42bf-a5fe-917a85a17b91", "value": 743424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683459660, "uuid": "014b550b-929e-431e-bfae-1da95cf4b095", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683459660, "uuid": "81b2c921-334f-483f-9ba1-88716302090f", "value": "9B1752C0E5F980B01E81C3C75C9B7FF998F3006F7A7EB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42d959af-ecd9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683465339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683465339, "uuid": "53dec8ae-23b8-41e2-a0e2-765f4f31562a", "comment": "Malware payload (Mirai)", "value": "11190e20c243e5a12793fc36ef1ca9c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683465339, "uuid": "6f3972ec-b7cb-42b8-9d55-c74e9b1613b3", "comment": "Malware payload (Mirai)", "value": "9dba16ed5ec6dabdc28eaabd50b7e1f865aba7acf013134f389f6b69e330128b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683465339, "uuid": "b7aac02d-901f-47ca-a5ef-90b0feded256", "comment": "Malware payload (Mirai)", "value": "f2079f69d1fddadf5010dcb15c1826d00c6139ec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683465339, "uuid": "154532a7-ce21-42de-ae99-823c8b0269be", "comment": "Malware payload (Mirai)", "value": "552d2f9d77e7ceb1a44b3b8fc4c2866a771e9f39803585f48d8144818984e32b4a98639897ef26cb269dbf67803b1df6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683465339, "uuid": "abd7a3ae-ac49-4e1f-a29c-ebee660e4519", "value": "T1DC63B60E6E219FBCFB5C873447B78E20A75833A626E1D245E15CE9015FB034E645FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683465339, "uuid": "e2601a11-d86e-4dbc-a17b-7db03dfb1973", "value": "1536:y1xZeojGvZuKrgFrmWRTB6H0tIoMX6bJwxGvi+uJ5cf0ZSqaB:y1xZeojGvZu9FrfRTB6H0tIoMChxf0Zq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683465339, "uuid": "c34f1993-14af-4b65-adbe-abd31ad8e6a5", "value": 67808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683465339, "uuid": "e4d8cd4b-2e80-490f-bc18-267b1903f343", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683465339, "uuid": "bdd2d494-61bb-40ac-8e38-f81f5d5e18e3", "value": "11190e20c243e5a12793fc36ef1ca9c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6355ad8b-ecdb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (BlackMatter)", "timestamp": 1683466252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466252, "uuid": "fd00fb4f-2962-45c7-8723-a4b7c36f48b4", "comment": "Malware payload (BlackMatter)", "value": "6461f685015e5de98b4ff6f4a1a47388", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466252, "uuid": "9d78a020-6bef-4028-a48d-c1d42b73422d", "comment": "Malware payload (BlackMatter)", "value": "9f007ac0509f1b836a13933f568c4c69e56eb4feb619f3dc583f76d460a012eb", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466252, "uuid": "f76b042d-db05-4ca5-9c47-57bafc1bbc63", "comment": "Malware payload (BlackMatter)", "value": "383bca3f17e0e02d91ce495ffe44fec681d63e09", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466252, "uuid": "bb16db3f-ddfd-4920-a94c-dacb5bde04a5", "comment": "Malware payload (BlackMatter)", "value": "3fca0b1e0b97140fa8be7f46a3f2c5c52becae4db66f05472c649f3778369038d721d0a33612429515376fec30566945", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466252, "uuid": "39467951-8389-409f-b551-d3c3e2b878b5", "value": "T1C5E37E21F212D0B3C87718F53736B572F39E4E6C19A96407EAD80F99BCA48232F45A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466252, "uuid": "59c0df1a-d84c-41c0-a6f5-cead1f3789ae", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466252, "uuid": "5f96bbc5-f315-4722-b4c8-3d88004261dc", "value": "3072:M6glyuxE4GsUPnliByocWepe6QHVUzDJEDx66JfQSilHWt0qLG:M6gDBGpvEByocWe46QH8mc6RrilHWt08", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683466252, "uuid": "e4c23a59-8074-49b5-8e0b-d50861600850", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683466252, "uuid": "2c20b5dc-4b9d-4bb9-bec9-0e0f7b570764", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466252, "uuid": "8599fdf2-b11f-4a13-916c-a2d477f2ad6c", "value": "2023-05-06_6461f685015e5de98b4ff6f4a1a47388_darkside", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9933173-eca7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683444036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683444036, "uuid": "42772123-94cd-4311-b934-ba9d2b776660", "comment": "Malware payload (Amadey)", "value": "34b9753dee46b1006b018fbc3621c37e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683444036, "uuid": "06fb2f7d-04ac-421a-9850-4d5f5e2ebd35", "comment": "Malware payload (Amadey)", "value": "9fb09060fc1134292435ea475ac1ad3b92bdfcd1d71fe45f08066780682ef594", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683444036, "uuid": "34f6933b-2ea6-47c6-9d8b-1f6ccfbbf02d", "comment": "Malware payload (Amadey)", "value": "64e9f0dd03576ebcb6709a1774d25a8d49adb31a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683444036, "uuid": "851f80e2-2eee-499b-ba53-1ef80e443a45", "comment": "Malware payload (Amadey)", "value": "ddd0d74b6d17d71d21fe79c85c3c3c0545d329400659783d19b4796c36aaf28b9440eb8e3268cc9341e283ac064d588a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683444036, "uuid": "c3dcb386-5a86-4a58-a46a-718b7b02da70", "value": "T17AA40206E7D895B2D8B55BB019FA02931B337CE19D7543B73381A95A4C72AD0E83633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683444036, "uuid": "46874393-c2c0-41fd-9916-516679cc1a6e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683444036, "uuid": "717a35a0-26c9-4d6e-bd81-c73d6b7bc227", "value": "12288:FMrCy90NpLyWwzhBL6WYhpMK2FeZMtuW:/yoLqHsKn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683444036, "uuid": "e2c57f9b-5a5f-4e69-a4b1-4c6699dd830f", "value": 489984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683444036, "uuid": "4b3a2f3c-cab1-4443-b5eb-58eeca136bc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683444036, "uuid": "146aec67-ea7f-4cff-80b5-05f40981311f", "value": "34b9753dee46b1006b018fbc3621c37e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3448d64b-ec8f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683433532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683433532, "uuid": "9be5964a-0f96-44f3-a5d5-6cafc447daa1", "comment": "Malware payload (RedLineStealer)", "value": "706ecc6470bc2d4d527d119d5b75b1ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683433532, "uuid": "5164fc3d-67db-41ee-8cb0-fe604095d3a9", "comment": "Malware payload (RedLineStealer)", "value": "a38ee2750085cd494ac62caa19442b9eee35ad49c341d8dfd071cf2b635f4b42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683433532, "uuid": "4c155e6c-9393-464f-b8c4-0f248272fbd4", "comment": "Malware payload (RedLineStealer)", "value": "55c12c8dfc768d5bd4dd650035f93cfe04698981", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683433532, "uuid": "3ea81a84-3eed-4bbb-ba22-8656227d2732", "comment": "Malware payload (RedLineStealer)", "value": "45e00207a38b17fd7b1c4f34dcd571f275c6b68a24546e10e49bad10e731b7ed611b2a7c6755c554d80765bbdc4fa45c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683433532, "uuid": "458f43da-695c-42ad-b3b8-a1db8aa211e6", "value": "T1E9A40212A7D89033DD751BB069FE03C70A3ABCD05D38476B72889CAA6D73794A931367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683433532, "uuid": "788fa79e-a64f-4fc4-b623-d6243ab0ae55", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683433532, "uuid": "8d542811-d146-4340-9ee8-b0a34b65cabb", "value": "12288:PMrZy90qpnlbInt/uZ4SroGt1I7VzXmoH9ZTy6eq:6yvpnZGI40oHlmCk67", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683433532, "uuid": "c3c112bf-d76b-47ab-a20d-203f49aae0bc", "value": 490496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683433532, "uuid": "d5334bc2-ab6a-4460-bd11-1fa410157d1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683433532, "uuid": "88f19331-8c4e-437b-bc9c-fa8c32e4c9e7", "value": "706ecc6470bc2d4d527d119d5b75b1ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3e82f37-ecc4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683456563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683456563, "uuid": "358719e6-5b7d-4cb3-9560-a61ef9e5edcd", "comment": "Malware payload (Mirai)", "value": "7834efe917327193aee4f0a3b292dffc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683456563, "uuid": "dddfb811-29e1-4b82-aa45-2ae856c6bc10", "comment": "Malware payload (Mirai)", "value": "a397cffad0fbdc5257ed5dacf2883f4b6fb836379943f7eb8cee2f3912b7ba51", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683456563, "uuid": "19f7ccef-1636-40ae-8ba1-f8906a0b8d5f", "comment": "Malware payload (Mirai)", "value": "d12cdaf2881acd567762cd092643a88f35b2e268", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683456563, "uuid": "7df28e86-919f-429d-a73f-248b76719a9f", "comment": "Malware payload (Mirai)", "value": "4b557274d846528ad7d4f76792a4852410d2c1c2cf1df07701b799503e640a5a4b0307bec3c1262a1ecc676eb6e751c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683456563, "uuid": "573f4ce2-e9ea-4e38-a949-86eda53a22bd", "value": "T1243302137215FDA2DE751D3AB6F94D8A3084062DE4ECA82239C859A063C3157FBE55E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683456563, "uuid": "169e0086-d98c-4bc9-8886-7206fd7dba1c", "value": "768:vfZYvZxNZ/SPjiUv0w0zyIvfgJy2LHRfbwVz9q3UEL2qEK5J6OAsNTGjf2tl8XOU:0PtQjiZVcykHRDbL15J6RN2tAt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683456563, "uuid": "b3793f29-e0b9-4c53-85a1-c737d679781c", "value": 51432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683456563, "uuid": "b94bafcc-86e4-4076-b2dd-41ce90ffde4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683456563, "uuid": "560d26ee-0c32-4ead-a41f-69ab99bf75b7", "value": "7834efe917327193aee4f0a3b292dffc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9c80b7b-ece3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683469941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469941, "uuid": "e6d4ae5d-f39b-407d-9367-7eee286464ad", "comment": "Malware payload (AgentTesla)", "value": "97c8c0881e8685663ee4ab3374633738", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469941, "uuid": "86817b94-a16c-4e76-a1fd-bb143b3dd047", "comment": "Malware payload (AgentTesla)", "value": "a3c83ed0e5f57786c708af4ee4f5ea3dad116ccaea27d92d3ee0ae92db3f0fbd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469941, "uuid": "88b571c4-8041-4214-9a84-413abfab80a4", "comment": "Malware payload (AgentTesla)", "value": "9d9aba0b4e0efde5b63ba78a9f914976b53e0dcf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469941, "uuid": "a307a67c-e1ca-42d5-8bbc-a70d66f2d4f8", "comment": "Malware payload (AgentTesla)", "value": "c38dbde9b534afa68abba4bfa58bf80451bbeea91aea8b5897be13c192fcc409c9aaa4043a8c7982cef0c358cc98e953", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683469941, "uuid": "6389bfae-dbc4-4b5f-b473-f1f51ebb02bd", "value": "T139D423C8F8075F843516A49D4CC7361E9593BEA4216CD6FB1892E6B6B47E3C82D1CE83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683469941, "uuid": "175a3d6a-b468-455b-8835-7ad382e7e713", "value": "12288:BQJWEgNJQslfxIExwu1matt/wKdbYK9OfePCp+qcqSlU3gUc:qWLDlDwu1mattFbYK9qkhqSg2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683469941, "uuid": "e09d475c-87d5-4d78-96e8-d1ef40a250f1", "value": 598644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683469941, "uuid": "694b55ca-16e6-4ac4-8d0d-3280ab0a7ab0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683469941, "uuid": "b94838e1-d479-4faa-abfb-0278c78c1555", "value": "RSG - USD 37,760.87_pdf_____________________.zip - (4)_1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3d250ab-ece3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683469931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469931, "uuid": "8aa02000-5bee-40ae-a638-9a5c8d160808", "comment": "Malware payload (AgentTesla)", "value": "e4a193e229807fc9e9e28d928f1a63c9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469931, "uuid": "f1f719b3-f4f0-48c7-9ace-ad4f2115f089", "comment": "Malware payload (AgentTesla)", "value": "a486562b0d8c6aa23eb81a203a435824e9eb7ca33a5adf18d521f87504dd39d8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469931, "uuid": "52066f68-e4bb-4771-a897-d6db25026191", "comment": "Malware payload (AgentTesla)", "value": "014d69c8d6bfc4c7f74ed8c137d3cbcad338b444", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469931, "uuid": "4f6297ee-04e3-4467-bd0c-dce58bc70bac", "comment": "Malware payload (AgentTesla)", "value": "0885ec19823ffce61a4d1971b4b7828a525bf0fac453d2cc8ff0d9dff173bf6bb479cbe10d51866a75942bd401308ea4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683469931, "uuid": "e5ba4337-7336-4986-984f-85b73cf78780", "value": "T133D423C8B8075F843516A49D4CC7361E9593BEA4216CD6FB1892EAB6B47E3CC2D1CD83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683469931, "uuid": "f1682b41-882a-49ca-96ce-e40573609b82", "value": "12288:dQJWEgNJQslfxIExwu1matt/wKdbYK9OfePCp+qcqSlU3gUn:mWLDlDwu1mattFbYK9qkhqSg1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683469931, "uuid": "af097685-05f1-4423-9621-01366ce22b76", "value": 598508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683469931, "uuid": "a9c10dec-34a3-4a60-ba33-8cf36eaa46fd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683469931, "uuid": "190e6a48-1753-45a1-b947-b294a84326c4", "value": "ezLGJLXuftPIrq7.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04a70109-ece0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1683468241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683468241, "uuid": "5d240ab9-9e7c-4d61-9c2a-5178a969a285", "comment": "Malware payload (Vidar)", "value": "5a7278a064e4a62b707a2fd6a87c380e", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1515", "colour": "#D79557", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683468241, "uuid": "e4a1c526-f481-481b-bbfe-65657ed118b6", "comment": "Malware payload (Vidar)", "value": "a48c6a54efb7b704963e71c986a2f46decae532bc84f1c1552a9ee71d9935341", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1515", "colour": "#D79557", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683468241, "uuid": "b300becf-3f4c-4a4d-befd-5683f4b8d723", "comment": "Malware payload (Vidar)", "value": "acf4864bafba40d2fef9d207c6f8f6dcb14f2a1d", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1515", "colour": "#D79557", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683468241, "uuid": "d688b1b8-8f92-47b9-968a-cd7c2140e5e5", "comment": "Malware payload (Vidar)", "value": "a8b49fc4fa15ecc6cc07361c1854d11654e039079fef974edf979cabb2a7708690ce5bb159e70bdf9b2c5459d977a788", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1515", "colour": "#D79557", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683468241, "uuid": "e31acb8b-090d-43b3-81fa-a0576e28813d", "value": "T14C95336A9053DE517E08956F6E2D46980384C63FF98172DF8B0AB2EF3F8D6F58910C19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683468241, "uuid": "2b64313c-52a6-4733-90cf-efd71c16adef", "value": "49152:1y/2dfF2GkVAxD1MbkjepHQ3AbkQJJ4UL1L5BalAp8PkE3YCon+DXyZ:1o2dfUGBKYjO4A1JH1L5BYAEkE3JonI+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683468241, "uuid": "beac6c86-67c2-41cb-955d-8517cab3be11", "value": 1960638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683468241, "uuid": "4738e5e4-6e07-4db2-86a4-24b9e59fbc23", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683468241, "uuid": "4bf1bfe4-5edb-44e6-b89c-575054be7314", "value": "GTA_V_KIDDI\u041eNS.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4091cdd4-ecba-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683452020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452020, "uuid": "210d7bdc-002b-4719-930b-c43863a35b0c", "comment": "Malware payload", "value": "5799d8d3ccefc59aa453320b86277ca4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452020, "uuid": "29b0aa5e-e3b8-4da5-8639-49acc8690145", "comment": "Malware payload", "value": "a5cd18ea15c6f068be1c536fc143b46aa2675ae80dfe9deddd3a80221723c953", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452020, "uuid": "2683f8b0-85ae-4f2d-b6de-4d9a4ef20536", "comment": "Malware payload", "value": "08308cbd606464c948c85b5991805367d358db9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452020, "uuid": "67e63775-e6e3-4474-8e64-acb40bd579e4", "comment": "Malware payload", "value": "2f6e96db4565701f1ed526259579d8b4c27bb328eee5427f5f776ecd9a44c92cd679b625d698fcd2a9f017905cfae0ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683452020, "uuid": "20118a5a-cc1a-4ea5-9075-fc0d2f61f72b", "value": "T153F3BF223690C072E253167449B5D6B66BBBB8310BA1A9CF2BE9473E1F746D1DE70307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683452020, "uuid": "85062273-9cee-433e-9f5e-49d0123ee905", "value": "cb0d32ad83907c8b5d9a97a27bcf3623", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683452020, "uuid": "ff655886-1e57-4261-87e0-a6bf800d13c5", "value": "3072:TDF6y9X6dtpR/23Ad+KnvAIBov5KJjzzG0MVGCLYrB8jfUcIB:I0ApR/NkKYIKhMzG0IGCkrB8jf6B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683452020, "uuid": "99b75c13-f17f-434a-8d90-c968a85c60a6", "value": 169677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683452020, "uuid": "05764e4a-b396-417f-b711-7b13963be66e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683452020, "uuid": "4ff37d5a-c225-45a8-8284-1bc7cac5353d", "value": "5799d8d3ccefc59aa453320b86277ca4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52d71744-ed29-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683499725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683499725, "uuid": "ffb9e914-c635-4395-b807-a72e3e0e32fd", "comment": "Malware payload", "value": "27be4d1930a01d4a3ddebaa0d179116b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683499725, "uuid": "f43ae507-c0f5-48cd-b6f8-54ddadde3e21", "comment": "Malware payload", "value": "a7cddaab26425d654855f225afae2271c57fb051352a9754c968b57b5fd6579c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683499725, "uuid": "83f45c5c-3a3f-4fe9-a9d1-ff5ac2bd7ab1", "comment": "Malware payload", "value": "75b6c25584a4e34a926b6c3f5c64aa6975589a4c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683499725, "uuid": "877a25d1-5b41-45b0-9f4f-560300c22e08", "comment": "Malware payload", "value": "5f75d2d43d02285ef727f9b58f55d3a3fe15f0dd7950d74c7a323c243614f349d3bec2e7af34b6ca8ac4bb278563a809", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683499725, "uuid": "886e4678-aeea-4b84-9a37-5b38848fa09a", "value": "T12BE523C836DDB0B3F65524B80B5BA6BF15B1BE3685104C23BBCE269306B9B4CF251653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683499725, "uuid": "0b53f1fd-288b-4124-b2ca-c69ffd09758c", "value": "4ecfbe6e42943fae92c4582752c63b2b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683499725, "uuid": "2c66b8d5-a6c2-498a-a337-2f77e3d604fb", "value": "49152:3NtxIRIBa3qKcZMBD3TFJP1rXdTl5s6j4dcaXD+jC0Ws:3NXIRYa6KBBrFT4dLatW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683499725, "uuid": "d291a48c-2adf-4a1d-99ec-1b482a44d630", "value": 3248640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683499725, "uuid": "8903a719-0703-4bf1-8a71-674aa5ce148a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683499725, "uuid": "d0cffe23-e8a4-4e43-903f-2df74d2f3cf8", "value": "27be4d1930a01d4a3ddebaa0d179116b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b50af97-ecb9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RecordBreaker)", "timestamp": 1683451555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683451555, "uuid": "85d112fd-f4c8-40af-b5ed-570ea664b9be", "comment": "Malware payload (RecordBreaker)", "value": "1c6a3c722e6459e4b417fd7701472a72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683451555, "uuid": "6a3ae257-d700-4b2c-b75d-1f401662ec21", "comment": "Malware payload (RecordBreaker)", "value": "a80f5878b244926dfd47f2d14a2df321c480289b19931f3eb5b26fdd0ef18b26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683451555, "uuid": "2f56ba39-ae93-4a5b-9084-d0af28d2feae", "comment": "Malware payload (RecordBreaker)", "value": "141567c7e960b43734241a63eeb6b671efe843d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683451555, "uuid": "3df90714-ec5c-4bf5-a04f-ab101fcef7c3", "comment": "Malware payload (RecordBreaker)", "value": "d7851fca9451ed0783ac899b407b3263c2e9a3bd77f921ae5c89132873182ad1c1a805e835260bcca0eeca088338d89a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683451555, "uuid": "9242d3cc-cd3b-4779-bbc3-2cf60d10c269", "value": "T196746B1272F16D70E72A5A328E3AC6E46A1EF951BF1567DB23746A2F0970DF2C172301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683451555, "uuid": "1a560c9f-3ca7-48b1-be6e-2aa57151f30b", "value": "992b89dd1cf69c4a8881c4442ff0a51c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683451555, "uuid": "e9ea51dc-65ca-4ec4-bba9-35ae2d0fff18", "value": "3072:URMYqmZm3tGBp1ovNsW714jpvtRsEJNEK0V4x+b9ScCG6qt61BT8r94vqOfDT:UZZbC+W7SjHiyeV4G9F6fHqOr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683451555, "uuid": "8e772702-be8f-47ea-a037-0a7bfaaaab96", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683451555, "uuid": "47325c9b-bbc0-4180-843f-935292f51885", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683451555, "uuid": "fc3f790b-e866-4134-aa78-161f5605a735", "value": "1c6a3c722e6459e4b417fd7701472a72.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50e98f3e-ecc4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683456343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683456343, "uuid": "aad7742e-6943-40a8-bf9c-848636bb9467", "comment": "Malware payload (RedLineStealer)", "value": "6b276c4abf6bde22d977601e73724d01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683456343, "uuid": "f86cae2f-fda6-445c-bc50-0f30e6e66e49", "comment": "Malware payload (RedLineStealer)", "value": "a943e516323c3dff5d5ad9c3979d6b03651205051b9aa88a840c3d4a4e492156", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683456343, "uuid": "91bfb601-cc12-4238-889a-f5fe953d6ba0", "comment": "Malware payload (RedLineStealer)", "value": "ac18e7c2b018598c84ebd69fe9278d4792efa759", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683456343, "uuid": "1d821fe4-d1a8-4810-a378-ca1fc8983067", "comment": "Malware payload (RedLineStealer)", "value": "c3eb8074816ada18de24f076b8f81ccba650666d2b59d3ccf50de1b90b6bd9daf1942ff4b56ab399308b5c34d8684ff9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683456343, "uuid": "7178bc40-a181-4337-9233-62ebeaa07b5b", "value": "T153A40222D7F89072DCB6177468F603830B35BD614978936B3785AA5E0CB3B84E47672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683456343, "uuid": "72e02277-5dbb-4ccc-b2fe-855a317ac894", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683456343, "uuid": "aa50d3c1-02b4-456d-8386-696d6163b2b5", "value": "12288:OMrQy90RiZsminoB4dxq2OvrBqyvafm309dyAWS00:KyTZ9Qo17dZn30Pz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683456343, "uuid": "65ed80db-ccc0-475d-96bc-aa359a40e7bc", "value": 492544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683456343, "uuid": "51803294-5e9a-49bb-b888-f180673d030f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683456343, "uuid": "0b3de202-ed9f-417a-bbae-ae458294937d", "value": "6b276c4abf6bde22d977601e73724d01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54101e7f-ec6b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683418123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418123, "uuid": "4764d267-789b-46cc-bb63-7df21bbcfc8f", "comment": "Malware payload (RedLineStealer)", "value": "613448e241fd49ad2542ce513f8fa218", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418123, "uuid": "f59391a8-03f6-4a13-8260-be8825073d8f", "comment": "Malware payload (RedLineStealer)", "value": "ab55bcdfa1ed26570e4b5376d78e091e5419625ae5bd94c4bb516826ec7b5a89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418123, "uuid": "355c21ce-cf3a-4b3d-98ef-53f6f30c1b32", "comment": "Malware payload (RedLineStealer)", "value": "a9322f70f691e91bd0f7cb3ca108351ed7cebc5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418123, "uuid": "010774ca-5e4f-40ae-9dc5-1f3f013a6cdc", "comment": "Malware payload (RedLineStealer)", "value": "56bfa806f90d6f07cfa6b632c2d81e787cf3bf5077f5c4827541f3077db6550715d4cb79c5a0ff6b56da5537864a290e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418123, "uuid": "85a97812-c435-45f7-80bc-5e5bb3ea175b", "value": "T1A9A41212B7D88132D8F527B428F603930B76BC96CE7486972752295F1C727D8A4327BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418123, "uuid": "de4debcf-1c92-402e-ba13-7ffa69f78d2c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418123, "uuid": "3010d531-b388-4138-9116-8c77cd9b5037", "value": "6144:KQy+bnr+Xp0yN90QExQdkW8nZNXX42bqv3TMo+g3Pr2uCCo3DRVZE35QCjIZAmxC:8MrHy90xUvj9+g3PrM5DRjiem/d40z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683418123, "uuid": "0a9a45d8-9cde-4d27-ad7a-5e33b86b5a81", "value": 490496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683418123, "uuid": "342132c8-ef5b-4e50-a037-cd5282672ba2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418123, "uuid": "99b04e38-a278-48b0-8018-c8e8283724bd", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "167e5608-eca7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1683443789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443789, "uuid": "0874e3f2-68d9-4fb6-93bf-d63dfe4883a7", "comment": "Malware payload (Vidar)", "value": "f6c2d776d86cf21672d25a9f71ee4c2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443789, "uuid": "f18897dd-0285-417c-8c6a-5375545efd47", "comment": "Malware payload (Vidar)", "value": "abf0231bdf8df9e4d630de314ca71979fcaa7ed45037bb688d0d848e5d286145", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443789, "uuid": "09318634-0aad-42ca-a029-6db4fd64ad4d", "comment": "Malware payload (Vidar)", "value": "c3ca6b0aa4f5e3649240864d29702d72a9031521", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443789, "uuid": "9dd77cbb-a9b2-4813-b46d-9d29aa725b94", "comment": "Malware payload (Vidar)", "value": "0bd472e5f8e6a8e39ead3f2ebbac05f657c1cfa1a86d7e7b1ad017cebbcaa24f7ff42073893fa463a5256993e2944517", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443789, "uuid": "4aee1f0f-dc04-4d9d-9cab-d973cd21eded", "value": "T1C3C1E920E3D49736D9224775ACA393511274F7219D93CB6F28C8014FBF827A50E62FB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443789, "uuid": "94340069-7684-4bb5-b84c-931654270717", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443789, "uuid": "d6d48e31-1b33-4b32-b7ff-89706dac0f25", "value": "96:3tql2niJ0bHs5DLdWQttXzokQ4Eup6BeOb4SULR+HUBzNt:9LVD8LdBXzov4EuoBprS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683443789, "uuid": "b625479b-79ef-493c-9f8a-39495cd6a00a", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683443789, "uuid": "6b7cb1bf-6b86-41dc-9c92-62318b96975d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443789, "uuid": "878cd15d-75c3-490d-acc1-a89daf0d74f0", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "113d5968-ec6f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1683419729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683419729, "uuid": "6c7e6476-6f59-4f05-9e19-be0408c122ca", "comment": "Malware payload (DCRat)", "value": "fe12a02585a6ce25746ee2a914377cf1", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683419729, "uuid": "9088655e-3f83-49a5-b790-f2b611cf4c12", "comment": "Malware payload (DCRat)", "value": "ac08903be48df04ee8b744c61a65c8003af729943049cb4d04870854686c93ca", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683419729, "uuid": "2a4568c6-00cb-471e-9c74-a65d4f32695f", "comment": "Malware payload (DCRat)", "value": "078ae76a2b2bd974edbe3d8b05fc092d95b61668", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683419729, "uuid": "33bd0c17-02e5-4f89-85ff-15bc74efa402", "comment": "Malware payload (DCRat)", "value": "b19e13fdb1391366b26939380cad83a92ece00e619f1ca0e5235443ac4607fcb32555191bbaa690675ed55831ccd6e4d", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683419729, "uuid": "177f1a28-7f43-45bd-ade0-ed50c98d195a", "value": "T1BB76BF67B712CE68C0CAC571A19797B15B20BC1404B6A3073ADE371E6EB2B402E5D9DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683419729, "uuid": "24f86adc-727e-4af7-85a8-3b56dd37eada", "value": "027ea80e8125c6dda271246922d4c3b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683419729, "uuid": "385c5c9e-c369-4fb9-846a-e7ce4e8f652b", "value": "98304:qAbiwfZ7n37gA2hX3slpP0FA+uZiQlPjq/+3vzO0Kt/zxcNkHZVd/2sT:qAtZzL2hsE6DZiQlPjq/0zqzxcG5n/28", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683419729, "uuid": "83e8c5b2-fdb1-475b-848f-d4e8d9e2c2b3", "value": 7803519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683419729, "uuid": "b5abb571-3906-4a5c-9276-4accf5b1d8b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683419729, "uuid": "bc318092-518a-4256-948f-456509b0919d", "value": "ac08903be48df04ee8b744c61a65c8003af729943049c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac7d1df6-ecea-11ed-b3cf-42010a9c0076", "comment": "Malware payload (TeamBot)", "timestamp": 1683472817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683472817, "uuid": "28aeedd3-db6e-4c10-b0fa-d1696daf51ec", "comment": "Malware payload (TeamBot)", "value": "461d6a95c78bf16d6c87b1a52e62a7db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683472817, "uuid": "7cc29b45-c19b-47f3-a890-d8ac7d96fea3", "comment": "Malware payload (TeamBot)", "value": "ae885192cfaf1655c6ab43f0dc2cdd8de807daa1cbca6043cea07a7df01acb11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683472817, "uuid": "5a17a72b-4cac-469f-8dd8-6d4cebed9686", "comment": "Malware payload (TeamBot)", "value": "905aa67c72110b33903d5f96d3c15c1006dc98a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683472817, "uuid": "b24f1578-f925-484d-9490-a866efdfd45c", "comment": "Malware payload (TeamBot)", "value": "f6694b20c904d128cef93d982b78ea63c8582602da5895e75af783827e6d305588acd0828068f1c7db06cb3b2069d222", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683472817, "uuid": "edbd37b0-fe32-499e-a983-4d6cff7568ad", "value": "T19664FA43A2E13D54FB264B729E2FC6E8775EF2608F59377922189A1F04B11B2C273725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683472817, "uuid": "c4ed9333-6cd3-4323-bc9e-88b4df109e3a", "value": "d69fc05a14cea9e3be0e4e4cd2aac7e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683472817, "uuid": "cecad21d-f4f3-4134-9385-0cc411d68831", "value": "3072:TAXkGWYKnqDheLnY7BtIUj39nQZ4b5oukslUJrHJY1NSEXsj7sgT5g8ckxNnDA0z:wCYK4kLY7rIUj3ijrxhM07skxxDAGk+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683472817, "uuid": "6ff2d7de-435d-496d-a7ed-30ce9038437a", "value": 320000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683472817, "uuid": "f9a2e9e5-c621-4b5b-83d8-2c3142b133ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683472817, "uuid": "152f8dbd-5f8f-483d-ba49-5861840d8d3a", "value": "461d6a95c78bf16d6c87b1a52e62a7db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf067a87-ecb7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RevengeRAT)", "timestamp": 1683450971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683450971, "uuid": "306a6673-5444-41cf-82b0-efae16cfa274", "comment": "Malware payload (RevengeRAT)", "value": "4f1c17e2da8035b8fd827f0fc93a1a40", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683450971, "uuid": "1477d73b-6909-42c8-a866-ae39d2bdf536", "comment": "Malware payload (RevengeRAT)", "value": "aebe55c79817edcc4acff994e9dcb9230487092073bec48ea87448b90db1f888", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683450971, "uuid": "1f24e1d6-b273-4c26-b00e-93d864b0bf90", "comment": "Malware payload (RevengeRAT)", "value": "a47bf8b3d28d36279cb8a5a22f8c9a35206327a6", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683450971, "uuid": "c05037ca-0322-49b3-bf3f-2b04ce777540", "comment": "Malware payload (RevengeRAT)", "value": "efccc95eeb89c5addc79fab98340692d08da9fafe08ad2c77b308cfc1cf47bd9b9ef9f21c05e1af8e32f27c1b012d5f1", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683450971, "uuid": "ea7cf488-35ec-4d4d-bdce-ee217751c23d", "value": "T15382D1CBA9692498DDC61F30DE48357BA04DD0A649471D0F02E5BBA4CA110AF3FED735", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683450971, "uuid": "14d4f2a8-0579-4644-98f7-543578f674e3", "value": "384:dXPW8kJL8XaHgQOeE2kq9KkqkPGv9tMp4V9zNNxChJd:VPFaAn2kqnRctMgbNxChJd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683450971, "uuid": "1a2c3436-6d62-4f9d-8267-44ac5178df60", "value": 18132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683450971, "uuid": "6b95c342-2802-44f6-b4ff-455701672505", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683450971, "uuid": "a6850ec6-50e7-49f9-a7c2-6e72f7f16cd5", "value": "Documentao.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51e11b6e-ecba-11ed-b3cf-42010a9c0076", "comment": "Malware payload (LgoogLoader)", "timestamp": 1683452050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452050, "uuid": "41af2523-deb3-4251-8daf-552ae0a542b0", "comment": "Malware payload (LgoogLoader)", "value": "b3e23e3f8df08791a75e1b569eb326c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452050, "uuid": "4adf830a-2b9d-4d60-a32c-364e9d9e4097", "comment": "Malware payload (LgoogLoader)", "value": "b050f2f75118f23a0425f80405dd856d0dcdd94c96671febc50eb59d873a5e4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452050, "uuid": "cd75f910-2394-4839-87dd-d1ba34ef633b", "comment": "Malware payload (LgoogLoader)", "value": "03592b66df10c33a9490578d97a359b6fed58294", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452050, "uuid": "fe58afb5-9448-469f-ae26-3d5390681027", "comment": "Malware payload (LgoogLoader)", "value": "b5c066cf561803fa99cec08b24d7a0a1739cdb5e8dc72d589227bb369c2a562ffbb30434b9aef65569a4e6acf720333f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683452050, "uuid": "7e9a06e7-7149-4399-9646-54ac6efb00d1", "value": "T1A1B4CD526B0D922FFF7CFB31C8BBCD799E2993EE3841CB2402898958E9595408375F52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683452050, "uuid": "316df56c-68f5-40c9-bfba-792472502265", "value": "12288:cMGEajxzpChyH9mRelI8W63FBlV4rvH6gG4xw1COE5:cZpChmkAlnW63nlV4j6dN1Tk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683452050, "uuid": "87460cec-3b79-4883-985f-c1d35fdc4eb0", "value": 503664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683452050, "uuid": "f1d8ee3c-8aa0-4db4-a5b7-2e23d18ce52d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683452050, "uuid": "60e48f31-9f43-4167-a294-13e304643486", "value": "b3e23e3f8df08791a75e1b569eb326c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e66ebee5-ec8f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683433830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683433830, "uuid": "f3878c20-1ef1-496c-9d47-0eb5266cca3e", "comment": "Malware payload (Amadey)", "value": "328e77dccffe4ac96865fab2fa053427", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683433830, "uuid": "9f63ad0e-0a64-4302-94a6-4e81a5032a83", "comment": "Malware payload (Amadey)", "value": "b1895ff6323dad953e81dc8352066c809d9a8a336f297f39fbae61ee56e4f1a9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683433830, "uuid": "38788668-c687-4cf0-bb0b-cb00dcca04a3", "comment": "Malware payload (Amadey)", "value": "886eb192047cd47325e3e130d3f8b43771592e10", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683433830, "uuid": "ca29a6fd-dde0-4192-a4ff-64f2b009fbe0", "comment": "Malware payload (Amadey)", "value": "0d3dc87014daab3ae3ef529943497bcb15382633bfe60efd810ea51441d0a0472a7c69f64e8919b022241432054a4d43", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683433830, "uuid": "9d38eca1-3a57-4c5d-9603-d31493649f46", "value": "T110A40257E7D89071D9B117B058F203C70F36BCA29DB0D72B2345A89B08B26D5A93277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683433830, "uuid": "da19c3c3-0642-482a-ae31-b34d37452c03", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683433830, "uuid": "d49c307d-59c6-4682-937a-8e44ab57d4d8", "value": "12288:mMr8y90dj/ws6RiA8EgzWcoTRArmojuYcm1nvSy:uyk4ezfoFAfcgvSy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683433830, "uuid": "099b5f0e-8197-47f6-a065-5debf7357526", "value": 491008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683433830, "uuid": "9a21dadf-0a17-4163-bdf8-522c7946ea7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683433830, "uuid": "28337ce3-029d-4bd6-82df-fe9c39356ae8", "value": "328e77dccffe4ac96865fab2fa053427.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1732e03-ec6b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683418306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418306, "uuid": "c4ef7cf8-725d-4a7a-8ebb-9911aba33ecb", "comment": "Malware payload (RedLineStealer)", "value": "c0128e221c2c58fb32fa6865e93c635e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418306, "uuid": "cd43f249-f55a-492e-ae0c-d079ed58eb53", "comment": "Malware payload (RedLineStealer)", "value": "b237a20dd5d6d51b4a62fc3d0097cf5ad4176ce957de884b200863f3e1e3e8b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418306, "uuid": "e04cf661-b93f-4363-a7fc-d24bb80029d1", "comment": "Malware payload (RedLineStealer)", "value": "dc8243ebdd30414a7d37ff516dd31adcda66e9f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683418306, "uuid": "9d9545ea-5716-47d6-aa01-d1b930f210f6", "comment": "Malware payload (RedLineStealer)", "value": "4192d74ee57fc0abe841790aa375b2f801648c057dfc37dfe0282db52d8acd2175021c9933d60cb2ce2dfff46100ee5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418306, "uuid": "f2b905a8-2e90-4dad-8d3f-ff31c85750f3", "value": "T1F2A40256A7D89072DCB51BB019F707831B367DE558A8C3AF3350A88B1CB26C0B57672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418306, "uuid": "3bb3ac5f-b04c-4e68-a991-91d32186fbe5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418306, "uuid": "f922e7e9-e65d-48e7-8bca-876dbd6a5f77", "value": "12288:tMrMy90bB6rbDMt4ikbEM7obMILHNUArpm8:Ny3DgI7OHNtm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683418306, "uuid": "c974f496-aab2-4939-afd7-4f513ffa2c85", "value": 490496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683418306, "uuid": "e149024f-e93f-463c-8161-eb88e8bfcf06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683418306, "uuid": "5e938c4a-cea1-4605-9433-cf0022d823df", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14be0782-ecdb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683466120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466120, "uuid": "ff648ba1-5d86-4d7d-af8f-be254eb9cf17", "comment": "Malware payload (Mirai)", "value": "e7a26a3dba3e2380c3909d53d6dca64d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466120, "uuid": "c07281ec-fde6-4c0e-ae3d-8fe041fea60d", "comment": "Malware payload (Mirai)", "value": "b247cf4792376230ec16619093a316f7129c13915e236a0fed046c235d7e6a41", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466120, "uuid": "29b8c7c8-53a0-4a4e-b54b-cbab2597b653", "comment": "Malware payload (Mirai)", "value": "f6a2d9a12937d03ae1f6cbcfbceb407026491879", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466120, "uuid": "d944929d-8184-40d6-ae91-be244cd462e6", "comment": "Malware payload (Mirai)", "value": "1c3ff4665fd7ed2559e2f6fec275eeb11dfce5fac441548267d94a15153fde8dd0c35a3cf413b4962e0ba0f92b08e20d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466120, "uuid": "ec0c053a-92c2-49c2-8100-8c88f61a94f5", "value": "T1CF336C36E029DED0C6560234A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466120, "uuid": "3fb798ed-8fc2-443f-9282-5baccf98466e", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683466120, "uuid": "f6b7fe16-1f31-4400-a309-aad987b58729", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683466120, "uuid": "bc88a489-a123-4953-b551-22b395f8f81f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466120, "uuid": "dddf8796-466b-487a-a9d0-46464e02c32b", "value": "e7a26a3dba3e2380c3909d53d6dca64d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fe2a591-ec86-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683429632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429632, "uuid": "b0dbf0ca-47bb-47af-bd95-51c485fa04cc", "comment": "Malware payload", "value": "f1e7202930a71a873237c3295bcec4ca", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429632, "uuid": "0dc633d9-96da-4d57-94f9-b28d5518fc28", "comment": "Malware payload", "value": "b2e6d6c43d1c407084aa105e1932637ef46f46969dca95e5e7ba80e80abe667b", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429632, "uuid": "ce942033-0348-46dd-9ffa-5561c9df3072", "comment": "Malware payload", "value": "8e8b585eec4108a299bc04d6be15122af8112bef", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429632, "uuid": "df894111-dd70-4f50-9ed6-69fb7f85f54a", "comment": "Malware payload", "value": "b87c36710be1af6744b0a8b0f1ebe5043418359e76684c99aaf924f3ce21d4a819b29281cb74f5c2cd35011e5a697c8e", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683429632, "uuid": "f10fdf41-aa0a-40da-8d39-49b1a9e881a9", "value": "T165513EEAD3E366FC47A9C6C7F8B72C630F1D101A92F874192E906356EDC5E1C72606A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683429632, "uuid": "6445bf8f-1e59-4522-933d-6162c5328253", "value": "48:dKxA9AZD2RmoDO4DiRolDJJQTal8MDF5QTPhnDBJ8jR2Np/DxDNDEzWMjgEQnglW:dKxAGZD2RmoDjDiRolDJO2l5DFaTPhnJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683429632, "uuid": "bf8e027c-1e19-4ae4-8a70-bd37cb3c86cd", "value": 2608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683429632, "uuid": "f9cbbe8e-fd35-4783-bf24-539b18ec12bb", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683429632, "uuid": "c2f76f2e-879d-4d1a-b859-e21c1a1fa798", "value": "VirusShare_f1e7202930a71a873237c3295bcec4ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb5c71b2-ec6a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683417974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683417974, "uuid": "4ac16a64-b5be-4993-b8e5-774890264202", "comment": "Malware payload (RedLineStealer)", "value": "51d38ad201aeb5c88172ca78f058e800", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683417974, "uuid": "e7b8faf3-332c-493d-8a77-ebf27616237e", "comment": "Malware payload (RedLineStealer)", "value": "b37492169a7d62c2460336e08f61478467e7639045791f9a34e46cd0398de048", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683417974, "uuid": "ddd095a9-8a8e-4ad4-ba81-9edb190fe3d6", "comment": "Malware payload (RedLineStealer)", "value": "b3e4a12090e61e7074e2737317e99da147d83d88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683417974, "uuid": "aa6fc08b-c393-4965-979e-d2b3b95d82fa", "comment": "Malware payload (RedLineStealer)", "value": "e38fa14b8d7cb3d9af15ac94accf823b0c7b3ebdf1bb746728a655f97e3121bd6f4fbe0562dc3c554a7207f8c94f39fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683417974, "uuid": "a5f81fef-f095-45da-be20-7d71acfbf738", "value": "T1D9B41242BAE88173E8B517B058F603C30636FCF1ADB4575B2381A95B1CB3690A535B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683417974, "uuid": "7c71708f-7c3f-4fda-a13f-1eeea218e393", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683417974, "uuid": "86dfe08f-4cd8-4d40-83a0-cb5d4b55c25a", "value": "12288:+MrEy90+9n+Vg+M2CPFK6FEhkXSyISZ4wYCP:OytOVos6GhkXLNYy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683417974, "uuid": "1bf0cc55-5354-4695-bd97-2e13b47d85e0", "value": 503296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683417974, "uuid": "e0652a10-565f-41a3-acb0-b2e8d6acf770", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683417974, "uuid": "d419928e-ca75-4b71-a29e-5d03ef45faf4", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbb80b4e-ec96-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683436792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683436792, "uuid": "bf8f2c06-9b76-43e3-903e-77b0685e1d62", "comment": "Malware payload (AgentTesla)", "value": "ffafca7a1d4193ef89ea4df614f92224", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683436792, "uuid": "9835b85f-6b2d-44e4-9620-1bfbe92e3eb0", "comment": "Malware payload (AgentTesla)", "value": "b3cd2c1c4175d167fed9aa6ddf4d0d6fd1a1a97e0192c4896e500bb7d4cfed99", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683436792, "uuid": "f56a4912-09ef-40f4-bf6f-f4709ce539e0", "comment": "Malware payload (AgentTesla)", "value": "ec858dae72dd7f02411db243ccfb207d9653bf88", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683436792, "uuid": "97d2814c-5a88-4fb5-b67a-239db0944070", "comment": "Malware payload (AgentTesla)", "value": "a1df8d9436c7e465a0cddf25fc0dd5d5e82329e2c7204a287107f83572fcef3e4703d920d136bc8c5b19088d238d540b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683436792, "uuid": "44548881-2c1b-4f96-9751-48dfd0316fa0", "value": "T13FF4E0543679B792ECB683FC3204A5019FA56C00E37AE3E84ECAB0DC5596B15F620B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683436792, "uuid": "0a469c28-5694-4173-a2bd-3f015567d80b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683436792, "uuid": "8432051a-ffeb-4849-a1ad-31af41fdfd54", "value": "12288:UF5njktM+USdRqUQjQ8cGeGt5Pq4B+Ce67GOUaEhvJ7XZ:fcGRocFGzv+Ch7lUayJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683436792, "uuid": "70fe81c5-fc67-4b67-b3ad-1b94abb68723", "value": 752640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683436792, "uuid": "ff5a394f-7f19-4675-a829-b5446df4a103", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683436792, "uuid": "1470e67d-5243-4a39-be8d-074afa18f506", "value": "ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74b8ae5d-ecdf-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683467999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683467999, "uuid": "444f7316-b8b8-4cd5-877a-d072e35c863d", "comment": "Malware payload", "value": "1fff397bece4e272287ba6f81a9878e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "IRCBotnet", "colour": "#D0B572", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683467999, "uuid": "2c1192c0-f6d4-40d0-b2aa-f4829e7e509b", "comment": "Malware payload", "value": "b66c7fb85420c5da36eb5ae3d2e54c484ad8b25da7f5863789ceb2f1c3a37dbb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "IRCBotnet", "colour": "#D0B572", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683467999, "uuid": "5678a9cd-ae86-42ab-b537-e3742e6a0543", "comment": "Malware payload", "value": "8873661f27d656d25b5fc7b1539e0474d7d64beb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "IRCBotnet", "colour": "#D0B572", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683467999, "uuid": "d7118cf1-985a-43d2-a6bb-c0119d4cc930", "comment": "Malware payload", "value": "0afdd1d510fb659ef70915742d009e874dff15d8bfa3c235d0dd3c5a8feec7cdec21faaeac043255c3137782fef81801", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "IRCBotnet", "colour": "#D0B572", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683467999, "uuid": "ed25fea4-562e-4ff7-adac-06a0cdce1935", "value": "T1B9667D87B8D14686C4E43676ACBE80C433A74EB95B9B53666D04FE3C3ABE19D0E35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683467999, "uuid": "672f17ac-aeec-40c3-958e-794147c055c1", "value": "49152:O898aHfmBH3VVG+z97hMLubUh1YBB7EcAyl09xnudy3/ij/bMHhjflQ2U529Its:O89DHfo3/B3Tn2fAy3M/IJlQY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683467999, "uuid": "ea602246-5d4e-4022-b65f-cf2e4a4b7393", "value": 6705833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683467999, "uuid": "f9053b60-362f-4af0-b481-ec0ac5cff07f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683467999, "uuid": "3927f357-1b6a-4740-9c67-5538b9334f78", "value": "zbotarmv6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "111b197c-eca2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683441633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683441633, "uuid": "ffbd7cff-d84c-4c26-8fbb-b9a49e9fbbb0", "comment": "Malware payload (RedLineStealer)", "value": "6b4c10f44bd5e8bf41ed48203098049f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683441633, "uuid": "25960a35-dbe6-4fd0-a422-51215fbc79f6", "comment": "Malware payload (RedLineStealer)", "value": "b9bc2bf613ae62071eda092d64f0f719d7f377ec059c6b5de87a7aa20a6309fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683441633, "uuid": "716f6785-85bc-4098-96d6-e3a5236b3c83", "comment": "Malware payload (RedLineStealer)", "value": "860fc0357e693d9240ef6822a43b5a3c8aac0c04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683441633, "uuid": "9612fe1a-1248-42d6-ba50-268992686067", "comment": "Malware payload (RedLineStealer)", "value": "484e17ca2eb525668a3860e02cfe71444d2efa552d65b6c4ad73b80cf52c12538ed575351b590b9eb6c3fdf50be91fa1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683441633, "uuid": "00fa3f2f-874b-4f2b-9803-9d4c3050c591", "value": "T1D3A41243F7E45472E9B92B3018F606A30B36BCA15E7883671252AC9E0CF26C4A57577F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683441633, "uuid": "aaf43383-7be1-446a-a698-ecbd9b27cfc5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683441633, "uuid": "c3a344e4-26da-498f-a793-1b9accc4e8c0", "value": "12288:eMr6y90KiLY7W7XqftoVg6Bsc6rtfLZqL:IyximeXfg+D6rt9qL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683441633, "uuid": "f27ab4d8-88b0-419b-bd60-ee6f9b70f0c2", "value": 490496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683441633, "uuid": "f03c3b2d-1b5a-423a-9c0f-c441156b99c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683441633, "uuid": "e8b30245-1e8b-4d5d-a461-81447a1cd090", "value": "6b4c10f44bd5e8bf41ed48203098049f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "862e4538-ecb4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683449560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683449560, "uuid": "fbd890e4-22db-45da-95fb-ad2357f2fae4", "comment": "Malware payload (RedLineStealer)", "value": "505afffb3ea723cbdf3e690cfce136a8", "object_relation": "md5", "Tag": [ { "name": "37-220-87-78", "colour": "#B081E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeKOTA", "colour": "#00CD36", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw almvbeta058", "colour": "#A0462A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683449560, "uuid": "bc8d1faf-7df7-4e2a-a66e-142a562538ae", "comment": "Malware payload (RedLineStealer)", "value": "ba16f006ef5a5dcc9626b13c5a98b8fe9cfdb4278f45c3e27fb9925a11477632", "object_relation": "sha256", "Tag": [ { "name": "37-220-87-78", "colour": "#B081E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeKOTA", "colour": "#00CD36", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw almvbeta058", "colour": "#A0462A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683449560, "uuid": "7db0cb63-329d-4f3d-aee6-89ec5d0f449b", "comment": "Malware payload (RedLineStealer)", "value": "57bf72f67738933c4cf18fa205f7a8a1923bdd19", "object_relation": "sha1", "Tag": [ { "name": "37-220-87-78", "colour": "#B081E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeKOTA", "colour": "#00CD36", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw almvbeta058", "colour": "#A0462A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683449560, "uuid": "de65c205-d042-48ea-a170-47c914dba4e2", "comment": "Malware payload (RedLineStealer)", "value": "1f2c7bf89e72e9dea512876aaa03539783fa45bec9bdffa8d5df46e75528d2d64bb53a75ba5e28d2db0693939100acc2", "object_relation": "sha3-384", "Tag": [ { "name": "37-220-87-78", "colour": "#B081E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeKOTA", "colour": "#00CD36", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw almvbeta058", "colour": "#A0462A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683449560, "uuid": "dec0730d-3a3c-4db3-b8cd-4894e22553b2", "value": "T1B975336B0599444482F9249DA8D74A079BEF32BA3860CB60F8DEF0C952FD5ECD5106EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683449560, "uuid": "f699de0b-daa9-4c7e-957d-563b563574e8", "value": "24576:8la+L7plCSbgZ1k1dSxo2XOyP3q4RfVOkyTs/8mj4pt+Hk/3LAzB3k0VVua+V:ibL7pYnwuogOyvqEOkyTYYMYM37V6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683449560, "uuid": "d1d73557-45ec-45d3-a0e5-e95bcbac9ded", "value": 1576163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683449560, "uuid": "6e385c2e-9d95-4207-a23a-454be61397ce", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683449560, "uuid": "541718e4-8ac4-4077-89d1-389e0df9fb91", "value": "ALMV_0,58_beta.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "189e1427-ec86-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683429620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429620, "uuid": "ea73cff7-f77c-429b-b456-0ca417fa1bc0", "comment": "Malware payload", "value": "98ea395758ca1261fcbea31f1ed856d5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429620, "uuid": "2a5bd131-53e5-453c-a0c4-127bf2fe1977", "comment": "Malware payload", "value": "bb728cc9af358813e269fa58ef69e596b9b8e6c80ea0f94b238ea7294f900c53", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429620, "uuid": "5b091f95-f1b6-4253-8bde-69d6f17430d6", "comment": "Malware payload", "value": "d2d4d2eee6b12a4f87460b982de9e07bd7cb55f4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429620, "uuid": "2db149ec-4861-415d-b19d-a55968efa58f", "comment": "Malware payload", "value": "bc33c1b20eeb37dda74d403bc4c6429e2c0923251722e4ba5d91448178792c0fecd60230e98db47b918075d9a7ced273", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683429620, "uuid": "47b6fc37-489e-45b1-a5fd-c79e02aa2e05", "value": "T1E616CF403BD0ADBBD1EE6775912681FC4FBCD0866BD7A31B5604A56C0EDE3820E5E287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683429620, "uuid": "282fd7f1-6059-4ea0-aef5-7c866bbbf905", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683429620, "uuid": "23ea1b8d-7c94-460f-a50c-dee650448e51", "value": "98304:oXB4uluJRmMg6QWlIpgi0rHqsih/mCqJ4B4uluR:ovsJR0TW6yiIKRhzqOsR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683429620, "uuid": "4391b00e-647c-47f7-856c-26a685f4cbc1", "value": 4388024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683429620, "uuid": "5bca7c4b-30fa-478d-b217-8ec440b3ca32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683429620, "uuid": "1c1b6c31-6531-4034-a827-237791d2d678", "value": "VirusShare_98ea395758ca1261fcbea31f1ed856d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24bd3631-ecb2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683448538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683448538, "uuid": "f23d68bf-ef77-4bff-8b33-e0d788bbf120", "comment": "Malware payload (RedLineStealer)", "value": "f7db000646306705ae8fbf940c619f16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683448538, "uuid": "174b3116-3cb0-42cc-a03e-fb2de19d9149", "comment": "Malware payload (RedLineStealer)", "value": "bd6603f39e30e79521a170be86bd97be3361c937160f109c20bc481e17af8d35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683448538, "uuid": "b2dc7a84-6d86-4781-9ab6-615b02abf3bb", "comment": "Malware payload (RedLineStealer)", "value": "df2ff1e5da20d8d6578f49547044f47057ca63d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683448538, "uuid": "25814e5d-812f-4e1f-83da-db5d154890bf", "comment": "Malware payload (RedLineStealer)", "value": "bac91d3f8dd74cf37d25ed7b0ae73d7e279e75bc2d49e70ccc7beb7d570aeda5b10dd5b2991a575705a99710ac2f0592", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683448538, "uuid": "ea5d7733-1519-4eea-9f08-4039d553dc38", "value": "T131A402A3E7DD5473D87A27B028F303D30B3ABC614E34435B2259A81A0DB17D0A97276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683448538, "uuid": "a975bcec-b202-4f0a-92fb-4dd49255cea4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683448538, "uuid": "1513e4b0-ae63-469e-b525-d160ce136708", "value": "12288:8MrKy90xe+iiOrRSW3ObW5Tpv96nRV0LA/TT:+yi3Z4F3O6Bpv80qH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683448538, "uuid": "229612a2-f341-461c-bbd6-117977b75eda", "value": 490496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683448538, "uuid": "38ad4d76-7da9-44af-adc5-c4353c4979a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683448538, "uuid": "05fcf306-da88-4c0c-b36d-7a5820b0440b", "value": "f7db000646306705ae8fbf940c619f16.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a130bc9-ed10-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683489027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683489027, "uuid": "f1514eb3-0544-40f9-9f27-c1da44f06338", "comment": "Malware payload (RedLineStealer)", "value": "1b53d81dfae22f06f91dbd2a2a0ea973", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683489027, "uuid": "6d2ad45b-9848-482c-a558-ca2aeade9d8b", "comment": "Malware payload (RedLineStealer)", "value": "bddeb4e0c1c2770a7e4ba14d9491559f04fef2cfff285dbd40dd72f1b4c3056d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683489027, "uuid": "e95c4065-96bb-4f44-8199-597b07704b32", "comment": "Malware payload (RedLineStealer)", "value": "3fc4121615ecb1ec7b69c73efbe7498f4fa03205", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683489027, "uuid": "49696e1b-6a1f-47dd-8c58-cf8ff5b3f55f", "comment": "Malware payload (RedLineStealer)", "value": "1ea74c111ae21733574c643857a2d639a59ceed1b510709fab07f74af0aaf9784e9c5a6bafea88ec0b58ed3efd9df7d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683489027, "uuid": "dab4bc7e-238a-493f-a13b-3db9ec1d1855", "value": "T1FA748E03530EC9BEEE9B60B9FCC482A57B5890B87B6FA287BBD41E15052F1D0769071D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683489027, "uuid": "be7e3470-ce60-4c52-b561-00f39c37fdb6", "value": "d03a32a9d6119786dea4a25b734d4a33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683489027, "uuid": "649ecac6-b95f-48ba-ae35-6c22b9348b70", "value": "6144:xRRFYq5JHpDB9nuXrKwszx/C5VJzB4VeIzgQ:vRFYMJHrluWwsVEkVea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683489027, "uuid": "e5107a3e-4afa-481f-8b2e-1de5c801ec7e", "value": 349520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683489027, "uuid": "c300c08b-ad6e-4b6d-bdfc-ba4061de64ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683489027, "uuid": "2e0e6cd7-4ad1-419d-8ba1-85691b502d25", "value": "1b53d81dfae22f06f91dbd2a2a0ea973.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "726b8564-ec77-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683423328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683423328, "uuid": "d964f690-9ee5-413c-ba4f-f0bf703aedf9", "comment": "Malware payload (RedLineStealer)", "value": "885d2b54a59a0de816b2ae5b3c78a479", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683423328, "uuid": "12ec8332-12c4-403b-9718-673cd0b3fbf0", "comment": "Malware payload (RedLineStealer)", "value": "beedcfd6c00bf78cf0b20d54119dbb57d28a5c216743b4286c7596c69b7bd0d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683423328, "uuid": "93f54b45-fdbb-452e-ba27-b167d0136053", "comment": "Malware payload (RedLineStealer)", "value": "2b73dc93491cee4c88a1f151e726425fb411fc17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683423328, "uuid": "37c5395e-c7df-43df-abb0-9cafe8215801", "comment": "Malware payload (RedLineStealer)", "value": "8f8a5f45a8673bb2df912e33fbc66e4e23ffb9dc15f4b7b33fa97f587fbcfeb5debcfdee034d21752af17387e643cda5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683423328, "uuid": "be57c912-9469-4bd8-b642-0bdab04bc6e1", "value": "T187A40203FBE84077E9E5177058FA12930B36BDA29934836B3255AA1E6DF3280E575337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683423328, "uuid": "cae6af4a-1316-408a-bdb8-0dbe16588218", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683423328, "uuid": "c8a927a4-e690-4cfb-8a63-852925bf6a16", "value": "12288:qMrKy90mbM3ewNyR0sKKFwtT3GIHqz9JvFK:sy5Y35fo01Hy9J0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683423328, "uuid": "fdb4e576-f9d7-47d7-a97a-b317194b9761", "value": 491008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683423328, "uuid": "b2ec4957-bf36-4e5b-8e74-72913be657af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683423328, "uuid": "e94fe248-c1be-4dba-a85d-5878ae65e0f2", "value": "885d2b54a59a0de816b2ae5b3c78a479.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7268ccec-ed04-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683483887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683483887, "uuid": "ac2f5dab-5718-4a31-89fc-0524bcbc1779", "comment": "Malware payload", "value": "16159b9a077d6ffbf2e8cd421d6ce5fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683483887, "uuid": "91b2723c-14da-4ada-b50a-53d0ccf5d37b", "comment": "Malware payload", "value": "bef328d42a791ba05ccf9f1d16339389eaff0eb1fa4415eb33b90d892b04206d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683483887, "uuid": "43d0b650-297f-4079-bb1a-d00bf4110ce5", "comment": "Malware payload", "value": "09bf3cce5fb75350b0874355caa0ea277cd96d6a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683483887, "uuid": "5986f99f-fa5d-4ad6-9f2b-9bc9f692d328", "comment": "Malware payload", "value": "3076cf185b9e9e8bbe86e6ce6a2540a82d98209187500ef66c00448b31bada2daed9c5b5560a6f065d5424a7bb78b072", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683483887, "uuid": "defc0186-8123-4ecd-bbab-ca3545b48079", "value": "T19FE533FE35258363C03314E0DAA41445D7FB78DC1BD5AA203A1D66BAAEED0F84B74A53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683483887, "uuid": "cd77bba2-c4f9-4f75-93a6-a0c851e893bc", "value": "49152:H4nn0zD3Teh2DM7XDcoWuMACKeCt+23EK78l/GvfnDycBZpZw0DCyJ/BGJP:YnYqh/XDCu/FtIGv/DpZwS/BGJP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683483887, "uuid": "970610f9-d2d1-4893-b30e-99c5bb0e5ccd", "value": 3053404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683483887, "uuid": "0e35c2f5-ae52-4d9d-9765-682c7379012f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683483887, "uuid": "d2523043-eac3-4efd-a73c-f79429c2944e", "value": "AIO", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92fff568-eca7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1683443998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443998, "uuid": "f6b735eb-0662-4d21-a413-7be4e90ced5d", "comment": "Malware payload (Smoke Loader)", "value": "44b91e8b433cc8fcb0d5e192587a8088", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443998, "uuid": "a8aba746-d72b-4af1-94a5-76348a998bd7", "comment": "Malware payload (Smoke Loader)", "value": "c161fad5d50fac30c57635d1adabe5dd4f32e3952fc37aadc7fbf20af8084e0e", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443998, "uuid": "0d59b7db-5b1a-4e37-a332-5f335980185c", "comment": "Malware payload (Smoke Loader)", "value": "b3977eb0063b8f1d32c98af716cc9d0f70a2adfe", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443998, "uuid": "18305994-54d7-49c4-a8d5-b6a2c8776155", "comment": "Malware payload (Smoke Loader)", "value": "ce33207b121f58a8bf62474152130a44911449bcd555b9420fc4086dd9505dadda0cecd9a9e6a9638dc5b072831a1ae9", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443998, "uuid": "3f2804ca-9f58-40bd-a454-ad6014848813", "value": "T17F547E0272D0B8F1E6370A318E1AC6F46AEEF8524F1566EB1A456B2F0A705F1C57E712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443998, "uuid": "73063822-a734-410e-b4cc-cd871b157a05", "value": "00bbabcc49bda3cf5b939545bfd2c2f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443998, "uuid": "b3b25d2a-1716-4ddd-9b22-10462ac9ca04", "value": "3072:jF6QfILRFpR3/99DTkprLKFP7ZZ3T5FiuooqW59ywkPEoerQeBt/D2r05WL:Eo2pRbkdqpiuooqW58BPE5rQg2TL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683443998, "uuid": "4ab14768-fdee-41e3-a5e3-7b3e5975bd66", "value": 300032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683443998, "uuid": "25345617-6016-4206-b311-9a17136c063b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443998, "uuid": "40cacf7a-253b-4544-85ff-5d3d071ba425", "value": "44b91e8b433cc8fcb0d5e192587a8088.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0de4e73-ec7a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683424828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683424828, "uuid": "71ca1328-9357-4c2b-81fb-86078b13bf82", "comment": "Malware payload (RedLineStealer)", "value": "fbc00980540a0b8ea75518dd543517b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683424828, "uuid": "32215604-05ed-486d-b7b5-840d51bbc571", "comment": "Malware payload (RedLineStealer)", "value": "c4c75ad0dea2680e5a6f95d37e7d53ead37f7141a36b47a83b1e197594c0a749", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683424828, "uuid": "f1a1ff55-a8cf-4a65-937f-e670e85d4dea", "comment": "Malware payload (RedLineStealer)", "value": "3fb8105de42e3c5ebca2a40e96b99045d3f21dac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683424828, "uuid": "7ad2d32c-5bae-42b5-b029-bb7343e6720d", "comment": "Malware payload (RedLineStealer)", "value": "629db49827ec14fe0578371c97f049aafe080059ef474cd229055f5582c069d19fb370597e62010dde61238d771d2a15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683424828, "uuid": "d7e43a12-52d2-40da-9b5d-3cd9010c5c55", "value": "T1F8B40252A7D88023D87927B058FB03D31B35BC965CB883AF27496D1E4DB2784A53277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683424828, "uuid": "85e6a046-4cb2-470a-b3ce-486cba4ba36f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683424828, "uuid": "aa2f1698-2f4c-447f-b7d3-135cc58ead1d", "value": "12288:fMrwy90naysLj1Gnk1244fygFEu4y8vV4a:7y1T1L44hgC6a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683424828, "uuid": "732096d3-66bb-4904-b229-0a6385d46907", "value": 503808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683424828, "uuid": "ef5892bb-a9fd-4f1e-acfd-9c9158d97abe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683424828, "uuid": "e656d225-ec16-42c3-a53f-9e1fcd42112a", "value": "fbc00980540a0b8ea75518dd543517b3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4a103e6-ecd0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683461691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683461691, "uuid": "48132439-dc21-4107-b0dd-e8f0a8f4d9b5", "comment": "Malware payload (Mirai)", "value": "73dfc8a5e8424ce39573ad670c9a4556", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683461691, "uuid": "483a7126-6582-4791-ad96-9347ae95cf39", "comment": "Malware payload (Mirai)", "value": "c51de5424b4f28d91e56d87d24e8fe0e07b720c05c6aa10f178eb145d20a0f96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683461691, "uuid": "182720d9-5820-4af0-bbc7-799333c7489c", "comment": "Malware payload (Mirai)", "value": "05f85fa558d80cd899baceefe5dff3db079a55b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683461691, "uuid": "a54e9f1a-fcdb-415e-bd44-6e9213da0ffa", "comment": "Malware payload (Mirai)", "value": "5f7dc7e6e35b844e548192e0859f4958f7761f943c76a2c5e1dd1eed16a6f847490e22215c48b854ba8bcf4145a99c97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683461691, "uuid": "65d25ea2-9132-49a0-a6d5-73c2b0d563b7", "value": "T1D5536DC9E5C3E5F5EC110A71313BEF3286B7E67D2069DFA7D3986432AA11602D11639C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683461691, "uuid": "67cc8ef2-dd62-43ef-a5fc-afbf2ea90340", "value": "1536:Z7qARubgzY/bEJy5RcpC80LDHhklv4JQC9DSW:NP+eY/bEJLKXBk9AP9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683461691, "uuid": "da0a6dd6-2d38-48b3-b89b-3d088341f752", "value": 62864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683461691, "uuid": "378ab9b5-2a4e-4ec0-9ddf-a061f0884710", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683461691, "uuid": "168ad61c-aff3-43c7-ab5d-b6ce966766cd", "value": "Linuxx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1e50ba4-ecc0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683454841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683454841, "uuid": "c04ff32d-87d9-4e76-bea2-9acbe4c8a611", "comment": "Malware payload (RedLineStealer)", "value": "1521dd9bceb0eab0b07965c10b028613", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683454841, "uuid": "f7245334-ab9f-41bc-b95d-e32a99f9d8d1", "comment": "Malware payload (RedLineStealer)", "value": "c5e543f209c71de03c3fd59f065ced4f40719dabbaef2fb5855bb251aafe26a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683454841, "uuid": "008b58ef-5e4d-44e8-b6f4-e71938efdfd2", "comment": "Malware payload (RedLineStealer)", "value": "742e1774ab4b38b886f2d8076020ec99b2d73299", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683454841, "uuid": "e6fe6cf1-ca11-47f0-a2a5-f6af8dad7c8c", "comment": "Malware payload (RedLineStealer)", "value": "472438507d4d2ae9a7a4a3516d2256e54d28a4d99fabb41683069ccf08620e8247a3fad94881328f8fabd8cd61e4bf2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683454841, "uuid": "ab65728e-fde2-4794-b013-0d1192b2caa0", "value": "T1DBA40112A7D85036D9B427B01CFB02930B35BCA16C74C7A72366688A1CB36E5F57A377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683454841, "uuid": "c5efcfb6-a96f-4b8f-8583-28356689b55d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683454841, "uuid": "be372ed8-698f-40e9-9e24-cb08283bfcae", "value": "6144:Key+bnr+6p0yN90QEzsFN1CcYQeiJN6Qdq4CtkQQ9F+qRvPkNxSnVB2rs7F93z/a:+MrOy90gCxriJ5dOQ9p5j2r4JbAkP8h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683454841, "uuid": "034172bf-8613-43e3-9bc8-a179a4fe3343", "value": 491008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683454841, "uuid": "7a023914-3930-44ae-aac1-30a36633d8ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683454841, "uuid": "307b5db6-bcfc-48cb-91bb-71a623646861", "value": "1521dd9bceb0eab0b07965c10b028613.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6973c01d-ecdb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GandCrab)", "timestamp": 1683466262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466262, "uuid": "b6b85318-7803-4c2a-b3bb-2f53611e41f3", "comment": "Malware payload (GandCrab)", "value": "df2bf1909f1a5e9673bb38ac9366bcce", "object_relation": "md5", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466262, "uuid": "30210262-5e5a-40d8-aa1c-1c5c88259f59", "comment": "Malware payload (GandCrab)", "value": "c70e202d0c52ae681146d15d0975cb1ed4ec035b88ad61b90c4ddb75ff199b89", "object_relation": "sha256", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466262, "uuid": "a6319ad7-b994-4376-b4a6-b1e0a648d3f7", "comment": "Malware payload (GandCrab)", "value": "1d677097ae680b021f7b6fa73e1a8ee6d6294684", "object_relation": "sha1", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466262, "uuid": "144caa5c-ae06-4d8f-90f7-5831d9eb64f9", "comment": "Malware payload (GandCrab)", "value": "978c0393d845ceb0ec9c2e23ca0708400bf1887f5791811f8e33dadf87ab93b559a0706cca9000a99a344cb7659b994a", "object_relation": "sha3-384", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466262, "uuid": "157679f1-2669-4f16-bf07-d119299f7ec7", "value": "T10277CF00B1D191B6E9F64A3998F8AB45552DFDA01BE039B773B62A4F09310D35E31BB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466262, "uuid": "1e4223ba-a099-40e6-a953-dd79c18c6b5e", "value": "6144:ScytwbVTTSdBgQqqDL6SK+iZz+FF4X4sYN+Qaf3AVwbLW:vyiVTqn6r+iZz+v4+9M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683466262, "uuid": "d365242a-2ac8-4941-9616-11a4b150ff8c", "value": 33058816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683466262, "uuid": "9d568d0b-de29-4332-8e79-5c099018e0db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466262, "uuid": "9b898af5-b917-45ec-966d-2527d34e080c", "value": "2023-05-06_df2bf1909f1a5e9673bb38ac9366bcce_gandcrab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4633c26-ecd2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683462496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683462496, "uuid": "8055e869-8aa9-43b5-bb2e-5af409bac728", "comment": "Malware payload (Mirai)", "value": "7a8bc394c49a199a677e8065107eeb6c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683462496, "uuid": "0f2d1f88-0bc3-4c19-8f67-39658970339e", "comment": "Malware payload (Mirai)", "value": "caf8b70da52b414fced3777469d6641103f5942194bdf2630483d2e821e9a980", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683462496, "uuid": "c206038e-c038-4c00-903a-3bc6f6068c97", "comment": "Malware payload (Mirai)", "value": "284c7eaf4de098fcfdfb8aedb9d89a302ce0dcfa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683462496, "uuid": "d9f86a57-8ec6-4c1c-9b75-7abdeed396fc", "comment": "Malware payload (Mirai)", "value": "3392c6b33773d06945d79397958f6c64b362d92bf06b9746f17228b03f6ed9c86d1161495772b122d6436d32908c6a00", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683462496, "uuid": "53d3a754-a5c5-4c89-9511-6fc8770b93ff", "value": "T1E0234BC49A43EAF5EC120A7420B7FB335B37F07A5159F987D3659932AC42B11A20B2DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683462496, "uuid": "9e1328cf-ec44-4943-a648-09bf918dd9fb", "value": "768:c8/MjSNW4GBs82WELXamRfWzqNYeZjlAFEwaK3g+ZdG:c8/MjSNW4GBz3ELFdNYe/ARaK3hZdG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683462496, "uuid": "0c1b01b1-b7df-41d7-b561-d9b6928e3ae9", "value": 46640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683462496, "uuid": "a1ba58e9-4bc2-4736-920a-e5546f12e19a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683462496, "uuid": "60fc468d-8402-41bf-a0cc-dd5ccd176e89", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07958ab7-ecd5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683463521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683463521, "uuid": "2fab5db7-ff90-45e5-9440-05392847b690", "comment": "Malware payload (Mirai)", "value": "12fcf2552bc7f0f94794888c90c2b590", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683463521, "uuid": "142b61a6-5095-4daa-bbe3-9e5040fd0fb5", "comment": "Malware payload (Mirai)", "value": "cc22981ceb10ab233504fd8337d5295f5551c0b29d63dc62360c4e65d9e1c556", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683463521, "uuid": "158adc6a-c28f-4740-b727-467f885f9747", "comment": "Malware payload (Mirai)", "value": "e00db1af6cdbade00ed0b7e419481a1ef81f0987", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683463521, "uuid": "fba379a6-5299-43b0-a46e-3dd82292d3b9", "comment": "Malware payload (Mirai)", "value": "252f482b7ebf6566768a17b34dde79b255ab5296e9ea1e2adc82b13bb71b6dfcef82a4b0b172697c8262a877a526e0d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683463521, "uuid": "fdba99e2-8117-44cf-92d0-dd0ccbe0d09f", "value": "T11BC2E1E67D77B9ABDA29013A349DCE338274A012D75EB613E240410D6017179BF329ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683463521, "uuid": "65d75cf5-0036-4fa4-860e-fdd585ef4c0f", "value": "384:MX1DMwk8JPyG3GDZaEXVZVBy6HInRiWLRYh4Sw4cGJYeRzOFGBzd8Qa/fJOFVNy6:qMwoDZLFbBy6HQHRYfeAxdd8jfIFu0Nh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683463521, "uuid": "02c0d825-e952-4910-aa1a-b414afbcd340", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683463521, "uuid": "fe885eeb-891a-4ae1-9ea4-4040691cdf7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683463521, "uuid": "2ac13662-3a4e-464b-8e42-1b78b2d4e449", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cf92ef2-eceb-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683473221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683473221, "uuid": "78e0764c-26fe-4592-99c9-25dd9c4e901d", "comment": "Malware payload", "value": "9d3867079c56f577aca7814764626138", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683473221, "uuid": "a52e201f-3d70-40f7-afa4-b5561866de4a", "comment": "Malware payload", "value": "ccc0478f641b8b5814480ac55f566ed3132d9ea1ff8f604edb637b5b2f3b19a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683473221, "uuid": "4310e903-40bf-4e9f-a4e3-ec4606a1a57e", "comment": "Malware payload", "value": "3b5a7075fb6c002945399a58389bbff74c23747a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683473221, "uuid": "3b910683-75df-4757-a54f-a88e317ebec7", "comment": "Malware payload", "value": "4377fdfdac1a998a984ac8022c5acf76ef01e2510acc56ab13182f3a03866a97013405c28c264ac7e57b674e463426b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683473221, "uuid": "a13332d4-594e-4a96-9a82-a96cc2763944", "value": "T1FF158E02B6E240F1C615153004BB7B76A639EA560B168FC7B36CEF1D2F365A19E36237", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683473221, "uuid": "c1678980-acff-403f-b8fd-c9d4610c36c4", "value": "12288:3x2G8iIMwk/2FVeq43nbt0b6gDVaT9CG3iuN:3eRkOFkq43nh0mgJSEG3t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683473221, "uuid": "296beb57-a55e-4b10-80e8-59c5043748dd", "value": 926720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683473221, "uuid": "dcea6de4-5c94-4fc0-bf9c-9b20e43f67c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683473221, "uuid": "2e379bef-2434-43d1-959e-5144e850b17f", "value": "SecuriteInfo.com.HEUR.25245.8816", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01d19fa2-ece4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683469954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469954, "uuid": "4ae1878e-97e4-41a5-a4f0-610e72335301", "comment": "Malware payload (AgentTesla)", "value": "e740e000761fc3a9519e921142c05ca2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469954, "uuid": "8166d1a5-344f-4a3d-a5d0-3de4d757db7c", "comment": "Malware payload (AgentTesla)", "value": "cd601047559c9e33e8619a1583cd95129c8662ea3f4ad50edd8c73e87292d169", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469954, "uuid": "d44d46a8-1401-4a29-9776-980a9bc622da", "comment": "Malware payload (AgentTesla)", "value": "8adb2c2f230c5b9fb51721a4813c8647513b1e95", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469954, "uuid": "42dfece9-bb39-481e-b282-e312309b170d", "comment": "Malware payload (AgentTesla)", "value": "ffbba4cd6a8783bf71e9a0f38ca731b6381c9480fbee7b7514b565b94cba60e29acf1d09bef46d59fe6473c719287031", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683469954, "uuid": "f7ef3605-883e-49d6-a9ec-7d0d164d5973", "value": "T154D423BF42F233F0EBF96AB01FE507B159C5215488290095D258F7DF68C2A69E6F5322", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683469954, "uuid": "cb282990-a3b0-450d-94e0-e293b228490f", "value": "12288:+O9IOicEZFnqqbIN2YBq3bQ6CtDNAkTcc+E8R0Qe6yNhkppg2CTWK:+O9IOdssBYQZYp0rSzsT7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683469954, "uuid": "d0ddee2a-bada-4f92-83a5-81c1f3ca6948", "value": 635117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683469954, "uuid": "dd3f7e15-3e6e-4a62-aa86-37ad40546024", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683469954, "uuid": "1b7721c4-8f29-4319-bb72-67f3c7c07363", "value": "U prilogu je predracun_1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63c18606-eca1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1683441342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683441342, "uuid": "53b55be3-99d0-436a-b78f-cdeb5afe91b8", "comment": "Malware payload (DCRat)", "value": "d3855e12436fa13461cb31f90bbb49de", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683441342, "uuid": "c9a57d33-71e9-4bd6-8e02-a44f969da69a", "comment": "Malware payload (DCRat)", "value": "ceaea02e8e0b3830a756fc5a5f60e28cd2eb7626fc7ec88fc67478adb98be2a4", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683441342, "uuid": "8386448d-13b0-480d-a194-3b117b1c2cc6", "comment": "Malware payload (DCRat)", "value": "aede824b4aa017bc39a4df466cb3de26bfa34bc8", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683441342, "uuid": "d6c9e034-ca63-496c-a58e-8997c86e614d", "comment": "Malware payload (DCRat)", "value": "c2c88053c836b73055946443e9903e946c14821b424b352a0060adce74b86e077f6716d6f70aa775453b3fdd5a48b4f9", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683441342, "uuid": "4118c29a-6eef-468a-b9fe-7a0d65dceff3", "value": "T104645B1833EC4B29F1FF6BBAD4B352559771B856EA7EEB0E0D8150D91926380DD00BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683441342, "uuid": "f4b197e3-178b-4fe2-af2c-af6bb34d54d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683441342, "uuid": "92795da1-1b8a-4158-8929-56c5c62bad07", "value": "6144:GHFyN3U5hoSYEDtsUp0QiMKyIXF0tfaymknRvRo8//5SIbVVwCqy:GsNE5uotsCKyE09eknRvRoM5SuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683441342, "uuid": "9bd6ec7d-2fdc-4eec-a01b-d103b82cad0a", "value": 323072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683441342, "uuid": "94d96307-bf48-43dc-837b-3b10fc7c5496", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683441342, "uuid": "035a6d72-55c2-4915-9c03-c42f557be7da", "value": "d3855e12436fa13461cb31f90bbb49de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa5f34da-ec6d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683419127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683419127, "uuid": "27715e01-e3d4-410b-9dc5-c505b35a5097", "comment": "Malware payload (RedLineStealer)", "value": "a020bc7094b273dc80d181734ef9bfc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683419127, "uuid": "9882179b-cf43-4f3f-9074-874a2dc0f1ff", "comment": "Malware payload (RedLineStealer)", "value": "ceb64d242a7e6ec9ee691d155bb39c127ff0f7eaaf12a14f79a03258db72c072", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683419127, "uuid": "527d99f9-b4ae-467c-90e0-c17004847b61", "comment": "Malware payload (RedLineStealer)", "value": "b7758dfb406207ec5b1ae1eb6b3820ccc1cbb11a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683419127, "uuid": "e9bdfc49-f72e-47f4-9922-d2e9569b7118", "comment": "Malware payload (RedLineStealer)", "value": "72435ceb093a79cf35ae5f7190c4f8124888b8c35d5ad3ae4a0ad5482ea1d0b40091e71c9acb5d5d0dfa8d5d7bcc56e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683419127, "uuid": "e0b9f7c1-427d-4d65-8596-89feb1d5a790", "value": "T14EB40203AAE88067DDF02FB029F703C31B35BCA29CB4576B2742595B19B26C5B53536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683419127, "uuid": "9c9b3d52-af62-46d5-86f9-380407d13d13", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683419127, "uuid": "6ec969a7-8460-4cd0-9642-2470e89d00c6", "value": "6144:K8y+bnr+Jp0yN90QEB5w1bkrreWEZeD12E6SN6k2RkCu/RUy/go2/j0rpdYh56pT:wMrhy90fabkrc216S8DATd401dIlDS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683419127, "uuid": "f3edf788-8f59-48ca-ac46-409888720112", "value": 503296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683419127, "uuid": "0a0372f3-3108-484e-a4f3-4e62178a47df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683419127, "uuid": "1f595fff-8777-4f00-809f-c63fc36caa30", "value": "a020bc7094b273dc80d181734ef9bfc9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43250b3f-ecb4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (TeamBot)", "timestamp": 1683449448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683449448, "uuid": "9e7f88ae-b37b-42b2-bdd0-9d718df4cf3b", "comment": "Malware payload (TeamBot)", "value": "5adf6a52b4847aebbe04a83a639d708e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683449448, "uuid": "5c8501cd-7546-4df1-bbd6-a9dc7f4f4028", "comment": "Malware payload (TeamBot)", "value": "cf3dde77c9dfd75bfed51313165155159646fad1c64723e221389b8f0304d2d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683449448, "uuid": "fc3e65c6-1dde-4981-9dcf-2e4604d6a9c2", "comment": "Malware payload (TeamBot)", "value": "12ac4b75d7e85682e7e1f851e85aa653e4fa0c6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683449448, "uuid": "5adcbda5-1ae4-4fd7-a97d-9d75254df22c", "comment": "Malware payload (TeamBot)", "value": "ac171ffbeeded738e356a44ccdc74f04bac7653c31af1ec3c89af5debeefb6ec3ddb13615953eedf5b998ee351b86cdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683449448, "uuid": "fd4ca7b4-16e0-482b-b30e-ac9fe8d2ced5", "value": "T11A64F903D2E13D94FB264B769E2FD6E8765EF2608F593B7922189A1F04B01B2C173725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683449448, "uuid": "0bc53b45-dae3-4963-b703-429b6a409144", "value": "07392231fce6d1215d12aefe3ca2bec9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683449448, "uuid": "3a7084bc-2b25-48af-b559-86a9a0ccc406", "value": "6144:5nbNL25fJvxcfJkpzdfz7qFTd2F6wxgj+r/:5Z6fJAk9dfyFEPj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683449448, "uuid": "5c409a8e-6e2d-42ff-858b-6d8ecc5d7c8f", "value": 321024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683449448, "uuid": "df618976-8a48-4e2b-b947-faba220e01f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683449448, "uuid": "59b0494c-b4a0-48f3-ae84-801bdaf67265", "value": "5adf6a52b4847aebbe04a83a639d708e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "425bed6e-ecba-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1683452023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452023, "uuid": "e13e2ea6-b0ec-4d4b-9117-e9400a021dda", "comment": "Malware payload (Rhadamanthys)", "value": "08519d442427ddc963297f8424d8a07b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452023, "uuid": "15727bfa-6a45-45af-ac55-1dbbc4056ced", "comment": "Malware payload (Rhadamanthys)", "value": "cfbb22ccceaa89c67a1139e72f65b1139c962ff4b8f6960389a58c5844d8e9dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452023, "uuid": "0ee28c5e-a760-493d-b051-74b62e01d2d1", "comment": "Malware payload (Rhadamanthys)", "value": "28bc9f1191e9b03b85ccbce6a1984d957405499b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452023, "uuid": "98f9a946-8048-42d5-b576-8a7192bc84cb", "comment": "Malware payload (Rhadamanthys)", "value": "28f17baeb237dac656574ec3fe028bb5dd56319970f2049503b3423249647e0e727e17bf43ad4bb621070846064fc086", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683452023, "uuid": "92d3316e-c0b2-4952-86ae-e3c7caf1aa9f", "value": "T16084AF127690B471F6560B318E1AC6F4EA2EFC918F9666DB66047A2F08735F1C7B2703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683452023, "uuid": "a525a3ac-5912-468c-8d95-329be9265b40", "value": "cb0d32ad83907c8b5d9a97a27bcf3623", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683452023, "uuid": "2261c410-f000-4594-92c6-6a2801db5e74", "value": "6144:3J+Zbjc2uQqCEJfzABdBtWtILy5HfOXghTGgsqWL:Zw/c2uQqjzUVgIu5H2XgMpPL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683452023, "uuid": "411a2b2d-5627-488c-bceb-6fd4579c0c2d", "value": 378880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683452023, "uuid": "7ef923d9-761e-42ee-a111-1ee250a981d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683452023, "uuid": "6d0e5f49-d3c0-4424-b1ad-6d13b92c3c05", "value": "08519d442427ddc963297f8424d8a07b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eab95bd-ecd9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683465359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683465359, "uuid": "9996a331-d545-49be-af69-6ee7db10cec1", "comment": "Malware payload (Mirai)", "value": "b5b3105ec6ddb6f81e10ac0939046dab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683465359, "uuid": "22144668-2094-4853-97e4-a06986c0dc6f", "comment": "Malware payload (Mirai)", "value": "d1359921539d57ca46ad2a6da557f9a0828c385c8209f12748332093ce4a55be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683465359, "uuid": "16bc5556-2d73-46af-822e-449a665a25d0", "comment": "Malware payload (Mirai)", "value": "21a9d54971c4c23368eb902f96e550bbc7be4c58", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683465359, "uuid": "7c5480d6-436f-4e74-8a71-3d7c04c78eb3", "comment": "Malware payload (Mirai)", "value": "6b640fd86569116995ec2f0794e1f2f48e3a565865ee85d5e1101f3feb393be8201cf3573a75738ef3eae6631a09c95e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683465359, "uuid": "7bec11ad-8687-4165-bdee-392f918cc13e", "value": "T14AB2E174C60E746EE0C9057FA0EF06D3A8EEC24241BF92576AB3D68D50EB1519B2CB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683465359, "uuid": "91e28bff-6ea3-4394-91f4-056a1346b094", "value": "384:MJiiBiccUIgcNADBQDDY6/J3Nwlzq3ipTyKQurQlZANnDQsN+CTv1RHU:LiBiQI3ADYDXkl2SprQury6tVTHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683465359, "uuid": "56bd6504-1660-471c-9e07-1f2f8b61aac6", "value": 23432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683465359, "uuid": "35195b58-347e-433f-91f8-f5cd88edccc3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683465359, "uuid": "026cc2e4-9734-4635-a5b3-a542dfc4b025", "value": "b5b3105ec6ddb6f81e10ac0939046dab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e281b1d3-ecda-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683466036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466036, "uuid": "9beb2b17-47ab-4d31-80eb-46c32e80ac65", "comment": "Malware payload", "value": "42e01c1284fec57cf992e0601d3ee86d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466036, "uuid": "4958040a-53a1-4df3-80b7-1154a9987360", "comment": "Malware payload", "value": "d223f778cfa35c8feb4aa647e48e19cccbe2fb6f18be1ace9dd3f5195e74cc01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466036, "uuid": "4ba18179-d5f2-49dc-a685-b137e0542b35", "comment": "Malware payload", "value": "b8c0b0e5484672df445e52e7a852af9ee2f05685", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466036, "uuid": "1dacd1cc-98f0-4c35-a3e4-5199e4fd2bab", "comment": "Malware payload", "value": "031f6b9aeb09430f6c7675de47716812c47835b3757a35da81c72353ed76d548ad582f43bec9a22e29fe4374b0f1140e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466036, "uuid": "bfdd8ef5-9f96-403b-82ad-2ce50363d5f1", "value": "T153C409406BE24191FBE676300E75A231A83AB8E9AF35DFDF2148D5584C72DC0E935B1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466036, "uuid": "0ad461ad-9ec4-40b8-bad6-65c1c46a41c2", "value": "12288:bwF+1/YLPFME9td/m+rdczZQy5t//ClwRilCRaxyRpBipqBa1yBsqCRtxjyZKnb:bay/UStSlWCRtxjaKn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683466036, "uuid": "07d04901-f370-4878-8b82-57a482b3b08f", "value": 557056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683466036, "uuid": "8efe81cf-72b5-44b5-be01-aa7dad089d5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466036, "uuid": "a96aa008-7611-478c-b739-cc37633df9b2", "value": "SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.19509.14078", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "669ba819-ecdb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GandCrab)", "timestamp": 1683466258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466258, "uuid": "aadafbd8-a4eb-417d-afd3-6876fa3d4ab8", "comment": "Malware payload (GandCrab)", "value": "a96a94004139761a195334d2cbdc9514", "object_relation": "md5", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466258, "uuid": "1c2469f2-c852-43ad-bdb4-5f807cc9955f", "comment": "Malware payload (GandCrab)", "value": "d25dec749477ee6c6e2af613d0c1a17f77e15125d209b77c9ad0fb286c0e8fa7", "object_relation": "sha256", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466258, "uuid": "28debfec-10cb-4742-8f6c-3019f8cdf729", "comment": "Malware payload (GandCrab)", "value": "f11a43645536d9d0ace7cd113b6c8e509d54ddce", "object_relation": "sha1", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466258, "uuid": "4517a249-9286-463a-9864-bd140cc2dea7", "comment": "Malware payload (GandCrab)", "value": "cb6a88fa49e3c05eb0ffc5e5ebc6c84cc966cc2861f1cd00beee57aaef8fafa1ad225958ce8f48f90777b20ebc5037e5", "object_relation": "sha3-384", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466258, "uuid": "680a06f8-4542-49c2-9627-a0242ad1d0e8", "value": "T100048C1475C1E0B2E4E20936D5B4EB1A446D7D111BA47CDB77E21E9AAC331E3AE38B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466258, "uuid": "7e515432-9cb4-4a9a-83fe-bc5dd21d3e34", "value": "7848011b763d00cd02658995847dd30b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466258, "uuid": "1cbe53c1-d7c6-489b-9129-e0152591cb2b", "value": "3072:OwJPhkfHuLNDJY99JflZHQsozTS+SMqqDL2/TrKyxG:FJkHuJJMN1yTS+xqqDL6HKp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683466258, "uuid": "a8403560-c0db-4e7e-b807-92cb9557f30d", "value": 180224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683466258, "uuid": "42246751-53f3-4de3-9f1d-e3ba0a24176f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466258, "uuid": "ad58aa0e-6c59-4f00-be90-2c8b221f476d", "value": "2023-05-06_a96a94004139761a195334d2cbdc9514_gandcrab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c68aeae1-ec96-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683436783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683436783, "uuid": "4e678c21-69f1-4a57-a185-55fc361f41b1", "comment": "Malware payload (AgentTesla)", "value": "abc56b7a64f6cd536e69b930b620c76c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683436783, "uuid": "f49cfb40-e01f-4bb2-a0ba-466c9c43bb8a", "comment": "Malware payload (AgentTesla)", "value": "d36e21c8bede2f06e59dc14477f54b5d0f10030f78bd0730839207fbbc0331d1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683436783, "uuid": "e76a1da0-415a-4b79-920d-f804d4cd8070", "comment": "Malware payload (AgentTesla)", "value": "6a5b7d7538cd78b75b06cb5949bff6a8c52dba9f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683436783, "uuid": "892a195d-1fa1-42e9-90d9-c96bb96e9806", "comment": "Malware payload (AgentTesla)", "value": "a9f0733eda482aa763d603b1264b582b894ac2be76167af9f21004e27c85a65e11f17425d134f310663ebe8bf401850a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683436783, "uuid": "88eaea12-6668-4afd-8bbb-20315f916a46", "value": "T11BD4230B77E224EA11293764D98A396C232A6D966D3371D76004A1CBFFF3441B177A73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683436783, "uuid": "d5d129f3-b647-4115-afa8-3c7d9e1fcd98", "value": "12288:EtOt9TyXN1qEojgrAwIWOIrWkXS2ZSBL6Onrz+leI+ylPYtpDYMg0:EOmQEag1POIzS2kPnrCZ+GPYt1dg0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683436783, "uuid": "4ead31df-dfcc-4687-ac85-e30872ca909d", "value": 627300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683436783, "uuid": "a89a9f50-84ef-4a6b-b4e9-888dba33fc6d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683436783, "uuid": "3dfcc83a-d67c-42d3-9cc2-d0c5020a9eae", "value": "ORDER.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6720eee-ec6a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683417832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683417832, "uuid": "5c68a77f-5a82-4987-bbd8-0a867f00e74b", "comment": "Malware payload (RedLineStealer)", "value": "873840b00d7e440ddad188371af58e8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683417832, "uuid": "227cd988-273a-43e4-bdcc-a5cf3f46a278", "comment": "Malware payload (RedLineStealer)", "value": "d42b53d60029f149073170d929cc22779e291815b35b7088b419431761b3adaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683417832, "uuid": "30e35e20-d152-485b-8de1-1b312305c604", "comment": "Malware payload (RedLineStealer)", "value": "48a206b0371cbf712ee41b029b1d497616392453", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683417832, "uuid": "d3eee420-82ae-46f9-9092-bd5c9f0245ef", "comment": "Malware payload (RedLineStealer)", "value": "8e6ce535c431476e5d2484e3e02cc39eb8e71a0c50f090b99223bc10b7b1ad188ce268d34e10661cb2eaf23a110c33f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683417832, "uuid": "81020faf-0fd8-4804-8907-80dfc347d7d5", "value": "T116A41203A2E44072E9B11BB429FB13831B3ABDA15C78835F3785A54F0CB26C5A17277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683417832, "uuid": "eb738b09-c3a7-4080-a86e-e9268bf955c8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683417832, "uuid": "e6908bfb-0523-4ae7-b3e4-1e4bfb19ae45", "value": "12288:6Mrky90guxTxGEjYglKQUEUr72uQNCdVxz9QE:iyPLoKbPSiVxzz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683417832, "uuid": "c403d300-ac22-426e-94a3-dc419e48d18e", "value": 491008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683417832, "uuid": "0f7701f4-600f-4263-870c-41d8faacba00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683417832, "uuid": "a145a0b6-d9a8-4b8e-a415-b8726079ca0a", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8189f332-ecc8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683458142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683458142, "uuid": "710e4d6e-0539-4984-8bcb-b69fc75fe74b", "comment": "Malware payload (RedLineStealer)", "value": "2d83b25eaccf0246ca0737a22452508d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683458142, "uuid": "e1da84f8-3b9d-495d-bab2-7c942b8ed68d", "comment": "Malware payload (RedLineStealer)", "value": "d45e3d542a910a59f854673de93b485dc18f6c8fa0b505691bdb2ca0caaa2a8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683458142, "uuid": "bf2a75c9-6dfb-4533-a9ca-9800e455873f", "comment": "Malware payload (RedLineStealer)", "value": "0c8a91e9a384e88a2bd1e2f9d2eb0e41e14ec07f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683458142, "uuid": "48ac5c1e-0a5d-4ee9-ab10-9c30e2a4ef77", "comment": "Malware payload (RedLineStealer)", "value": "76309be860ef91bfeb45597a4903d41e73479301b1ae7ab7e6e8f9191af45bf966065fc3b38c7dcc7ef77a87a431bc14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683458142, "uuid": "55730b61-e6b1-49f8-873c-8564a1b918c0", "value": "T14EA40203F6D89572DCF623705CFA02C31B3A7C619A38876A7349591B1CB27C4A97276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683458142, "uuid": "b07b2e87-2812-4ba5-bc2a-04676d58fe75", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683458142, "uuid": "8362e423-8f5c-4f7a-8a97-163388296a98", "value": "12288:4MrDy90nMGGNDsOApZbbsxrBIT2HScQL1:7y5eOKT2xQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683458142, "uuid": "7b9fd4ab-cf29-44dd-bbdd-86c35b01c54b", "value": 491008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683458142, "uuid": "b19c99c8-6c17-469c-a4e9-78a4012e5838", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683458142, "uuid": "c66d4844-45ca-4dad-883f-fa3af66ccb1f", "value": "2d83b25eaccf0246ca0737a22452508d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdd30c9c-ecb4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683449654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683449654, "uuid": "bb2ab8a1-7fcd-431a-9a6e-5c8485f0c062", "comment": "Malware payload (RedLineStealer)", "value": "dcd4073388ad347850c0337e08cbe388", "object_relation": "md5", "Tag": [ { "name": "37-220-87-78", "colour": "#B081E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeKOTA", "colour": "#00CD36", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683449654, "uuid": "c1dc0f45-5100-4610-9d8f-8cb5000be37d", "comment": "Malware payload (RedLineStealer)", "value": "d50cf1f78a7c3342e9ec594a31c0754f08dfc4db408641428a8d32d1db6c887d", "object_relation": "sha256", "Tag": [ { "name": "37-220-87-78", "colour": "#B081E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeKOTA", "colour": "#00CD36", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683449654, "uuid": "9e3fa07d-2dfa-4ff9-b269-3c95cd2084db", "comment": "Malware payload (RedLineStealer)", "value": "97cafcb7a26e51f5112e0f9533986a8a5635c144", "object_relation": "sha1", "Tag": [ { "name": "37-220-87-78", "colour": "#B081E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeKOTA", "colour": "#00CD36", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683449654, "uuid": "89999350-9711-4773-ac8a-d82446ba898e", "comment": "Malware payload (RedLineStealer)", "value": "a99efa66f86b025df69c798dcd823908e015958cbc2b3b16ea9c71e5ec475ffd75adbaeba731075721c5609e4de0340f", "object_relation": "sha3-384", "Tag": [ { "name": "37-220-87-78", "colour": "#B081E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeKOTA", "colour": "#00CD36", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683449654, "uuid": "34f3b3b5-da0e-43b3-932f-52af84b92466", "value": "T14165B04C618080EEC8A6197D0864CEF9C769BD20571785F72BEC8C6B7B15E8E19EF097", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683449654, "uuid": "18446932-9eaa-45e4-b7ff-7754b85d4d8c", "value": "245662a6e5a425a1168d9f9efa96f9aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683449654, "uuid": "efbae580-ffaf-4f18-a25d-8d78aed9c301", "value": "12288:mWs6w3Wg86ajj2i3mqv8nWfnoKc/PCNy:uva+qv8nWfnotXCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683449654, "uuid": "476de53e-8a73-4a25-aa63-e674fcf43764", "value": 1454080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683449654, "uuid": "d5a8d11b-b5c3-48b9-9229-004bb7ca4819", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683449654, "uuid": "b7e6be6f-0554-44b9-8630-cb470a4b5c3c", "value": "ALMV_launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16bc6dfe-ec86-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683429616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429616, "uuid": "8ad36d8b-3129-4bd5-9168-dd8def900e0e", "comment": "Malware payload", "value": "94274681ee81b3fc9dc901c042816aff", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429616, "uuid": "cb3c434e-8a62-4fc4-9777-d3e550a67810", "comment": "Malware payload", "value": "d53625ec0254975e259d7d1fe690e82bec2f16314302cc3f0fda9c1bedfa4670", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429616, "uuid": "595c84af-322f-48e8-b2b8-5c09cbbcfe19", "comment": "Malware payload", "value": "daf2525f0e003f60b48d3a9a4250652a472430a2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429616, "uuid": "3561c892-0ce0-42fe-9bcf-3081f1b37dc1", "comment": "Malware payload", "value": "3d218aa844cba34756b567380dfd94dd3862a684852384e26e95e86bd0a1cfa9750011fcb3b50c60d1e7f18579790255", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683429616, "uuid": "f01d158b-e1d5-46d8-a1d6-5382752b975b", "value": "T1E716CF403BD0ADBBD1EE6775912681FC4FBCD0866BD7A31B5604A56C0EDE3820E5E287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683429616, "uuid": "6eddce6f-e915-4189-9966-c905a9222051", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683429616, "uuid": "4ce3cc6f-b7d1-443d-9ee9-8a80e8ff050c", "value": "98304:oXB4uluJRmMg6QWlIpgi0rHqsih/mCqJ4B4ulu2:ovsJR0TW6yiIKRhzqOs2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683429616, "uuid": "2d498c26-4e23-4cfc-a90f-95244e9168b7", "value": 4388038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683429616, "uuid": "25e518dd-63ab-428c-91c0-f42b75b8bc97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683429616, "uuid": "c9c48318-0e47-4e91-b251-be39477d3d91", "value": "VirusShare_94274681ee81b3fc9dc901c042816aff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bd6bd96-ecdb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683466105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466105, "uuid": "fd839c7b-d97d-4668-b947-f82d191e80c4", "comment": "Malware payload (Mirai)", "value": "be421e546634e600412e2cc8fe87e25d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466105, "uuid": "8746d8cc-b490-49f1-a420-abe0aa45868e", "comment": "Malware payload (Mirai)", "value": "d6897ad37b8158fabcd06bff527b645747a3975b0720634fd01386a19a3cfa1d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466105, "uuid": "c2ee0748-7be7-4925-afcf-dc97c2be303e", "comment": "Malware payload (Mirai)", "value": "8312357cb9696e419e832f6d780f0ecd109a2ad3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466105, "uuid": "4c144201-4efd-4de0-abc4-d9934b09f487", "comment": "Malware payload (Mirai)", "value": "46dd8673bba3125ad0912aa288d45dcbe3df0da9bbb0e9397efef3f04c4e5fec920d660985afdcb4e0a21427e2ed9ebf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466105, "uuid": "ce23874c-72a4-432c-847f-21041830b599", "value": "T161238E77C8796DD0D1588274B9258EBC1723A406C6A33EFA5E45C66A8007EBCF62D3F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466105, "uuid": "a60322df-df57-4af1-b307-25d873a2f19a", "value": "768:5a7wtk6ov4SeqUyIP66ivGK1ureCynnkhCVot2vXCCqA:5a7wtkxbxgjiBu+khhtgCCqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683466105, "uuid": "67294890-b25c-4e1b-91a9-e5c31a6aff2c", "value": 47696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683466105, "uuid": "df55e4be-bdfd-4612-b045-1fca883d91af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466105, "uuid": "f759a927-bd67-4d11-b9f1-a1dadfeb6400", "value": "be421e546634e600412e2cc8fe87e25d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e6f89af-ec89-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1683431133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683431133, "uuid": "9fa4357c-ebf6-4713-8d90-015a16def0ca", "comment": "Malware payload (njrat)", "value": "ca19aa5b909d19964112b02ba6137f17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683431133, "uuid": "8d3841e2-8ff7-4771-a952-98037689992d", "comment": "Malware payload (njrat)", "value": "d75855461ccd00a6a70b928f00797510d67e135eac4e9aa5906ce47b2b936feb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683431133, "uuid": "de8108f5-83e9-4099-a707-b23586d29055", "comment": "Malware payload (njrat)", "value": "c430780639f5faa45c8e2d9c1f27dd50d7afdd5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683431133, "uuid": "0c711852-0e79-4064-92f9-481b5288c76e", "comment": "Malware payload (njrat)", "value": "47450c3e01d6d2bd9ee9dd95011cca568565680e6d6d166072771680bcaf49f79c2a2be477ee522a622642a65d4bf25d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683431133, "uuid": "5f210445-10d8-4c0d-8fb2-4b6f273ba985", "value": "T136A3F77D7ADD4159C4BD01370572D136377BF8CFAD12892D9AE1B09A2E333C88B286A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683431133, "uuid": "3a850524-b58a-4495-8610-f2f64b3adf09", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683431133, "uuid": "b6a48c89-6359-4007-aafd-e1a3b578cda3", "value": "768:XSgblLJfcPnxftSerM+rMRa8Nui+tM2KKUU:XSgblLJU/xf8h+gRJNV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683431133, "uuid": "bcae5d31-75cc-40fb-84bf-8e5b9b84b6f0", "value": 105472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683431133, "uuid": "2479d8fb-8548-4267-a42c-57801fdd0160", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683431133, "uuid": "09c36f54-0b48-4c1d-915c-a84e6b5e4772", "value": "ca19aa5b909d19964112b02ba6137f17.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c884722a-ecb8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683451390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683451390, "uuid": "16b10dfa-d2a2-49a4-8198-dabeb8aac939", "comment": "Malware payload (AgentTesla)", "value": "f4811737e8f73c2e9674b402daf40b0e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683451390, "uuid": "2d46f87b-8671-455b-b5f1-34135aaa3097", "comment": "Malware payload (AgentTesla)", "value": "d7c65c1f15bc11adf9a53b561caa03d20c15057477ef05814f9195f931b3ae73", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683451390, "uuid": "4e88c0af-f6b0-4082-b797-c81345751431", "comment": "Malware payload (AgentTesla)", "value": "20023957e0cece3a1aa9e9818ce30a307e334e23", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683451390, "uuid": "a23f6d84-7333-4754-ad3a-64257a0dddf1", "comment": "Malware payload (AgentTesla)", "value": "4a522cbdac1d8e9d33a63c82b3fce5697bf83384723158eb3f4cc7c66a3cea5aa2001fcb9b2f18a9b1c462cf1b8d2855", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683451390, "uuid": "a108f295-991d-42cc-b492-4989d2854ff2", "value": "T13381838035C09A5953AF17A7B32F62F2F479189F9CA50C8FD20A9D655818C60C892FB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683451390, "uuid": "cd779250-793b-43b4-a61a-1f7133ffb6b2", "value": "96:XwEymAsDP0XSbug1reza5GU/7eAduaFkEYUJgT8EOXe5W9o4m:XF4sDsibPezEGUazfUJgT5OO5W9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683451390, "uuid": "fc7beb07-071a-4b45-9435-c79b5d4cfed4", "value": 3891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683451390, "uuid": "9de83c89-5edc-43b6-823f-af085f0b6a08", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683451390, "uuid": "e8d5a577-fa98-4661-98ab-bce6abf845ed", "value": "list of product and requirement.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96fed0a2-ec9e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1683440140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683440140, "uuid": "ca704dbc-10b4-4910-8995-f08184d20e87", "comment": "Malware payload (AsyncRAT)", "value": "9cb2e537bdb94a7529989730d540598f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683440140, "uuid": "30fe836a-39bc-4d0f-b64c-b56c6ffc6576", "comment": "Malware payload (AsyncRAT)", "value": "d7f8c12ef65aebb5b5e14c699562886b0efb5f7b54ab9935519df22c8d08dfa3", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683440140, "uuid": "fb80457f-81f7-4fe6-86b1-887f6748e92b", "comment": "Malware payload (AsyncRAT)", "value": "e82c7513c145d4c420ac24751127f8f4dc3065c5", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683440140, "uuid": "9e450ff4-0e90-4b75-a3d0-180635a393ea", "comment": "Malware payload (AsyncRAT)", "value": "ea7a684be9076418f73ac65a3242cef954275aa940e7e089c04b32086dd0a1839be4f8dc8c98025e6ff9ad2b58bcbac6", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683440140, "uuid": "dd647e53-c97c-4a09-bcfd-417e41c9b8da", "value": "T1C3253A4BBCA014B9D0A9D2318DB651917B31B8991B3227D73F50B2B82FB27E85F39354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683440140, "uuid": "7b68bce6-2625-4da7-854d-4078ce38be3a", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683440140, "uuid": "e8d17d1b-ecd9-4549-aeb1-51562bd1be0e", "value": "12288:M4mT/RcXtvyJdBQhXVQpbDv4alfZqby13caYgd2DK4TIu+:M4C/6XtvWBmQpbT4gcaYgdd40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683440140, "uuid": "17141b38-a5d2-4304-ad6a-e65b1a6565d0", "value": 992768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683440140, "uuid": "718f9bd3-a9c2-4408-bfe3-8f835f32947a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683440140, "uuid": "7efcdcc5-f589-4d05-9f62-5f4f7aea35cc", "value": "RFQ# 6000163267.jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "701ba76f-ecb8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683451241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683451241, "uuid": "9b7ec5c7-3360-48f2-860b-175139d94340", "comment": "Malware payload (RedLineStealer)", "value": "22e354dd42b53aef04fcf5b724db2137", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683451241, "uuid": "7216f3bd-a398-4256-883d-3d33e7657ebe", "comment": "Malware payload (RedLineStealer)", "value": "d80df51f6273eaf5fb2fd35c16caa0a48f33bc4dab2faad636feefea79c54422", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683451241, "uuid": "d6950f0f-5541-4519-aced-6b5af67b78c3", "comment": "Malware payload (RedLineStealer)", "value": "ee33903defeb010a7e2412b55064651132cec516", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683451241, "uuid": "81555684-235c-495c-8515-1e4303e130fe", "comment": "Malware payload (RedLineStealer)", "value": "3960a1942f8f51069f2f947b5fdc343fa6a87eed715a6e8b8f824beadcac967b03c55884913ae931d05beb218e034f76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683451241, "uuid": "efb98a36-a3b8-4619-aaf4-4ca589c37549", "value": "T12EA40203EBD840B2E8F55BB0A8F613830B35BCE19978921B27516D5F1C72684B67237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683451241, "uuid": "08e11561-7f70-4657-a6d2-898fd6ee0840", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683451241, "uuid": "10c7240e-a1d9-41a5-8ee3-fb4b9e30178b", "value": "12288:OMrVy90AFCww3zLY5c1u31ZThhR51LHFLJlKES9r6uH:LyXs3LAXfTPR5RBYLH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683451241, "uuid": "f91070a6-0fce-4d71-adad-908378bd1980", "value": 492032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683451241, "uuid": "5be11595-b05c-4924-82ad-f1700c6766e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683451241, "uuid": "896115e1-6690-48cd-9b00-ca75bf0ed584", "value": "22e354dd42b53aef04fcf5b724db2137.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04f531f0-eca7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1683443760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443760, "uuid": "4be81611-fb45-404b-8bf1-f437b3978dae", "comment": "Malware payload (Vidar)", "value": "78dd260522991f45e42621af95b058c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443760, "uuid": "6fad212f-0b79-4c34-8c69-6dac8cec7b86", "comment": "Malware payload (Vidar)", "value": "d845e5c2719a3eca2da5f9a11bb4b6fb24354c4630b5b488239c8e8e2ee2b593", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443760, "uuid": "98c7dbd3-0f5d-4b87-ae1e-5de212d78e84", "comment": "Malware payload (Vidar)", "value": "7ab659bc28f90e8e304513d03c21aff266a2a186", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443760, "uuid": "49176f10-4409-4210-ab67-92a186618d14", "comment": "Malware payload (Vidar)", "value": "14a595fb703072ecafd4b85076fd6a077a03f4a237c31c6c7ac9b5b65a7b412072bda5a362808404db435f0f0f717a1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443760, "uuid": "cd1be80f-20c3-4be9-b81f-3d1c7f543693", "value": "T19794AF52FE90B871E6530A318E2AC5F46A1EFCA18F1766EB3A047A1F19705E1C536733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443760, "uuid": "33c717c2-6987-47aa-abba-3653716468aa", "value": "cb0d32ad83907c8b5d9a97a27bcf3623", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443760, "uuid": "ab69b952-fb1f-4b8a-a66c-286aede08c35", "value": "6144:wmgVDGNqxjbyrUoUMFemg6zCIK+cvKq08JjFYXm/adR/WL:JIGNqxjHMFPg6zCICJ0UjFYX7dIL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683443760, "uuid": "f571884e-b177-4361-a033-0e2bd38df734", "value": 419840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683443760, "uuid": "fbc6dd03-aaec-43d9-8719-7a651acc166d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443760, "uuid": "54806c8d-a1ca-447d-b99f-ee2111496f5e", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8580176f-ecc1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683455143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683455143, "uuid": "5e9b7369-f912-4864-819e-65ca771924c1", "comment": "Malware payload (RedLineStealer)", "value": "aaf46122058f9a6ceaa71358eca59f2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683455143, "uuid": "a72c9a47-9739-4c3c-8b6e-66f6e090ad04", "comment": "Malware payload (RedLineStealer)", "value": "d94d96f20924b0fd739b29af2a086effb7aeb410f801cb8df87070b7d4aea3a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683455143, "uuid": "1183d44e-1545-4c3c-b0ba-d083f5864635", "comment": "Malware payload (RedLineStealer)", "value": "42a0005c921605ecbf444799fc9d504c98247e75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683455143, "uuid": "19d27a64-f784-404b-95c1-574280a423dc", "comment": "Malware payload (RedLineStealer)", "value": "1f97dcd6e37637c15720bec3534b1e45a3c5e9d0fba3dc22347978540f2d0bce4006679328a2ad67474ef11b00e321bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683455143, "uuid": "bb86a157-5557-454d-92bd-0870600d3b24", "value": "T152A40203FBD89633EDB52BB058F103D30B36BD618C74879B6785698A1C72A90A931777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683455143, "uuid": "c1b4a540-c197-4b7b-8321-afe12b7be561", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683455143, "uuid": "fde3f26b-e9a9-4f9e-bf09-e29714f01785", "value": "12288:6Mrgy90kmoWkspJ1sU0wke1omlASBlylCI:qyKyMspwKmlASelCI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683455143, "uuid": "acdbfb81-3638-4520-bfbd-5fe955bebc6d", "value": 492032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683455143, "uuid": "29e5dd13-9e83-4346-86ed-dc3cf3297d01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683455143, "uuid": "922b8c09-7359-4a42-b8c7-403ec070ebea", "value": "aaf46122058f9a6ceaa71358eca59f2a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "723a7f42-ecb1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683448238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683448238, "uuid": "47b69c2b-40ee-4954-aa93-7fa56268d2bb", "comment": "Malware payload (RedLineStealer)", "value": "07c4bbe5df22d2cbeeb5c0fb4323b240", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683448238, "uuid": "5eb3773c-edbc-48c1-a570-9985d05fb780", "comment": "Malware payload (RedLineStealer)", "value": "da311255342eec127ccbe63677bf90a8701c9162cb1a331443ac50b651ad385d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683448238, "uuid": "ec60ac99-872a-4bf5-afff-5cc5d0da6ac9", "comment": "Malware payload (RedLineStealer)", "value": "aedd16a8ba21e0da8daf01123549dc27b9a5236b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683448238, "uuid": "85da6453-4746-41e3-93c6-749cbabccd88", "comment": "Malware payload (RedLineStealer)", "value": "7b041c1b078152de1c36b352b2944c5dca29ce25deb99e1d8c543dfcfef7684b0866906acf53b6da351709aa2cf748c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683448238, "uuid": "f04149fa-520a-4458-bb07-65bbefc7fa67", "value": "T1F6A40216B3D44073D9B91770A8F603C30B36BCA16E39972B2745AD9B0C726D4B6317AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683448238, "uuid": "7d70440d-f59a-40ec-9055-f3b265badcbb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683448238, "uuid": "6058b4af-2f08-4d7a-a6a9-c1f47f23f348", "value": "12288:zMrXy903frWk3T5c1u31TTjqnWipOFWzVOMCF:YyIrWkNX1Tu/pIL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683448238, "uuid": "25314096-e8b7-4501-890a-387e04cb3ecc", "value": 489984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683448238, "uuid": "6bbc0a16-d6a8-431a-812f-ea2ef38a0ff3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683448238, "uuid": "44de7d65-fc9b-4bfb-b7d3-f8745057bdf2", "value": "07c4bbe5df22d2cbeeb5c0fb4323b240.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dcf15d6-ecba-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683452043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452043, "uuid": "e6300aaa-5999-400a-8714-fa369c0eff42", "comment": "Malware payload", "value": "fabdd4c030c58c94e4d26a68f7e85d2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452043, "uuid": "7ee5b6e3-52c2-4254-8ca7-79151d626dee", "comment": "Malware payload", "value": "da44ee4f0906dccee0c4653f9ada9668b3588b1821ebc52f0e99b15b1dfa414e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452043, "uuid": "9d4d7a4a-64f1-46a0-9f67-c5e228de5763", "comment": "Malware payload", "value": "7dbbfaa5cc1c5deb8bd4d1aea3cc5214bf0277ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452043, "uuid": "31f1b4c2-02c3-4767-bded-fb01040ca1a2", "comment": "Malware payload", "value": "3e56c0ee66226f579ff71f12a4bf3e491e65cfab6e9047ce5e5b3bbe45f9c331b4c6cba797bee659cbe98fc39b7da23a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683452043, "uuid": "a35d3464-5bd7-4d56-a703-4f2e8e394047", "value": "T1DC16011AB9648C74D493D4331015D6A39206D68EBA18CF8F13B01D0AFEF55EB8B16BED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683452043, "uuid": "28bab89d-11d6-4903-88c0-0ea5132b8bc8", "value": "c6e51dda1622035b42b177c9afe67c30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683452043, "uuid": "5e3e7b51-a5bf-4e8a-8764-055e3a1c1526", "value": "98304:Qq21KaNjf5rBIZU86Ch3/NCFBdkPo3Tsy1y6Ifgk31fTmU3Gt2F:e1DNr558bhV8dkwDsb6M31fyU3Gt2F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683452043, "uuid": "d18fff18-f7b4-489e-9fb7-10ff2286c77d", "value": 4334740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683452043, "uuid": "7080cc4f-a2b3-44da-8375-f24044004299", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683452043, "uuid": "86a6e6c5-b577-4b37-a4b8-7d59f96d6b24", "value": "fabdd4c030c58c94e4d26a68f7e85d2e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30a65344-eca7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683443833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443833, "uuid": "2859d6a2-b9a3-41c4-b039-f592b0602c9f", "comment": "Malware payload", "value": "5b2b663a5b14aee980edac3ba89c2ad2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443833, "uuid": "05111df5-08d1-4222-ae3f-4007f816f5ef", "comment": "Malware payload", "value": "daec604e167135a2da45518b4a4d19b72eca54802083c49f4a1942417f88787f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443833, "uuid": "94f1a197-428b-4528-ad67-2a9387c38faf", "comment": "Malware payload", "value": "0278ee72a0aeab7fd80096082d1b7a47d63f6e60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443833, "uuid": "f35b4df2-9e62-4d21-8720-7b8e54a47da8", "comment": "Malware payload", "value": "1547ab91c4116c1e383c5110752abeda319c708614726a8480fa6bbfa5f94153aa49c941b32eb7b5a53877f7138fa253", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443833, "uuid": "0b0f8a87-2f9e-479e-b6db-ebc41f631540", "value": "T159062321BAEF2498F439F5F66ADAC23F8B56B4EDB1470B371149224B4F507022E53936", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443833, "uuid": "0da0d75a-ea41-4bf9-9882-a6b113117da3", "value": "8d2cd9dce0359e2ab71ef91998c4cb76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443833, "uuid": "aa5b4d0c-8c02-4bd5-8f68-814c2d4796d3", "value": "98304:o8AOuopHIyiZpIzKQ1z1tEA0OHxvjxCp0EEkeGKqgzmu/V47e:xPnoyu+z5z/7bxANKPzmuh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683443833, "uuid": "8d9d770a-ea71-47a8-90b9-327cd5d390fb", "value": 4003659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683443833, "uuid": "f8417cc2-f836-497a-a313-569d6f1232d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443833, "uuid": "b9950835-d73b-4ebe-b071-c0e01cf91894", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10cacc80-ece0-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683468261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683468261, "uuid": "5e5122d0-fca6-4e2f-81c2-407d47e8e1ca", "comment": "Malware payload", "value": "ff730ccb6454946b00e4e407bbac9fde", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "IRCBotnet", "colour": "#D0B572", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683468261, "uuid": "b94bedb3-4e51-466a-82a9-2d9c8a170f8f", "comment": "Malware payload", "value": "db703fad83de57168d5cfb5320fa14e4eb7a0e5243884ebac061e02e52c00d48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "IRCBotnet", "colour": "#D0B572", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683468261, "uuid": "e28d68f3-81d9-46af-a6a7-d73090c5210c", "comment": "Malware payload", "value": "e50630e93c7eaff6ecfcab8fafc5b580781c2acf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "IRCBotnet", "colour": "#D0B572", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683468261, "uuid": "134616ff-1a26-449e-bccd-f2f39489117e", "comment": "Malware payload", "value": "86dfa5a60655fd1b00d784dc6d47607cf13930d3bcca54b7f73933ab517619cf63f6941e63d9caf3780c813f80ff423d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "IRCBotnet", "colour": "#D0B572", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683468261, "uuid": "e0c7331c-200a-4929-855b-1a233e940676", "value": "T157766B13BF58D70EC62422305CB1CBA46739AC4946D7A923B356F31AB8F116C1A6EDF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683468261, "uuid": "3d72425a-44c4-455a-bc6c-a47e0dad5029", "value": "49152:Mg9nF+fteXrvlo2jAtKVO2uNpj09+FS2yNsrHmfwfRftfw0/DfZ5XBriLl7saweB:f9nG21KpGi/Gx44C4jdmdcAQ/q9S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683468261, "uuid": "8ed855ad-ea18-42b7-8916-f66d3408d642", "value": 7284321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683468261, "uuid": "6ed1ae52-c243-4215-9d6a-f1034082b554", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683468261, "uuid": "9acf0c3d-badb-4be8-83df-283a16408cad", "value": "zbotmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "049f8c55-eccc-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683459651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683459651, "uuid": "c1bf924b-d0a8-4b02-8a06-7c8004701761", "comment": "Malware payload", "value": "63db35597c999af2cac29376797ad6f2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683459651, "uuid": "290ac808-b2b2-4fe8-8bed-022e18d26d8a", "comment": "Malware payload", "value": "dba6cb4c3541781d4deaf6f70a25f88daa70cc12de7f127fee1bad54eadc9e0e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683459651, "uuid": "41bee503-cedc-40c4-9201-437192293600", "comment": "Malware payload", "value": "e9fd3c673697c8dbd4516b1d2624385fa84b1265", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683459651, "uuid": "cd4ccb70-bc88-4223-89c8-3b70f4426681", "comment": "Malware payload", "value": "515e12ca791686e9dccebed18406ca121e4fb75a128e016cf360583347b921445076cd391a0778e712010a608b2666e1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683459651, "uuid": "22a5c834-3c20-4be4-8d28-89f1911ca597", "value": "T158E38E1076A581B6C28E003158669F3BD77EBE601FF184C39B69DB9D1C719A1F33B286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683459651, "uuid": "9eb52175-68f6-4fc0-bdac-ed1bd2c55399", "value": "7b9bcb348c1e3d4d1aa6264e79e4ec13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683459651, "uuid": "4e361292-88e4-4376-8c46-2456a4437ced", "value": "1536:GzykrDtT4NxMQRmWdhi79C0X/niKGn+TcFyc/i9wKZTz/:krXsx1ljiCn+TcFyc/iWKBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683459651, "uuid": "3855eff4-1f1f-4d11-a80f-7eb29da9044b", "value": 143360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683459651, "uuid": "c0999500-c08a-4bf3-bceb-e639ac6e19d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683459651, "uuid": "6530e9e2-0bf7-40f5-bdc7-a0574bd5cc3d", "value": "SecuriteInfo.com.Win32.Ramnit.Dam.29269.24883", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b3ab324-ec86-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Kovter)", "timestamp": 1683429624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429624, "uuid": "79e3a3c4-bd40-44f3-bd6a-f5163a5d284f", "comment": "Malware payload (Kovter)", "value": "a33dfa08f9a40f9c84ee7a65363443a5", "object_relation": "md5", "Tag": [ { "name": "Kovter", "colour": "#C8F4B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429624, "uuid": "08779101-847e-4845-937a-78cea6274586", "comment": "Malware payload (Kovter)", "value": "dd9ef0f7ffb948819f73b3c5651a1b1cff523e8bbcb9bc8e63c12230888e0fa2", "object_relation": "sha256", "Tag": [ { "name": "Kovter", "colour": "#C8F4B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429624, "uuid": "e6205002-c832-4e17-9ac3-fe81ab933a26", "comment": "Malware payload (Kovter)", "value": "a2dc820a2c3a5150260cc0e7ab164deb9ea9ac78", "object_relation": "sha1", "Tag": [ { "name": "Kovter", "colour": "#C8F4B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429624, "uuid": "e04653f0-281c-424a-baa6-df9c349031b7", "comment": "Malware payload (Kovter)", "value": "48790cf4664bcad0a551bc1c33db0764dbbe595aa710e3f7710cc174f410caccadc09503a005b671c08f01a675d61509", "object_relation": "sha3-384", "Tag": [ { "name": "Kovter", "colour": "#C8F4B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683429624, "uuid": "536b6f4f-87bd-4f67-b27e-c2ea413c998c", "value": "T118845B39F680D637D42258BCCE4FE2E5B569F2302D341857B6E51F4C48B92936E2BA43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683429624, "uuid": "4d28546b-839a-437c-8ef2-79af1a862b8b", "value": "c62ca0115b2faa73006dca641101cfb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683429624, "uuid": "2e4f1777-3f31-4ed2-bfa6-633581ea4720", "value": "6144:BbouacYxYvYiPLMNHu1f0eOAYPrQYmnBbYur+aLMT:JouagDPgNHSwAYPeneZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683429624, "uuid": "bf32349c-0a58-4e43-9b2b-516a747f57f9", "value": 401408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683429624, "uuid": "6699e027-b341-4153-88de-94fd23156ef2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683429624, "uuid": "9acf0c9c-a5fa-42ee-a498-09f44fa16aa5", "value": "VirusShare_a33dfa08f9a40f9c84ee7a65363443a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fa46f12-ecdb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683466112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466112, "uuid": "db3fd2e5-27fd-40c4-be8c-257b32bd3614", "comment": "Malware payload (Mirai)", "value": "a749f42a19b967f2ba7ccfe5e8d6c6cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466112, "uuid": "95d3d279-af82-46cd-b47f-018b8748cf46", "comment": "Malware payload (Mirai)", "value": "e0893425a4aeec7e6baba8a20c5aae56f748ebf8eac4384f91d40a931a5eeea3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466112, "uuid": "50f3c5a6-4536-4f70-9abf-55b4d7d26c08", "comment": "Malware payload (Mirai)", "value": "68ca9c88855df3efc1bbe70530bc6b6d2c0137ec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466112, "uuid": "99b3e100-de83-4d00-b63e-ab9b9968a45b", "comment": "Malware payload (Mirai)", "value": "2a62fb69b65148240c27576b0f6114448191e285a692a15baa9ec7770ed3ecd5aca6ac52e282352c49ee3a5e85374613", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466112, "uuid": "9c3d5a3d-8704-4e82-b908-1d4e0dff31bd", "value": "T194230271890F9DF124703C72DA999393B6E01AB5C6673023D6290E3C2FB5B231E57E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466112, "uuid": "7b7cfec8-cb48-488d-9e06-0d745b4e106d", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b3DW9q3UELbUXfi6nVMQHI4vcGpv2:DECFd+A6YHAxHLRQZ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683466112, "uuid": "407de0f6-bf0e-41f2-a462-312f600a9a09", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683466112, "uuid": "43ed2da6-b2e1-4a80-a7b1-fd97e798a84e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466112, "uuid": "08a1d301-ed64-40fa-9fd3-f4bf6405afa4", "value": "a749f42a19b967f2ba7ccfe5e8d6c6cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5f719a8-ecb9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683451842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683451842, "uuid": "66044a4d-f4b4-4953-864c-97a9c96a4309", "comment": "Malware payload (RedLineStealer)", "value": "a7e329a11a05ca3705d4bb615fb7e210", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683451842, "uuid": "bae6d2a8-760d-490c-8dad-2e51b8c49fbb", "comment": "Malware payload (RedLineStealer)", "value": "e44c4cf50f9e6bd96e7e535025dc095bfcbe3f9df9697cf4221d5be7fe1517da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683451842, "uuid": "cf611f97-752b-4783-bf87-fb649d859570", "comment": "Malware payload (RedLineStealer)", "value": "9d61ad6e0624e56eaf257897e6c92355ca93c557", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683451842, "uuid": "e609fdac-d897-4083-9716-3efb81566232", "comment": "Malware payload (RedLineStealer)", "value": "9c341b15fe1308cc84f7a24e8b1f1b604ed42dc32051e3e50c185ccaa82f87c6f155f2038e54b5dfb1dad61cd2826d51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683451842, "uuid": "574d4964-c8c8-4e0d-84b7-7814a3459e96", "value": "T145A41252ABD88173D9B5177019FB13C30A3ABCB18A74831B2746A92F4CB36D4E57532B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683451842, "uuid": "1f3f416f-4bdc-47de-a591-237ee3b5e072", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683451842, "uuid": "870a5d3e-227d-4ee7-93dc-f942834b50c6", "value": "12288:QMruy90SALBVERryN8L/RaM1TtG0BVFivnrZPRO7:uyhAKrnZaoTN7ivF8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683451842, "uuid": "6bd1de8f-8117-44ba-846b-e6b07d5608e0", "value": 491008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683451842, "uuid": "3bf738af-c2b3-49ef-b798-121697c23e11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683451842, "uuid": "0bacd270-5acb-4420-bd23-b7b833213ca4", "value": "a7e329a11a05ca3705d4bb615fb7e210.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52ee1f11-ecd9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683465366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683465366, "uuid": "92187a80-8a46-403e-9600-7eaf953350e2", "comment": "Malware payload (Mirai)", "value": "ba45be6ee72c898149062b728de77052", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683465366, "uuid": "2464f5e3-68d2-496b-9c7e-59385e19d922", "comment": "Malware payload (Mirai)", "value": "e5c0420e5539b02b02e04209f4e120886537812513040b86a4fcb09777fda941", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683465366, "uuid": "76978794-ffae-4028-b83b-8988e9b1226f", "comment": "Malware payload (Mirai)", "value": "409f4e2022e7b23530df35ac09381338430c0b70", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683465366, "uuid": "b661de28-e343-40ab-9ff5-cda131a383f1", "comment": "Malware payload (Mirai)", "value": "9a47873b2282b7f9ab62f7b43bef8ad826f1e22cb12fcff80c5f82e73f18ed73002421a868df8a03e2f4590a08bcb36e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683465366, "uuid": "be0cdf1f-aeec-4375-b533-79525189b5a3", "value": "T1CA63B516BF610FFBECAFCD3749A91B05258C640A21A83B767934D818F64B24F55E38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683465366, "uuid": "6765210e-bab3-40ea-be88-01e551120888", "value": "1536:XN1FyOKY49VIg4DJ6nAHILvTc9+B6Zwnz4ag:X/FyOKY49VX4l6w+Eq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683465366, "uuid": "b4f72425-17df-4753-9237-b458495971b4", "value": 68976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683465366, "uuid": "c47582d8-6d7d-47b1-8082-b55b5601ba1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683465366, "uuid": "f61d3ce4-9e02-4c3b-9c03-e7e993ec3573", "value": "ba45be6ee72c898149062b728de77052", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "609fb8f1-ecdb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (WannaCry)", "timestamp": 1683466248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466248, "uuid": "d20af1c1-52f8-4d14-8a80-20e39de3ee91", "comment": "Malware payload (WannaCry)", "value": "1d82912d3e95cc2f66d43f61e0be37b1", "object_relation": "md5", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466248, "uuid": "2eaea0d1-bfa4-47c1-ab5d-c721dfdf759e", "comment": "Malware payload (WannaCry)", "value": "e672965e0783643633efb6dab2d569add812e53af997cf48bd5d788e53de55d3", "object_relation": "sha256", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466248, "uuid": "5398f265-d1fc-45ad-98a9-a8aa0efe5be8", "comment": "Malware payload (WannaCry)", "value": "fbd822032c4a40ecc3582278eb1f2e7b7dcd884e", "object_relation": "sha1", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466248, "uuid": "ba3fcd08-f716-47f8-b869-036332058f77", "comment": "Malware payload (WannaCry)", "value": "b5104cdd3cb2a3a3e5d6cf4a728b328bb4a1cbb9e6ba3d298d2bcda8e969f4cfeebd2cf5294d590a8259311f18daf1fc", "object_relation": "sha3-384", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466248, "uuid": "fd562e8c-5655-46f7-b271-ef81c3889719", "value": "T1A56633765228E0ECE05486706067CF95F77B3C667AB65D1F67C087BA0DB2A8A7FC4201", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466248, "uuid": "4ceeb367-86c3-408b-bf62-3f559a5f7458", "value": "9ecee117164e0b870a53dd187cdd7174", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466248, "uuid": "593f2797-524e-4a17-b204-90f49a398ddd", "value": "98304:KuqPoBhz1aRxcSUDk36SAEdhvxW1A593R8yAVp2HI:KuqPe1Cxcxk3ZAEUizR8yc4HI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683466248, "uuid": "6ece9027-3161-4041-a334-2e2cc9a182bd", "value": 6729728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683466248, "uuid": "92e87ed1-936e-4e20-b398-09303e465c68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466248, "uuid": "1e8cf277-3ee5-42a5-b143-7a35b6834a26", "value": "2023-05-06_1d82912d3e95cc2f66d43f61e0be37b1_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94c2219c-ecd4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683463329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683463329, "uuid": "6a6cc8b2-ff01-43f8-a664-6b61a1019fe6", "comment": "Malware payload (Mirai)", "value": "e93221da4f7ec791295abbae87b8360b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683463329, "uuid": "f0cbe84d-57a8-4a73-af6c-43fff688e338", "comment": "Malware payload (Mirai)", "value": "e672d299b066eaf0b862b423b8ffb1ea5703b56f09868228da8e0e753f635dc4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683463329, "uuid": "19a93e65-3c67-4687-aa3d-6631a2bee590", "comment": "Malware payload (Mirai)", "value": "336fec8c1988fc79adf4d6e410834e7ce3b655e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683463329, "uuid": "2a131852-fd40-4f0f-b321-d2c362a278cb", "comment": "Malware payload (Mirai)", "value": "ee5f9bd408c5d3bf5cf2f56c45a61214a7c219f04d534977b611b4748676246bd00a2e344f2147b4e7571acad39eb0da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683463329, "uuid": "7f7b6393-8b57-4387-a758-0c09017690e7", "value": "T131A2E0A9FFA28089D0C6453C19D3A9BB366BDDE38398426B6D91D8C609D38CC804FC31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683463329, "uuid": "c4215cbc-ce7d-4b1f-b47f-4864d88d640b", "value": "384:TDYC95A2rM7RjFrvX2V6H2XJ8LaHYsbX1chNuHfmmcb4/N7KbxTKqNXcuiFqcJr:TDZ5Dw7RjFjcU+O24sDOuuE/Nmbx+qNm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683463329, "uuid": "44318a49-32ec-44cd-9124-4f82b70dd1b6", "value": 23260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683463329, "uuid": "c3043943-5eae-47c2-853a-4cd4a3e17c8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683463329, "uuid": "fb6f9369-5619-4e86-8aa6-79d2117c05c8", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b7bcc7f-ecb6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683450213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683450213, "uuid": "5ebbd1a8-a759-4fd2-b505-40e24aadf864", "comment": "Malware payload", "value": "a98f256f7473f66237a7adb33b513d70", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "FakeKOTA", "colour": "#00CD36", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "x86_64", "colour": "#DD69A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683450213, "uuid": "fd363ff8-bbe4-442e-8f57-1d2ef38c745a", "comment": "Malware payload", "value": "e6b6cf40d605fc7a5e8ba168a8a5d8699b0879e965d2b803e29b87926cba861f", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "FakeKOTA", "colour": "#00CD36", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "x86_64", "colour": "#DD69A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683450213, "uuid": "7da2dcff-43f4-40fe-b5df-d59cf366ade9", "comment": "Malware payload", "value": "7dc61a03c520d2ab63901818a2b3e833050d78d9", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "FakeKOTA", "colour": "#00CD36", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "x86_64", "colour": "#DD69A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683450213, "uuid": "1b25c623-50e1-456d-ad59-e750c2f7c30f", "comment": "Malware payload", "value": "251c89dec999ef95d20d22fae90e8429710bd4bdcb87e2dd38d6375c211eaf7a0f1be84d287986d0d4abb2ba442fd2e6", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "FakeKOTA", "colour": "#00CD36", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "x86_64", "colour": "#DD69A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683450213, "uuid": "083da9e8-bb5a-4462-b548-a2ed5fd34e62", "value": "T153470143F89044A4C5EDD2318A758252BB71BC990B2127D33B64F7B82F77BE4AA79344", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683450213, "uuid": "a18c608a-c66a-4378-8536-90decea12935", "value": "786432:3sZpv3x5Xvvz/yV9UOS3R4JBtkO+TMAu:32pv3xJvz/yV9UOSB4JBmO+Tj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683450213, "uuid": "9209366e-956a-4f95-bbe5-516cd8a7d668", "value": 26322208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683450213, "uuid": "6c429e4a-f8c2-4641-81b0-3cb5c2ad6da6", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683450213, "uuid": "b529d688-84c9-40ef-92f5-fb99dc35e35e", "value": "My Go Application.app", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "376c26cc-ece0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AZORult)", "timestamp": 1683468326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683468326, "uuid": "05e64aa6-6193-463b-92ca-cd4ca10b7ecf", "comment": "Malware payload (AZORult)", "value": "478f146fdc61c3b8bb776e581cda351f", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683468326, "uuid": "fe07a596-3455-4376-9a05-1bfb795d1539", "comment": "Malware payload (AZORult)", "value": "e6db758c06c1caf134cbfd16508570abc36a9931bcf7ca74dc2ebb3a3682c0e2", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683468326, "uuid": "580fe528-4ea9-4145-8b45-5004cbf554a2", "comment": "Malware payload (AZORult)", "value": "7509f1faf8f51ed5c21320be74c25a8d927ad49e", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683468326, "uuid": "64f68e7a-1fd6-44e8-8a23-22f633f691a0", "comment": "Malware payload (AZORult)", "value": "7cd116fc19b69ee51095800b6c673f53d441e970cf1bdd8045e8d95243f4cef00232b82fa46b1bf6de6de08ced18c60f", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683468326, "uuid": "2c16490e-e0ac-4460-958b-2994f84380eb", "value": "T146A47C892BC1DC35E4699EF5571103BAC023CC346A42DE8B62A73D6157F6DA763E8323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683468326, "uuid": "60fa2c71-2a9b-4e69-b4ba-bea6ffae4b0f", "value": "8519407c26c83c66ea72bad749e56a2b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683468326, "uuid": "c0f68a8e-eb95-4bb5-990c-1d1f4a625f3a", "value": "6144:gfjYzxKVmaT6ndW/X9ecs1t6sbCNUhj9PFDiQ:sjgc+WP0GmjdFv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683468326, "uuid": "426ac314-3185-49d6-aa48-d22915959d7f", "value": 491520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683468326, "uuid": "7640a561-723e-4d49-a5ad-f1eb6cd609f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683468326, "uuid": "e0ad389e-0fe0-477d-82f0-75dd2a365244", "value": "478f146fdc61c3b8bb776e581cda351f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "404806ad-ed31-11ed-b3cf-42010a9c0076", "comment": "Malware payload (NanoCore)", "timestamp": 1683503130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683503130, "uuid": "566626ce-57b4-4299-9cad-23c3e1b708c6", "comment": "Malware payload (NanoCore)", "value": "abd1b166ab1703f4b3558b0c66d77556", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683503130, "uuid": "037ab79f-5ebb-4a72-a3e1-1e5c5c062e6b", "comment": "Malware payload (NanoCore)", "value": "e7fbd0f33ca20caae55da9423c81241c9bced4018456d5fbd27cc9f93f912310", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683503130, "uuid": "2f1ec38f-744e-4035-ad86-1a55ddc08e89", "comment": "Malware payload (NanoCore)", "value": "d28ee7135fbb4da81904aa0cc97e772f200dcb29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683503130, "uuid": "5691b8d6-8f6d-4be1-85ed-24562f123d30", "comment": "Malware payload (NanoCore)", "value": "5757477ed68ac15f697c3c49d860e348cd32e47bac0a8a98d4b19b42efeae6779ac65ad0a24bf0265318df6c178fd624", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683503130, "uuid": "c7c70eef-d20e-444a-91ca-bfd79309610a", "value": "T1E214CF5677E94A2FE2DE86B9602211128378C2E3E8C3F7DE28D454F78B267E406071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683503130, "uuid": "96fac3fa-8ceb-4563-9228-8906947aa96a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683503130, "uuid": "c088c46b-e988-4aa7-9f12-8e14e743e2a0", "value": "6144:gLV6Bta6dtJmakIM5hlWUu5LYkO0TrWS2:gLV6BtpmkelM5LYkO0TK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683503130, "uuid": "7c349f5f-5653-4a36-a4dc-47cdea2ac261", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683503130, "uuid": "9ac344b1-7e05-4b61-a261-f7eb44a93841", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683503130, "uuid": "ed1749f2-234d-4096-826e-2cfc8c9f2290", "value": "abd1b166ab1703f4b3558b0c66d77556.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "006d586d-eccc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683459644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683459644, "uuid": "63ea40ff-9aac-4721-a2b5-24ab0518a781", "comment": "Malware payload (RedLineStealer)", "value": "e405ad34c38d470ec9cbd1f2ac5e7251", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683459644, "uuid": "a23f7984-67ca-4b72-8e78-f8c6e3a61c12", "comment": "Malware payload (RedLineStealer)", "value": "e810e42176869e987b747411d29a8071fd18db65de336b5f9f29be6b85c3bb21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683459644, "uuid": "3858cfc5-cba8-46a1-99d5-7c0b02bbf495", "comment": "Malware payload (RedLineStealer)", "value": "874f32de82abecc138e1cc0870bdda57747e77de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683459644, "uuid": "e5ef3598-7c57-4c81-af46-425bd0e8ceaa", "comment": "Malware payload (RedLineStealer)", "value": "dc2be2d1e53afd5d4ccdcb8b05a3c6edd747d85651a8e7e81372b18b1abe94e29a15e0750e599cabd62cb1b6eda4f6fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683459644, "uuid": "955bc8c9-b233-4789-8e49-e48b9750bf87", "value": "T14CA41251E7DD8472E8B56B7048F203D30B367DA28A7447AB1392694E0DB27C4E97273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683459644, "uuid": "499e9585-2643-46fb-98b9-03bc4fa71b32", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683459644, "uuid": "578d186d-98a1-471e-a6f3-887da45e6da0", "value": "12288:yMrAy90MPFI7/z6/ueVPROidjKyvpYNRZlCUVd5Lf:OyzPGTzdeP3d/pYH/3Lf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683459644, "uuid": "571790b7-29ea-4291-9803-bf472f121b63", "value": 491008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683459644, "uuid": "b6176ca5-a936-411c-8f5d-877d924b6dae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683459644, "uuid": "cf125430-dc42-4091-a4b7-74bd39db2eec", "value": "e405ad34c38d470ec9cbd1f2ac5e7251.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f70d1908-ece3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683469936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469936, "uuid": "6c02df0f-14f2-4034-b884-cdb6c5518a35", "comment": "Malware payload (AgentTesla)", "value": "8d872ce9212ac69cb69bfd320f41034c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469936, "uuid": "8bd7b6fb-453c-419b-952d-2d8d8dc69d5d", "comment": "Malware payload (AgentTesla)", "value": "e89e3adec78041202f3efa936d91d71fcb9e886ff1cd757ac34072a592370f4f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469936, "uuid": "e5633add-6f8c-4644-896c-2f0e8d06fd34", "comment": "Malware payload (AgentTesla)", "value": "cfb9566649142c44bf160a83039cf5079d445adf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469936, "uuid": "324329ba-cb4e-41f0-8ecf-6e59dae3aaed", "comment": "Malware payload (AgentTesla)", "value": "944ed2bf41fd3b950fdb6ffdd752ed0825dc144bd97ab91791a5c3e7e31c729119aa958322009fc2359deae7b1f08a08", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683469936, "uuid": "c70b966e-67dd-4b02-bcef-04f9f722dd4c", "value": "T12D45333F1A7372E9C7701234F463EB7E4A6A6C998E05434323851A751AB7CD58F0EB92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683469936, "uuid": "50b0ffe9-86a2-46f1-85d7-a59574d1e313", "value": "24576:u2/D3wIaI2MldEmkbhBtW7fIRschBjdEWOcOCP8LuMKVzZf6WVr:TTnb2MldohTCA3hvEWOgP8LuHkWVr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683469936, "uuid": "ff21f4e0-3f64-46b6-b81b-dabdb06722b9", "value": 1224843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683469936, "uuid": "890bc1c5-cae3-4cf3-aac8-ef030e41a711", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683469936, "uuid": "1624a67e-acbb-4956-b945-b66aa897e908", "value": "Purchase order 3500354689.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff32b59b-ece3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683469950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469950, "uuid": "53d66c25-f330-4016-a0e5-36a47507892b", "comment": "Malware payload (Formbook)", "value": "dcfe478cac08839f682acef05cf21ba2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469950, "uuid": "fe0580ca-0086-4595-bba5-43f1538d0944", "comment": "Malware payload (Formbook)", "value": "e9bb4fdb5d565583df045f39e547a01a380ab0d40d046765fbbabfbea2790be0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469950, "uuid": "af38e098-d974-4449-8361-1184ddfaef68", "comment": "Malware payload (Formbook)", "value": "8c5d49940570e4f24571f171eed2c4de91c05b45", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469950, "uuid": "85926fe6-53ab-4a9e-84dd-4434de4b1b89", "comment": "Malware payload (Formbook)", "value": "1e32d7957deca7172568054bf6a95de6db82eef41f9203718a7dd8be889b941c704aba1c2b9f828ef323744b962bad79", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683469950, "uuid": "4bce8798-63a2-44a2-b45a-58ce6a909882", "value": "T17FE42377495256E0306CD46380B6B1A341A8A4F39DB1326E4BA469D4B8C7FF93E74E38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683469950, "uuid": "f5c6255a-0ca6-4a52-94d2-99f17ea6de86", "value": "12288:JQBBis5lQSwf5Z2ZAtqstuUcIJsaR8i5Q8LVHZi7+95ZmZdYR:I5lQSy58yDcasalpJH0+BmZiR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683469950, "uuid": "b4066c15-d4d1-483a-83fb-921a07c9678a", "value": 665398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683469950, "uuid": "ed2d15a6-37cf-4baa-8890-ee689db08899", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683469950, "uuid": "c54079d1-3ced-49ec-9b61-02fae3751865", "value": "SPECIFICATION.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4708f344-ec9f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683440435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683440435, "uuid": "c3ae6a8d-5f31-4c4b-9709-d6000462f41c", "comment": "Malware payload (RedLineStealer)", "value": "2309a88a9cbcd4dc1182c02a2466be39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683440435, "uuid": "0723d05a-dc84-42c5-9b24-029c00128480", "comment": "Malware payload (RedLineStealer)", "value": "ea5065d0a99eaba17c9dc044bf3bb3ba8ed7bcfa39fab55fcb9bef36822c18c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683440435, "uuid": "0e269705-7c1d-4caf-ac74-3c5a62afb0fd", "comment": "Malware payload (RedLineStealer)", "value": "7bcf17322ff7a35ac7f174040a36db629cea69ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683440435, "uuid": "d58ed4a3-1ca4-4b2a-958e-2dedc881d29a", "comment": "Malware payload (RedLineStealer)", "value": "5ec7766539f428de9dd39fd3858686caf3e8d055543446e1dc2be67c30bb004d84bb4a1e8235854d6fd4c31e78c5ace6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683440435, "uuid": "97328c31-cda3-49ba-97fd-ae002a8b357c", "value": "T13CB40263E6E850B2ECB127B02CF603D31631BCA19A74067B2B9095591D73AD4A57237F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683440435, "uuid": "88202743-07d3-4c56-8cb2-76bd94b53b16", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683440435, "uuid": "d16a6c85-2b97-4495-94df-57730c5f31ab", "value": "12288:kMrwy90DBcJZJXt2bO7VJkXGSARinm4jkUwkbpS:syS+nNEOpJkXDyKmNUzpS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683440435, "uuid": "7c309980-be1f-4bc3-afba-804c821d2dfb", "value": 503296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683440435, "uuid": "f32e9c5a-96af-4da9-95e0-6e7d916044f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683440435, "uuid": "a13a1eb6-fcb0-4394-8bd3-0c7125108eb2", "value": "2309a88a9cbcd4dc1182c02a2466be39.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c628c116-eca6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683443655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443655, "uuid": "22c4d517-bd19-4d7a-b2cc-e5cac26651ad", "comment": "Malware payload", "value": "4654d716a0bcd885cb449a9fbd263383", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443655, "uuid": "733a3de9-fd7d-4bd2-8037-85805ca09a1b", "comment": "Malware payload", "value": "ec5289a86c83f3ab890a04c71db02849243402bf5f9e08d48d644e20954c8e16", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443655, "uuid": "b862fde5-4b51-4017-af65-9acc93f84890", "comment": "Malware payload", "value": "f27bc14ba738a33408008930e903dc88e9aa8f44", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443655, "uuid": "b35ca98e-68d8-41f5-918a-1dee447948db", "comment": "Malware payload", "value": "fec04f56824a68b3eb7b8717b6ecab95dacc3d461befbace082ed218a6f4b4a716e7456bea7e8151bad721ff8b61d918", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443655, "uuid": "35010606-ac28-48c6-81d6-2cd534a702ea", "value": "T1A9C6E0968320C5ADD9F76670CA6330D5AFC68C125FC345AEAA783E385AB75DC1700F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443655, "uuid": "9b732043-1b41-436e-889a-43379d70ed3c", "value": "196608:u+QlZuiEi8cu2C/t+pHq+YYz1u4SDnHtgNj9EM6yqh/aE:u+AZufi8cLC455YmVSDHtgF9EMeT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683443655, "uuid": "22a9fce8-baef-42fd-961d-07a5e45f1b89", "value": 12586016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683443655, "uuid": "cfef77a8-2180-46b5-b539-a099db25ff77", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443655, "uuid": "b2a0dbfa-0683-43fc-8082-8e74fdca489f", "value": "Aura Voice Changer_1.2.0_Apkpure.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "303c5e45-ecba-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683451993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683451993, "uuid": "6f5a9903-3a7a-4981-b3df-6d1e6eca471d", "comment": "Malware payload", "value": "84ec4428a39feac37ce231b888146f30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683451993, "uuid": "c1b1e123-502b-4668-903e-8d1c91536c0b", "comment": "Malware payload", "value": "ecbc0d116c6f2079d24ca92ab4fa847ada9a43bf13c4f7e81786fa14872493a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683451993, "uuid": "06889bb2-fefc-461d-bf1c-d9fe4942b5c3", "comment": "Malware payload", "value": "f49143317c62b078704d173534f67e4cd5f5ad16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683451993, "uuid": "29bed97f-4407-4ce1-ba53-aa90fb9b25bf", "comment": "Malware payload", "value": "b258835549c48dd42b558ddef152bfeea6920a0e78a15c7d82c16c3a39cc37c190d30db55eba61a807877225e2388f56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683451993, "uuid": "e37921db-37ff-4077-b227-dbbf6e296b48", "value": "T14146F810D641521EDDBB24F54AAD713EB10C9FE0131864C781C86AFEEBBA6E13E3459B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683451993, "uuid": "3f467a50-8858-45f1-8247-e37d79c578a2", "value": "49152:HLz6va++B6xN2+V+tfG2VcruFG2KALO9D3pMDuDhEDL4xqU9uBB7fQbA6qbC6KvH:rzC+CqfG2VcruFG2KAyVEDLvTQt9Hn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683451993, "uuid": "760db043-6ba2-4173-b079-c5811fb0b2ad", "value": 5431566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683451993, "uuid": "49087f72-8d2b-4754-b526-57b8c914df0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683451993, "uuid": "9a16dd73-1541-420b-8cc4-cb4f4fc417b0", "value": "84ec4428a39feac37ce231b888146f30.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "909b5dab-eca5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683443135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443135, "uuid": "ef89e50c-bee4-4dab-bf69-3005f9d1768d", "comment": "Malware payload (Amadey)", "value": "172fd3e47e8a34d5309eeff94f9910ed", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443135, "uuid": "d0728cd6-1684-418f-9070-d37a63802fa3", "comment": "Malware payload (Amadey)", "value": "ed77156c39f0b3185533e6bbebe21f62085046eba82a91db0c064b58be9db666", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443135, "uuid": "fd9ccc23-bb18-4053-87a8-700d3b4744d3", "comment": "Malware payload (Amadey)", "value": "a7be0914931003151c6c9f12fee02137dc760d61", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443135, "uuid": "0dfd57c7-9075-4de3-b62d-3bd97cb81f06", "comment": "Malware payload (Amadey)", "value": "2a7527c5bab931c418059903ffb7b11bd1ab60856b76eca6dce475caa9efb193c285eb6b22f69392ebaa5aac1ebfe53b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443135, "uuid": "7784cefb-a8d3-4f32-a3c2-ca702fe7cb25", "value": "T153B41212E6D84077EDF417B058F606930E35BEA26A78926F27846E8F1C72980E57137F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443135, "uuid": "c7620cf0-44f3-4f10-9943-48a0bbffe2d9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443135, "uuid": "fa5b9db9-daef-4752-93f1-b484f3f9a626", "value": "12288:5Mrey90xXAS8Z7z1TK8d2A5pxH6zWJV3P8HralhtXOWm:nyzdBTBt5HaWv3P8ulxm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683443135, "uuid": "b69c1cd5-a7ce-4376-b97a-0932a6f5a3dd", "value": 503296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683443135, "uuid": "c250de86-b663-4d95-a18c-9b7fb562b1bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443135, "uuid": "99c66b7b-cb87-4180-928d-540576404ed3", "value": "172fd3e47e8a34d5309eeff94f9910ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18fed431-ecdb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683466127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466127, "uuid": "d111b6e2-146b-48c9-be4a-a0f0a86733a8", "comment": "Malware payload (Mirai)", "value": "0ce8a22a9d353076f833508b6d95f6a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466127, "uuid": "c063d40e-310b-4cbf-b665-12e2001ea5c2", "comment": "Malware payload (Mirai)", "value": "edb8ce061a084f2a9a564e964b20a127254658c60e5eb32755e64b1cc7448d7f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466127, "uuid": "9ee5a85c-46bb-496b-a943-20a0f38963b7", "comment": "Malware payload (Mirai)", "value": "da6aa68d9a722e548e23993a31eb7926ad651ef4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466127, "uuid": "a48307fd-5d4d-42c6-99ea-e7559eb04b80", "comment": "Malware payload (Mirai)", "value": "ebf5f98a0c5927b458bc8fefd007c4b53267a8fa2adc9895e6de7a18b24d22a3bbf85bc7ec762cbb95cd6b0ef935c7b0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466127, "uuid": "0ea3b7b9-e5fd-467a-bdb4-2425df8d4c6d", "value": "T10E335C0272280947E4575EB0753F1BE093BFE99021F4F688684FDB5A8276E331586F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466127, "uuid": "57f4e12e-a10f-4b36-af76-8bd992c80582", "value": "768:snhCrA2xSRBXT5WJtrgjZbGMN43xitBl5LK+0Wmsf:sQrPgJWHCZbbe3cr5LK+XmG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683466127, "uuid": "5360a33c-91df-4ae5-aae9-99f9240ed960", "value": 51040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683466127, "uuid": "9d9205a5-6790-4193-918a-dbc26d947d1f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466127, "uuid": "436e1251-14fb-44fc-abeb-f30d8151930a", "value": "0ce8a22a9d353076f833508b6d95f6a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c10f4ef-ecba-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1683452013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452013, "uuid": "1d70db09-948b-4882-a9bd-9467b32eb9be", "comment": "Malware payload (Rhadamanthys)", "value": "d1e8b256605c4f1595c38209a8c7bdf5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452013, "uuid": "50a39489-b07b-4c12-a91c-9c906261c356", "comment": "Malware payload (Rhadamanthys)", "value": "ee692a6bade4d08fa2c9ccbcf1e812ab20685a99105bb3af06f6767854a76831", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452013, "uuid": "4879c616-cd87-4bd3-aca2-e82dc0346b4d", "comment": "Malware payload (Rhadamanthys)", "value": "30077823b8bbaf9f149509e89b4be09033702122", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452013, "uuid": "24b9a54b-01d8-47fc-b33f-67ca51b2cdaa", "comment": "Malware payload (Rhadamanthys)", "value": "56656720b591f6169a11be31d53d3fc190cc7072940822d61a7be6f7e58e10bbecc38321573ce173083357481b331d92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683452013, "uuid": "77698385-f9c0-404c-b5b1-373cf96adb5d", "value": "T18184080392F17D54E9268F729E1FC6E8F66EF2508F59776A1219DE2F04B02B2C263711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683452013, "uuid": "8c5fe95f-d7cc-46e8-90f3-aebe9aee2eaf", "value": "bb88f4adba9a887009b468960699d154", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683452013, "uuid": "9ee72a5a-1f14-4ba0-9906-493554834d9f", "value": "6144:ZbT7t9LXAZJE8kGTQTnJrBGUb2kPEMTAssdxSZ:ZPrkZJYsOJ9P28XsdAZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683452013, "uuid": "0e53cc32-145a-462a-ac59-26ab3e50e952", "value": 383488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683452013, "uuid": "a96e4480-2ad6-44a4-a0f8-f8ba961d300a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683452013, "uuid": "41fd34fa-3c46-4c7a-9412-953038154d56", "value": "d1e8b256605c4f1595c38209a8c7bdf5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7faf9d7-ece3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683469938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469938, "uuid": "e9d66b08-b9b6-402e-8e5e-5be7e92e0b6e", "comment": "Malware payload (AgentTesla)", "value": "04f37c1f639bdfe745d96b6803f25878", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469938, "uuid": "8c24a6f3-9f0a-4b6e-84da-5112674880de", "comment": "Malware payload (AgentTesla)", "value": "ef7efdb1e205d31ad1a79452cae95f4f72b10a4e84dce82f66dfe2e3e2a2739b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469938, "uuid": "9988a88f-fae2-4671-aaf6-131ba3007ecc", "comment": "Malware payload (AgentTesla)", "value": "3b7401521a7616375d060c2e4c2542cb6c91c9a7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683469938, "uuid": "3f016b45-b934-417d-931a-e4047e578635", "comment": "Malware payload (AgentTesla)", "value": "d60f6917d1d4032bbe0f2f86e55982aaa6677f8b9d2cf03fa82267841ecfa61d8a38214ca57d1dbe05b18975a5d18d9a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683469938, "uuid": "4331d27c-0352-4ade-80b7-99954856dbaa", "value": "T1AAF47D3A25689B7AF179C734866C4460F3FCA41FF351EA59BCEAC0E805C2D81A6D352D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683469938, "uuid": "ea6349e5-4c7b-4fc9-8f3e-8a26dd393077", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683469938, "uuid": "915ae6b1-0612-4675-b3ff-0545fc4b07c7", "value": "12288:m0uMAP4wgC6bYLq9fRYVG5tVvNKq8XuQzha0eKMC61JmpnpFR:UqUVItVFH8XhFajB1Jmt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683469938, "uuid": "4a8faabf-ebd6-4885-a78e-3376366596c8", "value": 727040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683469938, "uuid": "2d34f688-7858-4198-a701-45c7b7384f50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683469938, "uuid": "fa41b0f3-3252-421a-98fa-534491ebb33f", "value": "QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9a1819b-eccc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683459955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683459955, "uuid": "3a1c1b8b-a14b-4574-8055-2a4bd059bf93", "comment": "Malware payload (Amadey)", "value": "00bf41f5548d630becb5630653b4693e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683459955, "uuid": "e04ee030-5b70-4475-9cab-c45e8c27cce3", "comment": "Malware payload (Amadey)", "value": "f1a8e4bd48299de9376f90f804c506745bdc03a916691f7a1d100e28251d669a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683459955, "uuid": "c7a1320c-0755-4328-a66b-f3cafb54306a", "comment": "Malware payload (Amadey)", "value": "ad7ed193f142a0ae8926bdd38bf0f94e3677c057", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683459955, "uuid": "8df61716-2c9f-4d1f-8133-48e8a85ac9aa", "comment": "Malware payload (Amadey)", "value": "a3ef4daa6c613aa3206f371a4c9d447a8f1049645bfd6b2b9cfcea9bc05ffab165ce8a341b76ddcfdde94931ae09de15", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683459955, "uuid": "b934aafe-c179-48e0-a284-b05bbb2c609d", "value": "T1D964FA4392E13E54FB268B729E1FC6E8765EF2708F59777922189A1F04B01B2C273725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683459955, "uuid": "69437159-bf28-4e2a-b507-f7ed87ae7f49", "value": "07392231fce6d1215d12aefe3ca2bec9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683459955, "uuid": "6b8ea4c4-d6e4-471d-9fc8-8886b3bec760", "value": "3072:hAX/9PJOHP0CLQ76o5DlAOdxseynmKBlFKXJ5IlPSxozBgn77+B/:KFKDLQ2o5ZAOdmeom4K0Yxodk+B/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683459955, "uuid": "e1abe5e2-d9e6-4538-96de-106231a335a8", "value": 322048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683459955, "uuid": "68b47a41-6ee6-4e46-965d-490fd3cf6f9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683459955, "uuid": "156ed11c-a66a-4b30-b2d4-7a8027b4c135", "value": "00bf41f5548d630becb5630653b4693e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "490950ad-ecb8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683451176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683451176, "uuid": "ccf25a9f-36a9-4a7b-8e11-1bb37909ae6e", "comment": "Malware payload (Amadey)", "value": "64d71779a23591879bea49423a743dcb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683451176, "uuid": "8b1a7051-bd9c-4016-b5e6-4401c4c671b7", "comment": "Malware payload (Amadey)", "value": "f21e19364953177fbe0aa9c4b20eeaec1efdfc8bb8958eb5ffc3ba096d5594e0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683451176, "uuid": "d3cfa952-7a0e-4e92-b7f2-3898348bc07d", "comment": "Malware payload (Amadey)", "value": "bf25182d8337ad9d90c9db69e72bec68ec4b4514", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683451176, "uuid": "c5afbdb8-7d67-48a9-a071-afc7dbc12cb7", "comment": "Malware payload (Amadey)", "value": "b87d8880da31d301cae1cc12f0d012abcc08be67af2874e030e795f172865693947a244d5659dbbba783260f2ea05d2f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683451176, "uuid": "51809c25-d7a1-41c9-9a4c-7fc8ce049969", "value": "T12A935B1030D2C471D57E55351478EAB68B7CB924CFE08EEF27551A7A8E702D1AE32E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683451176, "uuid": "9f2ec490-9e9e-46b9-abb7-5e2b04c5ff5a", "value": "52982bbab8b9d5eafbb4ec438626f86a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683451176, "uuid": "b64e1c67-4d4b-4868-8d25-ed93e9f3e345", "value": "1536:CQFNPSrQba4Y0bpa1W94oUshHrbcPuNh12ZszsWuKcdJUgwaB89p:CQvS8bhdpa1ToUs6uNh125LJUlaB89p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683451176, "uuid": "982fb9e3-d91b-4651-8103-01fe3e739fc5", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683451176, "uuid": "6544ab0c-8d75-4045-870f-09b7a38cade5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683451176, "uuid": "def78271-cdab-42f1-b19c-5c35f9638f98", "value": "64d71779a23591879bea49423a743dcb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aa14a99-ecf2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683476062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683476062, "uuid": "705b4417-f9f4-4250-989b-fa8e042d4d1f", "comment": "Malware payload (AgentTesla)", "value": "0c9f6ebfebc42cdcf20144a42bac6f8a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683476062, "uuid": "4912f667-a9b8-41d0-8900-2c8a567f50bd", "comment": "Malware payload (AgentTesla)", "value": "f4987dacf72e39e82c79a98402f44f83e364f4e1a96c808dbdcfd232c276fa09", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683476062, "uuid": "cd1f34bb-c721-4fd1-a35a-a95ad13251cd", "comment": "Malware payload (AgentTesla)", "value": "0e7e7001ad3e6ac8c0ebba16451551678c66f3f6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683476062, "uuid": "89bd65d7-4c96-4b55-af20-782a9fc05ba4", "comment": "Malware payload (AgentTesla)", "value": "588a66703ea8812dfa23a635fea81c97661d8898ddca82666c0b2ac474975ea200dc5a682fce643f19ee9635400dff4b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683476062, "uuid": "6090bb77-678d-4f1e-beb8-81fffd4a52bb", "value": "T1C0E4E1213379FBA1DCE583F8720CE4015FA45D50A3B9FAE88DCBE0D45598B19E7606A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683476062, "uuid": "44af86f2-d0e1-4772-b43e-365a2eb20b2c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683476062, "uuid": "0541a166-32f1-4186-95df-3b66fb61378b", "value": "12288:Y2A22OmddXqtacvwaOTAeQJmrfOETiQQD5SWDjYuUXFSC6WZaMT1MNmSLrGJI:HAbZcvZORrgQQDxXlU1SErBMsW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683476062, "uuid": "bf24e035-b976-4c62-8ea5-4e34f36d636f", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683476062, "uuid": "ed94d68e-d1f2-4c4e-a617-c77ab73ec62e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683476062, "uuid": "c828c0c6-991c-49cb-8091-55a7c513dbc2", "value": "Transferencias-00202305.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1323883-ecda-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683466034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466034, "uuid": "990ce780-05fb-4741-b326-92b621f5fb96", "comment": "Malware payload (AgentTesla)", "value": "336a11f0599570c025e2458715d67311", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466034, "uuid": "ed01a59b-ad6e-4db7-ab04-ebbad9355ddc", "comment": "Malware payload (AgentTesla)", "value": "f4c51da15914ffd80de043160163b5a91561def1d1f28fbb016c3f60021a0b45", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466034, "uuid": "00bc4e2e-0da3-4d2c-886f-c0e93e415fb0", "comment": "Malware payload (AgentTesla)", "value": "f24e771c27b2944055084f950edc1b7119e63699", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683466034, "uuid": "536d417c-1670-4273-9c07-925a561684e8", "comment": "Malware payload (AgentTesla)", "value": "17f0d5074273838e3229346c5ef2b01d95653118be7eba0192fbba13841a2f5e0137f6d2ae70c19ed54dd47858fec5e7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466034, "uuid": "f75e8e86-30e1-4d2a-934a-f13774bfc4ea", "value": "T1DD158CAC3220B6EECC57CD7ADA582C54EE106C76931FD293905715EC9A0CA9BEF141E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466034, "uuid": "dab66ea8-fb98-4dac-bed6-23e9226335f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466034, "uuid": "c78a4640-92a0-4e54-8526-0580db7b3f20", "value": "12288:FiCo+rkce4mGLiOfEt3aXGOLCO+cA9ZLxWceb0nq4HxREzqS66JRakydHV7bsHpB:84muiOUaXBLNFcxWceYn5HJSt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683466034, "uuid": "ca00d00d-ce73-40f5-ae9b-113b0a17859d", "value": 903680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683466034, "uuid": "122664d4-095b-49a1-b616-a15769d51c81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683466034, "uuid": "4533d647-403d-4c3b-89bf-8a77d62bb9b8", "value": "SecuriteInfo.com.Variant.MSILHeracles.80732.11982.8549", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20d40728-ecc6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683457121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683457121, "uuid": "32c130e1-36ec-44f2-99d4-15ade4861a18", "comment": "Malware payload (Mirai)", "value": "5dc90d72210b354da32b3e03d27e7000", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683457121, "uuid": "cd9db5cc-6b93-4c8a-9c1e-5886a5db9725", "comment": "Malware payload (Mirai)", "value": "f5b3830485730fdeaba4d0222ee6909d45b193af1c9a17367d8853a70d388a14", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683457121, "uuid": "873e0551-3754-41e7-9e07-d99cdb514923", "comment": "Malware payload (Mirai)", "value": "9e94c054bb42190853097d195761fab4062d0f61", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683457121, "uuid": "a3640a59-510b-4cd2-8d23-064fadb3fafd", "comment": "Malware payload (Mirai)", "value": "60be1ee4f811d56d1f68e3321b44e7887b37593805dd29b5f42761b9dfe033edb41e4e1f9a922377bdceb83afe81cee8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683457121, "uuid": "9edc7cee-0471-40f6-8aee-ba3465fe35f9", "value": "T1A0C2D1325EEF38F1C29474B9EC788ACB614F4AB965F16521734017A1DED200352768E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683457121, "uuid": "bdfb8e46-7fc4-4aa7-bc30-f63df345e952", "value": "384:kXNSIfjdxuZ1DUofVOyPqMvt6GqAAdq1K0jzNH7EUz6z6RNo9ch88GhymdGUop5o:AjKX9vt6GqA3Q0jzV7EUyUq9EGs3Uozo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683457121, "uuid": "4d0cc088-3555-4b69-ba12-f69e3ce318e5", "value": 27336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683457121, "uuid": "6616ec32-72e8-4231-8e91-4e2fdec463a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683457121, "uuid": "c2cbf744-e099-4a04-9a7f-62571e84608e", "value": "5dc90d72210b354da32b3e03d27e7000", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "054592e0-ecc6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683457075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683457075, "uuid": "c15fe3f6-4d5e-43dd-a0e3-61a7284d9640", "comment": "Malware payload (Mirai)", "value": "2c03156b08890f8ba39bd47e1e5a880a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683457075, "uuid": "db157687-dcd9-4ddf-bb38-3386569d5236", "comment": "Malware payload (Mirai)", "value": "f683388a96486b9b2328bb54dff9dd90be08566ef64f57d4dff8276f81226b00", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683457075, "uuid": "a9e08bfc-4a26-4bbe-9fe6-14d7257c63f4", "comment": "Malware payload (Mirai)", "value": "9127c536a27c659ce087deb461331fb95699cb86", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683457075, "uuid": "15a2e517-008d-4f9c-9fc4-e8d60dd2dd31", "comment": "Malware payload (Mirai)", "value": "c1accc08caa3d79e6ae31929401246686da7c92763dcbe687d37ac862281866439bfcf521c12ce8cdc2bd4182cdd1476", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683457075, "uuid": "ea8812f7-37d8-446a-a55c-a8be95005b89", "value": "T16B538D75D11DAEA8C0414AB4A9198E705F13E4C046733EF7EA9587A68443DBCF858FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683457075, "uuid": "d806c269-6e44-4a93-a13f-d404dd3f090b", "value": "1536:ragXV1f1Fl/wtknCPQauiufs3Ii3O/qyD6EZeCc:r57f1b/0QHf+Iey6EZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683457075, "uuid": "c74f441e-2b02-4908-8fd2-ee4071aee291", "value": 63480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683457075, "uuid": "204ee589-23ad-46df-b612-bc3da450dc19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683457075, "uuid": "d0e961b4-768e-45f3-ba29-b22b2749a512", "value": "2c03156b08890f8ba39bd47e1e5a880a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7783c357-eca3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683442234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683442234, "uuid": "002c7549-93fa-4ccf-a3b2-2c5553129dac", "comment": "Malware payload (RedLineStealer)", "value": "e2dd99bdad829031ee82c1b48365d14a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683442234, "uuid": "487cfa07-468d-4a43-9708-8b9b1f916ada", "comment": "Malware payload (RedLineStealer)", "value": "f686f974db928e85279098e0c0ef7f4459304da9b3ecb7381f3d5d7d6bbae4d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683442234, "uuid": "17191fed-a21b-4717-8cbf-32204564e372", "comment": "Malware payload (RedLineStealer)", "value": "5952e2d74b54bb1ef09f6b12467ddd0631cdce73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683442234, "uuid": "cb0d63bc-4344-4740-9ba7-1453bcc8e2ab", "comment": "Malware payload (RedLineStealer)", "value": "dad739cb189c95c60954bc736776bbbb78f0edb3ebb2d444ce9ed0455d5370c6f176f1851ce44ea6e1c35e016c487a92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683442234, "uuid": "8033fb63-103a-48ef-97fb-ddacfe28187a", "value": "T11FA40207FBD880B2ECB447B018FA07931B367DA19DB8876B3B45695A1C72694E43533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683442234, "uuid": "43597ee2-b29b-4bf9-983c-f702ce8a667b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683442234, "uuid": "e3e93f15-b508-4d90-9357-eb515a5debdb", "value": "12288:GMrUy90c5iXomu8NN63D7p8bYh7ReeukS/NckyRZG:OyA/NQbtejALRZG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683442234, "uuid": "f2bc685c-01fe-4011-b11d-e0235ae6fad9", "value": 490496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683442234, "uuid": "6fc9025b-e138-4168-9f59-485c7bf7fb0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683442234, "uuid": "d0899fc9-105a-4e95-a6e6-445bb19d9452", "value": "e2dd99bdad829031ee82c1b48365d14a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d77d29f2-ecb2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683448838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683448838, "uuid": "0960639f-f966-4f78-bf6a-e4e67efa92e3", "comment": "Malware payload (RedLineStealer)", "value": "d012d21e78be7706958c99f7c968bdb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683448838, "uuid": "8490910c-092d-4107-a225-ae76136051d2", "comment": "Malware payload (RedLineStealer)", "value": "f72c983461bfc779558367186c5ce11fe4de83befe4d71e801a70d41160cd1e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683448838, "uuid": "2cba7086-6295-4aca-80e2-54fc3a52f92d", "comment": "Malware payload (RedLineStealer)", "value": "42a2135fed5f36a09e818bbf6ad60d616f32e0ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683448838, "uuid": "2cc4f461-8ae1-49c9-af0a-9cb7ffbb88d3", "comment": "Malware payload (RedLineStealer)", "value": "e13ae2d1113a86bd536a9bfec42d0f2719064556a262f37fa9f66abb41e9108b7c861547841831b567e0a8e4d46106ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683448838, "uuid": "3379e8c1-7f86-4b87-8b43-eb4b65a67135", "value": "T1A0B41213E7D98072ECB017B059F703E31B327DA159B482663786694F2C73A94B934B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683448838, "uuid": "e1e7b935-f764-4acc-b5f7-d26aba5f3937", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683448838, "uuid": "514d97a6-5c46-40fa-849b-eb16fc6f8fd3", "value": "12288:fMrWy90OXzM7qx3dA7b2VCPKRsaSYpFYM/:1yBj++xUM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683448838, "uuid": "ec406e1a-f474-4301-8537-0aeece4a9dda", "value": 503296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683448838, "uuid": "d1624649-3a8f-4f16-bff9-a2e6d510639d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683448838, "uuid": "f0397f09-03b7-45d8-89b4-40f51af1de20", "value": "d012d21e78be7706958c99f7c968bdb2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc9fbfe7-ecd5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1683463825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683463825, "uuid": "d90d42f9-e009-4843-ae72-ea6e394f450d", "comment": "Malware payload (AsyncRAT)", "value": "f576dcfacf32ea5da3767e71b5d92705", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683463825, "uuid": "b4ad61b8-4889-49d6-b298-e169f8a898f6", "comment": "Malware payload (AsyncRAT)", "value": "fd19b8abd59beda896e4b6bbb96fb1d2888460dcf107cd584319cba66e264d91", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683463825, "uuid": "27cd249f-7259-44f7-bdb3-a8883f5bc4e9", "comment": "Malware payload (AsyncRAT)", "value": "3aaec02365584eef10ac33cc84f93aabafaff546", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683463825, "uuid": "489efb3c-3593-41b3-a1fe-b54b8f25ae6d", "comment": "Malware payload (AsyncRAT)", "value": "fe3e416cab37fd208063415fd443cd9bc02e8b6967574f31e662df04224733993661c05f99327c6ecf49fff9e8465ef4", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683463825, "uuid": "e9ef4d01-c561-4cb6-994a-6030c4dc8507", "value": "T1D1231C1037E9812FF2BE5BB899F26141867BE2633703D9493CC811DB5B13BC696426ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683463825, "uuid": "ae600cc9-2a19-45e3-8abd-ef37c9dad865", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683463825, "uuid": "f5e4632f-4cf5-4512-827b-1177f64ab6e6", "value": "768:EoDVMt9b8i9K4GR2VNv8+7lnuPc3fR89VnbC5Y0jbygr3iyiUbLi/xClZJ2tYcFX:EoDVMth9bBnUc3fR6iYUb1rSyiUqErJA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683463825, "uuid": "8aab6c90-3d73-4a20-b43b-f8d38594d46d", "value": 48128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683463825, "uuid": "a25f878f-69a5-46bd-86f4-62da058593d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683463825, "uuid": "c8b37318-69b4-4275-8019-4c4f874a2d37", "value": "FD19B8ABD59BEDA896E4B6BBB96FB1D2888460DCF107C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f76f8e1-eca7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683443939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443939, "uuid": "7e7509d7-f8f3-4bec-8ff0-94c386b1973d", "comment": "Malware payload (SnakeKeylogger)", "value": "e72c3c7e9bfc1c83e80dd1b05690d397", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443939, "uuid": "5b7ec88c-9331-46e4-8628-029483492218", "comment": "Malware payload (SnakeKeylogger)", "value": "fd36e87f08b87a1413854b9763d7603f12be2b5b15d2d4f87537d840faff3123", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443939, "uuid": "abcfe79b-e28f-4b66-9fbf-230f4cf99ad7", "comment": "Malware payload (SnakeKeylogger)", "value": "504dfac9169b56e60e30fcda112f5336e13411f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443939, "uuid": "090f0f93-bbe5-46c7-ba90-fbd44cd48303", "comment": "Malware payload (SnakeKeylogger)", "value": "d798b779e91c3147051f2830ad89b5b6f0a51fc03213a67aca239d2250e0b2ae052756cfee6ff7e51bd7affc4b47ffc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443939, "uuid": "986a4aff-2294-4f7a-9da0-dad01058964d", "value": "T1F9F4DF102279B791DCE6B3FC7604A4019F752C84A379D2A88EFAB0D85572717ED40BAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443939, "uuid": "c2364f49-ff5c-44ba-b79b-ea4ef9d7eb15", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443939, "uuid": "7c03328b-ef0b-4986-88d9-e64a56ef59c2", "value": "12288:xKmKY9Iq23dyes13kJa/zQV2C32ehROILOpeJ4wKk9MVePemjeFbpW:47MjaSoJV/OVMMvLzW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683443939, "uuid": "7ad29096-9234-4c02-87b3-46a3d04aae78", "value": 733184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683443939, "uuid": "e225ec94-972e-43bc-91f2-edebc1d5a9ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443939, "uuid": "eed77e4b-79a2-4525-8982-633a77c89db7", "value": "PO 6543YT56.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20af1387-ec86-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683429633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429633, "uuid": "36dbdf27-4ea6-49dd-9931-4bbceb4a6a10", "comment": "Malware payload", "value": "fc8561274d4ccd2bcd3a1e654d30bece", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429633, "uuid": "eae94a4d-13a3-43c9-9bca-e7aadd04958e", "comment": "Malware payload", "value": "fd640637501c240527e5d22d4a31140ce83eeadc77548bab23d5cb75ec613e7e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429633, "uuid": "d1de4900-fe60-468d-94f7-c134b10a032b", "comment": "Malware payload", "value": "cb873cd01fbbd569b5a27b63362c8b2ea06a5f66", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683429633, "uuid": "d9365e4c-2870-473d-be3e-beb8b6243472", "comment": "Malware payload", "value": "549ed04cbe2e1586a9118ce4f7f27346c30c8163b1a7f9e89825eebbc707172c8d785eca44406c3d83576068d0659be2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683429633, "uuid": "1e4911d5-e0fe-4ed4-a0fa-ded790c543af", "value": "T1E816CF403BD0ADBBD1EE6775912681FC4FBCD0866BD7A31B5604A56C0EDE3820E5E287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683429633, "uuid": "5232fbcf-e146-4944-9a05-e326c367e35d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683429633, "uuid": "e5bb90a6-f2e1-42b6-b945-5f4c41af5e2d", "value": "98304:oXB4uluJRmMg6QWlIpgi0rHqsih/mCqJ4B4uluz:ovsJR0TW6yiIKRhzqOsz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683429633, "uuid": "954dcc40-c22d-4c69-80d5-da6741885cb7", "value": 4388022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683429633, "uuid": "8b69d5a9-ee9f-418a-b747-812ead6e3e93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683429633, "uuid": "159179e3-f10f-4546-84c3-3a983c9dcb75", "value": "VirusShare_fc8561274d4ccd2bcd3a1e654d30bece", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e9e069e-eca7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Lu0Bot)", "timestamp": 1683443803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443803, "uuid": "72798735-4537-4ec0-978b-4c4d7fbf3ca1", "comment": "Malware payload (Lu0Bot)", "value": "8813931fa41948acaa6589416cf3a79e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443803, "uuid": "295cac93-a197-47d5-8291-eedd9850b02c", "comment": "Malware payload (Lu0Bot)", "value": "fd746c51486e5ccb2bd801f4cffbeefaf77e7844ef1dd5d211a4c183ec26f52d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443803, "uuid": "b1be17c0-7689-4015-b31b-cbf06d5fd20e", "comment": "Malware payload (Lu0Bot)", "value": "05335d98f1ae1a4a124ca00b6e545a980d00981a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683443803, "uuid": "52908081-726a-40ef-9d8b-7ca2c6db9ee1", "comment": "Malware payload (Lu0Bot)", "value": "4baac1dd411685ae83ee9c5bff7866179cbf1f3393902e62c937f61f3824f5a5d2d42cdef8c613bb2d6306e76b8676e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443803, "uuid": "95c21588-0d65-40c4-9a0b-0593fe629cef", "value": "T12BB53336ABD5C937EE6497306CF367835B30B59116FAC7862394798A8E733608C36316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443803, "uuid": "1abc637e-f282-4e06-91da-fcd1694f2602", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443803, "uuid": "11733d8f-2135-478c-a173-b7e730c204f0", "value": "49152:T5G5joOS6EeC1WpMxqWgOw41s3zEDDwcNdLVZuBhUWQgCdZ:iS/HopMxqWg56fhd58Bh9QgCdZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683443803, "uuid": "bd2927f9-c235-4dbb-9f14-4ffdef5c440c", "value": 2483200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683443803, "uuid": "e4f2a864-4622-4fe8-af27-a5da1db8a030", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683443803, "uuid": "13e45bb1-19c4-4dd9-a058-1a09a7e99db9", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c3dabee-ecba-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1683452040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452040, "uuid": "e703c3c4-ad61-47c3-a3d5-19452b1821d6", "comment": "Malware payload (Rhadamanthys)", "value": "0bfb4ed2d6b6c8554bb4e36f4b453069", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452040, "uuid": "10a4c1c5-c868-4400-9a63-f6e5f6c7050d", "comment": "Malware payload (Rhadamanthys)", "value": "fe652f4fe8a4ff5df293201042d1ff0206e1e34541a5ada6741c75be45f88f41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452040, "uuid": "5706cd54-cd0c-4bb5-aa06-9f8b07bec1b1", "comment": "Malware payload (Rhadamanthys)", "value": "d49b9434ddcc9fb42badb227589e43eb51509fb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683452040, "uuid": "8fcc03d3-bf58-4233-a5be-e199ef152b0d", "comment": "Malware payload (Rhadamanthys)", "value": "8601de4a631e65c02d8af49b3dcf76dfa8bc44b4bbcd7f5a532bced628e56633f75f705e06d31e76cedccd17aaddc36e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683452040, "uuid": "1508e01f-e10a-4049-b20e-6c4f2113e092", "value": "T15F84BF1272DDB8F2E6530B318E2AC6F46A2EFC518F1566EB3A05EA1F08705E1C572717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683452040, "uuid": "2568634e-f41e-42ba-99df-3fe19860916c", "value": "d24ebd4d5de51c0702fd69cb75bd11b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683452040, "uuid": "d875faf1-edc8-4dcd-b55e-2d76bd355b40", "value": "6144:ZS+GjT7QYrYIog9dXaCjfVH8T32SG4kiawbdNMKL:MhT7QYrBRPTeySaibdNNL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683452040, "uuid": "b3b6e789-dfb9-4426-a544-40457596b56c", "value": 374272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683452040, "uuid": "94616e8d-9a1e-48ee-873f-36693ca70da7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683452040, "uuid": "1ea5ae9e-417c-4807-b08b-845ea1813af8", "value": "0bfb4ed2d6b6c8554bb4e36f4b453069.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }