{ "Event": { "published": true, "date": "2023-06-08", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-06-08", "timestamp": 1686268981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "0549d285-ad46-4ed1-9218-316e6882f4e9", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8996c655-05fc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686229269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686229269, "uuid": "58348344-38a7-4c27-8f45-e6e30a4bf386", "comment": "Malware payload (Amadey)", "value": "1370ce98a079de1f9a6ec6ba85ac0311", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686229269, "uuid": "eac24abc-8014-47bf-9400-d54b1f8c4884", "comment": "Malware payload (Amadey)", "value": "0101030ff068e78bbee5ada477f31031448d6aac25cd4e087c0148c3b2469fa7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686229269, "uuid": "a64346b8-11e6-4c9a-b0ff-81afb91ca324", "comment": "Malware payload (Amadey)", "value": "e65f3a2cdc29a65c29fe52fb6ffd7305b9591eef", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686229269, "uuid": "702be2ef-0078-4d13-ab07-a93ef678e0d6", "comment": "Malware payload (Amadey)", "value": "6a2011d0175d1463b561360f914b61c35cb0a540009b03e194a2259178535eaa08f53fe28532280fbe5919282644b876", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686229269, "uuid": "cb3dc389-cbf9-4a2c-87cc-6bb67fa1d1bf", "value": "T1E0D4121BE7DA5033C5B21B7068FB03C30A39BC9358B452272B49A95F1DB3990A97173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686229269, "uuid": "ca88c929-3491-437f-8fec-2610de0e1eeb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686229269, "uuid": "64af9f0d-237b-4128-bb90-5cd7cba68e94", "value": "12288:mMrHy902MsBfAxUYQ2jFBs8qyH4PD/hWk9rqGog6:5yVpAWYxs84DBUj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686229269, "uuid": "6c4f18d8-65e8-4d23-9455-12b6963e009d", "value": 616448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686229269, "uuid": "0df5c9e0-0089-448b-abc2-5fe3fa6a3943", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686229269, "uuid": "0954fb7f-0703-4c58-ab01-8f2fde3d52f6", "value": "1370ce98a079de1f9a6ec6ba85ac0311.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a113e341-0646-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686261091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686261091, "uuid": "4c0b40e3-5fae-4f2a-8155-689d7448e86d", "comment": "Malware payload (Mirai)", "value": "bf2b1c4e18a94d4200377842ecff9ceb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686261091, "uuid": "58ae439c-9577-445d-91f0-2e26d119c02e", "comment": "Malware payload (Mirai)", "value": "01502257528510bd7a790913bbe692393ab4f6c0f4fb3c35ae1cbc9aeeae90b6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686261091, "uuid": "8ba89c00-06cd-4277-884b-042c2e4d55d7", "comment": "Malware payload (Mirai)", "value": "f990d823eb083a0bf0683c4fcf13da090cfce615", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686261091, "uuid": "020691b0-861d-4f83-becd-84e05aad73cc", "comment": "Malware payload (Mirai)", "value": "b9a89d676998d217fdab26e6ecc95b75d49cabe29c1c165e1e05f03676a4fb312bc80b50d2250694e6c04cf2a1b9109c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686261091, "uuid": "824cbca3-07e6-4a69-bb42-2ef43fb76e13", "value": "T104636B21B8391E17C0E4957A22F7872AB2F9534E24E4862E3E750F8EFF5558076472F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686261091, "uuid": "7ca17291-aa0e-4cb2-b1ae-a8c1f2b05593", "value": "768:IcowEe26GLAhfg+MhN2K1sv11FN1nD3Id1pv2nh3Ei35aJbyqCDSgPoGO+75ZLo0:IcIMlhfgNhNvR2nwVypX75mUotQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686261091, "uuid": "12e573b4-5d38-491a-846d-fed957f7b4ba", "value": 72660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686261091, "uuid": "e4d31048-d02f-4734-b914-206c4d029371", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686261091, "uuid": "b511cdfc-80be-429f-9c31-9e210192b209", "value": "bf2b1c4e18a94d4200377842ecff9ceb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81249397-0619-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686241710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241710, "uuid": "127952d0-fea3-4407-abf3-5a3a4999e12d", "comment": "Malware payload", "value": "110176e0d296ac9d6855073c2e777134", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241710, "uuid": "13e82c34-a7d7-439d-b9e1-6be3970883cd", "comment": "Malware payload", "value": "01cc57094a915b6ab00016d9c2e94db06271aab164bf18466d3ae6003c826365", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241710, "uuid": "b5dbea46-f4d6-4e10-9a4e-acc3dd4bc60a", "comment": "Malware payload", "value": "2f5e2ad921f058a42ad945eeb912008b982e3f93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241710, "uuid": "784f67f8-a43f-42a8-afc5-c83ab96bed7b", "comment": "Malware payload", "value": "729832c1d3351d9caa8ee24ba80f9dd9817ced200b4fb0fa07684bf3e804c45df3c0d763fe0f4124b1fd896008842839", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241710, "uuid": "b93a9477-4b2a-4588-bbfd-869d4a4329ad", "value": "T1D0B16BC6F668A61BC10E17F30426711338B939305FB7AB00ADF5972BB8E232616747A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241710, "uuid": "c0aa9e43-c7e8-48cd-8423-a6c6b6695910", "value": "78e2b39885cb7ee552df154da6a07f0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241710, "uuid": "1d1fc238-7260-4366-83ab-fb75c396b625", "value": "96:EiUe/8Jv5DF6F4z74U8P+xYljiZShNaoY:Ge/8Jv5Dlz7vI+Klji+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686241710, "uuid": "2a536d54-a09c-4533-83ac-a563be4ee42b", "value": 5120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686241710, "uuid": "92581455-2fa9-4030-92b7-dff3d6893359", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241710, "uuid": "5f46b3c4-6bfb-4a27-b002-655b7eed0b4c", "value": "SecuriteInfo.com.Variant.Lazy.340598.32656.17952", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16f05acc-0636-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686253987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686253987, "uuid": "5adfe38a-ef3c-4955-a5ba-27adc51e59b9", "comment": "Malware payload", "value": "d402aec3dc56d6b77d17685e5c6ba4ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686253987, "uuid": "07efa2d1-cea8-47d0-a163-d593f3dfd919", "comment": "Malware payload", "value": "02faea4481281e7d6e4bd48f06e969b6a9854d4746525af6ccae7a9748b49b95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686253987, "uuid": "a8cf87bc-bfe2-4463-a824-96ea8742ac96", "comment": "Malware payload", "value": "f867b9cc5aebc7e842c2201b0ace55f311d8b49d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686253987, "uuid": "75d155a0-b749-46df-bf05-a48812adc118", "comment": "Malware payload", "value": "0d286dbc5d928975b29430528aa3c43802b278fd965ccce49f045ddaa62b5f0eb90d37a7dfaffbb01584e325be13fd3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686253987, "uuid": "3f391571-d3ea-4bc9-8d3a-07f3c55a6c8e", "value": "T1BD844B1392A13D55E9254B338E1ECEE8365DFA508E4D3B661A18AE1F14B1272C273F1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686253987, "uuid": "6ee6fcf1-d691-4632-a234-957eccd66e31", "value": "ce94ff4312bf546ec7c0ebb9ac311897", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686253987, "uuid": "2bbb2089-56a4-4521-aff4-08214613f545", "value": "6144:T542pYxE5tayWiTndiZI1sxgsHwtjahCaJHhgsq:T+2paUayWcnIZIEgvabg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686253987, "uuid": "8ce421c3-88b1-4fd3-9e30-90e7f3308675", "value": 375296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686253987, "uuid": "81448af4-8cd3-42ee-baf2-33522b32953b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686253987, "uuid": "b0896971-a311-43f3-98f5-12c142d000a0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e730e3d2-05cf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686210099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686210099, "uuid": "6e0f40ce-8a0f-4a46-aae3-8fba34b1f4f7", "comment": "Malware payload (Mirai)", "value": "1026fec778a2e81edbcdd37ea573260e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686210099, "uuid": "b5138138-a920-414e-b30c-9fa3f30ad241", "comment": "Malware payload (Mirai)", "value": "0498def21cf717819308678fb25ddfac0a10ce5302396f15ce94e64678ac9dbe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686210099, "uuid": "c1cf53eb-2b7a-4b5c-816f-05f2900f61c0", "comment": "Malware payload (Mirai)", "value": "89872dd8883a721c3cabbe97de828ed698274b44", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686210099, "uuid": "902ce121-0a85-42e1-b0e4-2d902b9dfed4", "comment": "Malware payload (Mirai)", "value": "cb03e66e477ca5768c8d3e7c68c2ea4eec80cbb341eae20f7a242b616097ee49728d64847d7ca635cf403d5cb01683a6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686210099, "uuid": "fe2ca65f-7538-4f87-901a-aa1e352ef184", "value": "T1C8B3BE61D0A56DE1C260023060F19A385773F849E61B5FF36989C3AEA447DECB16B3B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686210099, "uuid": "44a883e5-4ae8-4373-a241-b81ec49a159a", "value": "3072:5V4UT/adsuyBvaLzqJjRNJ3bHRbJyh5u/eWL:f4UueDUzqjNJNYwea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686210099, "uuid": "80a3d262-5949-44d5-a4a8-05c29c1e12e4", "value": 116308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686210099, "uuid": "00f3235b-ed15-4958-84ab-3ee61057b108", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686210099, "uuid": "57561bf9-8ff8-42cd-b5d6-5a0d1db5cbd0", "value": "1026fec778a2e81edbcdd37ea573260e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9b9fc85-05e4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Chaos)", "timestamp": 1686219042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219042, "uuid": "f2397219-436d-4084-92ca-7d2adf6168b2", "comment": "Malware payload (Chaos)", "value": "b1228ba24ca5f75f8df9d5d177e5bb2b", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219042, "uuid": "b11a3cab-ceca-4940-9dfd-d7603fa209fa", "comment": "Malware payload (Chaos)", "value": "04b106b179c202c67361aa4debad5d82f79a1927ab0ab8abc2ef350d18894b08", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219042, "uuid": "2bf4792b-b61b-4101-9b5d-4c8a2378579c", "comment": "Malware payload (Chaos)", "value": "1895758de51ccfefa40239aa11055540c8c5deb7", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219042, "uuid": "de3971be-b44b-40dd-9877-b525b2c390bc", "comment": "Malware payload (Chaos)", "value": "150e68b891a792d02528b6bfb2da313816a20a477185f6da41e18e954f95569e9e4a5483ccd982ae53bb6da5dc9b00ce", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219042, "uuid": "7681e919-5292-45cf-8452-deb297132bfc", "value": "T1B803A6143AFB4029F3B7AE795FF4709E8A7AF7236B1AD5581095034A0E22F44CD9173A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219042, "uuid": "ce85894a-0d05-41c8-a8dd-14c00d5558d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219042, "uuid": "43e3ea52-f416-45a0-8dd4-4020d0fc8e80", "value": "768:hqo2khp1DlNjwQr9KWO4TOpkx7u/LraCvpbMC2mkek:ko2kFpNjwQr9KWODkx74L2CNf5k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686219042, "uuid": "7c5200a8-fb3c-4b7a-9adc-e7dd88801bb7", "value": 39936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686219042, "uuid": "692ba663-51e3-4851-9831-3f9a5ff6e81a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219042, "uuid": "aedc9fdc-ae88-4bcc-919c-6e8edf06bd47", "value": "Electron V2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2d7c8fe-05bf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686203166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686203166, "uuid": "a9f4f6e7-fb82-4dc2-8a41-7eef9e1fc4ed", "comment": "Malware payload (RedLineStealer)", "value": "ec08e43d77dc2714501a2375d13bd610", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686203166, "uuid": "675b7b7b-3cab-4597-9514-db1a05902a70", "comment": "Malware payload (RedLineStealer)", "value": "050597ce3937aa171ace07bf00d94c65d256a760550a7af901bb1e5e2da20406", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686203166, "uuid": "4ec63392-02b0-4527-a24c-721ab0693935", "comment": "Malware payload (RedLineStealer)", "value": "368af54391813f13ffc26587c40e62b102cc3c6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686203166, "uuid": "48365219-b3e3-42e5-aa6c-c6629efc576c", "comment": "Malware payload (RedLineStealer)", "value": "465ecf8f5e89eb59fb9e0d847dd94e9a08ef952f0debf9987afb7ff0688fd7d062246e98aeeebf50a9c7987f05ff45c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686203166, "uuid": "9bf09693-c3c5-4822-a6c3-c7f665bad750", "value": "T178F41213A7D590A2D8B527704CF653D30F7A7CA6AC34536B2385985E0CB1AD2B47437B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686203166, "uuid": "a4de109c-90ec-4b82-a75e-55ff793feeb8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686203166, "uuid": "0c394e9d-a89a-4e66-b1ba-07928ebf8d6b", "value": "12288:dMr7y90+XhH40K0wvX2g3kv7Vi9H8BDyar/R1F2EapYG/iEUHEVpPrin:Kyp47002gIA+Nbd2EapYYijkfA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686203166, "uuid": "5a1ae7a7-0871-4560-ab02-a408f2f0972e", "value": 768512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686203166, "uuid": "99b6343b-8228-4382-b2b9-563389b3d224", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686203166, "uuid": "e4582fb8-ae2b-42a2-8296-5a83fca6c87d", "value": "ec08e43d77dc2714501a2375d13bd610.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b43b934-0619-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686241700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241700, "uuid": "db1123f5-50fe-4043-b381-48fb1f32ac92", "comment": "Malware payload", "value": "ba9bc07a4c8599ca073f60fd259aaec4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241700, "uuid": "4532b041-6e81-4a45-a518-d7da4d49fb02", "comment": "Malware payload", "value": "0537f1a09008a8f00becd2199608a85a4dbac31acd09bfee781c1cec3e56b5fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241700, "uuid": "086615d1-848b-4908-96d7-b9cd4d237194", "comment": "Malware payload", "value": "fd07cde6d7569b0ed0016291897dc9affd8469ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241700, "uuid": "da8dada5-96c5-4df8-9c9c-012d147a46ed", "comment": "Malware payload", "value": "1956a8b1cdb16936774f8e049ab6c44102b6c5b946496dfd4725d855fd53499e5dae9fd70af1843677ad157b7a45f2fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241700, "uuid": "f36e0d0e-5a50-408f-9f84-bc667d07fb22", "value": "T131134B53F6F104B5E072CBBCAD39A215D73B7F7298B4816862795CDA0D262818CDA333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241700, "uuid": "54d4c220-f762-4284-9a9c-8da52db68c7e", "value": "065df6d518cbaa2e26fbb9f5238883df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241700, "uuid": "d9fc6892-ca34-4356-b1bc-f677a6585935", "value": "768:HFVTqZEhjPG8HvAVAnzw02aCSKvxTKUkcOMUr/JSiI2:fTqZEYYvAVA72v3xjbP2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686241700, "uuid": "c6449585-7e34-449c-ae2a-299f40b46c48", "value": 42496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686241700, "uuid": "991ac8a4-0125-4139-8ee0-864067e5e36a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241700, "uuid": "fc8234a8-821b-4a89-9188-a50d8b1a2c20", "value": "SecuriteInfo.com.Backdoor.Win32.Bancodor.26040.31266", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c391bd9-05fe-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686230052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230052, "uuid": "6ba5c60e-492e-4531-aa8e-df2944a9aea4", "comment": "Malware payload", "value": "d0cb6296e57c3153083d97b7149d9917", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230052, "uuid": "6885d744-1320-495d-afd6-f8239175cc37", "comment": "Malware payload", "value": "054bf4c127bf529827a30eb246d24d7f4c0a8c610b6264e34160af91bc0ec855", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230052, "uuid": "14161714-3e09-419b-9c08-7380be637968", "comment": "Malware payload", "value": "455567d681d0d812262f69ce4346f514caf819ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230052, "uuid": "f30336ab-5bc5-456f-a386-cd2180dc61aa", "comment": "Malware payload", "value": "8217f71b5667f873385e6c6430b156b17bc790c42eed82b6d4eb7b5f2b31235fffd6c1730935b506be3a0b89ff6e5650", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686230052, "uuid": "eeda51bd-60b3-44af-8893-bbaffeab3448", "value": "T1D5A37C11B0C1C472D0725D360974DAB55B7EFD700E259BBB23A812BA4F741E0AA3ADB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686230052, "uuid": "cb6c8f32-792c-471e-91b8-aefa5772fdb0", "value": "4cfbadab1ad49a81489db4a989648760", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686230052, "uuid": "c8cb3507-d095-4c9d-a834-a86b99706459", "value": "1536:3PaihhEceOQksACrHUdIRmR7g5jL4RSIokpCsb1gWUM2OYJisW+C5cd7GXCIj3V:Q7kCrURE5jUvokpCwWWdslCoCXCIj3V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686230052, "uuid": "3718e114-1bb7-4f6e-ba53-7ab4e2156e1f", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686230052, "uuid": "23ba3d58-73bd-4eee-8a21-837c5f09c4b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686230052, "uuid": "417e707e-219c-43cd-a2da-eead9bd88e07", "value": "054bf4c127bf529827a30eb246d24d7f4c0a8c610b6264e34160af91bc0ec855", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56617aba-05f1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686224458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686224458, "uuid": "14d1066f-7ef7-45c0-a2f0-f91f538fe343", "comment": "Malware payload (Amadey)", "value": "8a54f6399d688f2a5662745191702696", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686224458, "uuid": "ae4bfb75-52e0-46af-9050-70ee0d51b703", "comment": "Malware payload (Amadey)", "value": "05a7e5eebb670216cc5d295d409439e8838713ebcfadf3362543b1dc37848fe1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686224458, "uuid": "8da04879-f1de-4c58-8b81-a40dd927af66", "comment": "Malware payload (Amadey)", "value": "a2c699125a87583efbf073bed514f0adcb68eb23", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686224458, "uuid": "c39b70ed-b6a4-4afc-b0ba-92364049be11", "comment": "Malware payload (Amadey)", "value": "b84fbb1fc9826ccf5ae9fb941e986b481bb991d11833ed5aff339b9ec741957291aeb68591cb3b02ddb1ce73cf982e28", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686224458, "uuid": "3f404b6b-dd8f-4b23-8840-d7126fb101fb", "value": "T1A424F7257D12C032D56061B619F5BFF2C59C6828ABB049DB7B800F77DA122F73A61E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686224458, "uuid": "8e3b6b48-6b11-448f-9949-ced943d42b26", "value": "f8cc61ade86cb7277d0ab974de6323cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686224458, "uuid": "03f6b2db-9c1c-4b9b-9527-2232aae34b06", "value": "3072:H/DmgskHbfHN+Pst60p0zuNmnKG7peNMQbuZAIqbey3lfbi:fDmfAfHN+wiuInRexuZAIij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686224458, "uuid": "77e1ffc7-9ede-42d5-8baf-b9ae24fa164c", "value": 213442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686224458, "uuid": "1f44e5c2-6364-4316-a9c2-8947dcf5c873", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686224458, "uuid": "c8829967-d1dd-4e93-be91-430a22ab238d", "value": "8a54f6399d688f2a5662745191702696.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f50ceadf-05f6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686226872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226872, "uuid": "81a5a915-1d06-4497-af84-522e8b24fef5", "comment": "Malware payload (GuLoader)", "value": "d2a06a7386680bc248d79c2974f9b0cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226872, "uuid": "ae40f853-6bd9-48f5-8362-64f28f66b813", "comment": "Malware payload (GuLoader)", "value": "05c6b84c8c5301bd86d58f8036a46353aa4e8d26003c64363b91451d909b4b4c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226872, "uuid": "04b53289-7e6e-4f0f-a2b2-d119daa4a19b", "comment": "Malware payload (GuLoader)", "value": "40cb62f0760b7875380c5cf49146698e85f6087a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226872, "uuid": "9f970379-732b-4fb8-9483-d48fb7a0c166", "comment": "Malware payload (GuLoader)", "value": "ec6c13518d8cc0f18e9877dbd31fdf1a972156c94d71fe64a3beac2f37789ca4aff6277eb2fa48c0e61b6e9d4eec7045", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226872, "uuid": "22f0fa1e-43ba-42d5-9048-cf4af2aecc91", "value": "T13F84F13A376DC52FF14916B16DA3834973B0AEC03DE44743B7673B2C997934299C229A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226872, "uuid": "555f5926-194a-4536-b02a-62b1664c0559", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226872, "uuid": "1cdde20b-5474-4d4e-97f0-664b58e43102", "value": "6144:26dANzV+OT7cG6I3iLV6COt4gVVvrCbZwRyxiin5YSU9snMl2ZLQ1o:EP+OTQ7I3iLwJVVrCbb75lMOLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686226872, "uuid": "378ccff9-f9ea-4e91-98e6-68c2d1ee27c4", "value": 403784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686226872, "uuid": "6669f67b-7ff5-4484-8b3b-ef94480d8395", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226872, "uuid": "d2503167-d389-4caa-a28d-c831cc4b613b", "value": "d2a06a7386680bc248d79c2974f9b0cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d74b3c6-0619-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686241704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241704, "uuid": "fb0e7750-2567-429c-a40b-944d078541d9", "comment": "Malware payload", "value": "16d543adfe9757c9d24cbfca17b213aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241704, "uuid": "a194627d-2573-4b1a-9f67-421ab98c689d", "comment": "Malware payload", "value": "05ecdaa3eb68ed8395f81ffb1c8f02bfe1f9a63e3cd7bab718f3b9ffa2944096", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241704, "uuid": "6f6c15a7-49b7-4cac-9ac8-2f7c60d39ec7", "comment": "Malware payload", "value": "6bcaf0f0e41485635d303369ac3e71f59893a712", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241704, "uuid": "1b1c03be-3c2e-4d96-8af9-25569bff3035", "comment": "Malware payload", "value": "05bce016363d8d72101cf91c7f1ac7efe85dd45dcc205e87c17bd793dbe5da9a7a9cc3a2fd0763f1bbf4de6c02c106ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241704, "uuid": "d2d30880-8ca5-45ee-a302-e9e06558a77a", "value": "T193235E07F6E2487AF0E28AF82C34A499BE377D301D35965667780F8A4D297E44C5836F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241704, "uuid": "87e8840e-4c5b-43b6-8c6c-cb2e5aebe824", "value": "3b5341ed0d678cb541ae642d35d08a9b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241704, "uuid": "ff167859-c039-49c5-b4a2-5da4bf479bdf", "value": "768:SZ8qC2wjzhG2PN9RHRUo9D3jTZDgDEnqCpx1qLMEY/VLyXO4AtsmM1etI:SgfPNJzTHliMEY/w4hM16I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686241704, "uuid": "662d64b6-5ff0-43cc-bc34-b85f6922d1ab", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686241704, "uuid": "aca943cb-29c3-4480-ac9d-a2ce9398633b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241704, "uuid": "e7f43847-88d3-4358-ac2c-d72b590e34be", "value": "SecuriteInfo.com.BScope.Trojan.Cosmu.29072.25017", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "448c3021-05f3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DarkCloud)", "timestamp": 1686225288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225288, "uuid": "60ab9199-1320-4d73-9147-48539ca87040", "comment": "Malware payload (DarkCloud)", "value": "1c49cb0f9c5ccac7a55a13287d8af03e", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225288, "uuid": "1a461031-560c-4246-b0bf-fdc1b886ab44", "comment": "Malware payload (DarkCloud)", "value": "0603b725d5e29437694d397a725b4584e55283525e552d2d9dfd24b3cfc5b5e1", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225288, "uuid": "a6c4e40b-2271-4e6a-b92f-cf2d06c52196", "comment": "Malware payload (DarkCloud)", "value": "b42f6f6db918cfca6bb7f16677115902f92ccb2f", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225288, "uuid": "2547c170-5512-430c-86e8-30a49be6a95c", "comment": "Malware payload (DarkCloud)", "value": "63babcdd23510a8a7cd75d374766d83c97637a1eec59a4a9204e7419f14ea2e9d38e464c0914d765f312aded868927e9", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686225288, "uuid": "afbe9f54-e21f-442e-9fd8-08bae41a1503", "value": "T111F40149636316BAF358C13A035B9611C6E17EF5B421B1A3BB811BDE4D3433A16F4ACB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686225288, "uuid": "ba974f83-c613-4009-adf0-8fa7dae6c99a", "value": "12288:xh4/EWovEJtycm9zgUZYUfnKgw9x8zaFNIFNnW+0mLLIStcDy:M/EWo6ycYzgkLeFNIFNW+0fSB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686225288, "uuid": "bdfb48e6-97b0-41a5-bd50-90e5d1753d44", "value": 792464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686225288, "uuid": "648f807b-764f-4357-adae-62a274bdfd61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686225288, "uuid": "dc9ac7c1-2911-4d05-af8a-9c3d0e01d722", "value": "0603b725d5e29437694d397a725b4584e55283525e552d2d9dfd24b3cfc5b5e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44a7edb9-05b6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686199088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686199088, "uuid": "155cd9e8-5d49-4c02-a3eb-d1816c8d4739", "comment": "Malware payload (GuLoader)", "value": "e230816a29bb8af0b5f24adfbe5eff62", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686199088, "uuid": "d26f23f0-df11-455e-a83a-9583df17da8c", "comment": "Malware payload (GuLoader)", "value": "061eab00aca9bb4dc4a164c23f0ec24b805eaff6bd597b45601bde2958744ca3", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686199088, "uuid": "3569e924-84e2-4dbc-a265-0ca2847da1e3", "comment": "Malware payload (GuLoader)", "value": "841fb495cc824fb043d1be3f033326294745dfff", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686199088, "uuid": "8f78ba20-16ce-4a65-a320-f8610125467f", "comment": "Malware payload (GuLoader)", "value": "fb96b5e1ddf112354d120e271c3f2cd83c6553e9d1a06bb92622fbb4b2c55a3a24ff40d297a446b0552a411058771977", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686199088, "uuid": "5c24b0e4-e3ae-487c-a2ab-8cbe35b3e15c", "value": "T178B2C0565B8C4C62F269E87B865EE00E58FCF23230C255C4BD9DE2743B7D20E4B6A5B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686199088, "uuid": "60b38182-85a6-4ce4-b44b-897795ab2926", "value": "768:XJnxqg/d7sWctQS0vZJ7UtnZlo2QLdWX2tibZqSA0:1xJ7sWcEf7gnc7QX3/A0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686199088, "uuid": "fa97ef11-27e2-4080-b331-7cdc5b61ad7e", "value": 25618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686199088, "uuid": "8edc0600-f11e-49d7-ba48-cf98adf7da6d", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686199088, "uuid": "68cbab71-9ea1-4eb7-ad24-61464ae8d313", "value": "e230816a29bb8af0b5f24adfbe5eff62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61b631ad-0617-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686240798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686240798, "uuid": "83ff3278-e9d7-4414-8708-4a52a9b6506a", "comment": "Malware payload", "value": "cbe8af1bd5f5737ee10311bf3b2009c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686240798, "uuid": "84a8f9fc-53fe-4d3a-9d99-096d7f49528e", "comment": "Malware payload", "value": "06a152194976346ea573394df32e58244ec5f1d9f97008d1fd69ae7146f47c4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686240798, "uuid": "960126ac-b5c2-48c9-83e4-cdd3195dd0f0", "comment": "Malware payload", "value": "1dcd3aa218231f7a76db330c39abaf56d35a0c26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686240798, "uuid": "b24b6060-35eb-4538-8b75-ea2079011f9b", "comment": "Malware payload", "value": "9ac6cbab2444d01c8207cc40c17025540852ccbbd89e56de41b110cd564eae7f338faf95c254c215b6aea529509c0406", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686240798, "uuid": "fa153557-a6f5-476e-85ce-c201025a6f84", "value": "T16B644A0336C28C79F8AA073E51D54F2ED837ED60064568FB37A49A654FD1313A0AB5BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686240798, "uuid": "a60c72cb-df29-4019-9107-47263531bf28", "value": "4e895722b26aab4e38438670ee8ec7ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686240798, "uuid": "073a45ea-218c-458a-a07b-c912064aa01b", "value": "6144:DJiaQVtzlRba+Y0P0imtipjXkhoyXlVwXCcetePH:DJ4VN40ZXkhoyXlVwXCNePH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686240798, "uuid": "f3afab09-06c1-490b-b3bf-87fe339883d4", "value": 311928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686240798, "uuid": "42421864-f6b6-43e6-9330-b23546781488", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686240798, "uuid": "4807896a-07d5-4433-8a2c-40121862183f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01d331e1-05a1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RecordBreaker)", "timestamp": 1686189957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686189957, "uuid": "184f09d7-c3d3-459f-816b-9c2b5998627c", "comment": "Malware payload (RecordBreaker)", "value": "0cc066cf1fcda06eb375e9ae5bcd730d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686189957, "uuid": "46e348a6-306c-489e-8a8b-5db14d6ce4a6", "comment": "Malware payload (RecordBreaker)", "value": "080599f44949d8022e1d5e210cd3db7ea3f02ecdaa3ccf38e93fdb933dd6eebb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686189957, "uuid": "6f3c1d5f-82d6-4b22-9d25-3aab8bb6087f", "comment": "Malware payload (RecordBreaker)", "value": "5e5bb11ec0a2adc2cd3fd4d51f2fdbc49015cdc2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686189957, "uuid": "1bfe6f62-c192-4c7d-8041-965791f5fbd4", "comment": "Malware payload (RecordBreaker)", "value": "34a22789771a90ab71c5d91cbd25f34f02b2f886bee6690a78aa98f159dc47bc7bf66b6fd5d45408c697c65629592404", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686189957, "uuid": "f7761ced-c8dc-467e-aceb-758c4ecf1b9e", "value": "T13185121E7DB0C531C47156390ABDA3247B2C3D27FAE3C6DF1FD8BB2909A089166256D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686189957, "uuid": "0723afcb-9b0a-41bd-a340-4c75c9a1e7fd", "value": "ab9ff6e4872ea2766a5f5c6af5649e9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686189957, "uuid": "8cf2c7d1-a828-4514-9493-ac9daa432d25", "value": "49152:NJ4HL+sY0BKdXpnsOtzxhTl0+F43YKfCI48b:NJ4HaPXpFtbR0gdKfCI4M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686189957, "uuid": "945f985b-285f-4224-8035-c36f34167754", "value": 1773509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686189957, "uuid": "73148aae-9134-4ec7-883f-995bccd7bd08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686189957, "uuid": "731cc0d0-5de8-4889-b9d8-9b9362058eb1", "value": "0cc066cf1fcda06eb375e9ae5bcd730d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8205412a-05fa-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686228397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686228397, "uuid": "64df5b4e-8e7f-4a65-8b79-fd6231e4b910", "comment": "Malware payload", "value": "bd08bf688aa1a6d46c1675b57110dd7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686228397, "uuid": "50460767-62f6-4467-81da-099fba9f51da", "comment": "Malware payload", "value": "087e18811cbf2011123edb351edb631da3917f65371b046e4b70137deb08d2f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686228397, "uuid": "6e851c15-6b73-4646-97ca-41712e8b9195", "comment": "Malware payload", "value": "27ace7f22287839bf704f40581e18563b3ae7038", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686228397, "uuid": "31109790-d053-4af0-9064-472e93189c1e", "comment": "Malware payload", "value": "ec4028ac936926e8254f7ff7cd52653156da32a095b6173cd4a58d6725e7041a8f18285e61284945c4195f35ba9a0c32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686228397, "uuid": "a99e2e7a-bfd9-4b29-ba64-b505aa676eac", "value": "T1A4B2184A5FE0047BC211CC701EBF2B7809B6AA46AF261A8B4785DF8DCD737115827B0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686228397, "uuid": "6afa3b98-7c86-478a-ab7f-f7e5878b36d3", "value": "d3a94f88f5b02567341d32389abea285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686228397, "uuid": "45683359-f8ad-42db-8779-b293e4ed195f", "value": "192:h0lkFwtXjJQoOLqeCamZWRmqyRmgP1oyn0wW0//093j5ZG/XNTMfNWnxcc:5StXlQoCqCk1qwr096/XNTMfNWnxj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686228397, "uuid": "b88e123f-989a-425d-9122-59b4699b108d", "value": 24576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686228397, "uuid": "6f2394a6-fef7-4642-9845-f42ebd6f51b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686228397, "uuid": "c1cdde11-982f-4c71-862f-0965ced16f53", "value": "087e18811cbf2011123edb351edb631da3917f65371b046e4b70137deb08d2f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "745d0fe2-0611-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686238253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686238253, "uuid": "5119ab39-ddf0-4d31-92f2-da15a15ca0bf", "comment": "Malware payload (Mirai)", "value": "88ab84d83cafc065b8112cee2d106a28", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686238253, "uuid": "32d94a33-a168-4a0c-bb33-0b9a61ed2877", "comment": "Malware payload (Mirai)", "value": "08ba5963a80eb7fc960d066baef2fc8f7514d5ce63d3947b7717a57f5eb05665", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686238253, "uuid": "690255d3-989b-4a10-b6a6-de63c3cd28f4", "comment": "Malware payload (Mirai)", "value": "9339410c1c9d4bd0455acf1f3da955a57a49e2b6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686238253, "uuid": "8f7128db-432e-48ca-9e84-97b65d8e18e8", "comment": "Malware payload (Mirai)", "value": "00fa233dfaf1b4d949e45d68049eba752e41a221fdcc86f8b60e2b9b4a9470f1753e377ff9bb3e4738300cc2ff168c35", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686238253, "uuid": "e16a2878-56f7-4150-a763-43e0323df268", "value": "T1F0F2F169A2167AC0CD2F607959BE78DEBB307B5F5820A1FBE74970336442F64550C60D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686238253, "uuid": "2e35305b-7e7b-4995-a5bf-e641db1c9909", "value": "768:VAqA+PotZeuO2bR/JksEwGfZSl1wBaZPhxaicPIciMnbcuyD7UfyqI:VAl+PgHOgssL1wUZpOPIciMnouy8qqI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686238253, "uuid": "896de311-2ce1-4f72-8587-e670567dbefa", "value": 36460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686238253, "uuid": "7042b83c-c855-457c-b601-a48a58dd6650", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686238253, "uuid": "49d3c166-a4e4-484c-839f-5c9297946c00", "value": "88ab84d83cafc065b8112cee2d106a28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "975aa347-05f0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1686224138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686224138, "uuid": "eb9c9d85-f04b-4fef-9765-56de32281803", "comment": "Malware payload (RemcosRAT)", "value": "b09d8da41c25dbe44e71bc2bc16de91c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686224138, "uuid": "22d928c4-ee86-41c0-af39-abfa1b0d9040", "comment": "Malware payload (RemcosRAT)", "value": "08e14938644b60afa9c05d77d66bfd6e91c212f528b9c73b9e3734862fb17c12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686224138, "uuid": "e7c53ef0-c6a6-4715-93f5-9490b82ffeb1", "comment": "Malware payload (RemcosRAT)", "value": "1cf249eb79d02549059cb377ed38f5505e262229", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686224138, "uuid": "fe1acbb1-0330-4478-bfdc-508dd82b5b95", "comment": "Malware payload (RemcosRAT)", "value": "ee959d4ca9bc1b031461291e9f023c030ea221d8692784346f7a06a3d4891d084cc209552904ee65febec2dedac15ca4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686224138, "uuid": "8fc7ac72-486f-400e-9f1c-ea30d871951a", "value": "T1EC252341B2668B13F2797BFA15025A7017F6BA17B872F2060EC173DF6939F419A12B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686224138, "uuid": "654a1b70-b75c-4dc1-8cd2-fce72cb99efd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686224138, "uuid": "765497a8-3c19-41c6-90a5-da9a93c17219", "value": "24576:05GoR5a2x18A8DNaUQUzP/F73CjyQKraEyRC5x:0Io22xCDNaUQSPp3CeQ+aVRY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686224138, "uuid": "96f4440f-6a6f-4e0a-b0b0-77e2eba26617", "value": 998912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686224138, "uuid": "d5b98d27-c44c-4cb7-a3a4-c69960409098", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686224138, "uuid": "f4063736-cc5d-4f3f-b4d6-42984eef6218", "value": "08e14938644b60afa9c05d77d66bfd6e91c212f528b9c73b9e3734862fb17c12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7840076a-0619-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686241695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241695, "uuid": "d0ef6470-bd4d-402a-97e0-62f0096f5c56", "comment": "Malware payload", "value": "bbb86f44bdabd4b807666140381ac313", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241695, "uuid": "7ba90b21-2386-41f3-b8ff-4c80f89916c7", "comment": "Malware payload", "value": "08e6cb8c0bda2ee56050482d5e190c66269374a691dfd623a497dbf1171d93d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241695, "uuid": "bcd3d62b-51f6-4f07-9936-3a01a144df67", "comment": "Malware payload", "value": "76118ad482d718e58bdfbf9fd1db03d4a12c6a55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241695, "uuid": "a75921bb-4b38-4e6d-a573-721462edc86b", "comment": "Malware payload", "value": "bfdcbbbc38ea5e3deffbe4ea3f2d777e6da031cca91c6ce8abc1978fe2878ce2a436fa4e968706df69a7124575e081d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241695, "uuid": "22a1e406-18ea-4852-8ad7-58cf13a43e0d", "value": "T158C59D57F7668192C5CF2A77982EB31E96B56AC81720CFD3B2803A8EA9305D157333C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241695, "uuid": "5b7ffaab-a94c-4e14-8fb3-8617b9f160c8", "value": "49152:VrX6igMvfF3JluSbfYhcZmx4V5B5Owsqb:VroMxDYosqb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686241695, "uuid": "82ff4af2-894e-4bd0-bc9d-efcbef7923b7", "value": 2531328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686241695, "uuid": "7497fabd-081c-4d91-821d-62878831cb8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241695, "uuid": "8d6f10e3-abef-4dbb-a69e-1812d2db5c7a", "value": "SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.1034.6168", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28a9c7d9-0621-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686244998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686244998, "uuid": "a44e60db-6ea0-4032-a7ae-ad783cba1d01", "comment": "Malware payload", "value": "572a066063c6f95e3d15268be3c812e2", "object_relation": "md5", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686244998, "uuid": "8e5f089d-d952-4b1a-893b-2ab1692a7c98", "comment": "Malware payload", "value": "08fd0afdf8c328c02b5a72d9d7cb522becb773e97c6c446833249ecf273f435d", "object_relation": "sha256", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686244998, "uuid": "c48d8b75-40b3-4b3e-8721-3a42b238cf2a", "comment": "Malware payload", "value": "c62ecefa33fb8a4bfd2393941a38e80815154b4a", "object_relation": "sha1", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686244998, "uuid": "91fbf92a-fc45-4894-b8f6-2100a0d48a43", "comment": "Malware payload", "value": "418099aaba8ef0bc209e3639aeb90831507e89f57cee17a6510f26615f5bc51eb009b566f0d0212933aa37f54cfa546e", "object_relation": "sha3-384", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686244998, "uuid": "9ecbaae9-ad6d-4e57-bb2b-b875084530b8", "value": "T14032BF22AAC199DBEC73E13BC63144D053C56F89E7136F310ED412897A8075FE98C16D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686244998, "uuid": "dc45ac89-cef9-4eb0-acc2-a9812449024b", "value": "192:QOLa04UucZHYtPaUIuhtpFwN7BraCzxvfu87ncJQDRKPrb0jgug2ND0hzoHc6NFC:yxcZHYlaLu3wNFpfF7cSDR4jug2Wh4c7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686244998, "uuid": "f2e9ca63-733b-466b-af75-2280311f1a9b", "value": 11840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686244998, "uuid": "1062f4e7-d766-47d9-9084-29ad36cc3fbd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686244998, "uuid": "166544f5-f55b-4deb-9ad0-dc7669bf0c94", "value": "10707236826.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fef81bb-0619-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686241708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241708, "uuid": "d30fcd2d-ef7b-4f56-8dba-1d71383c1984", "comment": "Malware payload", "value": "87121ea3cf91f49f99b05dc6a976c1ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241708, "uuid": "dc36b238-d0bd-47c5-9370-71bb182f7823", "comment": "Malware payload", "value": "091391f47cae2e2623cf30329d91c093ec40f274eb950863a94935b0e57954c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241708, "uuid": "3d877daa-d3e7-4c83-a956-a9cecb692382", "comment": "Malware payload", "value": "dc1909672e54b0570fcc95a1c1b4ca5ca8c1cb7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241708, "uuid": "9c5a50f2-3124-42b6-a7cc-b81ed8ccf8c1", "comment": "Malware payload", "value": "a26173a75d1b28f7c57bf3f453b015b2796fc2bb57b0aae4efb6adc57211517dddc010e6d2d9a9f3998a4d1293391bc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241708, "uuid": "42338e1a-872a-48c3-9785-ce3bd9f373f3", "value": "T1432412BE8B806650E156B37589678F35DB23CE11EA3AFB5305A9380C3DB3644FC1A527", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241708, "uuid": "47a1f515-21e3-45b9-b73d-f35f6ca32806", "value": "87915b31955bd2c4e9031f425ce6d1cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241708, "uuid": "259e739a-3ca7-4939-aaf3-29228eb11347", "value": "6144:Bi81+I5zSMgyNiWacz9UN15a933zbdEK:Bi9FMnNi6UNY3NE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686241708, "uuid": "2215de87-42f1-417c-89aa-dc7979ea91eb", "value": 225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686241708, "uuid": "da726dcc-0b64-4363-b501-5687fa382864", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241708, "uuid": "18a0146d-d8ed-4d5a-81e7-d7811a7e3356", "value": "SecuriteInfo.com.Backdoor.Agent.26007.31385", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a465afc2-05f0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686224160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686224160, "uuid": "f670f26d-09bb-44a4-b0d7-205ff5056f2a", "comment": "Malware payload (RedLineStealer)", "value": "4b110d36417ba6ce62d9d5138b75cc12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686224160, "uuid": "b58d129d-e60a-43c1-9749-07a884148757", "comment": "Malware payload (RedLineStealer)", "value": "09146c35b49be8f83266dac44958e35f877bef0daa85898c6810338dafb70151", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686224160, "uuid": "982f65fd-0bff-4cc5-b431-f206a0eda8fd", "comment": "Malware payload (RedLineStealer)", "value": "6849cb5a41199f956920fe09fe069a51e40ec433", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686224160, "uuid": "43e7981f-e97f-47b2-bcaf-52b5563d603a", "comment": "Malware payload (RedLineStealer)", "value": "6033bc84dda8851c262b1666b3bde5a91e2458953983c26ab8c308ae9713a41962008d9e4d76f4d7edbe288fc5722d3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686224160, "uuid": "451d0034-709a-4ffe-b9aa-3437e21d9ee0", "value": "T120D41222A6D58077E8762BB018FA17831F767D916938437F2B89D82E4CB36859437337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686224160, "uuid": "74223856-c48f-4916-b2df-7557026bce52", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686224160, "uuid": "abe1c205-3da7-40dc-af23-745b82704ca7", "value": "12288:pMrcy90xo+0OwFI48nJosIdrhRuAZHyugIhcsBlw6t89RDDJU0:lyyyh/xtRJZHkIXcb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686224160, "uuid": "53460ad3-beb8-4173-a00b-dbaa3bde6943", "value": 616448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686224160, "uuid": "ace80205-ed22-4224-b042-94c2cb922e92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686224160, "uuid": "46f9c5be-12d2-4586-8878-57962a74e5e4", "value": "4b110d36417ba6ce62d9d5138b75cc12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9147ec87-05a6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686192345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192345, "uuid": "5adfb7a7-3171-4c63-87f0-6fa57dcbdc90", "comment": "Malware payload (Amadey)", "value": "1eaa945d5d5f58ca0ef57548101b6f67", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192345, "uuid": "17aa6472-774c-4740-92a9-70f47e541604", "comment": "Malware payload (Amadey)", "value": "0aba977bc3c3ebf7573ea899df6d90dd9f1bf6d84421942e839255cc623d3f39", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192345, "uuid": "bee3ccfb-8aab-444a-9318-f0a52d020638", "comment": "Malware payload (Amadey)", "value": "0190a9cb074fd4614bdbf99ce4e89778f0c6f6e3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192345, "uuid": "361d7e8e-e491-40d9-a163-9d8572dfb41a", "comment": "Malware payload (Amadey)", "value": "ff3173ed85d3a7b7a974e047478603518031b21bc850dd6269ba442a3b5d3591d985f564afb9beb886688d6e02646ccf", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192345, "uuid": "eda395ad-e1ee-4089-955a-7629880c006a", "value": "T1C6152303BFD98122D8F42B7198FB118357327DA14DF483AE1BE2694E04B27D9A57533A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192345, "uuid": "d2f1b2d0-49f2-4602-8862-a3433b4162f9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192345, "uuid": "a29722a5-1703-4f07-915d-11354b4b15bf", "value": "12288:+Mrry90iWpzVn5jK6w73d/gcDMiExNFVFjULh/2d8IhP+d9iYEsCWd7QDRgTgfr:ZywfOL73tzDiNFVFUTISDV7QdqGr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686192345, "uuid": "4af75304-60c0-4049-9ad5-4e6eac087e7d", "value": 884736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686192345, "uuid": "c9cda4c0-6d5d-46e0-9ebf-a25ca2a7464f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192345, "uuid": "f0b5cb93-a85d-4964-b4cc-11a5f65518de", "value": "1eaa945d5d5f58ca0ef57548101b6f67.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "809ace1a-05a4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1686191458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686191458, "uuid": "2327829a-95a0-4ef7-a253-07407fb7f91e", "comment": "Malware payload (Gh0stRAT)", "value": "1350a6e84d16c0a375d99e2862d13414", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686191458, "uuid": "5e3b045e-b141-4a69-8359-8e0188477b18", "comment": "Malware payload (Gh0stRAT)", "value": "0bb4962544cd7f55b3bc78f3e28a89a687f52bef7311a65749c1268d7a3d1558", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686191458, "uuid": "decf9a7b-5c2f-40a8-9c65-d7aec89d3277", "comment": "Malware payload (Gh0stRAT)", "value": "1b8690d6fa86a3cd86907eeee6b5428bf722488f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686191458, "uuid": "a3eac5ee-505d-43cf-b01d-c9aedf5ddde3", "comment": "Malware payload (Gh0stRAT)", "value": "6e6d29d82aac57d97e24eab122fbbc06c3a565bb63095b0d5910adedfc2764691b656405a2701e3b6644c68e81460b12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686191458, "uuid": "e9905749-53f9-41eb-a14f-cabf9dccb1d6", "value": "T1C3E47D43F3B7C0F7D44D00354469D3BA7A38A3216356CAD762D49A7BAEA53E15E3028B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686191458, "uuid": "53d97edc-f26b-49eb-87aa-9698ef1189f3", "value": "e2b4a22dd01bac62ec948d04cee8e739", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686191458, "uuid": "87214839-f00a-46c9-85ce-2e60f3d0005e", "value": "12288:SaejG/5NwYkK19iOCr+TMoO30mYn0YaAsGhQHxM5DKTrH5eZQ2y:2jGAK19iOCr+TMoO30mYn0YaAstHxM5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686191458, "uuid": "45284868-a39b-4dfe-8881-bf36786e4607", "value": 674016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686191458, "uuid": "a24e7e8e-af86-41c6-a01d-6e05236090da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686191458, "uuid": "41013e7f-f1f5-4e75-968a-f599d382eaac", "value": "1350a6e84d16c0a375d99e2862d13414.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba88347e-063f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686258127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686258127, "uuid": "f0516add-4c31-4e7d-9bac-f95d945e2d2e", "comment": "Malware payload (Mirai)", "value": "ab0de8c09966938ae52ce6f3442dccce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686258127, "uuid": "957b7a43-938a-46a3-aa5b-87baf8696c2f", "comment": "Malware payload (Mirai)", "value": "0ce96825b0f60f81cc8737a41370a9d6a1ed340b8d1c63b178bb0529064e1bf7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686258127, "uuid": "a6961cb2-ab62-4702-b15d-6ed0cfb9a10d", "comment": "Malware payload (Mirai)", "value": "d3d988b925520e69c838f1036fd81305cec420f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686258127, "uuid": "088d7326-0aa9-430b-bfaf-fc24551ee99a", "comment": "Malware payload (Mirai)", "value": "d911122c473a99daa1d043c56634bacf35e11582d100c7e56a4f038178e57d8a205a90a6fd0253d12c47d868de042e18", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686258127, "uuid": "b99fd78f-3df4-4cb6-add5-7ef57a100862", "value": "T18EB2D08DD0542049CD9D5C7D36DF89268FAD70A4779ADFB96320CE5876BCA0AB90C06C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686258127, "uuid": "5399c0ee-59e0-4158-8be9-0aa8c458eb47", "value": "768:c4rQlS07dEv0UXqUhvQE+CXvk3TGWwm0VZq8Wvi:BQlS07FUXqIYSXvkom0rqQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686258127, "uuid": "6eab89ea-efbd-4a01-98bf-5a0b47a6aef6", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686258127, "uuid": "9a0d209d-711b-4a70-8035-76ace1d3fb75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686258127, "uuid": "f2cea73a-694d-4fc5-9b2e-3ef6fa48cffd", "value": "ab0de8c09966938ae52ce6f3442dccce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8683de5e-05c9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686207359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207359, "uuid": "c550fb7a-8221-4ee8-841a-fa692acdcc42", "comment": "Malware payload (Mirai)", "value": "8aa8c323542782b0dd25288b60394483", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207359, "uuid": "0244c54c-d8a6-48c3-b982-89f71d44b23a", "comment": "Malware payload (Mirai)", "value": "0daaf0446ae765d91ac8e50cb43e97fa9646511f19cad656d62a7fc93366b90b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207359, "uuid": "0513aaec-fa22-48b8-97cb-72b7a616277a", "comment": "Malware payload (Mirai)", "value": "e83aa03f7918fc43abaae3ad221b3424b2c3cb92", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207359, "uuid": "04492550-06a6-4b3d-b0fa-005ea352dfd1", "comment": "Malware payload (Mirai)", "value": "60a1bb47d033e7a07e1e073016fa14af62ba9cdc23025b65c3996cf980c8c316d711ba66ea8a57a2a70616b4d62309e4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207359, "uuid": "ae9d00d8-e471-4c0d-aa84-23de06d6021c", "value": "T15B731A46B8419F12C5D122BAFE5E418D33132FB8E3EE3102DD24AFA07BDA9D90DA7511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207359, "uuid": "a00cc976-be0c-4a7e-9b80-cd05c5081519", "value": "1536:70npcfHvERE4d3cp9MeA0QF0vYPR/lGfgTNSoYbdpYOuZ0jPXDhYIIe2WTfr8:D3N4d3cp9MeA0QF0vYPRQfewI0jPThh3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686207359, "uuid": "0f6214a0-2fc7-4b83-bee5-316f835b1edd", "value": 77184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686207359, "uuid": "0ae5c3cc-2526-4e0a-b2bd-675e03c92151", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207359, "uuid": "7bc4ead4-9fec-48ee-823f-5b4d85e8c720", "value": "8aa8c323542782b0dd25288b60394483", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c08d9d7f-05f2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (MassLogger)", "timestamp": 1686225066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225066, "uuid": "479adc76-4632-47b5-ab5a-5a95cedf6e1e", "comment": "Malware payload (MassLogger)", "value": "a8a2e3100a56c891b16cd7503e4b03ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225066, "uuid": "bd683ca0-b625-4e10-85eb-f5a473441c33", "comment": "Malware payload (MassLogger)", "value": "0eef67dbee8912b9267f7ca7f7eb4f63547bc8d336bdddc22f98c14563c32515", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225066, "uuid": "dd493247-899a-446d-8146-4394e3db26ee", "comment": "Malware payload (MassLogger)", "value": "e5313848436433842b4d932e3ddfc408bb20337a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225066, "uuid": "7d0051c1-05f3-4a23-9502-8793136d5df0", "comment": "Malware payload (MassLogger)", "value": "40857d5836264878c2217e600e13290674be0f6d7bc251ab930c140747886bccd007fbaa42bcf27d96b8d62f7fc5a113", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686225066, "uuid": "465e3298-3b64-4bdf-aac7-7d6b95c98362", "value": "T14A83290E33D4D820EAFF847655B14251077AF812495BD31E0EE5B8AE2F367948A93F93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686225066, "uuid": "8902d51b-d5dc-4015-b313-a1ef91b2a974", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686225066, "uuid": "08a5d8cc-5adb-4240-a398-8673f994befe", "value": "1536:6mcODmuU/nqPPjLXFC6ihgDHXwivg8v8Pp9bLYmxQwTW:rZdPjLX4DgDHXwCggA9omx5TW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686225066, "uuid": "f0e8beff-340c-4edd-8358-849ba105f164", "value": 82432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686225066, "uuid": "219daa74-c98f-4024-9fdd-737669418a8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686225066, "uuid": "8c9a7734-6edc-40be-9c56-a5ed24539146", "value": "0eef67dbee8912b9267f7ca7f7eb4f63547bc8d336bdddc22f98c14563c32515", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bca3a7f-05f9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DarkCloud)", "timestamp": 1686227904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227904, "uuid": "b641c5c4-d2a6-4b4e-82d4-d85a415828d9", "comment": "Malware payload (DarkCloud)", "value": "6c43e077924d7c713cb7c3609302542e", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227904, "uuid": "34412204-34d2-4512-8534-d31529c32ab8", "comment": "Malware payload (DarkCloud)", "value": "0ef89d2165261d5efae81b3594180d6377065dc9f1edd9dc7a699ed31e039d63", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227904, "uuid": "0a27989a-cc7a-43a3-94b2-2242bc95127e", "comment": "Malware payload (DarkCloud)", "value": "d1970b1575f7622e00125ba09dc253ddc9c4339f", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227904, "uuid": "1f5db62e-d626-4125-87de-b23f2f543695", "comment": "Malware payload (DarkCloud)", "value": "31137ab3ab89721350815a48971c93ac4173469b6c58ac7a5482f6d50192231faf8c17cbfc970e5cc479777144c4bc52", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227904, "uuid": "6da754c5-7427-4bd2-a1d2-7363407895a5", "value": "T1142523407BCB807FD2970FB80948677455FD82DDBE37DB274D8B9095EE26A2A6082352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227904, "uuid": "c5f6f557-3b72-4919-9178-4f09298eb475", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227904, "uuid": "2ad3b4e6-d4de-4cd1-9a2e-3cbcb11ac47e", "value": "24576:7PLaVUH999bynMCX70p3IgE49lAjLRqw8ZXSfegKNtpwWZ4:HBH9enMCLxUl4LRqvXSfHKNX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686227904, "uuid": "743e1d6e-df28-4856-8ac7-79905d8f2a34", "value": 1052672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686227904, "uuid": "358cd25d-3e82-4e8b-b62d-23d490dd83e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227904, "uuid": "3a63ad3a-9682-461d-abfa-51ac9fec75cb", "value": "0ef89d2165261d5efae81b3594180d6377065dc9f1edd9dc7a699ed31e039d63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "159dd022-063c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686256562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686256562, "uuid": "332783d8-d9b0-41a9-a86f-4bc1626f51aa", "comment": "Malware payload (GuLoader)", "value": "357f9298368e64b2febeb6742f0a2552", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686256562, "uuid": "c70ce148-f2f9-447a-90c3-406cee47e58b", "comment": "Malware payload (GuLoader)", "value": "0f849525b31bc8eb26642e47cdcf9a3b9c945e5e481dd427a3175486278ac2db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686256562, "uuid": "49365538-433c-46e8-89a7-1b84b2ece61f", "comment": "Malware payload (GuLoader)", "value": "ba9efdb353c2485666991c44d3aa699ee8802d3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686256562, "uuid": "25c2a67b-71e0-4535-894d-c487ec58ed72", "comment": "Malware payload (GuLoader)", "value": "6c9aa59312a68ec7f527e8676b7cdc48b4cef99c9d805554dc5450c555060e77db8b9d07496fd4dd7fc878d240f02ab4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686256562, "uuid": "52ad9587-fdb0-4091-8e6b-2d57c63fe648", "value": "T147F49EA2F500808FDE24143FF5B6766C2AA56FED998A76D12351B7D70C72A42C34F60B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686256562, "uuid": "5b9e31e0-c05a-40e5-8efa-52aa6767d6d9", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686256562, "uuid": "19891875-644b-42ec-a4e3-485d37929723", "value": "12288:dgQ44tKy5S3Uc7I6aA+SHGvwygKbUliOLQdxR8pSwM4vXVFQIq:d0CKMgUUa71wliJ2pSV4PvQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686256562, "uuid": "2e51b6ec-e2a2-4c35-8b65-7f579adaca04", "value": 726164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686256562, "uuid": "26ece21e-b025-408d-9b61-db65c45b317e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686256562, "uuid": "a7527449-7d09-49bf-82f7-ce55ce6ed2ba", "value": "DOCS-INV.PKL-778012DHL-PARCEL INFO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ee0771a-05f8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686227560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227560, "uuid": "177940d2-33c9-42b8-80ef-8849854165be", "comment": "Malware payload (AgentTesla)", "value": "f9408cc760a142348184e50d87553510", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227560, "uuid": "018979b3-8a2e-4a1b-aaaf-9857bf31fed7", "comment": "Malware payload (AgentTesla)", "value": "114bb32789591863f1e52368028e2a59589b96117e2b6596d75f046ccc7863e0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227560, "uuid": "95bc34b7-f48a-418c-8075-6c899c8e52fa", "comment": "Malware payload (AgentTesla)", "value": "12c23a13ff1b883823eac46d1c84859f1812f4ca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227560, "uuid": "6731009f-25d9-485f-9ee5-475630c93282", "comment": "Malware payload (AgentTesla)", "value": "4974635baf818fc0be8bd730227daee75026169424ef9ea2bfa1d43780b043f238d8d5148c077a52751d9147b6d35395", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227560, "uuid": "59e7e57c-96a5-431c-aef1-33ba3061bae7", "value": "T132F4F090B17B4F2BD4BA53F1810463350BBE5A9CB972E31A4EDBF4E72521F414981B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227560, "uuid": "964fe44c-c96b-4602-9151-2c95fdb6d2bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227560, "uuid": "2d22025d-7290-43ee-8a65-4ffb15ae676f", "value": "12288:Vw2B0xTGlxNqvNu2hZ+nUEsn9HicwZnZz1Lo14e1VhhM1W7yFJ5M174rEIt5:VwLaVUH999CXXElhEPJXt5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686227560, "uuid": "6536ca2a-071f-49b8-ab55-57c629ee0a21", "value": 772096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686227560, "uuid": "7953c727-7f9a-409e-87a3-9da778347a56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227560, "uuid": "ef5dfcc0-0ea1-4916-906b-0449596a8d32", "value": "114bb32789591863f1e52368028e2a59589b96117e2b6596d75f046ccc7863e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4db5db13-05a7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686192661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192661, "uuid": "a505f7a2-4317-450f-84af-6932c50052e3", "comment": "Malware payload (RedLineStealer)", "value": "19fcced234285581d3aa3e2f40ec10da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192661, "uuid": "282c51ff-886b-4d09-8cb9-1d59561b2c9b", "comment": "Malware payload (RedLineStealer)", "value": "11848ea1d323147534356fe7c69746808b627063f3e82717414263bec3345037", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192661, "uuid": "cd403907-0e96-45bb-8ed7-33674f8963b2", "comment": "Malware payload (RedLineStealer)", "value": "78d9d3ab66728acaf8c2384c593ffc762ae8cb8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192661, "uuid": "42027e07-0155-4b52-9ec8-509d49817da6", "comment": "Malware payload (RedLineStealer)", "value": "b19d74523b94d7dc9a1376dbca6bf147602485f0959eb4b0361136ee5fad11a51d3620a1647b423eee393641e3bc7f7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192661, "uuid": "64614084-2ab4-4ef0-b419-c8cc44b03927", "value": "T18AF41283B6D48266DEB617B08CF303831B367D52CE7947BB17869D8A88B35C0953176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192661, "uuid": "32a3373b-6056-4adc-bda0-691c0cc1b3f4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192661, "uuid": "a10f5c16-490f-4c16-918f-1ba1eea43142", "value": "12288:XMrHy90UhkIyDCrAiMJ2jt7fke8XoV2HixImhdZBJ55jQC8:8yth9ZgkWX+2CxTtYC8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686192661, "uuid": "dac7bc5d-582b-4382-a223-bbaf3ef1d8fe", "value": 770560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686192661, "uuid": "72f76008-8e99-4cb8-8d84-13501eb910cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192661, "uuid": "1ba9911c-a379-4162-be37-1a648a4f8cb7", "value": "19fcced234285581d3aa3e2f40ec10da.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec46a0b8-05a5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686192068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192068, "uuid": "d19709ca-2a5a-4a90-a65d-daeb05b7b624", "comment": "Malware payload (Amadey)", "value": "45648ce195c527cb6f674ed73efdc9d8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192068, "uuid": "cb3db9f5-fb46-4f80-8c90-67a4cecd8a03", "comment": "Malware payload (Amadey)", "value": "121c1e7b6390fdfa45472c7479c2e20f7772feacff085de509640847da5b4e2c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192068, "uuid": "dd65b447-b451-48a0-80da-981df26bd866", "comment": "Malware payload (Amadey)", "value": "38b06dd7b7ff4a2081e782c23779364bf85a9229", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192068, "uuid": "367a58fb-a80b-47ed-bc70-afde45e98ed3", "comment": "Malware payload (Amadey)", "value": "c0b122c244bc5b27f45fb9f739844f20745bbd01bec0dd7db2bd11db9e04c046de6575c916adb03f329e83541d1fca3f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192068, "uuid": "5fe243e8-4793-48b1-9475-e6550fa5759a", "value": "T1ABF422136BECA832EFB2A7B418FA03930735BDA449380B6F17859C5958736946D3173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192068, "uuid": "27b395cb-02ef-4ad3-be75-dd64fdb89d2d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192068, "uuid": "38cac94a-3cb4-4c6a-83a9-543d18328380", "value": "12288:6Mrjy903DGl4kTHXyZhq40RJH3jTq/IlbLSJ/KebdZP3B:hyFpTHXyZhGRJnHY9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686192068, "uuid": "713b5f8c-b6f3-460f-af9e-7edd9a121512", "value": 770048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686192068, "uuid": "cbc3c5bb-d43a-4f40-a4f5-3d574f85a49b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192068, "uuid": "f95707dd-de68-4a16-892d-56068d2ed3af", "value": "45648ce195c527cb6f674ed73efdc9d8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7126d269-0619-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686241683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241683, "uuid": "6884a10b-39af-4fe3-ad8b-e0413ba2184d", "comment": "Malware payload", "value": "cc0ab3503a60ba8155e211338b7b4105", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241683, "uuid": "49403ae3-005f-4a5d-9769-89672efecc21", "comment": "Malware payload", "value": "128419e25e710e6c47d821dc5a538e1cf4f38642adf071bbab2fbb143b4ba178", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241683, "uuid": "55d5ab5c-0110-473d-ab49-a744d79f8089", "comment": "Malware payload", "value": "465f552d27dc0ec4da38025f526e0e63feba38de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241683, "uuid": "8d5119e7-2257-472e-95a4-4e8e5e791bb1", "comment": "Malware payload", "value": "d2a17b51d623293dd5c2335785f29df1a0452268b538e7dd09dd0e1b7d95de21e39e190aa396527c56aea2f3c4581a2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241683, "uuid": "1e04cc5b-a704-4977-a037-580d3dd4ce91", "value": "T14A92BF8AA186CAD6CC9C0E3A916B56DC9E25BC43CF1B2BC37815C90EBDB62CC1745C16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241683, "uuid": "d706d4d4-1562-49ad-b60b-08a7b7c9228f", "value": "c2728f76e43fb2115b5a43687fb9f561", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241683, "uuid": "abdef859-0e56-416a-8153-4e072398461f", "value": "384:NQNkkdpzcsuoKdnQugIXeequsPQb3gaNBshhY592KYPs+Wvl4:eKDdnF5ePusYzVNGhhY59DYu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686241683, "uuid": "2072289e-6d1e-4364-924b-ecf2f5f4838d", "value": 20992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686241683, "uuid": "c3a907d6-ba1a-4823-9047-2a9efe074a83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241683, "uuid": "ff6a9141-b847-42ec-9669-42e950b1bf16", "value": "SecuriteInfo.com.W32.Generic.AP.30314E.tr.7310.21054", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3196f303-05ff-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686230410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230410, "uuid": "a11a1714-b4a5-43e8-829e-d84b5021f178", "comment": "Malware payload (AgentTesla)", "value": "f2390147b225e560a2840de045652e3a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230410, "uuid": "84d29f1e-4709-47c8-b269-8ad346616c2c", "comment": "Malware payload (AgentTesla)", "value": "12d37f94ebe64d74e7cc1a4290af6797832b512a223d03d410171f47cd979065", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230410, "uuid": "eca7b142-36c1-4184-8228-798c7e0a8746", "comment": "Malware payload (AgentTesla)", "value": "fd723e9065b971729c5dd0a23e78c60f79ea315c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230410, "uuid": "908c888f-9e3b-42c8-b3ce-3ce7ab6451c1", "comment": "Malware payload (AgentTesla)", "value": "c61739132404d020f1c452f96b51e3a8002c737997b71a538df36f486b27a0ed9238c7bbcf8fab2fbd8c541fca56c4cb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686230410, "uuid": "355fb5f6-82c8-495e-9a2c-4fe0bc2ce60c", "value": "T1A6F4025533E7114ECD6EBFBD198906BCC9F4AA067503C2878EEB785DEC68F458A00297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686230410, "uuid": "2da06a49-c4de-4c04-9ccb-1e76acb5a6cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686230410, "uuid": "14040e85-5794-4c04-82fe-3551d372b402", "value": "12288:+d6L7PVXfliybhaDnLMzIL2q+RTdOL8I60XtWsi/PmAF+EMQBJxLzspsCITl5epN:/OyqGUL8IrtijRze/d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686230410, "uuid": "c694f64a-5898-400a-a382-d6ec5786f115", "value": 769536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686230410, "uuid": "7ba5ff6f-2582-4e47-9eb2-bdb579680181", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686230410, "uuid": "74f9ff0e-14d5-4f59-b1b9-1ce079ed124a", "value": "PAYMENT CONFIRMATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "417a02ae-05e7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686220128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220128, "uuid": "8a6b8535-423f-4e3e-acb5-b3126244ad9f", "comment": "Malware payload (Loki)", "value": "53399a7a14da1bb2686c0a445b5cabb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220128, "uuid": "5e110d01-5af0-412f-ac68-b432db1ad9bb", "comment": "Malware payload (Loki)", "value": "141eef5010b1211cb42d8209ecb8b41db12a4222086beadded2c8ec5b3457a2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220128, "uuid": "834c5007-41ad-4eaa-a0e4-8bc8f0ebe158", "comment": "Malware payload (Loki)", "value": "9194e4dde3075a1dc267e5a2e32449e1cc5601c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220128, "uuid": "a3715926-8ac1-4b68-b066-069ac4eb6499", "comment": "Malware payload (Loki)", "value": "35232b4777c7d40a24f2152bb0f09713cd5bd94af2535a6ed62be51c45ae589988762c7c350b752a53ede37806a569e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220128, "uuid": "bd9712a7-a803-47c2-9a9b-93d08c834c95", "value": "T141C4E02026D9C70BD16B537880E1C3F057769E98B9B7C7970FD8FC4FB28E2A65212256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220128, "uuid": "7de753a8-00ac-409b-9127-4c9884424ea3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220128, "uuid": "df16c11f-3cc9-4389-8262-e4265070b092", "value": "12288:wtigwS4Ez5aj60LNFOQjzE93VSYKfpV7ANxIgKLQ:wtiNS4+aj6AFPj+VSYKfrAPdK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686220128, "uuid": "f7913dd9-eb87-43d3-9079-b502634df402", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686220128, "uuid": "1e39592b-4572-45d3-b050-17c9f71ac387", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220128, "uuid": "a49e98fe-3888-4e58-aa13-0214e9b9bac6", "value": "141eef5010b1211cb42d8209ecb8b41db12a4222086beadded2c8ec5b3457a2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af27cb64-05db-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686215158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686215158, "uuid": "c9fbd117-34fa-4825-a004-3a870ada236a", "comment": "Malware payload (RedLineStealer)", "value": "106ee367b22918ded2ebc544e5285890", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686215158, "uuid": "c6512fa8-89da-40f5-bcba-df4a102e5e9f", "comment": "Malware payload (RedLineStealer)", "value": "146a863d6dc271817d5373e76716df665d3971350a0a80153bbc47b7d278c1b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686215158, "uuid": "8ca5e318-25ee-4492-9545-2e8305d3135f", "comment": "Malware payload (RedLineStealer)", "value": "b59f59e478c94190fc559fef3ed29f560f78ccf9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686215158, "uuid": "97cc989f-c058-42c3-b666-04cc2a49828e", "comment": "Malware payload (RedLineStealer)", "value": "511a9e1f078067de3fa22260d0b052e7d59ff0879e75c6e8d27e82b96ceb110e589c0c3a7772a90e0aa80ccd3977d6c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686215158, "uuid": "be97cd3b-244f-41e7-a3f4-62ea690a76e7", "value": "T1EFF42262ABD45477E876277008F603D30F32BDA05876C76F2B46A25D89F2290753A73B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686215158, "uuid": "dcf98463-780a-4628-af51-9c41a24af18f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686215158, "uuid": "a195d44d-69ef-4af6-8be3-7fdeb53999a0", "value": "12288:DMr0y90w2S6C77ZFnd6Qx0f6nQdfNvD4jYTVewf+CkD+FYeLFWMW6nqGkOG5K/R:7yffXL6fiQRNFTf+CkHSiN8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686215158, "uuid": "49bd3585-b37e-4ee9-80cd-ea12167dfb22", "value": 791552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686215158, "uuid": "423be4cf-83bd-498b-9ef8-c977d47986b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686215158, "uuid": "cfec6b0c-0c0e-4d68-a3e2-5fafbd336aff", "value": "106ee367b22918ded2ebc544e5285890.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a978fed2-05e9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686221162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686221162, "uuid": "39a30f43-013f-42b9-ac54-876af700ba3a", "comment": "Malware payload (Amadey)", "value": "bda97c863de7328cd21141b546d85378", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686221162, "uuid": "aaad14bc-9793-4676-8744-f7606ce291f4", "comment": "Malware payload (Amadey)", "value": "14f52fdc7dea4e1d10eb0cfa7a09c7ef4e4648b87b56431f6c468fd058f813e2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686221162, "uuid": "6fc3cd63-7d25-4f49-9658-0156bede0f62", "comment": "Malware payload (Amadey)", "value": "de0bd1ab7571a9dc9a5e9f47722cc645c2f492fb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686221162, "uuid": "c7b9f797-c918-4987-84f9-37f20e3e6ee9", "comment": "Malware payload (Amadey)", "value": "46a3ca57540d6c617e60daf3d0af280fdbc294e917237594c1dac74fef4dc82e36be4f89cfe1e66b0316cfcbf9d2af05", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686221162, "uuid": "606cd249-1513-4104-9b21-da4642ce6ec1", "value": "T155F42352ABE8A532EDB067F044F203C30635FCA19D74866B2B8428571CB25CEA47677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686221162, "uuid": "7077b203-5953-496a-a6b3-4e8fc89e6f18", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686221162, "uuid": "32d50a3e-7998-45fe-9b9a-393fc4bc78e6", "value": "12288:cMrIy90SuwMRhj81eUvsDsi5CDvGqm6+BzBuM2XbtO871b71yMCV:cytwj8WDr5qvv4hN2XbtO8pXwR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686221162, "uuid": "6af06765-7d30-4a12-a27a-4febc8873692", "value": 791552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686221162, "uuid": "1b61cfe6-0b2a-49a3-9d14-462de03111bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686221162, "uuid": "13681215-2e4a-4d5b-876f-1d3706da4f02", "value": "bda97c863de7328cd21141b546d85378.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e03feb3c-05dc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686215670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686215670, "uuid": "a91813cc-5cd3-4802-b3fc-de911e190795", "comment": "Malware payload (GuLoader)", "value": "f5879c1be334d16e12d50db0fd3c233f", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686215670, "uuid": "2159b2a9-8b06-417f-a10a-52769cbf3841", "comment": "Malware payload (GuLoader)", "value": "16447f7e27de852783027404f8ccf368ecf8e1eadd47f8e080e6e4819d2203b0", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686215670, "uuid": "d7ad5803-a01b-48b6-81fa-f3015cd8e19c", "comment": "Malware payload (GuLoader)", "value": "6993ec206a042739fc89d7c001a855e10f3946bd", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686215670, "uuid": "0925eb0d-6908-4044-bf57-e10f0774a396", "comment": "Malware payload (GuLoader)", "value": "ae9d0779e3b40b235b57010a5f36cf627736882ffa791e733daa5b1a12df105ffe29fccd0594ee4219da6a57a4aff8e3", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686215670, "uuid": "ff952a4d-3172-42b8-917e-2fad497977c6", "value": "T113B2E4566B8C4C61F25AE8BB475DA00E18FCF23230C255C5BD9DE2747B2E10E4B6B1B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686215670, "uuid": "b35f831e-3d6e-4507-b641-447bca4d5ba5", "value": "384:kz6mmMVuOpyEiI8XnKevWuykFZKjwiise2RuWEd+RLKoCwvnliuEjTUVbS5JH/0t:k5VAOpmI8XnCuVwwr72YWpRLKoCwvnl/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686215670, "uuid": "2bfa4453-851f-4a03-b129-28f80658b581", "value": 23389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686215670, "uuid": "3062a7a8-062e-4a23-8210-1c3ef70074f4", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686215670, "uuid": "f7e90ee4-d204-4102-879c-62ac743e8e6c", "value": "f5879c1be334d16e12d50db0fd3c233f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52504778-05e5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686219298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219298, "uuid": "431db8cd-d887-44be-ac47-dff3b7c48e1b", "comment": "Malware payload (AgentTesla)", "value": "22e7f21b0d8c6bed12ccc4d1d9fcfb21", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219298, "uuid": "5c591328-bb65-41e7-867f-635a95d941a0", "comment": "Malware payload (AgentTesla)", "value": "166321f2bf53cab5d536489d145e913c75727473627922b9ce53e0dd8b40e99d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219298, "uuid": "54ca1e0d-141b-48f4-b012-bbcc800bf1f8", "comment": "Malware payload (AgentTesla)", "value": "fadc4a581a932577f69ea323c3b440ce356e0500", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219298, "uuid": "6d82d1c6-8359-48d9-a5c8-4ec1cce742ab", "comment": "Malware payload (AgentTesla)", "value": "2a74728fbb004547360c85f9c3c8a03f6399f39ce2cf5499f44377cf7fe8069405af6f565cb1f2f02e9d8b397cebcf18", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219298, "uuid": "e9193825-6c24-4d8f-9de3-e0d147be49de", "value": "T160E4F12027D9CB0FD46B523884E1D3F0577A8E85B976C7834FD9FC9FB29A2A52351242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219298, "uuid": "8b902778-d2dc-43d4-8bde-1a61fa3dff2b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219298, "uuid": "7458d25a-d06b-4668-b99f-dc1ee8f36389", "value": "6144:OofPu45yDwEtTaGvrsu/S2lYYa2eKXMXW+yZwqvso4y1eHdLGADzeOC397dvGoN4:OofmgYppYm+yyc093Dz4EkojJk9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686219298, "uuid": "78481856-9a8d-474b-a8f2-967ad6de5c39", "value": 663040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686219298, "uuid": "fd2f3fab-67f5-451b-a8b6-109bf5a1fd6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219298, "uuid": "bf52d9ad-bcd8-4670-9a9a-76e06efe0268", "value": "166321f2bf53cab5d536489d145e913c75727473627922b9ce53e0dd8b40e99d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4e6d0b1-05eb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686222147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686222147, "uuid": "864eb851-85c4-4fb2-9738-5bae6001a902", "comment": "Malware payload (GuLoader)", "value": "88098867dc6191e1768ef61958c2e649", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686222147, "uuid": "24c144ec-8e64-470f-9f35-b2579fd384c9", "comment": "Malware payload (GuLoader)", "value": "168fb27a2e23a410e81c23a8c25ee1e6a4c73e75318692959eb6b629513a8a15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686222147, "uuid": "606b99fe-9f73-4567-9482-c7d12cb64d48", "comment": "Malware payload (GuLoader)", "value": "db2300d44b0efeaf986eaf1b9e71644bee686980", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686222147, "uuid": "a99b78d7-c3c7-48b7-8a3a-96c8a594b62c", "comment": "Malware payload (GuLoader)", "value": "4b9aefb3af8147b09987284fc72f03930e4b0c3e548bdb7670869ce6f7cffbf15f07a89edf3dd2768897bf3913a97faa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686222147, "uuid": "8c2a82f9-2cc3-440b-82b4-2d07dac8e26f", "value": "T11A64D0C3764091EBEC620971BF1F84EB1A92FCAAD4D04F4B7774733A19D1135A21BA4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686222147, "uuid": "e8ab7c81-f64f-49aa-aeb6-ad9dfe8fa485", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686222147, "uuid": "d3268b84-77e7-473e-b0b3-59cbc55c42af", "value": "6144:fQ606x5wOyFNKvLOsI5H8T58y3zYtwr7U0Gd/EC6:/wDSvysI5858yjJ7O/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686222147, "uuid": "306722fc-bff1-4c36-8493-3e6e4739e15c", "value": 336370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686222147, "uuid": "706d5cce-caec-4254-a4f3-93069202b6e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686222147, "uuid": "637b2481-7c35-49b4-bfb5-bb1dc7087448", "value": "168fb27a2e23a410e81c23a8c25ee1e6a4c73e75318692959eb6b629513a8a15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f414a797-05ea-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1686221717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686221717, "uuid": "05874b71-20dd-4698-b630-7376e8e9a6dc", "comment": "Malware payload (RemcosRAT)", "value": "2e8e89544086cc8905577ca8200ad894", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686221717, "uuid": "c488da3b-9c5b-4861-a5cd-0d316d467140", "comment": "Malware payload (RemcosRAT)", "value": "16bb974c71635d85ce58284f8e17291ac46bf7c2972e3235fcf60c1a1c0ed681", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686221717, "uuid": "ab764739-c46e-4cdf-970c-f64eea43ca9f", "comment": "Malware payload (RemcosRAT)", "value": "f195fbebac33fa202d5ad57e1aefa63dc8e36c9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686221717, "uuid": "aea5889a-98ec-4405-abe5-0971ac24dd40", "comment": "Malware payload (RemcosRAT)", "value": "089ec9a40ecd9fe9677efa9edb9b456a15b3b409b23d594044864d27fb37066f7e70402c08e906ca57a78c749e473c0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686221717, "uuid": "dff4d3e1-158b-487d-9be2-cc0bc9cf0a67", "value": "T19125C6386CB61C27D438F5BE86D4B023B1298B27B70E4A19D3C357853A2E92777C256D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686221717, "uuid": "fdfeb15c-9281-44e6-96f0-1ee2e0503485", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686221717, "uuid": "7459f81d-1909-454e-98ea-47d595459220", "value": "12288:SlGiTB2QwaNYCTdnwRFtPLPEJ+Kk2S6bQzdLVEHA3UvlSLvqCIsIHMf1YBRBe986:kJYCmFNPHKk2Rb+LSHA3UvlbTsdOf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686221717, "uuid": "c4dda0b5-f546-4b4c-a233-5950e504f8c9", "value": 1036800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686221717, "uuid": "cae90176-b3e5-4a40-bd84-cba440228c5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686221717, "uuid": "8acfbf03-b300-4880-ae81-c6b8a142113f", "value": "16bb974c71635d85ce58284f8e17291ac46bf7c2972e3235fcf60c1a1c0ed681", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0596d1c-05a5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686192048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192048, "uuid": "f01bbe5a-8b70-41be-83c1-3f041df124b7", "comment": "Malware payload (RedLineStealer)", "value": "53d4a1f74c54991df866d9c0e9cb329b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192048, "uuid": "b9c22624-17fa-4440-9320-bfecbeb85f61", "comment": "Malware payload (RedLineStealer)", "value": "174d48a13b69727709e45e4f165c818140a51f29cdfc693a6f500d2aee17c125", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192048, "uuid": "9c0b93a3-a894-47a5-b048-a207705647aa", "comment": "Malware payload (RedLineStealer)", "value": "96b376b8460b957d83ddb84b24ea00ba0a7c2300", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192048, "uuid": "63b11d02-c710-44aa-914c-e6a00bb6a52e", "comment": "Malware payload (RedLineStealer)", "value": "b54bbe56ef4d971458295bdea1f3541ea70fd7434d51bf03e10ed24e148d1e296df732314c4374850b9e2786c521cc44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192048, "uuid": "a869d482-abcd-4881-85d4-d47cc2aa0e3a", "value": "T1B1F41212ABE89173D9B417B01CF503C70B39BC92AE38465B3B5549660CB33E5AD3176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192048, "uuid": "29a08fcd-967e-40aa-9e68-263aa135ec42", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192048, "uuid": "40918056-272f-476d-91ce-50d87a9393c3", "value": "12288:mMrzy90iRu9VWxxa1LNvhJBQEK7nQvo2fRIMFr8VwngB14XTTV/MRcknef:1yewaLN+V7Qvo6+RVw61GTTV/MIf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686192048, "uuid": "22259a04-e064-46d4-89bb-3e2fbbd77d0d", "value": 739840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686192048, "uuid": "d8cf37f8-4df2-48ea-a753-614f6b646f4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192048, "uuid": "26ff78f0-6745-475c-ae3d-5a5b56f327df", "value": "53d4a1f74c54991df866d9c0e9cb329b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df36af76-05a5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686192046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192046, "uuid": "0822bd4b-8be8-4f99-aa6c-f8691fd14014", "comment": "Malware payload (RedLineStealer)", "value": "0f545053d4267394934630bcd3e4d580", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192046, "uuid": "a704d489-4168-4358-a9b9-a6a72b67afda", "comment": "Malware payload (RedLineStealer)", "value": "18093a97691a2bae77629aec88c69d45e9282a986c7940ad87eeb7febe5a0a9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192046, "uuid": "07a93108-dbbd-4bfb-952a-16f14bf87963", "comment": "Malware payload (RedLineStealer)", "value": "8b9e157a17b0a1a7d006893decb1ec1417497a40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192046, "uuid": "79ea25d4-2cf1-4c5f-b36a-4e642b174d1d", "comment": "Malware payload (RedLineStealer)", "value": "6461e3f83b17b5d52f8d40137a7aeb2f6b77d2b050d029794eff1980fd5093b9145c28134b5b2d6cb33852ca65767091", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192046, "uuid": "a020dbad-c20c-4c56-b883-d2891a046f33", "value": "T195D41252EBD48933D4761BB048F703E30B36BC658E74976B1785A95E0C32791AA3237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192046, "uuid": "dea08d34-dca7-4edd-a2e7-72ebad67f3a8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192046, "uuid": "02a462a7-0fd6-41ee-a909-8a28a82935ae", "value": "12288:VMr3y90EHA+AEWs3S0alzGz7Ywl3NRZgJF1OK9PVYTXQcAW4azUo:OyE+N3siYq9n+F1OKMXXAtago", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686192046, "uuid": "800d3d95-b2e5-4673-baa9-539ea8b24655", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686192046, "uuid": "df69ea76-64e1-49cf-95c3-21e14793672b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192046, "uuid": "d6c0e7b1-28cd-4a8e-8b9f-05d26f09a257", "value": "0f545053d4267394934630bcd3e4d580.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39b3b4a4-0600-11ee-b3cf-42010a9c0076", "comment": "Malware payload (NetSupport)", "timestamp": 1686230853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230853, "uuid": "2bdcdb2b-2c1b-4677-a181-7dfe68fa3a7f", "comment": "Malware payload (NetSupport)", "value": "b3fd76d55099718de79c8024a7b42cc5", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230853, "uuid": "75a66244-cc1d-40af-ac67-4666efc4699d", "comment": "Malware payload (NetSupport)", "value": "18bcff2e8da0ff30ff641a097dba27d475937b0ca6c93ba9689689237d1b065e", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230853, "uuid": "56411241-a2c2-4e81-befc-60b361b95c9d", "comment": "Malware payload (NetSupport)", "value": "6860e88974b8b9b321604c8938eddbd6c17d69b7", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230853, "uuid": "3f992b41-d048-44e3-9a03-4356e9abd344", "comment": "Malware payload (NetSupport)", "value": "b2cf25bf9ee2dab939493645702a4ef84634890dfdf0ea99dc78d945c7b5ca0cf0a18aa842013945a26971f1a6d152e8", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686230853, "uuid": "016f1e72-5b00-4ead-a323-6807d691bee6", "value": "T1A0239424A2D07C44139B6BA7F72BF5E1FC9F0EB93460498BD410BCA46EA9705E6D0772", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686230853, "uuid": "8291012f-e992-4bd0-98af-33ef95b8fb7b", "value": "768:2G8kNNpAqcUAOJcNAuf4TzRCGeUgOBHOvjWgrIBg5g63f9nU9MlG6RyTZ4kP1gZ6:2G82FNaLP/us3+5iy23or", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686230853, "uuid": "ba761675-7ec1-4a12-ae23-59b5f71dc8d1", "value": 48271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686230853, "uuid": "f6e8c5a3-962a-4c4b-b6bf-078a0bf4333a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686230853, "uuid": "94112c8a-94b7-48d2-a5a9-88fc2749d1b2", "value": "569601465.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74f57296-0619-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686241690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241690, "uuid": "77a301a3-c266-414e-b4db-44aabf39d103", "comment": "Malware payload", "value": "22b2a390c6d2f669cdd4ec8f4276eca0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241690, "uuid": "a8fab007-cdd9-4fe9-9f61-e365e3b59d64", "comment": "Malware payload", "value": "18e09ed01716f5c494e54b1ee236532efa893634ba3d0f0a2f973cc0f2f56243", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241690, "uuid": "027890ad-a030-4a3e-8cb6-cc7fca2f924e", "comment": "Malware payload", "value": "60e458c50f1599cc4a0a15f170c17b9c2d64285f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241690, "uuid": "546760bb-858e-4306-b6b8-cf31b1615aa9", "comment": "Malware payload", "value": "46ae9472bd041ec657d9fb27648adc4cde4eb959c124f1d8fc4a0a815b173ec4be7cf44e59aa3d3aee9481fcfd3f9115", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241690, "uuid": "b1b6663a-f004-4101-b09d-7cffd40d26f9", "value": "T15DC49C127AF0C07AC69742314D57C34A72E2ADA08F3646D337E12B0D7E745D6AF3A25A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241690, "uuid": "bf711118-5e53-4315-9ee1-36a831772bb2", "value": "6144:oPo91aYlvZbKjJnMuw+xn2P5JqOrviGhZctucMXDRQj6bLWiHao/uHGd23+QWm:ogKYO9bnE5VhiucMTCj63HHaoQGYzd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686241690, "uuid": "366cb021-e356-438b-9153-54b38c128980", "value": 545792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686241690, "uuid": "504a5aee-7ba7-4acc-99f9-93a6d3b38542", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241690, "uuid": "87e540e6-3ee9-4351-a8c0-313fe0fa7629", "value": "SecuriteInfo.com.W32.A-62389890.Eldorado.10151.17605", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9286c2dc-05d3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686211674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686211674, "uuid": "0a8a848e-e4b3-4621-98c9-82f30e4ac89d", "comment": "Malware payload (Formbook)", "value": "f94ab334453121d31cfe16bef56d42b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686211674, "uuid": "a9656be9-58af-4612-bb6a-b237cb49b968", "comment": "Malware payload (Formbook)", "value": "19b7214fa574ae296ae0494841dbd55d213c422c8872867e1be8969bb6d0e812", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686211674, "uuid": "1ab0471a-6619-40f1-b965-6851ed859138", "comment": "Malware payload (Formbook)", "value": "1d130afff77c70c5f9e87e3e5b10b437c3d04af0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686211674, "uuid": "9d069efe-bd51-4a85-8b54-ec38235f7479", "comment": "Malware payload (Formbook)", "value": "56ff2c8ad68fe079e6c1f15ad961469ec95fa29c921746714e54ec19a25151854c080ff6b20b5f1af3a2f53ae42a2ac0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686211674, "uuid": "d08e9696-f5d4-4761-9ba6-19b7666a1c84", "value": "T14BE4023832AC6E6BD2BC05F800D175C56BF32656FE51E2C84DCEA4EA15D6BC1874268F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686211674, "uuid": "36f9849d-c6ff-4ef4-b3e5-3ca662a6f7a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686211674, "uuid": "d30b99b3-31c6-4193-acb3-e8404f9759a8", "value": "12288:Jg4eMQbFEMe9k6qh9Xxd9CZ/Oawzet4Yx4TV+Au9Udq1BZa/FkAgsN:JgJ4y60deOlzeaDTSmdWukAgo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686211674, "uuid": "841c9dc1-91a1-4622-86cb-3dcfb8308e35", "value": 707584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686211674, "uuid": "b9b704c6-477f-428b-80e6-47e9827fff3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686211674, "uuid": "68f32ab8-77df-4a13-ba34-a975cccc35fd", "value": "PI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71112b2b-05ef-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686223644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686223644, "uuid": "f3c75c0f-72e8-48f1-8ad2-7f911424b2fb", "comment": "Malware payload (Formbook)", "value": "a54e950edb4ad0b060297c5aee544cef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686223644, "uuid": "8e11b25f-1b48-4c2d-bc4a-9a5de537268d", "comment": "Malware payload (Formbook)", "value": "1a392a2f97faa5ba1a5c1802dc5cb1308566590322f42d9369a47bbf519ae030", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686223644, "uuid": "43d7e306-07ab-4263-b06a-0e97444fbe67", "comment": "Malware payload (Formbook)", "value": "a7a1e5c16721702eeea6040c48c8f46e2acd8801", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686223644, "uuid": "1b91f62e-5bda-470b-a9c6-f22f47b75f77", "comment": "Malware payload (Formbook)", "value": "601669f1428d14355c91b3a4a58a695d1c2ee587a7c1453edeeb15ea98bed2ed2d06a2a2ed71e491d28324d0231b0a56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686223644, "uuid": "d1e28ca9-9e9f-4d80-8c47-26536decf7ec", "value": "T1A1F4F17932D31E12D78BF7FF88913AB413B63A163463E3191AC423D99E52BC59411B8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686223644, "uuid": "37619873-7295-4c38-a501-5f9891b67640", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686223644, "uuid": "ac77dc72-a904-44c2-ae91-cb5b0ee57264", "value": "12288:wq7z5GoJiGaq5auX/pfN6FOzBFSophhUEIW5ixZL922:P5GoR5aQ/pfN64BFSIXuog92", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686223644, "uuid": "752c9bdc-cb27-427d-aad5-0a82e76d2c72", "value": 776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686223644, "uuid": "84379396-3571-461e-abc5-dc5bc289c236", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686223644, "uuid": "896f7fbe-f5d0-41af-9b70-2f43a2fd3382", "value": "1a392a2f97faa5ba1a5c1802dc5cb1308566590322f42d9369a47bbf519ae030", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3957b6e2-05d6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686212813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686212813, "uuid": "9d96a471-c723-4182-b91f-4f3b083fc7af", "comment": "Malware payload (RedLineStealer)", "value": "716e4fa9812f497190762ebaa64f8b79", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686212813, "uuid": "5a5898b1-8c50-47d4-ac64-84ec1c7fd242", "comment": "Malware payload (RedLineStealer)", "value": "1a6ebcbdbec2e51caa6b76b39a8608fde9ae766e8f937ac128a638763c4ad223", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686212813, "uuid": "667c3f98-08b1-4aed-9123-2e63590ff294", "comment": "Malware payload (RedLineStealer)", "value": "4a1701298aa4a139fd96b5549a4a248f1c05b158", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686212813, "uuid": "f8eccb08-0f14-440f-ac6d-20d5085ef4e0", "comment": "Malware payload (RedLineStealer)", "value": "70ae4e46dd43d3b6980db1c43fdcd88e1571a870e553f6c3e5a42ec9c383a6ab9dab15b9f18aeea437d097cc00d73040", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686212813, "uuid": "50883744-0337-4372-85c0-2dd00df12226", "value": "T112845B1392E17C54E53D4BB38F2EC6F8370DFA608E793B692219AE2F16B1172C163651", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686212813, "uuid": "687344fe-918d-4b24-ac5e-677432d438bb", "value": "af40ca862bb560756a6239b041d2950a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686212813, "uuid": "1d1fe2d3-b6ae-415d-8cf4-4d7231ff9ba0", "value": "6144:aldREcfxsqOblTxhUwjydPOTyZa9FMwog+rmJ:aXREqxsqcpxBi9hwog/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686212813, "uuid": "23347e97-dd87-42fb-8e03-6a7c93e62989", "value": 390656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686212813, "uuid": "9b1fd54d-7dfc-4422-b9e1-22cce75f6e96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686212813, "uuid": "9527a800-afa0-475b-a692-3548b7989c54", "value": "716e4fa9812f497190762ebaa64f8b79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bff6d29-0646-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686261082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686261082, "uuid": "03c91afb-bfb5-4483-b7ad-75744cc74fd9", "comment": "Malware payload (Mirai)", "value": "5ea597463771012e833dca5617d4b3c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686261082, "uuid": "e53f6686-731f-40eb-8ff1-da71ab4e0319", "comment": "Malware payload (Mirai)", "value": "1acda35e098b4579ea0056cce9ca6a085186ce0bf978dc439d5060c91b33dd66", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686261082, "uuid": "1110c4c5-98cf-4b1a-9ced-0048ba26158e", "comment": "Malware payload (Mirai)", "value": "e9387bf0776e683c4dd5dba8c6193b076929591e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686261082, "uuid": "48b6f530-ac5e-4a9a-96ec-04da20ff9438", "comment": "Malware payload (Mirai)", "value": "a9bbc21229fcd50f0bc06d545d12d60c9709a6e38a69167c183240f545b23e2668082391b653dfe0ed11f1c5703f833c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686261082, "uuid": "97200bf2-81b5-467a-bc8c-10498a377d21", "value": "T17D539E63C4641DA4C1544AB0B9288FB61763E60087637FF5426ACBA99057EFCF60A3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686261082, "uuid": "8cb1c029-446e-4bf7-b851-ed15f1e6cf80", "value": "1536:oagv1AOp/umClcqse4yYGsYh4iSijKmR7GrxhCKkdV8:ox11KmqsrI4tiGm2xhKV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686261082, "uuid": "d6fcbfc6-219b-403a-a983-765bcc52f43c", "value": 62592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686261082, "uuid": "e3d7d2bd-59a2-42e3-8159-511f40bb5773", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686261082, "uuid": "c73d5002-5a76-4913-b038-ba9498e25a9b", "value": "5ea597463771012e833dca5617d4b3c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "037650a2-05a8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1686192966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192966, "uuid": "a2564f01-add4-48f2-81d8-3cad33dad192", "comment": "Malware payload (Fabookie)", "value": "4179238c49a009468a87403bc51a3d48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192966, "uuid": "9c9cfaa9-a844-4d4e-85f9-17b32b73914a", "comment": "Malware payload (Fabookie)", "value": "1adda3b870c28e6ae33226565b2f31ebfed65adf7a530a883404021104714746", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192966, "uuid": "23743fa0-a7b2-477c-a24d-c24824758f5f", "comment": "Malware payload (Fabookie)", "value": "4ba7cab7aafd77a37a2352abe7216e8f30c588a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192966, "uuid": "6dd5a0bc-e9a7-4048-8d38-f92689a89cbb", "comment": "Malware payload (Fabookie)", "value": "49f042b38a8d4aa55a480a3b1f0018f07dad1f2d9681976df85278a0b1c56f8eff83e9b4952caf968706a9bc41075a65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192966, "uuid": "a92c41b6-8a9b-4e48-92c3-4addf9f9c443", "value": "T1A026EF76ACAB84C2D0F334A9ECF5F81C17AE133C3D5AA9D06A3595CC61372962241D7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192966, "uuid": "824c8094-7ee8-4610-ad81-b5e3dd02d969", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192966, "uuid": "83622607-13a7-4bf4-a3e3-cf611f86254b", "value": "98304:295Xve/N7hR1j+Y5+5qBONF+Slju5IhZza8GzAZ2DIv9zMA4q3pGUOW3slcPcYJJ:+5XvOLl+Y5i4OuKjW4BJZVhMA4q3pGUP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686192966, "uuid": "5ceb6d0a-ee4a-4959-9a1b-f451d8ab20fb", "value": 4423680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686192966, "uuid": "c24ec5ec-9298-4995-8929-e83527a7e60b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192966, "uuid": "64b5b22f-ebe4-41a4-9cdc-b0c073665d4d", "value": "1adda3b870c28e6ae33226565b2f31ebfed65adf7a530.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84600c3a-0619-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686241715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241715, "uuid": "38a3c0f9-b93a-4979-995a-05a95fdeab49", "comment": "Malware payload", "value": "6d04b8bbd16cbac4e0a7a2af73010fb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241715, "uuid": "22359ba6-e010-4efa-80fc-33de09a0fc67", "comment": "Malware payload", "value": "1b3502ee01dc062c93fb6bc9424bd9accfd488bee939ed538428a94f37d1d74a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241715, "uuid": "0b42dc54-8660-4962-bc86-f1c923379fe1", "comment": "Malware payload", "value": "11d96a81bbf83e834381c7729cdfbc3796db0d18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241715, "uuid": "c53063e7-fa75-467c-a680-ed391bafa851", "comment": "Malware payload", "value": "b6c491fbf0ff71525963827d11948839ebec2826c9f06c4a8a4c4fe2fc957bc22adf8121b105e4885cdd464d658ecab4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241715, "uuid": "1357816f-28e2-43f9-ae09-8bc830edae3b", "value": "T15E747D5773A144F0C4A841B0986B5A64EF773D20203581E79FB0AE3F9E75790E62AE37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241715, "uuid": "1838ae40-4923-402f-a77e-f8fef73c2813", "value": "bafcab10f55cf781a90c00a3e38433b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241715, "uuid": "df8afad0-2e45-4707-99cb-c9886f3a0374", "value": "6144:cnLIDAOGf/PzbKVZIU9YcXd82tRUnXzCm:cnLcsiMU3tbih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686241715, "uuid": "04a9ba58-58cb-4af0-8ec0-564c78cb25ce", "value": 348164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686241715, "uuid": "2dd49251-ad43-4e68-8dae-a91fee5c8f6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241715, "uuid": "b98e62c6-65a5-4107-80c5-83d12af43023", "value": "SecuriteInfo.com.BScope.Trojan.Wacatac.17556.3755", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2441d634-05e8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686220509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220509, "uuid": "b840f4f5-a42f-4c5c-b8a3-08bce23904a6", "comment": "Malware payload (Formbook)", "value": "d489e340ca48de2c8f2f2cd28f72e475", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220509, "uuid": "242b050e-9dd7-4dfe-9af7-5cf598108c4d", "comment": "Malware payload (Formbook)", "value": "1b5b6ed04e3ec262fea67243125ed91802898631a6552b6c3c37464c2861f5d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220509, "uuid": "46e058d1-32d0-4b04-a427-42acbaad7377", "comment": "Malware payload (Formbook)", "value": "f04fc3257d5f72cb41bc86350dfb3ed6b17234b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220509, "uuid": "b72693e8-18d6-433f-9b34-644068558a7c", "comment": "Malware payload (Formbook)", "value": "09696cd96748da4d7302988efee9e659b4e5acd993eb0052566a6d3e6e6e896527eefa0e05063d25232536ae0e4591d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220509, "uuid": "f4ac51c0-ec39-425d-814a-ab07ff413e14", "value": "T10205AE780666C60BE42B1B38D8E2E3B13BAD9DD092C2C74B4AE47CFFB556165B7910C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220509, "uuid": "e54266eb-56f4-4008-9318-e464fb78f0e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220509, "uuid": "1c3db5e9-1a9b-4b5a-8879-075f8d185f27", "value": "12288:YWGYJoLQVBrXu4ve0eLwimR1VI/dXVL+XRsE:6LQf7ve0JimqyX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686220509, "uuid": "35e7114c-b7c4-4664-8bf0-31cdcdc77bfd", "value": 872448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686220509, "uuid": "409a2c42-754c-4206-a9f2-a69111014b65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220509, "uuid": "8d321003-c681-4597-b368-f3019edfa50b", "value": "1b5b6ed04e3ec262fea67243125ed91802898631a6552b6c3c37464c2861f5d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c08c63fc-05a6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686192424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192424, "uuid": "e1d7c4d5-a250-491c-b7c5-9c73ad52b202", "comment": "Malware payload (RedLineStealer)", "value": "935b8cea5617dd019a2006794a16a1bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192424, "uuid": "e8e70d17-92f6-44c1-9f8e-8dc94c404093", "comment": "Malware payload (RedLineStealer)", "value": "1c33355ac4a1b6790138cdcfacf3460d1605b908e614faf63df2bb065a253c7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192424, "uuid": "6603e813-0a9b-4753-8162-91bc4c0c6d46", "comment": "Malware payload (RedLineStealer)", "value": "4865ba9e58c96ae74df73f51b2c19cfa987f4aaa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192424, "uuid": "61e40bd9-7178-49d2-838b-e147d237180b", "comment": "Malware payload (RedLineStealer)", "value": "9f84de25e30bda1d26f6dff78d0125bb1635a93412a8f8428f26247f07d663230bd8f9f8d3849cad340ce22b002efb00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192424, "uuid": "751323fd-371c-4e82-b120-bb903a975dfa", "value": "T1EDF41223A6DC94BAE6B4177058F6139307357CE68C34C1AB2741AE6B0CF26D0993977B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192424, "uuid": "8cb40d0c-b23e-48bf-950d-1c53fd1a7f19", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192424, "uuid": "7e909d41-7b98-4b3e-b8e8-7b262de9c8a2", "value": "12288:3MrFy90DLo0Z4XIEkTziI0d8wf2ioKTxYOE9XUMyjbjwb7OL76YBmKpU:qyqLv4Xm70VTxYOE9XUMyjbq763mEU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686192424, "uuid": "57909180-7c1a-48ef-bf14-1d1b10db04c1", "value": 771072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686192424, "uuid": "4ea4b17c-a181-4f30-a4d9-925c7fee3778", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192424, "uuid": "6eebad49-c438-4d32-a6be-92386e912f5e", "value": "935b8cea5617dd019a2006794a16a1bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84ed63be-05e9-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686221101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686221101, "uuid": "5584bd3d-ff21-4904-b4c6-cb06a136764d", "comment": "Malware payload", "value": "827d507aa3bde0ef903ca5dec60cdec8", "object_relation": "md5", "Tag": [ { "name": "Barracuda", "colour": "#416918", "exportable": true, "hide_tag": false }, { "name": "CVE-2023-2868", "colour": "#BC6F6C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "ESG", "colour": "#5A58DE", "exportable": true, "hide_tag": false }, { "name": "SALTWATER", "colour": "#A6BF98", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686221101, "uuid": "f65cbade-4b96-42cb-9bee-4de857914051", "comment": "Malware payload", "value": "1c6cad0ed66cf8fd438974e1eac0bc6dd9119f84892930cb71cb56a5e985f0a4", "object_relation": "sha256", "Tag": [ { "name": "Barracuda", "colour": "#416918", "exportable": true, "hide_tag": false }, { "name": "CVE-2023-2868", "colour": "#BC6F6C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "ESG", "colour": "#5A58DE", "exportable": true, "hide_tag": false }, { "name": "SALTWATER", "colour": "#A6BF98", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686221101, "uuid": "e6c6b01f-aa52-4270-9684-fe32060094d5", "comment": "Malware payload", "value": "10b621c5e07648bd7a7391e569aa62a510be82f4", "object_relation": "sha1", "Tag": [ { "name": "Barracuda", "colour": "#416918", "exportable": true, "hide_tag": false }, { "name": "CVE-2023-2868", "colour": "#BC6F6C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "ESG", "colour": "#5A58DE", "exportable": true, "hide_tag": false }, { "name": "SALTWATER", "colour": "#A6BF98", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686221101, "uuid": "9839370c-4043-4051-9dc9-52cac383565d", "comment": "Malware payload", "value": "c964caa7640a23b306327fc21ee5e591a30f6413899130e282b3356e0acfa05c336c9ddd63c9d40d47b9582faebe1418", "object_relation": "sha3-384", "Tag": [ { "name": "Barracuda", "colour": "#416918", "exportable": true, "hide_tag": false }, { "name": "CVE-2023-2868", "colour": "#BC6F6C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "ESG", "colour": "#5A58DE", "exportable": true, "hide_tag": false }, { "name": "SALTWATER", "colour": "#A6BF98", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686221101, "uuid": "46ea27a7-5f19-4cc2-8b9e-901e4f043d7f", "value": "T118952906EE8744F6F9AB1A3090E3F32F772DAE068525DF85C50C1C81DCE3A4E561A6D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686221101, "uuid": "147f2a9c-8f43-43a8-9afc-96a608e9538b", "value": "49152:L2bA45ujJtIxon+zl7cqi0pV0U4TUMer/5r:L2bA45ujJbSrpr/5r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686221101, "uuid": "798505d9-e59c-43e4-9b6b-fc99228e4eb5", "value": 1879643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686221101, "uuid": "d56d6b39-7c50-47ba-9c41-1be91496c9f4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686221101, "uuid": "043bee45-6275-4c57-9944-de6bb6a5dd90", "value": "ssl.so_orig_see_https:::twitter.com:cyb3rops:status:1666726658806521857_for_details", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c2b23c6-05c9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686207315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207315, "uuid": "2bd76d17-7908-461d-ac92-2363f6f6098c", "comment": "Malware payload (Mirai)", "value": "5ab58217c6e1b5c07a836356274cee87", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207315, "uuid": "ca0fe311-204d-47d8-881e-d9e06c2bc130", "comment": "Malware payload (Mirai)", "value": "1cc02a536d682bc8bdfa240aa0b6d1566200777db13a04f1b190cf40e3da3082", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207315, "uuid": "605e462e-8ccb-4c54-80e6-36c12574ae6c", "comment": "Malware payload (Mirai)", "value": "cb1e928c931c080c562c98eb653c213c26eb8492", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207315, "uuid": "c4a95558-4994-4e1b-a355-9ff9e447e0eb", "comment": "Malware payload (Mirai)", "value": "b1259fade4f8c071f83ee9ea6f00fe94e6310438e8d36fc7a49f16bb9ddf64d9ba68c11c625eac360678f1e8f86125ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207315, "uuid": "f74dd542-8b91-423b-ae8b-45503ef88b50", "value": "T1D183C71E6E21CFACFBAC833447F78A21A758379522E1D285E15CEA015F6034D641FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207315, "uuid": "0b3bcd2c-6c8d-4972-a46c-26d3a5d4c511", "value": "1536:0DIJKLbYLyA5YDzfh4iXWA+nPjBumegtHKvImhveVOHQ:0UWbAyJd4zFlvqvImh3HQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686207315, "uuid": "5c2ac133-4c7d-4bda-8aba-437fb1b234df", "value": 88676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686207315, "uuid": "8a93f7b6-aad4-4f8e-ae53-52092d02e26e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207315, "uuid": "dfdbbd4c-d597-4d43-811c-82bd7051bd40", "value": "5ab58217c6e1b5c07a836356274cee87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "318c4e01-05f7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686226974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226974, "uuid": "d1a1bcab-e996-4e25-b480-3e1a935f76de", "comment": "Malware payload (Formbook)", "value": "0e605329b065ce357050e0b5c90f43b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226974, "uuid": "c2ec81fb-6b69-4815-845d-109ce11c43f7", "comment": "Malware payload (Formbook)", "value": "1cdde22ebe2251b7dc0678e7a6a7911384565312929a39976a46154272bfb075", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226974, "uuid": "ac525631-8a62-4806-932c-23ce140d7268", "comment": "Malware payload (Formbook)", "value": "9df54a23591f7f71575f5b1183ba1fb369d0bb5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226974, "uuid": "f8269d21-8eac-4b5d-9438-72417ca155d0", "comment": "Malware payload (Formbook)", "value": "f8954fdd01e489d9606c04f7804a00f388521932d2a092b30f289c900e0a150257be7cbdc4d6a63cc16b04d5bcb1ea89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226974, "uuid": "669ea9ce-fa28-4ec7-a385-01471baa2de6", "value": "T13F05F151B5BB0F2AC5BA43F1850462345BBE5AACB972E31B4ECBF4D62661F0149C0B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226974, "uuid": "b0c15841-e9b7-426c-8411-36b4c1acf32e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226974, "uuid": "0ac62819-8a6c-4c85-b49b-07e83f4f77fc", "value": "12288:lG2B0xTGlxNqvNu2hZ+nUEsn9nyy/aOaCB12e8EHuPuNSUzk+XkiUVuMPSVvjUdB:lGLaVUH999nyyn5H8WuLiUIHg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686226974, "uuid": "063745b7-618a-4215-9109-3f73273ff2cc", "value": 797696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686226974, "uuid": "f682b089-c12c-4785-82ac-c7f31106f52b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226974, "uuid": "e6bd44c2-71da-47c8-932b-628606acc71e", "value": "1cdde22ebe2251b7dc0678e7a6a7911384565312929a39976a46154272bfb075", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4daa843-05dc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686215678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686215678, "uuid": "d7881492-3d62-48d3-be95-4ab69b584c5f", "comment": "Malware payload (Formbook)", "value": "e3c28f839ac6e19f1512e10394d213f9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686215678, "uuid": "d3fd6f0f-51b8-473c-94bd-072936c7103e", "comment": "Malware payload (Formbook)", "value": "1d5bb553d60ae8991ac063133535b4e3b9d858e0235a8d48c9c27cc8c52b663b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686215678, "uuid": "5a2f38e0-fe4e-44f8-84e5-ce8d2947f111", "comment": "Malware payload (Formbook)", "value": "a176e4d5a13a038a209005fe185945c847c3f1d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686215678, "uuid": "68ab4d9c-639f-4870-885d-08b00cba48f8", "comment": "Malware payload (Formbook)", "value": "b5e1ba7a87e8d9437953d1ac4fb1989b51f5c248bf27dd4be76464785985c87dd6dec3ba5e89f6917d612bae93883bdf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686215678, "uuid": "49871586-ceaa-4e9e-9274-5c51a3badb5b", "value": "T12F5523927991CAC6E40906F12EF3C66661397C601D9BB243B6CEB7BFD672446CC085CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686215678, "uuid": "5fbe4e28-d61a-44dc-9bc7-cf39dab1ea5c", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686215678, "uuid": "ad1d0954-b536-4abb-b104-231942e7a292", "value": "24576:BPwRKrZYLB3cE6G3VibpHIdebodR6jlKFtQVUv+iP8o79bO+I:BCK1YIG32poHRS2tQuWikK9jI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686215678, "uuid": "1f37d70c-8850-4ce0-858b-4f7721060b3a", "value": 1296928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686215678, "uuid": "2bfc4fd8-c40e-4272-b13f-9bc1d9a1a790", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686215678, "uuid": "7965dfec-8ef6-47c7-96d3-c9057ca38817", "value": "e3c28f839ac6e19f1512e10394d213f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e69ac38-0646-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686261087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686261087, "uuid": "30668e7f-cb08-4f34-a24e-b9711313aba6", "comment": "Malware payload (Mirai)", "value": "2ef9bdad18708c68ed96bb939a11e791", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686261087, "uuid": "9076dbb2-53a6-4f0f-bbd1-34f5f4f0dbe1", "comment": "Malware payload (Mirai)", "value": "1e83e76c17d0268b970cdf3754d3360b451489b6dcae26c2f9daf35a8837b969", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686261087, "uuid": "11802421-8480-4443-875f-9a1c77252749", "comment": "Malware payload (Mirai)", "value": "05926a459e049769f10d45938561d213264c0799", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686261087, "uuid": "743332e4-9f3d-4b5d-800a-189596ab006c", "comment": "Malware payload (Mirai)", "value": "2c026e8d34bafffef94b3f57bc4938f2528c095cace36a25c98820a26b9e3ee8df270def44b153a6ef95f10b7995a970", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686261087, "uuid": "77f5c14a-efb0-4a62-b052-49dd0d02aab0", "value": "T154232996BC91DA0ACAD023B6BD6F64EE330163DAC2DE3247DC145F243ACA90F0D67645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686261087, "uuid": "9204f77e-7812-46ce-9a34-042599554e77", "value": "768:1TOD91Ug/ghNHSSxyhI7QgHZqx4F+ErnZJffui9VU5SpwpYWaBES53VeeB16Y03y:wKgYjHSS0ucxUrn7baSpwq/ueqZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686261087, "uuid": "14bff286-39d9-436f-9eff-637a28e1fcbb", "value": 48260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686261087, "uuid": "84f39ff7-ac2f-42b3-9d89-08268b2ff8ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686261087, "uuid": "a3628e3f-47bf-44eb-b4c6-5e8bfee3553b", "value": "2ef9bdad18708c68ed96bb939a11e791", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95700ae4-061e-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686243892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686243892, "uuid": "58ea942b-08ff-4efc-97cf-b2c242110938", "comment": "Malware payload", "value": "76aba677b9ce27bb4f85679c7cf8cbf8", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686243892, "uuid": "716b3cf2-b396-4132-a4c8-594166fb62b6", "comment": "Malware payload", "value": "1f615d78b355710026465136efbc424c3ce9d3726acb7f0a6be2fcfdf755d13e", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686243892, "uuid": "89e13385-6359-49a6-824f-010355ea6208", "comment": "Malware payload", "value": "4df3295e5bb241fbc6557375f524892e1f5ec71e", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686243892, "uuid": "3e6ab34b-2f9f-4a21-a628-61e497163823", "comment": "Malware payload", "value": "297d8a6bea0c29fe26526ed5277cc85a51da5352d03679082356da25f87b8207f67109eb8e052e9ae0fd980e85cbc37d", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686243892, "uuid": "3f31bc4b-867a-4100-b03d-b00492a4fb53", "value": "T1D1235D0136684A52C6BD137515F24280A3BD6B77BB1AC34E2DC710EAAAF33974705BB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686243892, "uuid": "b11494d5-fd4c-43a3-a43c-882bef11525a", "value": "768:/b72nSvdubXpdtpnii/ZXA1IaxoGceVt3+Y4X7hd8ay0CE5qb4raflIOa:NFuLpViiBw1IurTC7hqareflIOa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686243892, "uuid": "1a1a9687-f684-44cb-9b3f-1e48a3447a32", "value": 45568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686243892, "uuid": "a82bfd67-d064-4a27-91b4-4eda7af1b7ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686243892, "uuid": "62be2dc5-80bb-4010-beb1-cf0b36a35875", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5719ec8-05fa-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686228483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686228483, "uuid": "febfc2fa-55b3-4677-a98b-197b96005e37", "comment": "Malware payload (AgentTesla)", "value": "3e228a5e2511f4337cb453da1f7aa029", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686228483, "uuid": "787f807b-6854-42c3-88f5-003d605705c7", "comment": "Malware payload (AgentTesla)", "value": "1f9d1b268f67bc64c145ba149a9b0ecbce8e08d3d8149732b77022278089f97d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686228483, "uuid": "2c9b329f-2021-4589-a4b8-dfb44004f978", "comment": "Malware payload (AgentTesla)", "value": "8f15b8016c6c11f01d5e256561d9a95807800195", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686228483, "uuid": "de51a36b-6967-4503-8d6d-d097f861bfdd", "comment": "Malware payload (AgentTesla)", "value": "68b973b2e3e8b6c2f96e13052e0c7216e8de19545e97e313e313c644e119ef49f6fb727ca5c9e191d63adb8af6a1cb09", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686228483, "uuid": "15a1c289-cba2-43b2-881e-9937ae131327", "value": "T1B105128E33675272FB3902B207A6A66246E47FF95560E5DBBF05279F4C413422A313CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686228483, "uuid": "24bac7e2-d6be-4da7-a139-174a3ce9f106", "value": "12288:UsFbsfI8Z1gMFVobi/WS/DTOTH1D/4OP5s1C7H06uwx1Rfv2Nl58PXOdOgd:U0bsfI6dFqbI7s1DrP5q6uwlnG3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686228483, "uuid": "754972c0-31b2-47e6-b182-c7808f487c70", "value": 838656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686228483, "uuid": "b54392ff-5f6e-4a60-8c82-1ed2b645f9a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686228483, "uuid": "e89e7c04-13f2-4322-8492-7e0528bccdb2", "value": "1f9d1b268f67bc64c145ba149a9b0ecbce8e08d3d8149732b77022278089f97d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40afe6e4-05de-11ee-b3cf-42010a9c0076", "comment": "Malware payload (NanoCore)", "timestamp": 1686216262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686216262, "uuid": "782cdc63-4c4f-4e8e-921d-e5c9c9dd1fd5", "comment": "Malware payload (NanoCore)", "value": "01beaefb0f56383b0c2906619fc03f19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686216262, "uuid": "6c6661c6-73b3-4842-b657-dd3211ab4f07", "comment": "Malware payload (NanoCore)", "value": "1fdf23401a81a5b558b87e91316f8104167fa88d6a849a17d1dc4f372582ef6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686216262, "uuid": "5199748a-f6ae-4f03-ac28-d3eda374c69a", "comment": "Malware payload (NanoCore)", "value": "a1d497953866f1dbd3ba0693343b65fa953698ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686216262, "uuid": "2c2f8673-790f-4064-89bc-7835d0353777", "comment": "Malware payload (NanoCore)", "value": "e927c1250fcf915e16b6976bf7ab8ac8b54d3a71a210ea422512c582b43aedf5dc7d380dc73f9a7f7b00de9c5c6de4d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686216262, "uuid": "e0886180-dc44-4d1d-a8c4-536f87e09f8e", "value": "T1BA64C09C765032EFD85BD8729EA86CB4EB64747B530F5203A02705ADEA0D897DF180F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686216262, "uuid": "4114ccdb-dc80-4074-984c-1f18be3bea9f", "value": "6144:xAcg/1XlGfcRTYFDtKUbVS4fi2na52fnoBAyc5edsb1Om:Scg/GEV4KySaa5VBF6edsb1Om", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686216262, "uuid": "f76b4106-97da-4fa5-b742-1d9a7dae4f4f", "value": 313856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686216262, "uuid": "b7bd0318-c99b-4ea6-be6b-367493d8e4fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686216262, "uuid": "2366f686-fd14-4018-985f-6926c3fcb0dc", "value": "Nano.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38bea89f-0600-11ee-b3cf-42010a9c0076", "comment": "Malware payload (NetSupport)", "timestamp": 1686230851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230851, "uuid": "45ad7810-bd86-43ba-8fd5-c9a76a086afc", "comment": "Malware payload (NetSupport)", "value": "32264c51e5ab7710d3012bb702bd53fa", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230851, "uuid": "e0aa6ab4-f6c4-4cc2-a443-19f0dfddfcba", "comment": "Malware payload (NetSupport)", "value": "206e63a1db77fb92aa5292e8c3dd0bac5f50e9203829e2d01e7f0d07305a377e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230851, "uuid": "cac07711-18fd-49a5-9ad8-6f9c4870d3f5", "comment": "Malware payload (NetSupport)", "value": "fc8f3ab80244e221a406fe4dbd25525273c33a6b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230851, "uuid": "74f365b5-9c9e-436d-a9b1-66886c83542b", "comment": "Malware payload (NetSupport)", "value": "ce5d62acdca4186b1acf24d05d50c906a0e7fac436c30fa82ad87b76ddfcf359f569c03db6354a1bfddf4266650ceed7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686230851, "uuid": "e3e50819-6c75-4cd0-929a-5e0d6db7563d", "value": "T1D6239424A2D07C44139B6BA7F72BF5E1FC9F0EB93460498BD410BCA06E69705E6D0B72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686230851, "uuid": "60a4aacf-839b-4465-b8cd-9309f4426c3e", "value": "768:nG8kNNpAqcUAOJcNAuf4TzRCGeUgOBHOvjWgrIBg5g63f9nU9MlG6RyTZ4kP1gZJ:nG82FNaLP/us3+5iy23og", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686230851, "uuid": "4aaf9113-8b04-410f-b815-228062f1d675", "value": 48149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686230851, "uuid": "888b65a9-aa66-4624-9a51-f32509413c77", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686230851, "uuid": "f66f6372-5ecb-46fd-8437-60c5e1eab249", "value": "148428995.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aef4a99-05f5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686226265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226265, "uuid": "a506b41e-5e4d-4471-b33b-791a3005b568", "comment": "Malware payload (Amadey)", "value": "0af7bd1ea79fd55e3ea97d54e770865d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226265, "uuid": "b36252de-729f-42f6-8434-08f9ff810d21", "comment": "Malware payload (Amadey)", "value": "20e03ee3b7aeb3ec2ec2ae90de34ebbe1a3479a1b9b3d9351512d03c07dd7cda", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226265, "uuid": "947d6736-4f59-48e6-972b-0a33e1c4f081", "comment": "Malware payload (Amadey)", "value": "009666d83453b46950625cf07e54c0974f357fcf", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226265, "uuid": "c14cc2e1-009d-4fbb-a259-3c0195e3e41f", "comment": "Malware payload (Amadey)", "value": "169163ecbbf108c73c5da9dc84ce0dad8c79951773b907e5db98e1c8de52d43c76ca3f408753ac54ff058c56f1380a7b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226265, "uuid": "8ee489e6-99fd-46cc-b471-466cf272dcf3", "value": "T161F42312E6DCC536EAB517F019F742431A35BDA15C7883BA37C1A94E2CB3B94853632B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226265, "uuid": "9a5a85ac-2003-470e-bd60-85d6747a6218", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226265, "uuid": "c90d9e2e-c04a-4238-b8c2-cdf49366325a", "value": "12288:5MrOy90rnXjXEJ/bJ+10XcB5gwtoGQ7F7NhddmiXXciye1Aa4ONLD8Sy:Ly8jXEJ/F+ecB5Y5NhdYi2XBORD8r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686226265, "uuid": "158d720d-b406-4bb9-b7b2-5e64158cce40", "value": 791040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686226265, "uuid": "cf7c8386-1c91-46a1-b412-d8a44944a171", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226265, "uuid": "5c619ff4-250f-40db-a184-15ffae85ee5e", "value": "0af7bd1ea79fd55e3ea97d54e770865d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ba70bce-05d7-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686213274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686213274, "uuid": "3fd082b9-323a-49ad-984c-4001a64c3e39", "comment": "Malware payload", "value": "02fb52f225868b3cfbd27b3753be9697", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686213274, "uuid": "9e4c2e48-4518-4711-818f-50c3da25e149", "comment": "Malware payload", "value": "20e7a2ae1a6b3c9d46b90cf9d571920becc355aa2bc40bbf34bfff7291a97b54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686213274, "uuid": "7c81bf0e-6e05-4782-a8f0-9e164e88ce3c", "comment": "Malware payload", "value": "0a14d5566fed65010a90aaf5ab13d21bf6900538", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686213274, "uuid": "ad4e8afa-21c0-4fec-addb-de5e09956c84", "comment": "Malware payload", "value": "f525c50b66d9839e5802b2030096c7fbddf75c2da80aa1465aaf5c7feaa258d292d5d5b6a6ef3bd45259513b1713ad9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686213274, "uuid": "68d7fc0f-c2e3-4318-9950-707463680f1c", "value": "T196351201BBC194B2D06128324A766B117D3DBD201F64CEDFA3D46B6E9A325C1DB31B7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686213274, "uuid": "16ecd0fe-35d2-4cd4-bb3a-d9079d6f1f0b", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686213274, "uuid": "116573b7-14b1-493c-96ff-ac7fac9eb106", "value": "24576:dTbBv5rUDkeIayutZfb8ZcN523fBnX7SWXMdAfRd/b:3B9vgZIyNk3RXPMUlb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686213274, "uuid": "22bf87ea-79b7-4dd6-9352-e3a743c52006", "value": 1111293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686213274, "uuid": "f48caf1f-e470-433c-ae10-11e64e51c0e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686213274, "uuid": "64b57a8c-6fda-4f9b-bb60-4bbaea287913", "value": "ORDER__Q.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34934c8a-05b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (NetSupport)", "timestamp": 1686199920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686199920, "uuid": "531e0de0-ee8e-4c8a-be35-87d635582730", "comment": "Malware payload (NetSupport)", "value": "89c9bfd922985d94d16d7dffd233b302", "object_relation": "md5", "Tag": [ { "name": "balibumba1-com", "colour": "#191C23", "exportable": true, "hide_tag": false }, { "name": "balibumba2-com", "colour": "#638CE9", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686199920, "uuid": "0aaa1fbb-2317-4049-b4d7-29bfb227943e", "comment": "Malware payload (NetSupport)", "value": "214ea8c41cee117ac2f67a14f8ac3dfe42b13e908a755723eb2a097b20ad9391", "object_relation": "sha256", "Tag": [ { "name": "balibumba1-com", "colour": "#191C23", "exportable": true, "hide_tag": false }, { "name": "balibumba2-com", "colour": "#638CE9", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686199920, "uuid": "442ea726-b0c7-47f6-a5b1-6b7449226718", "comment": "Malware payload (NetSupport)", "value": "e2c594add7ff4f7b368a5bb582f42aca9eb460e7", "object_relation": "sha1", "Tag": [ { "name": "balibumba1-com", "colour": "#191C23", "exportable": true, "hide_tag": false }, { "name": "balibumba2-com", "colour": "#638CE9", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686199920, "uuid": "0ff4674f-aace-4dde-8480-6664c863ebfa", "comment": "Malware payload (NetSupport)", "value": "55775255155ca96e7b4701fbe2d68ce5d170a2783c7597ccf0cb1fc7cb7eb725a0f7d5647c691e9b252423f20e289607", "object_relation": "sha3-384", "Tag": [ { "name": "balibumba1-com", "colour": "#191C23", "exportable": true, "hide_tag": false }, { "name": "balibumba2-com", "colour": "#638CE9", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686199920, "uuid": "0d3c4bf8-47d0-4034-b171-925a96c17b38", "value": "T132B533262F8307B37027946AE1207F114008A73DB6BE797366263DA7787B771A345EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686199920, "uuid": "70486389-deff-45ac-898c-24ade7317603", "value": "49152:1Q6J3WM202p5GutgAJuIxyxWCIZnS85PWZ5FvcB+:e89i7JDmWjzP+U+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686199920, "uuid": "9d24509e-3f8e-4121-9411-777b12208ade", "value": 2277617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686199920, "uuid": "46baf2f6-1410-4ad7-a9be-1dfb69a1e772", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686199920, "uuid": "c3000272-8610-4097-87c9-a6e973c0bedb", "value": "64815cb077a16.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87bdb0a9-0619-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686241721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241721, "uuid": "26c9c4fe-5535-4b04-bc82-0c7b74346d37", "comment": "Malware payload", "value": "ac663823430a9bb4ac4e75fb03ddc0e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241721, "uuid": "ad492fac-4231-4ec5-8409-aef8c65ed98e", "comment": "Malware payload", "value": "220afdc07395514a4a517473cf3473cf1307ae597cfe924b0d05b0958f68852e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241721, "uuid": "e00057cf-cff6-4ca2-9e04-b67f1188a0f2", "comment": "Malware payload", "value": "d3a7c990e1006696c0c067b794b93613657cd2cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241721, "uuid": "8d1bfcdf-126d-4b46-ae06-9c565bf94bb6", "comment": "Malware payload", "value": "7b85b790bddbc8e2561cf77e3ccda00147677b753eba99c744c9bb34dbee989d6bbf0e8192641208f1e3346b27dcf5aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241721, "uuid": "55ba1c8d-8c59-4a35-8b18-3b9131616e9e", "value": "T1EEA46CE07741C461E85375FA843A95A7A5336E1E9E58144E2AB5BF0B3D72383CC2389F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241721, "uuid": "1e402ba8-c898-45e2-8100-1267cf234bc0", "value": "226e959f376c12d4fd7272da9253903b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241721, "uuid": "8ba82f17-5273-4fc5-a4db-070fb910b2e3", "value": "6144:Mo/Q3qHpO2qTIM3BOKECeTNYwLumaOVPDKAESk3jsnRatBofFi5nTEZYjzb:Mo/iqFW0KhSYAu4PDrojsnR67EZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686241721, "uuid": "49c1c280-fb41-4eab-b15f-99e71ce6007d", "value": 491520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686241721, "uuid": "489486fd-7f05-4ebd-80db-475dc714bc7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241721, "uuid": "f3f4d773-5b86-4a5a-939a-86fa0a6388aa", "value": "SecuriteInfo.com.Variant.Symmi.8933.7059.14767", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f544fa66-05e7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686220430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220430, "uuid": "8d4f7559-25a9-483d-8d50-c0385e9f3e4b", "comment": "Malware payload (AgentTesla)", "value": "c1abf14dab1c04a3a231ef602fe99190", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220430, "uuid": "6cca6bed-d877-4734-bf0c-ce1872dc7931", "comment": "Malware payload (AgentTesla)", "value": "225db11a76895f4acb6660a727f05ac9b2dadefadb1fb6ee505654b367c33b5f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220430, "uuid": "220b09a8-891a-4f27-ab31-78ab85997049", "comment": "Malware payload (AgentTesla)", "value": "776226207978c79aba2e339d66cee89209608146", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220430, "uuid": "93ae5a6f-292c-4d72-aa1d-c5f3c49f4222", "comment": "Malware payload (AgentTesla)", "value": "2cd1d5ae4e7931f32314d581908b9b4c8aa21789b0fb050a7c014d010372ebc477bd5bad43e51a67797e9378544ae6ad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220430, "uuid": "abb70d85-599c-4dee-affc-963f6907c96c", "value": "T1E9E4F03027D9CB0BD06A5275C1E0D3F067769D94B876C7974EC9BC9FF28A3B6225120A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220430, "uuid": "e8d82741-c1df-4256-b195-8be7294a7067", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220430, "uuid": "ad8a240f-e13a-4b0c-b033-a41680e1c53b", "value": "12288:w0gzebRQiuTsCh8V7CNfb5Pc5FSGa1P5kvqkn2j6:w09GsCCVeNf1Pc5Fw1Ba2u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686220430, "uuid": "0a66f3e7-3ab1-434e-b7b2-dd42bcd3408c", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686220430, "uuid": "c61b8210-7308-4fc8-be51-f11684ad5da0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220430, "uuid": "4a7bebe1-1e9d-4109-ba2d-5b5a4254147e", "value": "225db11a76895f4acb6660a727f05ac9b2dadefadb1fb6ee505654b367c33b5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6977da8c-0611-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686238234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686238234, "uuid": "d3a69bb9-7b3a-41b8-baab-a5e3162549c3", "comment": "Malware payload (Mirai)", "value": "380e01644b7bda8047cad6160e3b2fff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686238234, "uuid": "2e9600aa-21de-4ccd-850b-15996610b839", "comment": "Malware payload (Mirai)", "value": "2260fc22933692bdf8d35101ea37788335440dac416108d4f5afd56da0189880", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686238234, "uuid": "534a1db2-0d55-45fd-823a-4c947c417b9c", "comment": "Malware payload (Mirai)", "value": "350def99a868b1cfb7a25f3d3d2acc0f207944eb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686238234, "uuid": "39050afd-a89d-4eac-9ed2-88e3e8fd95bf", "comment": "Malware payload (Mirai)", "value": "2764dace616cbf1e28db1cab7fba933c8aab82e63b7ab602b323e53672839b5a737993955a00908be67d23d3c162231e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686238234, "uuid": "f1adcf34-f743-4f46-958c-ebf58033fada", "value": "T1B1E2E1064BE098F3D0E61D7257BD9102538D2E7DF48A30681A04A6792FB2D6BFD7E153", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686238234, "uuid": "088b322e-5d34-45f4-82b6-c0615fab130c", "value": "768:eK4pq3yYaILEwMaSjKQXa7JCXcrE6qqov90D3UoB:eq9LEw2GTl+cQPaX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686238234, "uuid": "b058741a-86e2-4fef-ad40-be649167a016", "value": 31292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686238234, "uuid": "6a579cb3-f369-41bf-a06c-c58fbabc69c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686238234, "uuid": "8ee52cb2-9eab-4f8d-8eef-8c619c56c93f", "value": "380e01644b7bda8047cad6160e3b2fff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35146ef1-05e2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686217960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686217960, "uuid": "b09d50fc-73ca-49e6-af3d-c6c5a10f38d4", "comment": "Malware payload (AgentTesla)", "value": "60cc4eb97d36b3e2ac7301608dd3a452", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686217960, "uuid": "6e4e9900-f4f7-416d-bb27-8a0418b2fb58", "comment": "Malware payload (AgentTesla)", "value": "228d7f101a604736db5019b9a13d7601003c76a7c55d67a4b1bb42a7c62ea9b3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686217960, "uuid": "a192b195-a06d-428d-bb50-d2e00e5fcc60", "comment": "Malware payload (AgentTesla)", "value": "744da8e744a6f8dbbab4c0cf35fd0a142ff19c88", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686217960, "uuid": "5d6c2f4f-3fbd-40fc-998a-584d2e2dac7f", "comment": "Malware payload (AgentTesla)", "value": "834eae0a694ed3ba44d4046882a2b783e8843fe7029e7e8846d4970f860c77ababb16acbaa5f9e75fea841b91af565e5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686217960, "uuid": "a8ecc5cd-b999-4f2d-9e01-db93fc7ebc2a", "value": "T1EDF4DF1426D7D61AC515C3FD84E1F2B053A6BD8B6073C64707C6BECBB685FE88A5028B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686217960, "uuid": "d32f2b52-3513-4136-adb3-47e2bb813b86", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686217960, "uuid": "90f30ef5-7aad-4624-af21-3924f8389646", "value": "12288:nMcYfQPHs82cU724eMgiQ/4VdHK4Ontsz5pLQOEVylMkHH:nbHPs83u2uXHK4OALQhVy+yH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686217960, "uuid": "f98b453e-d23a-438d-9671-d7bd97c77b1c", "value": 722944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686217960, "uuid": "4b42fa56-e5d0-414a-90b0-a021340ee1f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686217960, "uuid": "a17f74fa-4a60-4482-b02c-e828a2fc99f5", "value": "228d7f101a604736db5019b9a13d7601003c76a7c55d67a4b1bb42a7c62ea9b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8875656c-0619-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686241722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241722, "uuid": "463360d2-c4b2-4e97-a5b8-f7c8f657005d", "comment": "Malware payload", "value": "54c1352867be81a635fd63217b55a01f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241722, "uuid": "e597bfd4-1ef4-4c84-90d7-1f94d05233ed", "comment": "Malware payload", "value": "249a75ecba6b1709483623819976534621aafdee9b9bb0ee425df91a9af8fc63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241722, "uuid": "44228844-b1b8-498b-b581-31feaacdda35", "comment": "Malware payload", "value": "72f564a9144255a7b72fcbbfa4f245c37b6bc1c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241722, "uuid": "7957ef94-67df-4b04-ac83-92fb10913a90", "comment": "Malware payload", "value": "364faeda231276e5b5a6807942ff9e5dc76902c4b579ad922cd3e1f1f8caf22eb229303d6724ea0af9747288f2ed14ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241722, "uuid": "195c0e42-c98a-43f7-bfec-ec5710f608a6", "value": "T1E6034A0FA0B0EAC3E4DA937525560790B9A79D407234EFA7EC136C6DD2381F84E5456F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241722, "uuid": "a88d5551-8e70-4f08-8c8a-0cca2d76d5ea", "value": "768:/SwItGz+fasK+J6Ozoi527Hiw4jCujK99LWh1dxbE:E3J6Moi52rgjCuK99a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686241722, "uuid": "bdcb7643-065e-4224-b991-19e8a8ce95a3", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686241722, "uuid": "da31c965-3bcd-4b8a-8054-30c5ae1cc7bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241722, "uuid": "776a6d5b-1c7b-4c91-9635-da021a74f8fb", "value": "SecuriteInfo.com.Win32.Malware-gen.597.22438", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d411cb11-05f8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686227676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227676, "uuid": "b31f2b3c-cc76-4c42-96a7-7313f26deb05", "comment": "Malware payload (AgentTesla)", "value": "730489e23e0a9cc0258baf9cb01b8ab7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227676, "uuid": "cff35b39-9f38-4817-97d3-743f3e77d5ab", "comment": "Malware payload (AgentTesla)", "value": "24c833b34f54668f74ebc8f23d79777b766fcc52b7a4006f9b6936b56ef11a17", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227676, "uuid": "56b82c6f-82b2-485f-844d-0505f7559132", "comment": "Malware payload (AgentTesla)", "value": "3f9a60f6ff50ca148ddb2c50d520cb581d392bde", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227676, "uuid": "fe7c7cae-98ff-4a7f-ad28-b4f8ad82a190", "comment": "Malware payload (AgentTesla)", "value": "74072c0325353e83c515d2ac3dfd6b247ddb43ce81b2c6cead1fc4c8de26f6070a13ae59108bf1077fbdf2affaa3cafa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227676, "uuid": "943e8927-43ea-43e3-b359-3522acc72d16", "value": "T182E474388B75637A92BBE39447C6B49FB1905C36B2113BE5E491230D4931832FAC7E5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227676, "uuid": "50a7edb9-9d5a-4b62-99f5-605d116f392a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227676, "uuid": "839f71c2-5614-434d-b5ef-9904091e48da", "value": "6144:YzqZqMeyZKgM3WMnnQBxjM8gWlwTClhlZRKfqUwibo1CKxom6fgzf:uqaA7rBSSSErDKfqebuTAgT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686227676, "uuid": "51199b5f-e6f8-4d99-89da-51292547afa9", "value": 718336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686227676, "uuid": "7f1410c5-ead2-4edf-993a-7dac598d0fe5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227676, "uuid": "a984fc0b-1f20-4189-bd7b-560dac8284af", "value": "24c833b34f54668f74ebc8f23d79777b766fcc52b7a4006f9b6936b56ef11a17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55c98a5a-05c4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686205130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686205130, "uuid": "565e82c5-6f23-43d3-9278-ea1f5ae67ced", "comment": "Malware payload (Mirai)", "value": "355d985bb6178868561ce8cb237a1caf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686205130, "uuid": "18ce2cc9-1b78-4740-894b-b5ae0192c77e", "comment": "Malware payload (Mirai)", "value": "24f71d99db63e1694bae8326504f52b85b805951be60f6b70c24e5c8fc04ebcd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686205130, "uuid": "c79a8d3b-44a5-441d-a1d3-960a52ba4811", "comment": "Malware payload (Mirai)", "value": "422aed11ab38a8bfef2a592dbb4f3021865e7f3a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686205130, "uuid": "aa2456f0-f398-4df9-865a-3d06b05844cd", "comment": "Malware payload (Mirai)", "value": "37ba4e1f53bbdb296b9f6218129cc24aa8e91f4b71af557412643a0a9646f05940d3100052ca8f0da9620a2e997cd96e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686205130, "uuid": "2d544f7e-290c-4546-b8a7-5de590a9103c", "value": "T1F962CFA4E1209445E5F3E5721C7A0FBAE291613EA6EACD2E19556FC40C5F843F52078C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686205130, "uuid": "03e33dad-7c5c-4b96-8ded-8796684ad306", "value": "384:Hwv4ILZHzpu68inrnCAdXRlMUO/93EjsAa:Qlu6Vn7jdXRxoCsL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686205130, "uuid": "1b775dec-958d-49b1-b847-642aaddb8847", "value": 15196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686205130, "uuid": "62cca104-5ae0-49ce-903c-e5a5e8119d28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686205130, "uuid": "d7ba8841-bce9-4b1c-8da1-fd522efab97a", "value": "355d985bb6178868561ce8cb237a1caf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0cfece4-063e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686257789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686257789, "uuid": "8a8cfee6-37a6-4d25-bf33-0bfec29e04e4", "comment": "Malware payload (Mirai)", "value": "6037cdca34faf2216e9980313ecd2811", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686257789, "uuid": "0acb9306-a39f-4460-b80b-6fa3b7a4c1fd", "comment": "Malware payload (Mirai)", "value": "25214994f294e2e74b283caf78a12635a27dce92283f99492c8b59f2b1bd5b73", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686257789, "uuid": "9d6ed489-9314-4659-a645-f87a3c0f2261", "comment": "Malware payload (Mirai)", "value": "5fd503c0b1dd62513a6b976f8ee5531f19861f4c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686257789, "uuid": "0127c08d-e30b-4b87-9bf5-768978e9fb14", "comment": "Malware payload (Mirai)", "value": "c2801d23190d9aa11013e18f9001f02969a4c4f20dacfaf91b83148503c91bfcf430da2fc38f83025e817d53e6c8f411", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686257789, "uuid": "e9d0e7c8-35ba-48aa-ae88-6d8ed22d1893", "value": "T152536DC9E5C3E5F5EC110A71313BEF3286B7E67D2069DFA7D3986432AA11602D11639C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686257789, "uuid": "333c4534-9ec0-42f0-84d5-bd2efa9dd55e", "value": "1536:Z7qARubgzY/bEJyfRcpo80LDHhklv4JQC9DSW:NP+eY/bEJ9UXBk9AP9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686257789, "uuid": "976a7e8a-e7e5-4404-98fe-b49435a50773", "value": 62864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686257789, "uuid": "48acae62-4460-433b-a83f-47fc89ec62d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686257789, "uuid": "17c89c7a-8773-416b-9636-26afee7508f9", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d64ad0c2-05d6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686213077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686213077, "uuid": "b7903c5b-86c8-40dc-99fd-f3bf144c3dc2", "comment": "Malware payload (AgentTesla)", "value": "8dd995d2f2b30848b91e2398a83edc8f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686213077, "uuid": "74774ec3-4ecc-4aea-8e47-ed5be501af22", "comment": "Malware payload (AgentTesla)", "value": "256d95ed0250f85a144ac36fb6509eb6a09e8d3e83f88eef4b62a2b8343d3354", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686213077, "uuid": "51074a31-54c3-4e41-8d6a-73428d14733a", "comment": "Malware payload (AgentTesla)", "value": "f21ea5bf5a66be4d972dbf890b470416e50cd9e7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686213077, "uuid": "17432241-20f3-446c-a4a7-6d54417bb4f7", "comment": "Malware payload (AgentTesla)", "value": "ed29daa7c5361b114f08a7d1f87d5239fc9c8b59732af977a50abcd7619c15b618a3487ba86616e5447617322d6cd3b0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686213077, "uuid": "3dab571f-d854-4321-a042-96ffcc61c761", "value": "T116E4339546DF1C36AD4CC95E43938A7A18AA0CB359D398AF51DCF6CBB2874304C1FB26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686213077, "uuid": "f376333e-9878-4425-926a-6bc2aff8a752", "value": "12288:rS1yiMMkwQWbSIrHXVVBLg7h2YI+wITUdE9c6ZCUWbMb6e11rFdvMzXqgo7kiwL:21yi9/QHIr3VTk7hqAg+9c6kbOBLvMzh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686213077, "uuid": "30fd7758-81f8-44cc-ae4a-a9482c0d4287", "value": 691828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686213077, "uuid": "6b73e835-56fb-4ee3-a7c3-790d7746a530", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686213077, "uuid": "720e062d-77ef-4e01-b95f-6fbf49d51b95", "value": "Invoice.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd289d7d-05cf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686210082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686210082, "uuid": "ee3ed1b2-adde-47aa-ab23-0d1e1e1e555b", "comment": "Malware payload (Mirai)", "value": "50b4c3918e99cf44d713b185e1c3557c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686210082, "uuid": "15d6370b-5331-4c6b-a0c9-cac1c74b2a21", "comment": "Malware payload (Mirai)", "value": "2652eac8b95194eed0e5e49d07fee5898b155f0e6c7e11d734208b1b257a6912", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686210082, "uuid": "3598edfc-46b9-43bc-b14d-07157a507a3e", "comment": "Malware payload (Mirai)", "value": "fb048731ec890bfce25f5dea0f8d9eb2c7ee36dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686210082, "uuid": "4e42e5b6-80f7-48ed-b968-336ca03e7e2f", "comment": "Malware payload (Mirai)", "value": "fe866f411ad7c3c1615a9dd8f82a87074dea80a2ab5fd8c450e5d43e90bff3cbe33813c1d043afc4cffdccad7f96abb1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686210082, "uuid": "5ee90cbc-9f39-4c6f-bba2-215a1baccc96", "value": "T12A13F180D0056EA3D2E5AD76B9EA0787F2C96FF461BB219B0F4D035950C7084AA7D3A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686210082, "uuid": "cc946aef-88ff-4cc9-a14b-73210ac1bf35", "value": "768:A7VJaxQsQrMqxnh+uhgWCsCLRQlUSrVAOSylYL6SnxVrxAN9V3aLM3UV:AnaxBQfVjdlXVAIlYXxVSND3m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686210082, "uuid": "a499ed34-a853-4a16-b9a2-71875253b586", "value": 44344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686210082, "uuid": "3bd45169-c4ed-4ca3-b03f-f55c10a4059b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686210082, "uuid": "1bb9cacc-b82a-47fd-9040-0879f3b9d9e3", "value": "50b4c3918e99cf44d713b185e1c3557c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4807fbbf-0593-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686184062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686184062, "uuid": "25f8be62-31d6-4820-bdea-03fbdc00fbf2", "comment": "Malware payload (RedLineStealer)", "value": "51083e49b8a51cace2d1a7bd269f3939", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686184062, "uuid": "fe14d00d-7207-4b56-a199-90ee10bd8c19", "comment": "Malware payload (RedLineStealer)", "value": "280b556c23bd2fdfc11ab046321eb5b05b76d8667a97eff3cea3a9c54a4dc358", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686184062, "uuid": "fb6f633b-5bf8-4c74-aed5-0dfacbbda104", "comment": "Malware payload (RedLineStealer)", "value": "7c131dc9968556c47ea0f45e06d7a1e9f9dbefbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686184062, "uuid": "218cbe95-098c-444a-a360-3a21f46e410a", "comment": "Malware payload (RedLineStealer)", "value": "0fac79b0e383e2dbb1f60a04675097e3bc555bddfcab8fa54c9183a556481be167252005d191fc8f9ff0e204b3a2a1f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686184062, "uuid": "8f798c04-8116-423c-986d-ea478452dd90", "value": "T13DD41243B7C98132EDB9177018B607C30B797CA1A978976B2385995F0CB26D4E8723B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686184062, "uuid": "4c9684d4-f06f-43b9-8784-01fc2222c517", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686184062, "uuid": "cff2c7aa-3840-4b7e-9c27-ccf26d906ad6", "value": "12288:uMr8y90V3RaWptRbq45xQiomnq9gByCowq8cR/cBM:ayeRakrBxXqBCowqT+BM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686184062, "uuid": "b4fcc50c-fb2c-4940-b4c6-82e266cb17ca", "value": 605696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686184062, "uuid": "3137a720-b5e0-4635-aacd-f6a5ff368914", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686184062, "uuid": "13494fc0-6ee7-4693-a36d-a7525ef9ef7f", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c26d6fa-05b2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686197464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686197464, "uuid": "a004bd05-7000-4e7a-b43e-7fca6d4d7972", "comment": "Malware payload (RedLineStealer)", "value": "ef836776857591a2b722f7777baf6323", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686197464, "uuid": "80971e5c-f6eb-4290-a33c-f8999121510b", "comment": "Malware payload (RedLineStealer)", "value": "28d90c8ee264393563eaafcc66ca05a5d2fd46ec53c5e4ecf5258093a1a86e07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686197464, "uuid": "85910271-4114-4058-93cd-8fb0f39a9e41", "comment": "Malware payload (RedLineStealer)", "value": "02e1dd9379351bfe62b49149d4a5fc35b5c78422", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686197464, "uuid": "be2fe16c-cfb0-4890-92c3-d66737411905", "comment": "Malware payload (RedLineStealer)", "value": "fffb8c7eca619fe67a7365dbca36f2999400562fc3c961c2b8a9e30211f57a0bdda90a1b805108b5b25b7cf0634434cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686197464, "uuid": "af7b08b9-72e6-4d5f-add4-492b19fdc5ce", "value": "T1C254480237C78CBDF8AA073D60D48F3EC877DD60165464FA37A89A618ED0213959B5BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686197464, "uuid": "3e100362-8342-4683-a7d4-9d1ef61383e4", "value": "f264906d4975bf1277da66f2124faba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686197464, "uuid": "7f467a00-73e1-4372-8164-2ac8c6df6ea3", "value": "6144:YQvoWvJ6ZaFwvTygXUNVS4MGh1aBFrvz1xcxcWhJrt:YU+zyR1aBFrvz1xcxdJrt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686197464, "uuid": "6858cea0-f097-456d-a4a9-89e4d1a9cd4c", "value": 288901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686197464, "uuid": "a907714c-89f5-434d-800a-fc2684aebcaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686197464, "uuid": "5204feab-dca9-43e1-a419-6a117ee750e6", "value": "ef836776857591a2b722f7777baf6323.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf6424cf-05e8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686220796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220796, "uuid": "43849540-6a91-4a09-872a-892473305d7d", "comment": "Malware payload (AgentTesla)", "value": "8a71b3b78950b851977569ec25f776a7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220796, "uuid": "3f8a4477-d005-4673-8238-2d01546671b8", "comment": "Malware payload (AgentTesla)", "value": "2902d146aaf42ecb6a8e09556b84b8bfa88d0accd46f9a51a24a78c3c32578d7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220796, "uuid": "9fad0e89-8939-4168-8f5f-0753ab12227a", "comment": "Malware payload (AgentTesla)", "value": "7df2509310dbcf7fe08cccb16761b1a9d82e64e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220796, "uuid": "e6f3558c-052b-43e2-8178-83a9affbc012", "comment": "Malware payload (AgentTesla)", "value": "4a2ff86b75c825630b482c0c42dcc6eb6dfceeb60d526e0f12d58cdf35c071d6a449162dd30bc53a57e8e1c08dabfba8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220796, "uuid": "58367170-6a7e-4d56-96f7-a97124ec78ec", "value": "T15215F1915AA04C11F2AA9FB54A73F23853792C95E713D30A54F02D9B7D3BE927B06383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220796, "uuid": "cf7c11be-c2ac-4a57-bd8d-9c80af011b4e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220796, "uuid": "f6d12872-8e5d-4514-89dc-c288e04ca53e", "value": "24576:SP0t9nSut3rftwfO+d2eKHj+6OATW7gEITK:SP0PSutbftIpKHdOAT3EIT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686220796, "uuid": "907579de-cea6-42f8-b3a5-503b7362d520", "value": 897024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686220796, "uuid": "105fb26b-4b70-4f8a-84eb-737a651b084e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220796, "uuid": "c65b1c1e-c892-4d2d-ad0b-5053a4ad09fc", "value": "2902d146aaf42ecb6a8e09556b84b8bfa88d0accd46f9a51a24a78c3c32578d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4690a6d2-05c3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686204675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204675, "uuid": "9407d165-3984-4f6b-8821-71b51f89037d", "comment": "Malware payload (Mirai)", "value": "e4af1303692aa0f8b7de692a715648f4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204675, "uuid": "8d08f0f9-918b-4f41-b0ce-0690a8353d3e", "comment": "Malware payload (Mirai)", "value": "29a37ad44921e8827dfdfaae9e4e74118f1a887defc8e477353545390b69aa8a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204675, "uuid": "c35b1dcf-248d-4fe2-a54f-b153a0c3dd35", "comment": "Malware payload (Mirai)", "value": "ded8a792c925c281854b282ae411aae961a44c52", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204675, "uuid": "5bcfdb63-86a8-40b9-934d-95c29725af7d", "comment": "Malware payload (Mirai)", "value": "7397bd8f76d72b18ee4f72d52dbdd01f09466c7af67c50459103d43a84192a8cff6eacc1be76719fa9b3edb1345f273e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204675, "uuid": "709775ee-eeb2-44aa-b2d7-b5166735428d", "value": "T1AC434C0333280E07D9961EB0353F06E093BFF95126F5B68A194F9B758639E761182F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204675, "uuid": "48f24210-12ac-4412-b21a-506538d421e6", "value": "1536:q01NDkjhWBPe1ZMaDy0wYrudk/GrWd42+P:qEgoBf3YrucGWK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686204675, "uuid": "a919aa95-5dc2-4b9e-971c-f3c54b7e5b14", "value": 59960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686204675, "uuid": "df77006c-959b-4c28-b3b0-28e15c069d4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204675, "uuid": "45b67ce0-055a-47eb-9207-cefbb78f03ff", "value": "e4af1303692aa0f8b7de692a715648f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed896ac5-0593-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686184339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686184339, "uuid": "0d54c1d1-7ad7-497a-83d9-8bd20adfe5a0", "comment": "Malware payload (RedLineStealer)", "value": "29a1ffa46dd13725a0307d5ae8127033", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686184339, "uuid": "39716fdd-562d-49f6-921c-1114b1f028c2", "comment": "Malware payload (RedLineStealer)", "value": "2a071fd7e5c6344f0d9dcdff4f8b0aa8a23e46795df6359260ecf6b1ed6d832a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686184339, "uuid": "3f1180b9-93ad-49d1-99d3-826b27ff4910", "comment": "Malware payload (RedLineStealer)", "value": "f5d91ae67f86aaba34629095078e043e108d6898", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686184339, "uuid": "3a2f8a21-5c77-457f-9114-0531c9064da1", "comment": "Malware payload (RedLineStealer)", "value": "400086fb06944da2174a0a6c3508adb81bf5265e3b9a8ba1fa477453ec7441836ea690ad864d33318cb68c3a11fb794c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686184339, "uuid": "a837ed55-4f52-4e24-bc5a-7b997dc70a56", "value": "T15754480237C68CBDF8AA073D60D48F3DC877ED60165464FA37A89A618ED0313959B5BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686184339, "uuid": "e829f564-a91f-473e-b463-6b57280dbe9e", "value": "f264906d4975bf1277da66f2124faba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686184339, "uuid": "cea77105-6610-4197-8c03-cf81401b93d8", "value": "6144:rQvoWvJfoZuwvTygXUNVS4MGh1aBFrvz1xcxcWh9rt:rUO/yR1aBFrvz1xcxd9rt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686184339, "uuid": "0cea8bcc-7bfe-42ba-97f4-b962f50da08d", "value": 288892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686184339, "uuid": "60becb31-e206-42d5-9e02-de8f4b82e14f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686184339, "uuid": "1a6a8f06-259e-4450-a760-b7e5d8cea32c", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0450a066-05e9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686220885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220885, "uuid": "45390499-f2e0-4f7f-a66e-7a6be0b057dc", "comment": "Malware payload (Formbook)", "value": "49ee41b860da1e7cd0bf246d63dedbfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220885, "uuid": "8bc58de4-fb08-46a8-b612-05ca8725a490", "comment": "Malware payload (Formbook)", "value": "2c4d743879afbbe0b4baa18e99e515a8b0586caf23308026e233c2031e69237c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220885, "uuid": "8c5f36df-b836-413e-9da1-ca3a15aeb07d", "comment": "Malware payload (Formbook)", "value": "ff044eb8c4ca4aba7f784f610293438561f293c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220885, "uuid": "8d19febe-fd24-4208-842d-d7c4a4b11b88", "comment": "Malware payload (Formbook)", "value": "79afb59106f9ca42d3ec16b701dc5fe264d44bf3d595aaba0b2b25b2405fd77417a26f10988417e37bfb2c37d389fb54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220885, "uuid": "82457355-6146-4a12-bfb5-2e6bb2734cab", "value": "T1AC15F1D11A989C21F2AA6F794AB3F23853756C51DB62C30964F02C977D3BE827E01787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220885, "uuid": "6448513d-2485-4081-8173-1e01b634f93c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220885, "uuid": "51c413d7-8561-4d97-a5a7-e5ece031e20c", "value": "12288:YzLpNaPn0YPX/N94+OClQuKfFiW+HaHa43xOW03Ro+M3nBEebF1fNJNgqCK78mRN:NP0tduwwJ43cU3BEeLNg48mMSkX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686220885, "uuid": "e7c1233a-27d1-4434-b97c-56d3a40d7dc0", "value": 921600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686220885, "uuid": "f2f21c4e-17ad-40ba-b426-df4327c70545", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220885, "uuid": "8181640b-5ce3-46d6-bed7-e7d349ca6fc1", "value": "2c4d743879afbbe0b4baa18e99e515a8b0586caf23308026e233c2031e69237c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e47fdc0-05fa-11ee-b3cf-42010a9c0076", "comment": "Malware payload (NanoCore)", "timestamp": 1686228445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686228445, "uuid": "eb10e338-a38c-4c0b-b55c-7e01a6e11dd4", "comment": "Malware payload (NanoCore)", "value": "91cb65d08d285bc9b39cbc62b16b8818", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686228445, "uuid": "735d6d67-5a0d-49a9-82e5-991b7a5c48ec", "comment": "Malware payload (NanoCore)", "value": "2d3f7cde8b7c6dff2835309532107db323ec291d5f5c1117ae0b38cfdf9b623f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686228445, "uuid": "feca2e04-f417-4b97-b119-5f810b5e24ba", "comment": "Malware payload (NanoCore)", "value": "2e6fc32926adedaaa7791475e2fee7c459dd1373", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686228445, "uuid": "6b4ff225-e2cd-435e-8944-8130bafd34a0", "comment": "Malware payload (NanoCore)", "value": "8a6b7bda463b662b806ba2fe28ce28a7d4c04c572389a0f5205bf23969dfe9cd3bbf821e4c614fbed448dd4ec07feb8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686228445, "uuid": "ee50f01a-bf92-4d41-b0fe-693d67627e71", "value": "T1F105847C9BBA237BE2B7C36447C5B45FB180A573B1057BE6B09203548A21871B5CBD2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686228445, "uuid": "144390ad-a718-4bc2-b5ff-bd5886b31d9f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686228445, "uuid": "a68a2ded-117a-4b04-8e75-f627617fb7c2", "value": "12288:QuLF2iNyk0dpZrxUMBODuhd8t03JWVApbFGhF6sP26pkWswlPjn3:lF1wdpjSKwt0XbFGhzP2GHnlT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686228445, "uuid": "e6a4d9e4-cd44-4b88-a272-09f03780e875", "value": 834048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686228445, "uuid": "e63423a3-1f6a-495b-96ed-96ddc1d511c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686228445, "uuid": "f2209d62-5bd0-4d47-a8fc-3c609b8a0595", "value": "2d3f7cde8b7c6dff2835309532107db323ec291d5f5c1117ae0b38cfdf9b623f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93c01695-05be-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686202657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686202657, "uuid": "a65292a7-dc5b-44be-8557-d094f40e6403", "comment": "Malware payload (Mirai)", "value": "3d5be0801b3a58e0a4782789d5237f9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686202657, "uuid": "3da8655f-ff9b-4da4-ba11-be24a70b670d", "comment": "Malware payload (Mirai)", "value": "2da28a4a1d4c015ee0eb9f6bb4f7b8210a03c5b94138c95baba9e4e2a777704e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686202657, "uuid": "7827d5c1-bb8c-41e5-8275-6e940f3017d2", "comment": "Malware payload (Mirai)", "value": "246e1d7c39e8115ebaeb232d9af1197cabd372bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686202657, "uuid": "eb65466f-c64e-45f2-9dd1-3c747ea01660", "comment": "Malware payload (Mirai)", "value": "f0411c01e80079b04fde65d23e93809cc333ab16d90655a35e3807fa1f32ef8567c9f5c06225d61ff8dec8b332d71b1d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686202657, "uuid": "4d2f315b-fa60-4eb2-9182-a2b99b4738ea", "value": "T1B33329C8E987D9F8DC5115712027FB368676F03B101DEAA7E79CAA23BC49B81D40729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686202657, "uuid": "8b41b943-8a6e-432b-b7ea-a14839ffe214", "value": "1536:BAmkKnnAvjccy7ZeDm4EJd+67ZhP/2Bj6NYc2dZKQDfv:ORKnAvjcV7ZIEJdxZhP/2taXSHb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686202657, "uuid": "dbe97c22-1ddc-4632-b8cc-1fb79c97fd4f", "value": 54800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686202657, "uuid": "29366acb-5c10-4c71-ab07-2068285deffa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686202657, "uuid": "d5a822fb-e362-4d6a-a522-529855fd444f", "value": "jew.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "744f3a80-05c9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686207329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207329, "uuid": "d58d6bb0-1ca6-49e8-a343-b5cfcb1467a2", "comment": "Malware payload (Mirai)", "value": "b318b4df0a62a544b0055909536ef130", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207329, "uuid": "e5222c52-8c99-4624-b0b0-553974b65489", "comment": "Malware payload (Mirai)", "value": "2db03b10df9c4d277312385338f82fa4ca8c1fd75a5c162e167a7c66c1eeb250", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207329, "uuid": "a28f9c6e-3ee5-4749-8f0a-b734bee2a013", "comment": "Malware payload (Mirai)", "value": "ae433c0dad246bbcc1dbec49f807726db45c6291", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207329, "uuid": "484da3a4-b4e2-4af6-9820-3e806cb87d8c", "comment": "Malware payload (Mirai)", "value": "7f01c9165f5f29acbf115e3bb634c7f9bf913be0d73d268c2ecddab987cbfbbd8d2136fac11df111d3bceb727e23a8c6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207329, "uuid": "fb0dcf68-8b0e-42db-829c-e9f0897b898e", "value": "T154D3726B7A109F29F798A73005F76D34834A23A726E5DA4AD19FD6001E3231E5C0FAF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207329, "uuid": "64a39a12-03cc-4cb3-8563-9c3efd0809c0", "value": "3072:6gZqh0tibBn0jNAYgrUpVzVkhxLP4Fb1lPlTqzWHzP9:6gohqNAYgrUtwAFb1lPlTqzWHz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686207329, "uuid": "c1bd97a5-b9a1-4e31-ae6a-f076e0638de0", "value": 136756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686207329, "uuid": "ca217166-260f-41f0-9976-4fe6cb03525b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207329, "uuid": "cbde5dbb-44a9-4937-8ef5-f40969b350d8", "value": "b318b4df0a62a544b0055909536ef130", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d19c78ca-05f4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686225954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225954, "uuid": "4530bb7f-450c-40ef-8cfb-602309c2f459", "comment": "Malware payload (Formbook)", "value": "34ed7fdd4c2886d227c1da98e21758da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225954, "uuid": "88feb550-d383-47ae-ae5b-7273a70e0bc9", "comment": "Malware payload (Formbook)", "value": "2e7d7b8366647be5b0b8a31eedf1f759e31ed5627d7efae3f9597bb424ed39b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225954, "uuid": "421647ab-cfdc-4024-9228-e35d9ce0cd6d", "comment": "Malware payload (Formbook)", "value": "718c2b3b3807b8e98ac3f8a0b306bc80ffbd1227", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225954, "uuid": "c6b30458-c5f1-4bca-90ba-ed7d7b10d9c9", "comment": "Malware payload (Formbook)", "value": "8dd7236313ac0decaca5db590fdc0174da9e8ac4ebb0d7daea65558aad26747b33c3e909069aff00ad5706be61cb6ba3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686225954, "uuid": "a45a4066-7d0d-4c5d-8ef1-923d66ac07fd", "value": "T1D8451202BEC159B2D1A719325A74A725A93CB8215FB9CECFA3D0492DDA316C0D7317B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686225954, "uuid": "e2d5bb18-a25d-46f8-9160-c3b03af2452a", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686225954, "uuid": "e83ed267-ba0b-478f-b326-1be0205bc73c", "value": "24576:NTbBv5rUanjlTs9BwkiZXzahDRok7DXaCUci4sSXepEgzXPfRXI9ghsfSB:HBjpkBwFpzahDukCCUcihSQVzffRXYgP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686225954, "uuid": "db846de1-9768-4654-97a1-1dd6c479d655", "value": 1236611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686225954, "uuid": "3438d126-ab46-49c5-907b-e2529b5dde28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686225954, "uuid": "f80f093e-79c2-4ad9-a0bc-3538b7b4a3f8", "value": "2e7d7b8366647be5b0b8a31eedf1f759e31ed5627d7efae3f9597bb424ed39b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1565711b-05af-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686196003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686196003, "uuid": "4c3f18d7-3dc5-4992-9b92-c68a791c3582", "comment": "Malware payload (RedLineStealer)", "value": "dab01eec3a475731140e635d0a7e4110", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686196003, "uuid": "719e476f-6ce7-4c33-9178-0100a32b9e55", "comment": "Malware payload (RedLineStealer)", "value": "2f16b4c767d1af66b07b21302e2a8e066d55dc12c099b1b8d8011707f5880bbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686196003, "uuid": "e4ff0f6c-584a-4043-bff0-18d54f0b65c1", "comment": "Malware payload (RedLineStealer)", "value": "b78c16a377a9ad61f4905e84818a3a7eccd65054", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686196003, "uuid": "611254cf-db15-47cf-9bb7-01b512f34a74", "comment": "Malware payload (RedLineStealer)", "value": "5b8396ac3569eee6d2416328d5d75b415ca366db20d758f046d4540396104f94e466dbbcaab6497915f33d27abff24d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686196003, "uuid": "a7c3f1b6-3b95-496a-806d-332bb57b616c", "value": "T15DD41223AFF484A6E8B46B345CF603C70F32BCA18C78426B27565D4A6CB2654657373B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686196003, "uuid": "5a700766-6556-43c1-8b65-eaaa6e8b3113", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686196003, "uuid": "0e521fc2-3892-4e85-92a9-2d3b3ee4bb21", "value": "12288:7Mrxy90gAFV02dnIBTgatYeDCqzPLGKRPTTzklpHltsNLzm905VK:6yLAvNwgatYAnPvUDtsZzm905VK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686196003, "uuid": "89a8c157-7193-4750-a1c1-4abb2f8de7a7", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686196003, "uuid": "8a13b87a-3d23-4acb-a35c-e045b44a1d8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686196003, "uuid": "d51fa6a4-dc38-4a56-b84b-69d92bf668e2", "value": "dab01eec3a475731140e635d0a7e4110.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5466a8e8-05c3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686204698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204698, "uuid": "615f12c5-c9c5-419f-86bd-9d3260b21189", "comment": "Malware payload (Mirai)", "value": "fe81f81be2c7850f504200023f33c79c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204698, "uuid": "a4779a00-def2-4b4d-8f60-4e1f4d9db2db", "comment": "Malware payload (Mirai)", "value": "2f23a4307d42236c0074e819280a51c0c3925f51ca215d67a1a873b1dd1fbb94", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204698, "uuid": "fc78645f-6c84-4e8d-ae99-a96c8a1214de", "comment": "Malware payload (Mirai)", "value": "2522cd96f93daa586376aea110914a13d5134a7b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204698, "uuid": "0ddf013d-48ec-4f7a-992d-7da06673fcc1", "comment": "Malware payload (Mirai)", "value": "6c78164e03bff45f254390f83d0fd5fc7b247d7db8ffb387c23c6f27d0cf06b3387e9c043c2d1b4b82cc13cf20ce684c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204698, "uuid": "7ffc418c-2d85-4f40-9723-9b8de30e8ed3", "value": "T13BA2E0785067E673F6F58E35D43E4982A7965AB4C6FC6C0013080B64E7F3B8AB1F6142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204698, "uuid": "142f2162-cff7-41cb-a95d-e95de6f65d19", "value": "384:o2wedKdXm67Yjmfy/SHvX6pq8iL10OT8ijJS46lxqxVLWpQOyCpqmdGU5EeCZdbp:AdXm6MjF6Hv6pq8iPufq7Opq3UIbp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686204698, "uuid": "30ba8fcc-3fba-4d94-b167-ee21c11c6cd6", "value": 23196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686204698, "uuid": "007e61bd-3a19-4c4b-8ee1-06ca6f462d56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204698, "uuid": "982655dc-74d8-4285-8ec2-4470e58eae91", "value": "fe81f81be2c7850f504200023f33c79c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7689e881-0613-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1686239115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686239115, "uuid": "45a5370b-c6ce-4d23-8a66-79d86d4900aa", "comment": "Malware payload (DCRat)", "value": "2baa6f19fa7f4ef5941e92335aa2c06d", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686239115, "uuid": "e882b825-945b-4c5c-9ecd-046a1772df59", "comment": "Malware payload (DCRat)", "value": "2f476997ecdb5116621e72532460d7149299a6b058bee5b58501484da80d523b", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686239115, "uuid": "d840ea4b-c2d5-4cab-b44f-6bce1706b345", "comment": "Malware payload (DCRat)", "value": "68c4872eba868d9e8b640e0e76cb1a4a00331d8e", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686239115, "uuid": "90dcefae-a8cc-4d7e-8f09-d9177226ba5f", "comment": "Malware payload (DCRat)", "value": "21b8a656cd04f1ee1bd219ea866b9371ef2b297666712ada9838721bc72ef1375b7357818dc06d239ffbd9b9e9447305", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686239115, "uuid": "2a6d53e8-bbf9-493f-975b-ba6b170329d2", "value": "T1E7859D017E85CA12F0191633C2EF454847B4AC516BA7E72B7EB93B6D55223A33C1DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686239115, "uuid": "8972af16-2cd5-4132-a4aa-2bd6821c9bd0", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686239115, "uuid": "961f826a-4d8a-4eb3-9b3c-ed4e797d2cd0", "value": "24576:e2G/nvxW3WXeGxRoXGkxVsAjtxWCu2RdBaYwqf36eYmMyXxRlRYSZF083SFN:ebA3V6aXGkzFaPmUzyXnlqSZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686239115, "uuid": "80822691-7d79-4171-b957-eefe21106914", "value": 1713299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686239115, "uuid": "ad2449c8-cf12-4d48-915d-685b6ace5eb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686239115, "uuid": "24f256b4-9251-4d40-8afe-5bb3667b1913", "value": "2F476997ECDB5116621E72532460D7149299A6B058BEE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f454b75-05f9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686227829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227829, "uuid": "a7114ab0-67c6-402e-9971-1f8288b9e9d9", "comment": "Malware payload (AgentTesla)", "value": "daa104b0dbbbac65317f8eda1f07f719", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227829, "uuid": "27d3b191-8fa6-4d9e-bcc6-bf2290a6f313", "comment": "Malware payload (AgentTesla)", "value": "2ffb5ab12548ae624d295f7e17a2f4115cfe1382d87cb548d6576efd546d7989", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227829, "uuid": "0d1efbaf-50e3-4a28-b749-f4e7f4303980", "comment": "Malware payload (AgentTesla)", "value": "17c8dbde654d7afc752a11ab306461281ea2c9db", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227829, "uuid": "ad702ba0-d568-4af0-b25a-5148f2414f7c", "comment": "Malware payload (AgentTesla)", "value": "9ac4a82845677dd589084834734db7af186016af6def09580c228d6ce3d1bdfdfce34125c0ee3c0ef47ea5a94a3c5c9d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227829, "uuid": "be7d0bb8-b869-44f3-ad5b-56d956055ea8", "value": "T11B04F8589E895F13F72D40B5CDB9014B0EB692464217E75FCDB0F8E63E763A3322A891", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227829, "uuid": "0cf110ad-8d55-4f69-ab89-3dfaecf6104c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227829, "uuid": "c4157ad4-9273-410b-9315-4893d6c6e7df", "value": "3072:5bQHEP3KbiUTu3pjbIQUXsQYkzHs+Ne4D1IOouuc:tT4u3KQUtZNFxIO5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686227829, "uuid": "0a705f57-8e80-440b-858c-c940b81393ed", "value": 173056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686227829, "uuid": "ba96f8d9-b522-46fb-95e8-16abb8ab2771", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227829, "uuid": "4d304443-2b0b-47e8-9f53-e1e560aa4432", "value": "2ffb5ab12548ae624d295f7e17a2f4115cfe1382d87cb548d6576efd546d7989", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84f32fd3-0619-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686241716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241716, "uuid": "1f4dc927-5463-4368-bc12-7e6fe0ade110", "comment": "Malware payload", "value": "118fb3c978438274edab552ec7c747ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241716, "uuid": "b5486685-4ab5-4912-a86b-88ab568a80aa", "comment": "Malware payload", "value": "31d69012fa3aec37bb6eac65a5d5f294eb450b5c4d7c64ed5ac0a57a1bd6c039", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241716, "uuid": "c7fae1da-fe59-46d7-b1e8-d3e16112dace", "comment": "Malware payload", "value": "49761eea6ec5e112a8b1683813e9ff2f15d12233", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241716, "uuid": "71920e84-b13c-4e1e-bd1c-d654a6d7b56c", "comment": "Malware payload", "value": "0a801a33d5cfb9563d114d2e51b27a8bfe88378b06fbaa80ea425fda565231e3dade8a13f4b52d80fdc57d6cf376967b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241716, "uuid": "58a2d64e-c6f3-4ceb-bf62-8fab3d9ed5a5", "value": "T11B91A017C7C88021FCFB373386A34A5B23C2E4771E99ED096B4114B70530D6074B7412", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241716, "uuid": "39e2bd9c-f3e4-4182-89aa-331402f3641a", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241716, "uuid": "61f7d5ac-10b7-4a49-b130-2252e89813cc", "value": "96:xe0XMer/Z5dgYlppnDmEta2Hdw8bUfh6Qk2Z:xedEbdgYlXyfiEh6M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686241716, "uuid": "aefac0ec-c5f0-4ba8-a088-3f90fa82c1f4", "value": 4413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686241716, "uuid": "f0188512-fe9a-4325-bed2-c205589f9acb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241716, "uuid": "2381e3f1-f3e7-43d7-98c5-87ac43d720d7", "value": "SecuriteInfo.com.Spyware.Webserv.C.23711.2414", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c928318-05b7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686199585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686199585, "uuid": "469995a4-1fc3-4b50-b69e-08a0848bcf25", "comment": "Malware payload (Formbook)", "value": "523638a13e3af95fc2256be66725c682", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686199585, "uuid": "7ab824e5-50b5-4821-a814-aa5de5d9fa3c", "comment": "Malware payload (Formbook)", "value": "3206c73842cc18def9792f97c1bdb6ee85f1a396173999a42aacfa4cdb329146", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686199585, "uuid": "14d0a364-c715-48bc-b9fa-dba1d2422c46", "comment": "Malware payload (Formbook)", "value": "4096f602f50b71a6d671d23c41f4b52dca59c8c8", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686199585, "uuid": "b6bf5544-6f5a-493f-a91a-5d55d5dd4e4f", "comment": "Malware payload (Formbook)", "value": "ad2d2c9f5fe22ecb0b38e62219b11c85c97847a5d379be908df86944d37308a3da67dd6eff34f76936f09479f6ee41a6", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686199585, "uuid": "7e1f0630-dbe8-41d2-87c7-dc62347f64e2", "value": "T102B2AE5A5B8C4C62F26AE877865EE00E48BCF23230C255C4BD9CE7757B7D14E0B6A1B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686199585, "uuid": "e13b2809-4164-4483-8577-65ff12fc4029", "value": "768:fJnxqB/d7sWct8I0tZJ7dnZlj2OZ52MgalwHC1xetibZqSA0:9xs7sWcuZ7dn/LvtPv/A0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686199585, "uuid": "8ca1b88b-d112-4339-8366-42c2b6826842", "value": 25554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686199585, "uuid": "b27aac04-31be-467f-915f-18b46126ac79", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686199585, "uuid": "14e69e8d-f775-4310-a005-77dd4b12d84d", "value": "523638a13e3af95fc2256be66725c682", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dfaa987-05f3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686225357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225357, "uuid": "0b9891fd-a468-4611-b011-e3cb7663fd76", "comment": "Malware payload (AgentTesla)", "value": "f60005621dc1f6fc654215d5fde75002", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225357, "uuid": "b44424e4-97dd-4739-b617-bb87f20844b7", "comment": "Malware payload (AgentTesla)", "value": "326d089faa6a93f0cb06311fd787593691b405807a399263e602964fc58de21e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225357, "uuid": "14ff11b9-0142-4dc9-9f01-5cd180e96f86", "comment": "Malware payload (AgentTesla)", "value": "37d74c37493a4737400710072c442ab00813a87c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225357, "uuid": "61168cda-a763-43b3-beeb-10f0e6a64b72", "comment": "Malware payload (AgentTesla)", "value": "4cf86dbc89f786a51257096523f669778aa58148a1edd42eec17d80a025e740c2869a4a5c605b6c8714beb0aee302aa4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686225357, "uuid": "69636d03-b08b-4234-92b3-04de635cae6e", "value": "T11044F1DCB9D61A36C5972DBFCCA0C5720B173611354DCEB49CEEA6F18841BB846A0E87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686225357, "uuid": "8e03f557-1dbc-4d03-aa4b-5826713a522d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686225357, "uuid": "e08b72f7-c243-424f-8be0-1b5a388b3426", "value": "6144:vh3VPt4DDzlV0ldw9Xf3OEAO+83lOBHGwbKOJV:vWlqe/sOJ4BmwWO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686225357, "uuid": "5f8ce141-8ee5-47f9-8388-04970c0a21a1", "value": 265728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686225357, "uuid": "3cb39703-3922-4d7e-96e5-2edee378ed37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686225357, "uuid": "406d38fc-678a-4a43-bb89-f9f6ac489842", "value": "326d089faa6a93f0cb06311fd787593691b405807a399263e602964fc58de21e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75ef9d34-0611-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686238255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686238255, "uuid": "8df28f7e-0bfe-4f67-842b-661e1acd58d8", "comment": "Malware payload", "value": "9d90056456cdc49908d7b9a29fc0a23a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686238255, "uuid": "414a6842-ee32-45e3-bf1b-4957651aaa1e", "comment": "Malware payload", "value": "32775918ae677e2e42b6997b9f1b0634d17d5d0ae641d37ad6d812d40ea4ff66", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686238255, "uuid": "6af63741-cd91-44f2-9129-5fb055185bcd", "comment": "Malware payload", "value": "dba6aae9ad3156a68792ea4c28275d36f91cebab", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686238255, "uuid": "58dd8781-808c-4fba-968e-6b64089499f6", "comment": "Malware payload", "value": "25ee93cf0a0e013f0105b6b7a1457e09e8e9585a7b404381b0018e2c17ac9828c390f9415d27a05600b88459d64fb8d9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686238255, "uuid": "45d0e2e3-eb42-4406-97bd-7641d4ea6ca3", "value": "T1BDE2E15D28CBB3BA2505D745E64E29D0E9B325AB95C10BB35CF4EC0872DD24F2CB6418", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686238255, "uuid": "76388d52-35ba-4836-b0d4-6356bc2e54a2", "value": "768:3PjZ4pJY9S48gc8VH8NplHoBQRzIn25YfncW:Sk8kHERzsncW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686238255, "uuid": "93f41c8b-2b32-4739-9e84-d4d71ae3c22d", "value": 31800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686238255, "uuid": "c113a5c0-2f63-4fd9-8ff2-27885f7d073c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686238255, "uuid": "4a9eef02-a5bc-4b2d-8dcb-796a501d44e6", "value": "Calculation-of-costs-420154163.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c97062f2-05bc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686201888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201888, "uuid": "8092ac2c-16f3-467d-b68d-9fbe8729a3a3", "comment": "Malware payload (Mirai)", "value": "47080b569bf4348b28356629e99d1049", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201888, "uuid": "2fa0278e-f55e-45b6-9ac6-7d6aaef19cb7", "comment": "Malware payload (Mirai)", "value": "33c605e6ed518636acd752fe296dd9eb07115f0b74146f349236766bce1c6951", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201888, "uuid": "87294dda-685c-4b6c-851e-13359486f407", "comment": "Malware payload (Mirai)", "value": "b340ac6e1d947c15db61940b93afb87e131641d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201888, "uuid": "9e092222-2e35-4271-999a-cc67d3ee9493", "comment": "Malware payload (Mirai)", "value": "1f877883d72a4c7bba4e4793704dc7c39c4d0f84c36e1c4b1248d3c4f9a7366f29bd1168ac6b90214ba3a8f5eb7f23c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686201888, "uuid": "175d5e43-8c40-4cc1-805b-9f2a0bb85152", "value": "T12CC35E86BF903FFFD81ECD3241A4DB0A129C590A2395BF7A1B78D408B65B11A59D3C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686201888, "uuid": "72732ee2-6096-4582-a45c-5e957927338a", "value": "1536:mpdzaAiDymlxxfNknAbDrHQWTee8QDncElcwCrQ:mpdzeGMt0VWv1Dl6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686201888, "uuid": "ce511ca2-415c-4ab9-b112-be98295f7ef4", "value": 128580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686201888, "uuid": "cd3b77e4-d045-465b-86db-ff5388a0fac6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686201888, "uuid": "558084cc-8ac5-4d58-832d-e2a63abdf295", "value": "47080b569bf4348b28356629e99d1049", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "689dcfaa-05a7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686192706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192706, "uuid": "4381b6bb-4762-4e2e-9b2c-6bf910c23351", "comment": "Malware payload (Amadey)", "value": "81aaf907c76afab3da906dbae03ef686", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192706, "uuid": "fd3a0f7a-881b-4460-a4ca-9d4135167af2", "comment": "Malware payload (Amadey)", "value": "34f18f9c8b09548fde94332040f02bcd55f2cd8d03ec5cb727e0a382f1aabaf8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192706, "uuid": "2180dfed-4242-4d18-b854-75881eb6dc4e", "comment": "Malware payload (Amadey)", "value": "ac63684250367b27f10dc671cf19364b2b161002", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192706, "uuid": "edf94b16-d011-4200-94d3-938ab3eb818d", "comment": "Malware payload (Amadey)", "value": "b39c6d1db294156ce8616bfb0d77c25db7dfb37fb20bc33afb251bd7dba0c38ec740cbd20c37ac97d050e15175ecf82d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192706, "uuid": "14a0ff69-5139-428a-81f0-44c76b86b2e8", "value": "T1A424F7257D12C032D56061B619F5BFF2C59C6828ABB049DB7B800F77DA122F73A61E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192706, "uuid": "582372dc-ab33-4d34-acde-c38f91533bac", "value": "f8cc61ade86cb7277d0ab974de6323cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192706, "uuid": "b96c69f1-4339-4189-bf3b-e7017a8ce863", "value": "3072:H/DmgskHbfHN+Pst60p0zuNmnKG7peNMQbuZAIqbey3lfbi:fDmfAfHN+wiuInRexuZAIij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686192706, "uuid": "5886a8c1-bb3c-496d-b013-431fb99a4992", "value": 211994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686192706, "uuid": "f9c62545-3a11-49f9-8986-81934fc862b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192706, "uuid": "73e8eb75-e652-464e-be0b-25c25c843488", "value": "81aaf907c76afab3da906dbae03ef686.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff58459c-05c1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686204126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204126, "uuid": "2b455cec-6378-4577-97f9-869db01911a3", "comment": "Malware payload (GuLoader)", "value": "bb82589608f2312e9bf9d0c63c8a3d68", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204126, "uuid": "7090b85a-39ac-4f63-9d25-43e0c6e7f849", "comment": "Malware payload (GuLoader)", "value": "3682f76c6feec004f58d0b9c732b45215375d45f250bdac03fb3694097710c3f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204126, "uuid": "db4e8d3d-38da-4d6e-92a4-319b95aa014b", "comment": "Malware payload (GuLoader)", "value": "c66d15184ef9a38a7423f1a6fbc60c94132051f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204126, "uuid": "6a910715-04f0-48ff-8693-122044720493", "comment": "Malware payload (GuLoader)", "value": "faba33d427ef9d22fccde926c9b346ed2c06c3acb64e60d0e156a22c6ad887c7f910d464c089b175c8bc237aa400a26d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204126, "uuid": "fbb02c18-6c85-4a6f-8f42-799ca0110265", "value": "T11784013A736CC42FF04612B11E62E358B7B09EC539D6474373277F6D59B4280A9D938A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204126, "uuid": "35759a45-60fb-4583-95d2-a17621f48bc0", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204126, "uuid": "9a0aafc5-550f-4c82-a2aa-5181531afdb1", "value": "6144:A6dANzV+OT7ck3Ke1/Lhw5ewNi4F/oJrcy+ShsV6+gn:iP+OTQkFLhaez4FSVsVI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686204126, "uuid": "b938fa5e-6485-4115-b2ed-731fc6aacb03", "value": 380392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686204126, "uuid": "88f153fa-df8a-4aea-b306-586292ea6ae9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204126, "uuid": "b2f055dd-2625-4b57-b2d7-13c16ee114cc", "value": "bb82589608f2312e9bf9d0c63c8a3d68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b5dc910-05d0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686210401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686210401, "uuid": "cfdbe1ea-48ef-436a-9188-5fdd8dec2a98", "comment": "Malware payload (Mirai)", "value": "a424ed0e1a76622525882a4c5044643c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686210401, "uuid": "9e34c956-5f84-48c2-9443-782186ea5f58", "comment": "Malware payload (Mirai)", "value": "36866b4848cbe6669d6a3afba4abf1b3695b11082575806b387d2a8bbed146b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686210401, "uuid": "2bd8ecfd-9f28-496f-9c69-f5c49d4072cf", "comment": "Malware payload (Mirai)", "value": "df850f37252417156a918c65ddae055cab9f629e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686210401, "uuid": "73b7198c-2408-4149-bc3c-6098a2b7faf9", "comment": "Malware payload (Mirai)", "value": "db719bf8c77c272898ece582e08e24da9618fbbfee922da78fc4bbebd77b735af392d2bb814ebf66971417734b523d04", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686210401, "uuid": "ded84860-00ea-47a6-8b2d-243fd65812f3", "value": "T1B43152A09AC08EADC8E042FF9C0943507352DF4DD1CBB222A22CAB686D1EE1CCC1701B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686210401, "uuid": "8ea0c6c9-4652-4e8e-b0b5-91fa3634c27e", "value": "24:6yYGpa7Urz/jlfQ+XK1G9Vev3gRGRP9iI/q8/+o+XLwAmE0Ba3eRx+uG6/:8Gpa7UrLZERlPIwOL1mtBauTz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686210401, "uuid": "6e5a7e60-7558-4275-9f8f-84bb1e863f29", "value": 1660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686210401, "uuid": "52a44b4a-87d6-4b54-bee1-ca99e4cc1c97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686210401, "uuid": "6fe4555e-5ae7-4524-8a17-642d6d68003b", "value": "a424ed0e1a76622525882a4c5044643c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "412fc6a1-05c3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686204666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204666, "uuid": "44ade3d3-25e6-49c6-87f4-6c729a458f80", "comment": "Malware payload (Mirai)", "value": "6be088259cea4d892dda38970d5df0ad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204666, "uuid": "b338418b-99cc-492e-9385-e8a0f579c37a", "comment": "Malware payload (Mirai)", "value": "36a7ef22625f81c2343378f7603e853a7b55227fe16dd8aa0b28336394413995", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204666, "uuid": "51bdfd8f-0be3-458c-bb3e-03ec8312a8ed", "comment": "Malware payload (Mirai)", "value": "f527c3e9055c33819437186b77c5a1e87fa171a0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204666, "uuid": "345c338d-3413-4e10-b98c-5c7b32f05935", "comment": "Malware payload (Mirai)", "value": "2df992992fd1b66b7ed6eefe53872f250d1466b49915974d0942b5ba120fe79b3741b12a4f7b4ae36bae06b706bada29", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204666, "uuid": "80e48f31-1bf0-445b-be19-36926c93401a", "value": "T1E6433B55F9429613C6C151B7FB1E438D7B6B03A8E1EE73039E29AF2133878670E6B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204666, "uuid": "ba68318f-57a7-4575-8584-e9142cb22537", "value": "768:K9l5Ziic0gOgRd3OxslOv1X/WZM0QSALRRBweMRl1fVemj/wu6lJn0tTIv7itI:Clhc01YlEtP0QS+FMRl98HVK8v7it", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686204666, "uuid": "269e13d8-8c19-43e0-b39f-84e978283068", "value": 56744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686204666, "uuid": "d0e4e374-e465-41de-9b34-48499f00f86e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204666, "uuid": "f123d91c-057b-4e4e-8be0-82ea7de8928c", "value": "6be088259cea4d892dda38970d5df0ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9af27aa5-05b7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (NetSupport)", "timestamp": 1686199663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686199663, "uuid": "da3fa057-de85-4399-9d93-c8522b1f0afd", "comment": "Malware payload (NetSupport)", "value": "49400d0ebc34337537a77a3edb5bf120", "object_relation": "md5", "Tag": [ { "name": "balibumba1-com", "colour": "#191C23", "exportable": true, "hide_tag": false }, { "name": "balibumba2-com", "colour": "#638CE9", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686199663, "uuid": "d8e4cd5d-6716-4ba7-a4eb-946c11201d1f", "comment": "Malware payload (NetSupport)", "value": "36cb67c124cbf975b03a7cd5e6cf026368fd78ba7d486a78dac242c71e41ece9", "object_relation": "sha256", "Tag": [ { "name": "balibumba1-com", "colour": "#191C23", "exportable": true, "hide_tag": false }, { "name": "balibumba2-com", "colour": "#638CE9", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686199663, "uuid": "f1db1590-4a2e-408c-a333-400888e4d4f5", "comment": "Malware payload (NetSupport)", "value": "6c3e1a7760e4b33ee34d475e71dc3ed71fc0c6fe", "object_relation": "sha1", "Tag": [ { "name": "balibumba1-com", "colour": "#191C23", "exportable": true, "hide_tag": false }, { "name": "balibumba2-com", "colour": "#638CE9", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686199663, "uuid": "23b67a21-d012-4349-8951-ed6bf75f9234", "comment": "Malware payload (NetSupport)", "value": "a78202c48dab97d80c643f94fadd8482760d6c43e94bdb33a6a3462ed960a9ee489795830a94752749c1c759af822275", "object_relation": "sha3-384", "Tag": [ { "name": "balibumba1-com", "colour": "#191C23", "exportable": true, "hide_tag": false }, { "name": "balibumba2-com", "colour": "#638CE9", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686199663, "uuid": "2f1c889e-6c74-4086-8a3b-ae5470d5d5fc", "value": "T174110012564ABD4D282BF2D6327414911FD38100F99D39229B54190FAF36C7E08DF4D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686199663, "uuid": "f62725eb-d7ce-4e81-809d-8728e90c3fb4", "value": "12:Lx/vONhz7q+mPXjxGSGpzWVTXuZ7/PfY837GXoKIDWUpYL7XBGSaCYublucayYHP:LpOhzZmPTxapz1l1yXtIDJCPBmu3aDDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686199663, "uuid": "238681e7-f1b5-4f9b-aa16-31bd1ef5dcb1", "value": 918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686199663, "uuid": "64a2a3b5-f800-4a1f-bfe3-7d5ae9542951", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686199663, "uuid": "92e8300e-2f57-45c1-8236-2713193747b2", "value": "client32.ini", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2828924a-05a5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686191739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686191739, "uuid": "c7ee6734-1870-4af5-baea-f221371bc20c", "comment": "Malware payload (RedLineStealer)", "value": "661aaef554d3a813843465db52a015f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686191739, "uuid": "fd6676dc-a383-4de6-93cb-98aa044cc0af", "comment": "Malware payload (RedLineStealer)", "value": "36d83019717db21e2f3bb61653c66a8aee21444801eeca6b950f8810ae9d3372", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686191739, "uuid": "ff3920c9-620d-4d9e-995c-324ce38e1054", "comment": "Malware payload (RedLineStealer)", "value": "525c14d71677b6853025e33b70e22b8907c1a031", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686191739, "uuid": "3e51a8e1-56ec-4718-b3ff-aebb1cdd476d", "comment": "Malware payload (RedLineStealer)", "value": "3f29c3bd917b1a8a24f7c7c822b560dd75216f949461c2eb75b9cfba8f785e645ae70905c101216e25383c1af879a26b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686191739, "uuid": "6d4968e9-289d-4181-b29b-9159713180ae", "value": "T16854480237C78C7DF8AA073D60D48F3EC877ED60165464FA37A89A618ED0213959B5BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686191739, "uuid": "6e2c77c7-d42a-41b4-9e3c-6715f3f87eac", "value": "f264906d4975bf1277da66f2124faba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686191739, "uuid": "156f2544-8019-46f4-b785-b494694fd5e8", "value": "6144:SQvoWvJj4fHwvTygXUNVS4MGh1aBFrvz1xcxcWh4rt:SUqEyR1aBFrvz1xcxd4rt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686191739, "uuid": "77196256-a9cb-4315-9673-97dae9d5873f", "value": 288901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686191739, "uuid": "64622b46-708d-4fb2-9196-bfef335c919a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686191739, "uuid": "d750fcdc-ea3b-4f22-930c-79f5f47d7838", "value": "661aaef554d3a813843465db52a015f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fc12450-05f5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686226085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226085, "uuid": "78a2bfc2-1cde-45d1-89ce-7fbd08046a7b", "comment": "Malware payload (GuLoader)", "value": "4c0190d6b7ac50cdcaf5dc81063661d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226085, "uuid": "fb5f1eae-c2ab-4f33-9703-97fad1abca51", "comment": "Malware payload (GuLoader)", "value": "3717424b02bedb7c66265376952fe5d5bd335615474e1ead4df636c0accc4cfd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226085, "uuid": "38ce3684-e085-4a2d-8cb8-25c0b87d0ad7", "comment": "Malware payload (GuLoader)", "value": "3626f438a52eac2537c46584b09f95755c32ab9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226085, "uuid": "869a2e97-7bbd-48e1-a8e7-fd2f55f495b5", "comment": "Malware payload (GuLoader)", "value": "c981fa9eaa6a3128feb36132bf2aacfb32cbe6289a0eb180d326d64b0ad15a11373f15ab4c26416877e29853f6edd140", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226085, "uuid": "e2f85342-58ca-4738-908b-4b8720e1708f", "value": "T1824412327B2064F3C61644B64A36AA2ADEF0D64A1091174B63E17E9E3D53BF06B0F192", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226085, "uuid": "ea2dab0b-4a29-422e-b9a8-efc891f2cb2b", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226085, "uuid": "1440ed67-67ab-4986-9e24-146306efa89e", "value": "6144:rqjIlLXk1aZxZ6T6iW9KZwweUu/aKkplDPraNU/fFoC9ZeaXd1WU:2aQg6T6iiKOUmkHnaNAv9ZvXH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686226085, "uuid": "e6f9b919-6c68-4160-b655-163f2171f3a3", "value": 275720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686226085, "uuid": "044f9969-faf9-477f-98c6-2b6e3051cc6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226085, "uuid": "1a916f63-46f6-45a3-95aa-081e274132d9", "value": "3717424b02bedb7c66265376952fe5d5bd335615474e1ead4df636c0accc4cfd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7676f45-05a6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686192382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192382, "uuid": "09a170fa-54d1-4365-956e-7737bc8a852f", "comment": "Malware payload (RedLineStealer)", "value": "7f43f757d9b615d5717d134986502fa5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192382, "uuid": "779b7763-5b0f-4473-9766-8f6af4ad0b10", "comment": "Malware payload (RedLineStealer)", "value": "374d10a9877989ddb3fdc9a33ce328bebbd2e18260710f3e4d886a86c77dc81a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192382, "uuid": "facac959-bb5f-45f8-b8fc-cdacb7e992b8", "comment": "Malware payload (RedLineStealer)", "value": "db9e795e081d6cf8639a4960bd87f45edf7f33bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192382, "uuid": "30d3b3c1-f409-456e-a868-f6f31af5d798", "comment": "Malware payload (RedLineStealer)", "value": "c7b43fd2690538a2d3af06c5140e1a6a31627bcb57af1f2f93e6ab938ff412812256ef31e663fcf8deac8a40d48adaad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192382, "uuid": "a0801aec-dd3a-4118-8a63-e26297443bf9", "value": "T114F41202B7E451B3E9BA177568F607C71A30FC92AD3C076B3385A81E19B3598A53173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192382, "uuid": "4d7512ce-646f-476c-86a6-7d1277ddccc6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192382, "uuid": "2672f1e1-5829-40bd-9620-341a2fee6c9e", "value": "12288:VMrky90uTceZP//T1p6wkQ9ohFPFcp+YHyU0thA70zjvwhqb:hy/ZPXTX6tE2Fcp+HHhjvf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686192382, "uuid": "457b0237-4532-4a30-ad68-22763bb659ae", "value": 770560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686192382, "uuid": "3dc4a833-4ac8-4c43-8b26-e8133ebaec5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192382, "uuid": "0b73fc4c-ddde-4d45-969a-25075acb4239", "value": "7f43f757d9b615d5717d134986502fa5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a634842d-05a6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686192380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192380, "uuid": "9f5cce4d-bca7-439c-9535-4c3cab33d7ad", "comment": "Malware payload (Amadey)", "value": "8d2db1ac60c314a15af0fecfa5636d44", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192380, "uuid": "b45203ad-8097-4506-bdd6-fb7bd2992855", "comment": "Malware payload (Amadey)", "value": "37641431e7007300142ac6f3cd8714541a21e7a0315e3328c021751adb424251", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192380, "uuid": "8af0f092-14b5-494f-ab06-cf9c6ed2d291", "comment": "Malware payload (Amadey)", "value": "1a7e5fbdb40cea3846dfb3496746cfd2ce4d96c0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192380, "uuid": "78f6924e-5345-425c-8c78-f84c562f7369", "comment": "Malware payload (Amadey)", "value": "1ddb11cba1db14b7435996a7abd078e3d6d57df5ba9d97573a0840f717f40a704ea1419756cbca8f8aebee6a401c0fca", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192380, "uuid": "ccc21c2c-58fe-495d-ad4b-4fe2a148cd34", "value": "T13EF412166AE88033E876677488F603D31B35FCD55D68A32F6350A88B1DB3A50D97273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192380, "uuid": "9b9948e3-1a88-461d-82f9-4d42698ba8de", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192380, "uuid": "275d8a02-1ca1-4994-91ae-8d094509bb58", "value": "12288:mMrhy90j9ek59q4rLE3JEPsF/y7muHAvPD4qqmK1CL2AqxFwPefMU:ny0JTqoMEPsFMmugvr4aKQLVqD4efMU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686192380, "uuid": "cc10ecd3-130e-418c-a9b9-68ab0497d051", "value": 768512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686192380, "uuid": "a5abd853-6101-473b-b6c9-4194cdcb7de1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192380, "uuid": "0d11a1dc-88c5-463b-a177-5161fa89ceec", "value": "8d2db1ac60c314a15af0fecfa5636d44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e43e4b4-05de-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686216365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686216365, "uuid": "b7f0e4b6-37a6-4841-9ec1-c03760d61182", "comment": "Malware payload (RedLineStealer)", "value": "77472348a029d8546196c58c7e976c16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686216365, "uuid": "b0d1f9c0-38d5-4e97-8358-d8d16c415af6", "comment": "Malware payload (RedLineStealer)", "value": "37d212c7540712c3e6a03b284d2a92b83f339583d4b2c6afeb54c1b449aa31a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686216365, "uuid": "898f892d-b10e-4f54-b961-9f67dca449c4", "comment": "Malware payload (RedLineStealer)", "value": "cd8dd86c13aac3bf5add0e9657274305051f08f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686216365, "uuid": "59bdf71a-71a4-4afd-b27c-c8193fbbbde5", "comment": "Malware payload (RedLineStealer)", "value": "96ec464b7013f50f8456cd566ca847fbdb1f279476cc482cedc8a5f2e400209b7ec1f99a2e3608d1c6ca0070172282d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686216365, "uuid": "9b52a1b4-dc82-4605-89b9-58e6731583ab", "value": "T1DDD41207A7E844BBD87657B019FB03830B35BDA25E78539B7350A84E4CF2A44A932777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686216365, "uuid": "c5c8b1c8-548d-48b7-ab27-2591af8a7a81", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686216365, "uuid": "0cdd35bd-f749-4f0f-8efe-6a1d9e276023", "value": "12288:OMrBy90qMudPfmBX++K9q6xPXrqSue03FzPi:Xy5DPfmoP9q6RXrqC0VLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686216365, "uuid": "625cc96f-392b-4fa5-aea3-86e37c348902", "value": 616448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686216365, "uuid": "b09f2949-6426-4d7e-8339-34988bae0e07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686216365, "uuid": "a0617c05-fabf-43d5-8612-4fd61da5b22b", "value": "77472348a029d8546196c58c7e976c16.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cb5a946-05c3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686204739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204739, "uuid": "affe9085-bde6-43f9-980d-69ffa86a24b0", "comment": "Malware payload (Mirai)", "value": "eb80cca22c9a6571e01895a85b7b15d2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204739, "uuid": "fdbc226d-6833-4718-bb73-4dd587bd139e", "comment": "Malware payload (Mirai)", "value": "38351ff8268be1696e809ce992d00d4d7ad8576f3e0128861ea854401b860e0e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204739, "uuid": "525c2677-65ac-4262-a7c4-1af0b56d1b95", "comment": "Malware payload (Mirai)", "value": "1daa2b27f8c9661b93ca2fce4a650786fab723c3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204739, "uuid": "5c53a4c7-8f17-444f-9c2a-0ca9f57e1a5a", "comment": "Malware payload (Mirai)", "value": "bbfd878e9455376b9586a757cda5ed887bd690318deb753188dd9188d21f748f403a102a7f6dd8e89c6b1df97b8ef2ac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204739, "uuid": "afc97572-fd81-4e04-b517-553c081fd402", "value": "T185632851BC819A13C6D1127BFA6E028D3B2613E8E3DF73179D225F2037C696B0D27A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204739, "uuid": "95369df8-40d4-45b6-b97e-66e0006c7348", "value": "1536:+NKlx0miiQJ1khGOf/kW0z+GiwcuZ487NRuFAv/W07:+NTmTEV6GiwcuWKZ/T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686204739, "uuid": "45bed390-5e8c-4300-9ffa-fdef504140d8", "value": 66936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686204739, "uuid": "822eaf29-4aeb-4da8-8a00-2c347371d422", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204739, "uuid": "55498462-774b-41ed-b94a-af7834002f51", "value": "eb80cca22c9a6571e01895a85b7b15d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b16b068-05a7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686192657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192657, "uuid": "0f646e7b-44f8-45c0-a133-1e3b4ef01193", "comment": "Malware payload (Amadey)", "value": "aa90a3da97219dc8dafa029bdcf85156", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192657, "uuid": "f515062b-2896-4509-acd1-ddc86cf3ae6d", "comment": "Malware payload (Amadey)", "value": "3942dcd4c9f110118328cb6c106628ff26d5bf57a0103db9d160a20533e2153f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192657, "uuid": "49750a63-4be8-4461-b17a-da489b61fe76", "comment": "Malware payload (Amadey)", "value": "aa76a2cf0cdf3a82f856af59d559eb63b5956b97", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192657, "uuid": "d4f1199e-4318-4a35-afa8-2c3043bacd01", "comment": "Malware payload (Amadey)", "value": "da5e3d80aa5596df83e2ed5af4ae95ca7e4d4a735b70c5201d960df5a2693fc29251db11da07c9c4b78eceb1be82bf66", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192657, "uuid": "22331b38-0bc6-472a-9030-c3d9938856fe", "value": "T178F41202D2EC5573D9F42BB05CF612971536BDA29E70C67F23825DAA0C736A0B93532B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192657, "uuid": "db75b85c-3269-46d9-b2a9-d717d19e0d59", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192657, "uuid": "8b5a49f3-487e-4316-a417-b226d215446b", "value": "12288:6MrLy90gAE+N+7+lWLtUmhRn7IUweb6OWEOEq/juGuMg+sFf6fX9bUV3vGNO:xy0z565hceLWEgCZMG6u99", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686192657, "uuid": "5fbdbde5-6fc8-403a-9592-e33b981917c1", "value": 770560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686192657, "uuid": "2d771d45-2671-4c6c-a47a-efbdaada17ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192657, "uuid": "8c59bc24-08f2-4303-a164-3d2255fc7d1c", "value": "aa90a3da97219dc8dafa029bdcf85156.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ed4df2a-05e4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686218835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686218835, "uuid": "71c10fbd-7897-4ab7-b099-ef719d1c3a17", "comment": "Malware payload (GuLoader)", "value": "95983b0202bbcdb63722e7a37dace963", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686218835, "uuid": "530d552d-4197-43c1-a831-d0aeaa8888cc", "comment": "Malware payload (GuLoader)", "value": "39cad9b07b0d322613b0da7574dc80f956daed10faeb63a36fede195a75331e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686218835, "uuid": "056a23cd-ca9b-489d-aeb7-dca8cab57fc0", "comment": "Malware payload (GuLoader)", "value": "fb9bb654449c3a95141582e1ad76fe8808253bb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686218835, "uuid": "f50e08e8-0597-4620-9c93-c3790d534d50", "comment": "Malware payload (GuLoader)", "value": "25f24704eea540fc96a75a9129c129ba142dee958aed092fb8338c5669f4ac2dd9ad34d021b870154a42f498d41f81e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686218835, "uuid": "345ad813-396c-4bff-95de-d3c7605ef998", "value": "T1BA7402A11B60C503DAA961B1FEA2CB372EB0EC490D55520707E8BE0B7E7F3635905B5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686218835, "uuid": "289b21a7-db9c-41c6-a0dc-18347072394f", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686218835, "uuid": "feaa56f8-d832-4e7f-bcde-376e8c8f58b2", "value": "6144:dwq3NpJC6373C1/bSlcXVX3hotJYgMcIV+28WJYhHh7EXBuslOslkTL1tVWPUj/:dzk6r3CZbS4XRu2EtHh7Grct2C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686218835, "uuid": "f213c9f0-1279-4cda-9de4-1a5dcf51c2dd", "value": 344216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686218835, "uuid": "ee192220-88fd-4f3f-a326-aa3c0393d0a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686218835, "uuid": "e9bdc942-b32c-4cd7-a213-9fe4336f0a05", "value": "39cad9b07b0d322613b0da7574dc80f956daed10faeb63a36fede195a75331e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "616d7315-05c3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686204720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204720, "uuid": "696fa133-7bad-41a3-84cd-ca2c6358b90a", "comment": "Malware payload (Mirai)", "value": "28084fb9295c69a9a0e7766a29b6b713", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204720, "uuid": "eeda340d-48af-46be-bf65-a0ab89ee1b15", "comment": "Malware payload (Mirai)", "value": "39dd53915e79ef051cee6ac36eb65557b3f154039f51bdcdb5514eb45f239f14", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204720, "uuid": "eb3f71ce-19e2-44d0-8ff3-ea142b4d08ab", "comment": "Malware payload (Mirai)", "value": "0839fbc06e41b51756958e4c3471442d590d5afd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204720, "uuid": "48ad00f0-641c-4486-8eb7-a98423420784", "comment": "Malware payload (Mirai)", "value": "8ee50fd84a630a3519e6f6aa355932d7c104252b48f9c0bbf386cfd2360e1abf323ef7a602ae2f20ba80362689a126d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204720, "uuid": "03b76eb7-b47c-48f8-a58d-747a59623df4", "value": "T118333BA5F8819612C6C111B7FB5E438D7B6A436CD1EF7303AE296F21738785B0E6B502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204720, "uuid": "cdb516f0-5201-4335-a859-d65f2b16a54c", "value": "768:FLLwGEicOgbD2PigHCE0J7dlz0TMFXJlpci4gDGpSl1EnVnwjyPgrwTdieI:FLFcOIFEwvTFXJr1XDGgl+lgMxie", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686204720, "uuid": "0aec8b83-3f05-4ef8-af9a-94ef78419bf6", "value": 54876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686204720, "uuid": "7ea098b2-3a5a-4dac-848a-dba00004eda6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204720, "uuid": "2d2ecfa4-8ea3-4f5f-9932-a3c81c2b4e2a", "value": "28084fb9295c69a9a0e7766a29b6b713", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f948719e-05ee-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686223443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686223443, "uuid": "b5a31a79-99c0-4ce6-865e-bf2a4cf0cc34", "comment": "Malware payload (AgentTesla)", "value": "0a948dbaa1ceef35d2c12518fe631031", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686223443, "uuid": "019ad885-9c52-42a2-99ab-8cb61294dbfe", "comment": "Malware payload (AgentTesla)", "value": "39f961f5b49ef78a9cb32548c8941dda6202da28953ce7013f5d8d3b49a69f48", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686223443, "uuid": "02f1d62e-a8bf-4d09-a5da-cdb5febafa37", "comment": "Malware payload (AgentTesla)", "value": "5c5d5909802257baa0c07e5833d12132021322a6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686223443, "uuid": "5853c683-758d-4842-bf8b-e04fc9e123b3", "comment": "Malware payload (AgentTesla)", "value": "91b487161e1b1dff2bc09fb250edcec583950336caac82c5be04a67f0d85ea89bd1c609f6e95f986385fb0930131e058", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686223443, "uuid": "5e4ab81a-4b65-44ac-846c-e9bce318b68a", "value": "T1DEE42264322A181BF8B7777526169EB00BB77B657430E79E0DC133EF5A8AF525228703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686223443, "uuid": "b01563b6-eb6c-4149-bc3e-9c4fae5f766a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686223443, "uuid": "e295f78a-35b1-4e6e-8a79-beb68a41b91c", "value": "12288:17z5GoJiGaq5au0FYoaL/0RscpsoBBc9TdMvpZ1H8lE46lN9Rl:x5GoR5azLi0h2oQ9TOf8lMl/Rl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686223443, "uuid": "9e201834-25ad-4877-a4d7-960fecdc52b1", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686223443, "uuid": "a41504fc-22b8-4cd0-af09-aafb93c6f561", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686223443, "uuid": "e0f883a9-efbf-42ea-b7e7-fda6361362ee", "value": "39f961f5b49ef78a9cb32548c8941dda6202da28953ce7013f5d8d3b49a69f48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ee27511-05c3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686204689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204689, "uuid": "250b6fcc-3962-48fc-9a75-b9268ff89870", "comment": "Malware payload (Mirai)", "value": "4e971c5fb3c97ade406aff7fc37267bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204689, "uuid": "eaea631b-7e54-42ef-b833-9c45b28d05dd", "comment": "Malware payload (Mirai)", "value": "3a7ec8209e44691e725fa29108399d6f6d16b723a4722d259b0c6db8787828b5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204689, "uuid": "ebe87ee9-8989-457c-8707-52f721348a38", "comment": "Malware payload (Mirai)", "value": "fae77f239cddef184eb9ff851dba2d53095e2abc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204689, "uuid": "49ed1d0b-d960-4269-9c63-3f9c0f21f121", "comment": "Malware payload (Mirai)", "value": "32f625a8b599ab71778afe15f47524962d64dd2667d505594d9892aca8104fcff590561900ab3533b2ce9d33be486c25", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204689, "uuid": "7e61d703-4824-4895-98c9-2d19de6700d0", "value": "T1A8F22935F9761E17C0C198B661FB8B28B9F507CB26A4D61A3D720E9DBF225406503DF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204689, "uuid": "e369f08f-13b1-46dc-8dc3-ae7b1e7c1e13", "value": "384:TMoVCnTdPOduOVypvhmRH6AUcaZlj2sRomSX+Qj7KMFU+pKW2biv9d:TMo+dPOVkvM61omSX+QjfO+LOiv9d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686204689, "uuid": "13168666-3d4f-44bc-aec8-ce1b97e3cb80", "value": 37332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686204689, "uuid": "7bb2c93c-a45b-4b1e-b933-a66782b878a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204689, "uuid": "90468aee-62ac-4452-8ed7-a6ac9321a137", "value": "4e971c5fb3c97ade406aff7fc37267bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb010112-05f9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686228063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686228063, "uuid": "cfa3ee34-03e9-46c1-9849-24c8ea042b7a", "comment": "Malware payload (Amadey)", "value": "a8a479bd5c3cb625e13eb4072aac6d84", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686228063, "uuid": "48bf1569-1542-4cf7-8abe-d2e054e489ed", "comment": "Malware payload (Amadey)", "value": "3a7f296f875c6b5bac610791e3ee31cb3bd2415cfa0511870cf90b46f34322fa", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686228063, "uuid": "3dd2f623-d982-401d-9a58-7d09cc0de7f4", "comment": "Malware payload (Amadey)", "value": "95bf275a206ceca59b5599f5cbce48e5b8036031", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686228063, "uuid": "5844e9f8-6029-4d17-baa4-73115954bd11", "comment": "Malware payload (Amadey)", "value": "d78f19690f64c17f5960ea2ca1f34761e8b6b3ba84f6472ba9b900f7672df280b124001cf7ce78664d13e21c74773b54", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686228063, "uuid": "0485be26-db3a-45c7-af83-58486fe99e65", "value": "T194D41253E6C85532E9B667B069FA03C31F37BD605A3486970A59D88F0DB3388A53137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686228063, "uuid": "b446699e-c72f-4a6f-b903-bb1e8675ed74", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686228063, "uuid": "288a750c-2659-4145-ba5c-0bf83f8407eb", "value": "12288:OMrHy90M5wAMaVAP6nttGQHtyXvMUrrxiy9TWRyrYk7+Jq5UR3Z:JyJLuyttLivMUrViiTWmYTU5URJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686228063, "uuid": "5e1f7098-11c4-4fd2-8d31-72ebac507c44", "value": 615936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686228063, "uuid": "3d3e008e-cd4c-4952-8255-410205a64979", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686228063, "uuid": "34ad5ce6-9922-4b58-bb78-951ebe3f9eb4", "value": "a8a479bd5c3cb625e13eb4072aac6d84.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b77e77e8-05a6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686192409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192409, "uuid": "537a124c-f903-4312-bcd0-d38460cf2fa6", "comment": "Malware payload (Amadey)", "value": "2fd6cdf7c8f3cb7f6cfe19ad9f0bb8ac", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192409, "uuid": "4230bfb3-af9f-48ee-8014-3093c0f67950", "comment": "Malware payload (Amadey)", "value": "3beb6926f920b26bb1a7ca4f8cee1f20eeea2bc660ddd2b16b04c7cd01d97231", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192409, "uuid": "0043fb83-c059-4365-9b8e-c00622c91729", "comment": "Malware payload (Amadey)", "value": "7c07447426c8b0188c01b8d49a347da2c42c45ab", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192409, "uuid": "7aabd291-bdb9-4108-b2f6-03570daa25d2", "comment": "Malware payload (Amadey)", "value": "594adcf426378c205c5b5e538f18264b565d279518e9e61b40323f1d96174283976e03268fdfe3d71665da912c46e8d0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192409, "uuid": "b2fb97ef-a5d5-431f-bf39-926977fac5d9", "value": "T1A424F7257D12C032D56061B619F5BFF2C59C6828ABB049DB7B800F77DA122F73A61E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192409, "uuid": "bced25c6-a145-4403-9f86-09b78bafe423", "value": "f8cc61ade86cb7277d0ab974de6323cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192409, "uuid": "cca33003-b2ec-4887-8fd7-2544afe6b9ce", "value": "3072:H/DmgskHbfHN+Pst60p0zuNmnKG7peNMQbuZAIqbey3lfbi:fDmfAfHN+wiuInRexuZAIij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686192409, "uuid": "175190ad-19b6-4527-a630-6e7824e1caa7", "value": 211578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686192409, "uuid": "0db0a3d5-a034-43d5-8a9f-c72f28cdfe56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192409, "uuid": "bcd25a7a-b3dd-4696-9aaa-8c320ff2db23", "value": "2fd6cdf7c8f3cb7f6cfe19ad9f0bb8ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "484a5f05-05ef-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686223576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686223576, "uuid": "88115168-cd78-41e9-b558-24683e9e2429", "comment": "Malware payload (AgentTesla)", "value": "8d1c1c78959985be8df6240606e07cdb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686223576, "uuid": "329a1ca3-d8be-4447-9452-0b6a3591677b", "comment": "Malware payload (AgentTesla)", "value": "3bf7b7244aaf94354649a6fcecee9add95d2e4768e8d60fb342202801ab16139", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686223576, "uuid": "46e06c99-8f42-4cfc-807f-a7c6457ecb5d", "comment": "Malware payload (AgentTesla)", "value": "ae31753f070735fd3fb06f2dda6a90198db900be", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686223576, "uuid": "7dc6bba5-794a-43b6-9ff7-c19f7aec147b", "comment": "Malware payload (AgentTesla)", "value": "0022c9e2a688eefc61d689c833607dc67522ad00a53fb44c295523b6ff9bf5646adea8e01f2a7798a717f0f19780dbbd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686223576, "uuid": "fc0fc5fc-6ecb-46ef-a514-125f976929be", "value": "T151E4010473A88B57F6BA7BF616529AB013F6B91A7835F20A0DC177DF4A33B048511B4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686223576, "uuid": "b81d3460-0104-4542-a65a-efdc5c706aa5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686223576, "uuid": "be1a28f3-a411-4848-b2b8-1694d95977b5", "value": "12288:8KY7z5GoJiGaq5au+9S9OghIZAg47f/YXl9LFo1a7BxZ1NzuyYsbdSQ:y5GoR5ab9MgY/YvLltuNcS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686223576, "uuid": "bc1cf7f0-2a36-4a35-8f8d-b9e0db128baf", "value": 683520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686223576, "uuid": "4ef39a8a-c703-49f4-b7a9-09836631996a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686223576, "uuid": "374f0711-035f-4820-a7ce-4da0421ae4bd", "value": "3bf7b7244aaf94354649a6fcecee9add95d2e4768e8d60fb342202801ab16139", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99511b66-0646-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686261078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686261078, "uuid": "9129cd43-08a8-486d-929d-3283104d1eb1", "comment": "Malware payload (Mirai)", "value": "d7b3cba2e8853a9a9f085154b4ade14e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686261078, "uuid": "dc2e36bd-01fa-4f65-964e-2044b2f0c28d", "comment": "Malware payload (Mirai)", "value": "3c548d7b7ef9245ebc95ab31b1885808607ed503b8721b7f62021de8fb90c8bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686261078, "uuid": "aaf47f71-97ad-4c84-bf9d-f7cb83e0e55a", "comment": "Malware payload (Mirai)", "value": "79b3fc6ce32153d2a80723f8a487ba5ebe173023", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686261078, "uuid": "e515fd0f-7e68-45d5-9e18-67b1757e8cad", "comment": "Malware payload (Mirai)", "value": "7f16a3c8d8b5de773a5091fe2428a057115dd6b5d75e22c20268c1e440a5af2a814e71bbb350567b72677e0ef61e2cfe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686261078, "uuid": "8c90f40a-9f99-4c45-8c3f-4f892e845623", "value": "T12A633A92BC819A02CAD412B6FE5F518E331623D9D2EA3207AD15AF2037CBD1F0E77251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686261078, "uuid": "56f047ec-389e-42ff-b7bc-fc7598f1082c", "value": "1536:/WloK05nJ7xkC0ztNrB28kkEWwq04AVW84lx1RVvH:/WNY7635q0EfXTVWp3dH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686261078, "uuid": "d724ac14-5dde-4680-b009-43bea6524d4e", "value": 72004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686261078, "uuid": "694cc233-2292-4fbd-a01e-30ede912fc70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686261078, "uuid": "13fb01a7-823b-4fc1-8b0e-55436e831691", "value": "d7b3cba2e8853a9a9f085154b4ade14e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3383daea-05cc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (NetSupport)", "timestamp": 1686208509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686208509, "uuid": "42c53dcb-3f78-4541-8fb7-57654350c94a", "comment": "Malware payload (NetSupport)", "value": "00ca8aab7965a690de1ef185b8b3ea6b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686208509, "uuid": "571d4661-bea1-4380-b446-53df04d2a109", "comment": "Malware payload (NetSupport)", "value": "3c710f1072b173b57a4af788eb196b69b3d4168361817cdb049dd6b7c8a97c0c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686208509, "uuid": "26a8f07c-9a46-4a40-bfcf-8a1bd5635253", "comment": "Malware payload (NetSupport)", "value": "90aea3abfc1e718966dc1ec60945ded4df60ab6d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686208509, "uuid": "cc3c1f07-e9a6-4a74-ad2b-d4595d441f26", "comment": "Malware payload (NetSupport)", "value": "a42f10363d24533f964ba89efadb0e07e14d1dc986c37f590b8bb2da3a809dd474d9f774c0d6057524bff36100162450", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686208509, "uuid": "992d2510-eb7d-44f0-97e0-4a78d256b873", "value": "T17633DE9826D3A0515613F47A932FA940E19608139D98FD47B88C7E10FFDE02CEEB55EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686208509, "uuid": "b3e8109a-95f9-47d1-a5fe-f985d2795cd1", "value": "768:i/FsatOC99XpOySa7yUxfwOVMSUBHfdE3sS5YmKqy9F:6WU7pOno+S+HSvEF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686208509, "uuid": "4e00ef51-2d8e-42f0-a449-e2cd633dab9f", "value": 51277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686208509, "uuid": "cc1a587c-b9d3-40d1-ac3e-1d747b52d23f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686208509, "uuid": "0173cda6-5a45-498b-ae04-2ab63f957592", "value": "pdf598598.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "217a1f2d-0593-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1686183997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686183997, "uuid": "8eebd803-54b8-48cc-8c16-12bbe8ff62a0", "comment": "Malware payload (GCleaner)", "value": "75e91bc77e696cdf2da97128f019fa85", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686183997, "uuid": "3ba49a31-3949-473e-8437-7dd0beafe303", "comment": "Malware payload (GCleaner)", "value": "3cdd0c8b421f43d235592c02e476b9c61341ddb653d392be9032268c515f1c27", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686183997, "uuid": "4b61397a-b35c-43a1-a3d7-e21a163420b4", "comment": "Malware payload (GCleaner)", "value": "498dce8a84d5b00299ab1431124ed39b97ea068d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686183997, "uuid": "ecea5e75-3386-40b5-97a3-0d2650d7a8aa", "comment": "Malware payload (GCleaner)", "value": "45654057cdcf3ebb25596b7dcb161468ba20ccb6bea6e7ed80480d9c19a42611d9bf7455213818e4c338d2ae7a876132", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686183997, "uuid": "0aecbf07-eec6-48e2-8dbd-df8b6a236624", "value": "T10654BE5366E07C61E9E256328E2EC6F8322FF2615F7CBB5A71265A1F09721E1D533302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686183997, "uuid": "d778b39c-06e7-427b-ab35-54eaca95ad1d", "value": "2e4173d4094e9bbe81d0a2fc8ae0cf99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686183997, "uuid": "0115c56d-c37a-4ec6-ab15-3f963d303ad3", "value": "3072:VycA5CsAKXQddjJwHQwd5M7Q0mFh+pzbV3obVQQkDcVwBq9XnzDTIiRXVPox5mmr:QRCsAKXQ52wdDzB32VQQ9wo9XjIYsv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686183997, "uuid": "ec30b3ae-6df1-455a-addd-cbfd2e0ebbc8", "value": 301568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686183997, "uuid": "df91f4d0-3159-4572-850d-1191276c30f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686183997, "uuid": "7717162d-830e-433d-84c6-9ab06e66ed1a", "value": "75e91bc77e696cdf2da97128f019fa85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50b8ebc7-05c4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686205122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686205122, "uuid": "121a3c3c-c784-42b3-be3a-6572f381103c", "comment": "Malware payload (Mirai)", "value": "f3ab5f0a2845702be593140ed1056c3c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686205122, "uuid": "3d55c083-029c-449b-884f-8c09453d4898", "comment": "Malware payload (Mirai)", "value": "3df05f9a7043147f995712e332826763b8ff038af1b7da408e280a3019f7bb2a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686205122, "uuid": "b0f532ed-c887-4fa2-ac5e-d21a60aa03db", "comment": "Malware payload (Mirai)", "value": "512a291055945fd910f102e13d7ecc9242fe6ab2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686205122, "uuid": "2cc0ef58-fa2a-462b-a84d-429d47f45e06", "comment": "Malware payload (Mirai)", "value": "a226155584da3c41e5106b6cb83aff3d007eff23e72b783ff5861499d954d338dc69025975c7d32a1c3867db20635830", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686205122, "uuid": "46fa1942-0088-4657-a00f-0808efef26d1", "value": "T19E92D0540A23B129DD44F53E8A3352207ABD784FDC1A7EEFDE77B16D1A0D2213188E00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686205122, "uuid": "683b39a7-984e-4358-85e5-ce11080fa495", "value": "384:DpmvOkELWDIYYUBRMWp0S1qwc0WlWmTrdMYRgssaxmQ68PpR6yq5lhKSN3:dGOw6UHpp0S1qd0gWCRsyf68PpRJs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686205122, "uuid": "aaa1dabf-fbad-4de8-861b-c234b13275b4", "value": 20584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686205122, "uuid": "6b370463-2671-4a66-9017-8f65d9829371", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686205122, "uuid": "380f8a7d-cb86-4f64-8b64-b6a891e4c7f2", "value": "f3ab5f0a2845702be593140ed1056c3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4a66c70-0646-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686261097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686261097, "uuid": "6af3d05a-97cd-4a63-b3cc-6a2445e372f2", "comment": "Malware payload (Mirai)", "value": "4d5d9964e9dde257ef3fe0ae9808cac0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686261097, "uuid": "dc00fc2d-31d2-488d-b94b-b2ac3a02525e", "comment": "Malware payload (Mirai)", "value": "3e41464ea1173f2b87ca1440e08b1dc7238d1a512d080eae23161fcf33d215f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686261097, "uuid": "9ca1e098-e215-429a-bb1b-b247335549d1", "comment": "Malware payload (Mirai)", "value": "c8ea4927ff1b890ac924615522f4844254202b23", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686261097, "uuid": "c084162e-4798-457b-acc7-21e2f5f7ee37", "comment": "Malware payload (Mirai)", "value": "61be3e4c540abade42a6a4d72de5c2abfaa59ada8948b9018e552a9169761487ca1aadbc9a7bf6bf5c09f1c9e8195a02", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686261097, "uuid": "f13f1c6d-814d-44e4-b152-a6dbadd06abd", "value": "T124732ADAB800DEBCF40ADAB68557490BF531A3518E930F36662BFD837D720A44D27D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686261097, "uuid": "6f4bf4b6-e516-405a-be28-9ee47ede9922", "value": "1536:awW0PKt9cwxjQ/dIXIdZzN3XD8Utia84GLf84Eo5WOK+7c4R6yN:awsgDdZzNDFtijjESWBryN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686261097, "uuid": "2f103f07-56a7-4531-9830-3623a39e688c", "value": 73524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686261097, "uuid": "99f40ff5-e2fb-40f2-b67b-bf726cfc306e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686261097, "uuid": "658635e4-268d-4ea3-b199-c529b6804d2d", "value": "4d5d9964e9dde257ef3fe0ae9808cac0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "080f725a-0639-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686255251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686255251, "uuid": "5d461236-c213-479e-a2ac-833d59d3ea38", "comment": "Malware payload", "value": "2d5abd21ea086208c95c0dc3c7febed5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686255251, "uuid": "5024aa4f-4868-4fc2-9215-cc60c9844a8c", "comment": "Malware payload", "value": "3ef6e2d77b69452be6d8101b1bc029570af3af86495111bbca696c92345547a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686255251, "uuid": "03d7a48b-caf7-4a3c-9d79-1f5b0812767e", "comment": "Malware payload", "value": "c7789859223961b77aa1992fac9ef7ee150b2b09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686255251, "uuid": "941db4d3-07c1-4b2f-8ae6-fdf709b4ff30", "comment": "Malware payload", "value": "7e50a97234f2a1c82df0dcc004791f1ceff9634e560c6ffb800368d22d9f1042f098fdba9bb533ce9a1a0b4c23f0af2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686255251, "uuid": "fe094c17-1d44-474d-bb2d-d7c92e7eadc5", "value": "T1CD845B1393E17D56E9254B338E1ECEE8364DFA508E093B652A18AA1F14B1271D1B3F1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686255251, "uuid": "24531854-5a9c-45bc-8c8e-21e4becdabca", "value": "ce94ff4312bf546ec7c0ebb9ac311897", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686255251, "uuid": "f608f0c8-9a13-42c0-a5a7-017298834f4d", "value": "6144:ex9PCdRmTO7s9RTU2u9lY/+/+hcXMH7UYmJtqz9+4:eDPCnJAxMck+mXyxmJwz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686255251, "uuid": "b77820be-d78b-4526-b71e-7fc9c63f0618", "value": 382464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686255251, "uuid": "3cfb9cbb-6f46-4a60-8125-a0f55a1b87d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686255251, "uuid": "8d195108-bec1-4c6c-a120-59abc07d6632", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "964bb5c4-05d5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686212540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686212540, "uuid": "0e761ffb-4805-4fe7-9d62-abc9d82fd77c", "comment": "Malware payload (AgentTesla)", "value": "3a629e0c90950ad8a90bf6c64cc25555", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686212540, "uuid": "a79c6c5f-e408-4927-9ca7-a86a53877663", "comment": "Malware payload (AgentTesla)", "value": "40247a3716900e213541061e25967670cfaa9415f554228dd6766e93a0def8f5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686212540, "uuid": "86a28ddc-e370-41a1-b596-5e35e04aa7d3", "comment": "Malware payload (AgentTesla)", "value": "b04d169506f11c5354ffcd2eecf3df153e8c6f63", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686212540, "uuid": "32092795-561c-4966-ba28-cbadec4ebbad", "comment": "Malware payload (AgentTesla)", "value": "6c3114591ad2fe4dd1cce55c360c4a436d203b21d889565f445016053063f3a116bce2b804631fb714cb63ca69c1032c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686212540, "uuid": "35bdfb7b-42b9-4d5d-abf5-5d3af3448877", "value": "T13225A13926751D228239D23E95DAF90BBA544DC3360CDD1E97C64F9A0A037B6E0CEE1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686212540, "uuid": "14373665-6c3a-4b7a-9f1c-7ad0c12e98a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686212540, "uuid": "b790c884-9b3d-47b5-9428-fbd5d0dad25e", "value": "12288:cNEewUSsZsVP8Pl1YKHjjD1966I4/u0Oa1ipDMJYx76npgI9DDUEiLNngci0gNs3:hdP8FH196v4F+SJYmvFiS3uRZf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686212540, "uuid": "58e6c907-7a0a-40ec-b15d-87e3864cb37f", "value": 1038848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686212540, "uuid": "fb215f1c-5ff1-41b8-b81f-beed0a2f0352", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686212540, "uuid": "28a19fd5-927c-4d5d-94ce-2f93d5a49e86", "value": "NEW ORDER ENQUIRY-JQ2341024749.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3223c64-05e8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686220856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220856, "uuid": "408ea5d5-d640-454a-89ff-e3853641b236", "comment": "Malware payload (RedLineStealer)", "value": "ef6e113e3753752935555bca6a53064c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220856, "uuid": "680819c4-4771-4132-8771-f545b8f4777b", "comment": "Malware payload (RedLineStealer)", "value": "40490ad3f61c37853fcc8c76386f0d17378f98bdad88f64e75e42efc0d4d0ded", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220856, "uuid": "d098bdf1-1176-4631-8db0-dbd11e4f9877", "comment": "Malware payload (RedLineStealer)", "value": "6d3b3f6991387a28d2c22f9eced1e8836b1701fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220856, "uuid": "0a61b2e3-ff2f-41bd-983e-f3e248ab0f90", "comment": "Malware payload (RedLineStealer)", "value": "835ee18990117897981d22f96d87f885a199d5a6e79b21258aa7cfdbaf31ae9731b9a6b9b13c6897029d3718e5600e21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220856, "uuid": "b39991b9-ed4f-495d-84da-a69c2d68eb09", "value": "T1C7F41242BBE40573F5B053B048F61BD31E31FCE29D71926B2289665E98B32C49E7136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220856, "uuid": "48ea7b27-2d66-45bd-875a-cc5ab8f532fe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220856, "uuid": "12a2cd7d-5233-40a0-be8c-2929c99da75e", "value": "12288:BMrTy9065CKlda5gCwnQlcFk4QSem/p+QJ1j1Stt8X7pAq2x2xEyQuaMxf5SYr5:OyP5CKlM5BwQuyHDGU8rpexa6YGYr5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686220856, "uuid": "0f466ffd-55c6-4b18-9959-a38a7906ab28", "value": 790528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686220856, "uuid": "a00ad50e-d746-4f35-a56f-ceb6b38c08e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220856, "uuid": "a37982a3-e5e1-4b65-ad6c-05b839dbd933", "value": "ef6e113e3753752935555bca6a53064c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16164ef6-05ee-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686223062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686223062, "uuid": "ceddf3ca-d357-4b11-bc10-29fbbc26fd52", "comment": "Malware payload (RedLineStealer)", "value": "5e25a6a8831cbeffeeac7f9c553d2f25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686223062, "uuid": "979e38d9-41e0-423a-9431-a5800cbf24f9", "comment": "Malware payload (RedLineStealer)", "value": "41021d6f5c436579daeae0e30121afbc5f1b624737560565f4c023fd0d229650", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686223062, "uuid": "4e76073e-4f81-40c5-906a-4296744847ea", "comment": "Malware payload (RedLineStealer)", "value": "ffbfd2ccbf2dd8f581e409f856580e6beaa09292", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686223062, "uuid": "91a97433-bd5b-4eec-a854-636a113d1177", "comment": "Malware payload (RedLineStealer)", "value": "e32b6ffaafa4875a311caeb4027c08c326454f5a3d2b727b71cf8e9090f2377d144789de0cb6f64487a37b9fafaf15f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686223062, "uuid": "0716fe13-2d32-4a80-856f-61563130dfed", "value": "T17D34CF2075C1C1B3C4B6113044E6CA7A9E3A7431477A96D7B7DD2BBA6E203E1A7362CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686223062, "uuid": "a0e9dcfd-9a99-4560-97c7-42280a80644a", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686223062, "uuid": "97f744dd-8d2d-472b-99e9-966d3c694e14", "value": "6144:wDKW1Lgbdl0TBBvjc/P/RJdUfwxd0dcX1:Wh1Lk70TnvjcHWuOGX1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686223062, "uuid": "36f8e44b-3d13-4889-9498-02e25f9db775", "value": 250368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686223062, "uuid": "8f09c6ea-aa04-4074-bdae-7bf65525e27e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686223062, "uuid": "3c0859ee-91f2-4249-b138-571e62003605", "value": "41021d6f5c436579daeae0e30121afbc5f1b624737560565f4c023fd0d229650", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2ac35d5-05dc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686215674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686215674, "uuid": "07f61961-31b3-4c16-9cbc-abb75635d751", "comment": "Malware payload (Formbook)", "value": "e6f5dfc983297d72ec27f94a2b695b03", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686215674, "uuid": "88c63ce0-5087-4ce5-a3e0-2e28408cf589", "comment": "Malware payload (Formbook)", "value": "41ab6054625f7a03d1a0af44403ac248ca880ddc0141f61e41755b6f2263e42a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686215674, "uuid": "f1b0b4f7-743f-4d28-9a95-32fd791f10a3", "comment": "Malware payload (Formbook)", "value": "c7063a9fb0d51cd5d2c6228a2bde61f113f9e4ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686215674, "uuid": "5a7f8d73-b576-4b55-8ab2-39db390d70ca", "comment": "Malware payload (Formbook)", "value": "ab1e65dd89b53aa81799373391a525ee876d19ec175f2cca62aaf230a6d8129ad797f5f86c6370840dc2fa6c3d7dbf89", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686215674, "uuid": "c3b55e98-fac1-4682-a115-0e2daf0cc7a2", "value": "T16905010832F6DB19D57A3FFC0890947083F091AA7556E78A0ED378DA5E71F428F0299B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686215674, "uuid": "a034cd2b-ae81-4e38-bd7e-fbc0bd25a5ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686215674, "uuid": "c06fb1a6-3693-45f8-9366-d2edca142a78", "value": "24576:WMK8ZHlWxMiQW/O4ue7NnQHhGvB/wL2gs4SXxj:6elYMiQWmS797vpwL04I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686215674, "uuid": "ef743b18-69ee-4e93-8277-133d32c208f8", "value": 857600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686215674, "uuid": "11fd114b-cf87-4098-a47e-eb624f52a762", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686215674, "uuid": "669f0c3b-2ee5-490e-a967-465d3ef1f962", "value": "e6f5dfc983297d72ec27f94a2b695b03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5b61f3c-05bc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686201962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201962, "uuid": "5e383a02-e380-469b-a35f-8f8df3d1dc9f", "comment": "Malware payload (Amadey)", "value": "5f86339329163681ea3246f413a740f6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201962, "uuid": "c40dd4b4-3cde-4cb0-af71-6f44c2e0cab3", "comment": "Malware payload (Amadey)", "value": "42241ef18f45bd6ff00590b0ed9b65bd9a3cc1ea182f85f2f40aef68c0ca0b88", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201962, "uuid": "c6fccf3a-9cb9-4749-bb1b-b990059de789", "comment": "Malware payload (Amadey)", "value": "6b6b552ae12659ef1e473bb39ac2f092067b3876", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201962, "uuid": "607b544f-1e0d-47e1-976a-5878ba4e247e", "comment": "Malware payload (Amadey)", "value": "d8e79a0ff08825f94fa28e29731f43de360389d06b4f9161de8dbf9068ca901303a50e9e7cbda45d6db20adcd6126103", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686201962, "uuid": "03c5540f-2762-46ee-8185-b464a6f6840f", "value": "T149F42312E7D98573E9B22B3048F706D31B3E3D924D78979B2205AA5A0DB25C1EC3477B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686201962, "uuid": "96b28a38-98ef-438e-8940-7b13b38450f3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686201962, "uuid": "03434060-0725-414f-9999-652e9e512942", "value": "12288:NMrAy90DdpFX/8Pp39GR41MRFSh30gg28/pXCxDTMbpCB0OZ1ZrfXv:tyO/XUPp39q4GM3l/8/FqIgaypXv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686201962, "uuid": "05befab5-2821-4d45-ac45-0833133988ce", "value": 771072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686201962, "uuid": "3169c8bb-5ce1-445a-923d-252e1e1334ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686201962, "uuid": "930f6cf4-7ffa-44cc-8ad6-1d00a9556fa9", "value": "5f86339329163681ea3246f413a740f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cb049c3-0600-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686230858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230858, "uuid": "f5436ccd-4612-45b9-a3f7-ea3223c7531d", "comment": "Malware payload (AgentTesla)", "value": "29f0050e4390d0ac2964d3cc89b119d9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230858, "uuid": "17949203-a171-4a53-b51a-7f92cea983e9", "comment": "Malware payload (AgentTesla)", "value": "4263607e5289dd80c01bc53319d102d906e806053852137dc781e0ad7853dcb9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230858, "uuid": "5b6f4d3e-72eb-42e3-b797-0138f2b2da7a", "comment": "Malware payload (AgentTesla)", "value": "4dc9b0e1e25045be70087324980be51a2799224a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230858, "uuid": "2a6ecd1a-147e-496c-ae89-b45c433c4eff", "comment": "Malware payload (AgentTesla)", "value": "19ceea1c6af6a5c2b23b98634788dcd3f4e86bf23314321dcd21303416e2d8a39f20c3ab24e4c5bd73caa5b006f45d98", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686230858, "uuid": "09cbea8e-fad7-48be-a542-4ff997547bb7", "value": "T1B2454BA56B900925F548873647E2275AF370B806B2B4436A765D832C5FBEEC48EB0DDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686230858, "uuid": "1d73d4ca-4e84-49a4-ba1a-c9705f0b3c67", "value": "96:5Aj9thIjUoOAsxJOHEHtNzVGz9zLTrsbyrDJa+szmhKhqJsq9FrWJcZnsx87sBkT:ajk4OHeRkFTrsbsd5gmUhqBrWJss7kT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686230858, "uuid": "4929983b-bf1e-450f-9998-c60c7c8f0082", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686230858, "uuid": "dd4943d4-8067-4ba1-b4ed-4507f450de92", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686230858, "uuid": "ad680934-4951-4e87-950c-4bcc14a1aaa7", "value": "Nr.2178759 Technische Dokumentation.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a87f232-05ee-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686223284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686223284, "uuid": "36fbe9f3-7086-4d17-ba1e-afff56a9c712", "comment": "Malware payload (AgentTesla)", "value": "d40f962e9b3f7ba45b639ec3c57b2b17", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686223284, "uuid": "e6ae76e3-e921-4572-be2f-3f241b8cf23b", "comment": "Malware payload (AgentTesla)", "value": "42cc7be87aa3dc4356b4eab6fbf0e6eaac9f1b8e351234b15f332fa4e57bacaa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686223284, "uuid": "406e40ec-3d70-4c18-8555-632e60bf0ae7", "comment": "Malware payload (AgentTesla)", "value": "9416ee7d65af7395dbc58a1ee911451ef4533ba8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686223284, "uuid": "e0ef86bc-2dcf-4704-a83d-3f835f948708", "comment": "Malware payload (AgentTesla)", "value": "50f4c6851e8c278150501de73d13eb10bc392dd233f6c2f2390dc32ea25e0273e816403a0473e93682c3c887350ba4db", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686223284, "uuid": "0c7398df-d4a1-4046-971d-cfa67d75964f", "value": "T11C140812BFA68EB2C38E1B3BD5D705484BB9ED51A103FB0F398B13B929437B64941647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686223284, "uuid": "4a1d8031-b43b-43ac-8feb-6aaf9050d46e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686223284, "uuid": "9bd17244-c73e-4380-9ea8-1446793a0d02", "value": "3072:LiX/BxdZQNCuWrYcMnakPv8eZ0e757+gSfeCRodrGUpgxYnDRy3Cma:wBxEEuWcc8a60sb756jeCRodrGJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686223284, "uuid": "5dde296b-3646-424c-beda-6245a3ca7c8a", "value": 195072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686223284, "uuid": "96571e7a-5d55-483b-b63c-4597ccae51ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686223284, "uuid": "048850ec-c444-456f-bbce-b756f9eeb065", "value": "42cc7be87aa3dc4356b4eab6fbf0e6eaac9f1b8e351234b15f332fa4e57bacaa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3e96761-0640-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686258599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686258599, "uuid": "152753d5-a7c0-4007-b5b0-cab9ffc9ec58", "comment": "Malware payload", "value": "a7f4dbbedb3c2899d1e047847044d6d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686258599, "uuid": "cac1de65-8681-47f7-8cde-cbf41c0ba2a7", "comment": "Malware payload", "value": "42d18e186ce411812e02008023380c2f968d4e1a304040a7002ea56c77bb7342", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686258599, "uuid": "beb18367-42a2-4cd4-ac6f-60175e7693e8", "comment": "Malware payload", "value": "06d2cddcc01e96bdaca9de9f905886b2cc22cdba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686258599, "uuid": "ae2cf95a-6da0-4b75-9e9d-58f2723c1f98", "comment": "Malware payload", "value": "0188157326056697ed26f674dece4b6af5ee98e7a26f5f03799f7b4ac164feca726aee7133593ee006741e9f37a32ae1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686258599, "uuid": "44106f21-689c-4163-99f7-a30c666635ca", "value": "T1C7645A1137E0D036C2B331724A66D7756AAEBC205E35838B77D03B3D9E306D1AA3875A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686258599, "uuid": "b944e3c6-aac0-49e8-a011-a5a2238f1a65", "value": "55fbfc75ff3e3b3dbc89bbe374193fa5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686258599, "uuid": "faa792ff-8988-41d6-ab1f-e49b7ba00383", "value": "6144:5fNHfH8W3rYNWGNyVQuCt+6rOodbOatmjg7inHLFoFKXAS1Idi7F:5fhfHnGNyV0YJjg7iHpgKXAIIdi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686258599, "uuid": "9bd200a3-fa9d-484d-87bf-7833e923bfec", "value": 310272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686258599, "uuid": "16b1a181-244e-4b6e-8983-003e39081f13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686258599, "uuid": "de917cc9-8bbe-402c-8612-687652b28e51", "value": "42d18e186ce411812e02008023380c2f968d4e1a304040a7002ea56c77bb7342", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fcaff90-05d0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686210408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686210408, "uuid": "a8eb14eb-7098-4de0-9bee-17c6a98a5e78", "comment": "Malware payload (Mirai)", "value": "7cfbf149084a82e0e45d369799c57b66", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686210408, "uuid": "862e8d29-4489-4ea4-a382-27cd989a9c9a", "comment": "Malware payload (Mirai)", "value": "4322e33f7aa171cf20461186742443a31a0ce497e20d237aca2fd449500f08bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686210408, "uuid": "0d0640fa-9c11-49a4-b59d-c581d8a63748", "comment": "Malware payload (Mirai)", "value": "9120cfb2856d24006d43165d0d7fcca87ea4ee73", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686210408, "uuid": "9c0ae0b4-2419-42af-9c63-e67e646dd46d", "comment": "Malware payload (Mirai)", "value": "837b98c5af05e07557d6b39daa9a3d763df225ae56d50f1072efccfbf1f6b9d3997b221c75917b78c2282bc98f069df2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686210408, "uuid": "1454f04b-40ae-4a9a-9517-2b6a698b9a95", "value": "T1C13154A09AC04E6DC8E042FF5C0943507352DF4DD1C77212A21CA7686D1EE1CCC1701B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686210408, "uuid": "713284e4-8142-49ad-94b1-f0bbdf00caca", "value": "24:6yYGpa7Urz/jlfQ+XK1G9Vev3gRGRP9iI/q8/+o+XLwAmE0Balix+uG6/:8Gpa7UrLZERlPIwOL1mtBaMTz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686210408, "uuid": "2e8d7026-b3ab-48fb-971c-abf6d89739ed", "value": 1660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686210408, "uuid": "e52c66cb-165f-4059-9e1b-118283b1132b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686210408, "uuid": "5d4f759d-142c-4e54-8c86-4b99b3887e34", "value": "7cfbf149084a82e0e45d369799c57b66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6898e59-0592-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686183898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686183898, "uuid": "602ae817-04b9-4139-8667-7e5c1dfa0644", "comment": "Malware payload (RedLineStealer)", "value": "576c9238fd8048f8be65cbf18a96c38d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686183898, "uuid": "8168026f-9a2f-4754-9f70-2e39e72696e7", "comment": "Malware payload (RedLineStealer)", "value": "450d78ed6b4d456212f4150065e2b0f5852fbe52ef396386c01362590fd0c3b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686183898, "uuid": "cbf7cbce-c52d-4d78-b759-79f2b75e3c14", "comment": "Malware payload (RedLineStealer)", "value": "be09634eb2c993c180a7af2ae41ebb098b22e5ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686183898, "uuid": "c64ec427-06b0-425b-877e-ea58461a0e50", "comment": "Malware payload (RedLineStealer)", "value": "a20723ab175e3093f9e126b56a9687b06f3e10663d9bf588e499701decc8495249f81bd87c2e9a5b890ed57f4456e31d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686183898, "uuid": "2aed311b-bb07-490b-945d-7720e26b27b7", "value": "T15554480237C68CBDF8AA073D60D48F3DC877ED60165464FA37A89A618ED0313959B5BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686183898, "uuid": "34a621c3-daf9-4e54-a58d-19ee99d117cb", "value": "f264906d4975bf1277da66f2124faba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686183898, "uuid": "a7fecf83-10bf-41a6-9ebc-bde991c05ac1", "value": "6144:rQvoWvJfoZuwvTygXUNVS4MGh1aBFrvz1xcxcWh9rt:rUO/yR1aBFrvz1xcxd9rt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686183898, "uuid": "e8b50de9-1088-4aa5-9e49-85b871ed3218", "value": 288903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686183898, "uuid": "69c8eb57-a634-4d12-ad1f-a57fe9552b98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686183898, "uuid": "eb14cc6f-c0dd-49b6-bdcc-17d977cf6119", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f1000d9-05ea-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686221574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686221574, "uuid": "5af3c6e3-a79a-409b-b9d6-90e2205be859", "comment": "Malware payload (GuLoader)", "value": "67c8292fb54b62020a54e423bb7cfa4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686221574, "uuid": "f8e045a8-1c74-42e2-832d-bdab59d9d319", "comment": "Malware payload (GuLoader)", "value": "45923109350d3e2ccd5366be4133c2e8a7e300abb9b19fdc85695497f4c57347", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686221574, "uuid": "09cb84d1-45ce-4fe3-9eba-f80d1912f3c6", "comment": "Malware payload (GuLoader)", "value": "2501ce905fd69ad6010eb690cf2e607c95e6607e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686221574, "uuid": "2a0d524d-abe4-464c-928e-b2066d333dc0", "comment": "Malware payload (GuLoader)", "value": "fff4dc2ff502e007786c6cd313761639e64cc2b36588600f5722545c89459ce851b0291f24b7cdaa6651e0592554e633", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686221574, "uuid": "168a6a09-cc80-4267-8c64-36c495191a22", "value": "T1E7A4BEC5F6B34526C3AD0274BFBFD764D6749C08080127362278BE2679EA3F5D507AA8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686221574, "uuid": "e166ef34-20b5-4839-9702-a670367b469b", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686221574, "uuid": "41d12d6e-7d08-4981-abe9-0a45d56de37d", "value": "12288:RyypyHyyyhyZyVF5ffqy0yyyLyly0bLBhXx1Qy+yyyyxvqy4Scb8yfyy6W8x0cuB:G7Ei82d4qobdw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686221574, "uuid": "e240d555-59d0-415d-9587-1b84d35876c0", "value": 489023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686221574, "uuid": "f52b9937-7f33-477d-8e96-3bb9e73c505d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686221574, "uuid": "84f47b1e-6fbf-46af-a2db-5929b20e0bd0", "value": "45923109350d3e2ccd5366be4133c2e8a7e300abb9b19fdc85695497f4c57347", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16ced38d-05f9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (BluStealer)", "timestamp": 1686227788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227788, "uuid": "837567e6-bdd0-4b4a-a29f-ed919b1ed67f", "comment": "Malware payload (BluStealer)", "value": "a1effb2cfe2a999d25a2f16a3271b0ec", "object_relation": "md5", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227788, "uuid": "432c087b-7869-4b46-8f2b-d119337abdf3", "comment": "Malware payload (BluStealer)", "value": "45c0d4c42e3d98c94d5ae01270b7b0adfe3de2454520fa7b423f0fc9e2f49603", "object_relation": "sha256", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227788, "uuid": "327b7acf-a7df-44cd-a41c-9e0f6b799084", "comment": "Malware payload (BluStealer)", "value": "68752a3d1b5c2837829f4b1e9d59fa7529d4ed07", "object_relation": "sha1", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227788, "uuid": "f55bdf23-0a8c-4463-8a98-bade7ea59189", "comment": "Malware payload (BluStealer)", "value": "46bb8fa233ad1436fec462b0e37a267aae461bf4b48241d868238e6af02aa56698d7f2c03fa4a47d1dc8cc09fe52f021", "object_relation": "sha3-384", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227788, "uuid": "7bcd9b0d-52e0-469c-a9ac-d1ff4e1f0ce2", "value": "T121250151B2BB4B2BC5BB53F5840063385BBE6AACB872D7064EDBF4D66551F010AD0B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227788, "uuid": "913e7acb-48cb-4e54-a704-00efb80aaf91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227788, "uuid": "d44add3c-8c43-47eb-937b-aadca29c99ce", "value": "24576:S9LaVUH999wbJG2Bzr7G9Fvqp8vYtY3aoT55ybAt:+BH9w1Havq6vYS34bA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686227788, "uuid": "09b0ce6c-cabb-4dcf-b4c7-73928fc7bad3", "value": 1048576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686227788, "uuid": "4d94ab99-979f-40f6-a40c-ef8f2feebd3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227788, "uuid": "95c3aa9f-f89d-412d-9524-6397c64ac227", "value": "45c0d4c42e3d98c94d5ae01270b7b0adfe3de2454520fa7b423f0fc9e2f49603", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2cb840d-05e3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686218601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686218601, "uuid": "be50a66b-dec8-4d5c-b753-cf2d6fa92370", "comment": "Malware payload (AgentTesla)", "value": "ef86dc729baa0495a965624481e6f1a7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686218601, "uuid": "fbae24d1-b611-48e2-b131-e03b1df4932c", "comment": "Malware payload (AgentTesla)", "value": "460a9286ae71b54f4ebee137bae14b65f07395d27d420fdf8f13a80031b002b8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686218601, "uuid": "43579ad4-3562-4c06-b9c0-99e407198b8a", "comment": "Malware payload (AgentTesla)", "value": "f9e3084c3621a73dd93b40bd25d27ab5ce88d998", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686218601, "uuid": "11eee31b-d862-4ef9-a497-cc21c6ee4e63", "comment": "Malware payload (AgentTesla)", "value": "11ccc58a247778c01721ba5f29c41d148875d4705d5a178f45afb869947aa6094dc3dfdf754c735af83de1e1f183f3e1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686218601, "uuid": "a76ed64e-259a-4a71-9d31-36924514d551", "value": "T1A9F32A289289BDD1C33F40B9D4B01144DFB2A8668607E75D5DA19CF63B47783322EFA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686218601, "uuid": "794df4e5-f1af-41b1-96f7-f41fe120340d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686218601, "uuid": "b4ee1aab-d0ca-490c-8481-b67e3c313599", "value": "3072:iTH3dA00skXOu8hwHIdT1/Lz17iVW7hpwPMsem:iTH3dA00h8hwH0h1qM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686218601, "uuid": "5a84265c-b86c-45db-b09c-00da235d3347", "value": 168448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686218601, "uuid": "817f1175-1fac-44a9-8f5b-12e978374429", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686218601, "uuid": "537212c5-1f57-4a6b-bfab-92ed68acf9b0", "value": "460a9286ae71b54f4ebee137bae14b65f07395d27d420fdf8f13a80031b002b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "486e3059-05c4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686205108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686205108, "uuid": "c1249c6b-7f35-4664-a66e-901b7255225f", "comment": "Malware payload (Mirai)", "value": "b0a5943646de3c1eaad2be9d3f1d74f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686205108, "uuid": "8e182f1f-b4b6-448a-b4c8-818989fb70c0", "comment": "Malware payload (Mirai)", "value": "46970b6d048d6153a91854a1a3cc7a1d0be23586b9c994dd281c2bce9289a182", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686205108, "uuid": "ebb26727-b7a7-4d41-83a3-3c200563fc11", "comment": "Malware payload (Mirai)", "value": "00635a28966a81bffadd43b78f38c9ee7dc97b3d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686205108, "uuid": "a2cbfb18-cd33-4376-a9b0-fb45a57fd33d", "comment": "Malware payload (Mirai)", "value": "7c2b9212806dddbbb895643c2bf31202a0eb6bd6379e5de483f1830c6931a736b411baacf21ea48814dcd17f83826a53", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686205108, "uuid": "2d4b4c3f-6773-4731-9d94-4da26a9e235c", "value": "T15182BF31D38980B3C0B08CF5ED7E858E63466EFDA1B574A2FB58436DADFA00C4E69416", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686205108, "uuid": "b1752341-c9c7-4556-85d5-efd0c8194148", "value": "384:rC1DAGtN2dTv4ENiGgV0d0trdyADx8HMZuvBzeVimdGU5Ea:+TN2dTQoEVawrdjd8Hguvd6i3Up", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686205108, "uuid": "c64b5b53-f781-4851-b96b-f59b6acb57d7", "value": 18148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686205108, "uuid": "be72b276-474c-4f67-b6ce-dac5257e872a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686205108, "uuid": "1dc00ec6-8667-464e-b096-2735e4027a6b", "value": "b0a5943646de3c1eaad2be9d3f1d74f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6589bfa0-05c9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686207304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207304, "uuid": "b9844030-f94d-46c2-9f86-0ecd6da3f671", "comment": "Malware payload (Mirai)", "value": "59a8f10cf1b4574df4697effbef38854", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207304, "uuid": "2c0af506-3d6e-415d-bb2c-e4181762233d", "comment": "Malware payload (Mirai)", "value": "46a1d3783a74d542595e2be9186bd125c1a3a7d9865c67334a28371d5a388d0e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207304, "uuid": "d7ec6292-43b4-41d8-9a03-0189e2d076c6", "comment": "Malware payload (Mirai)", "value": "ac6e65e36cb1ff1ed01d2231eb28bd9efbb9327a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207304, "uuid": "ac55639e-37eb-4e9b-bd80-a0dce28545b5", "comment": "Malware payload (Mirai)", "value": "d2f57f1d43933ecc28ff2367d569b931c7d9d512e0277993ee9700855abdbfa124c201f9cc4dcaf252bce3995161d887", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207304, "uuid": "e8c10fe7-5024-4ed3-81e3-adad4d60bbb6", "value": "T165E34C46EA808B13C4D61776BADF42453323A764D3EB73069928BFB43F8679E0E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207304, "uuid": "be67f7e0-0b30-47aa-a04a-e7f141f4518e", "value": "3072:02uU5BgbIZokVEUBrsNa4GRs2SgYvZ2E9ee/unS5oM/9TdpK:ZuU5BxVvINa4GRs2SNvXL/uSSM/9zK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686207304, "uuid": "0dc2e73e-09ce-4bea-87e8-dd7e08c7748c", "value": 154214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686207304, "uuid": "f1bb81bb-a216-4d0d-bd0b-e8891d0f83cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207304, "uuid": "bfda9b87-2d38-43cc-9aa8-0524ab7a2c8a", "value": "59a8f10cf1b4574df4697effbef38854", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25c1388e-05bb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686201184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201184, "uuid": "62cf96a5-9ccb-490b-9bb7-f3ad68f5d998", "comment": "Malware payload (Mirai)", "value": "b96f4fcf1967b5d74f05b974ee240222", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201184, "uuid": "ad56730d-5a3d-4719-8f95-dad76cf0f1e8", "comment": "Malware payload (Mirai)", "value": "47193512ae551b8c469a4107b79182ea578e6d4fb7ca227efa6763ca2a564383", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201184, "uuid": "dd97df1f-6dd9-4bad-a8af-82ad407ea498", "comment": "Malware payload (Mirai)", "value": "54361f9e1ca899cb7a5f68c5b839ca013e285b84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201184, "uuid": "1c252476-ce5e-422e-bcb7-b6ab430f6617", "comment": "Malware payload (Mirai)", "value": "e51f84b70368660a64a473feb64c553f802e33a7e78cef367a028005c55e91f0b08266be7ee61c611d11e1546b928da0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686201184, "uuid": "ebce8313-b39e-417e-a304-e11b76532888", "value": "T13D258D6BB2B374BDC157C1314BABCB756934F07501226D7B22C496382E16EA04F1BBA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686201184, "uuid": "37d18861-fcfd-46b4-ab43-94a15d90f3b7", "value": "24576:e17JR17Jq17JR17JM17J917J917Jl17Jv17JT17Jg17JI17Jl17JBAb4uMQQ+zO4:EAb4TQQj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686201184, "uuid": "7ac67610-da93-49b9-a968-e79d0e7e034d", "value": 969464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686201184, "uuid": "d68ad916-9a9c-44b1-a043-9bc34b45d9d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686201184, "uuid": "89855976-bbc3-4bf8-a3ab-e23cb60e9fc1", "value": "mirai.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77a1713b-05f9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686227950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227950, "uuid": "ebed39a9-5d78-4e41-9e83-a68b4b504f63", "comment": "Malware payload (AgentTesla)", "value": "c6b464c901f8ef206f7c7def30ea6df8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227950, "uuid": "427c4b0f-6596-4832-a6cd-f74ffffb578b", "comment": "Malware payload (AgentTesla)", "value": "47560478ac10be3464c9193150527e27af88e214e2c8acace019e7fe32df5197", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227950, "uuid": "640a4e43-fcba-4f2f-890f-ab6f959a6810", "comment": "Malware payload (AgentTesla)", "value": "0a4cdb1f4049927aea95a04e65f64d8e0cf5daf6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227950, "uuid": "fd0b4a22-0ddf-40e1-abd8-c3a2b5edf695", "comment": "Malware payload (AgentTesla)", "value": "9d8ac94322272f81f75ac1f3a138ae920a2f3f9aea793ed9de857af6f13f2f814108da83d972341bbe1b61a22951233b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227950, "uuid": "ba124c1f-55b8-476d-94a8-a2a3f1034c5c", "value": "T1D6F42290F997882FD6830FB44898777065EC43E6B4B2DB5B1C8BA4F5CB16E9F0181366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227950, "uuid": "459c5351-f9ed-46d2-a73b-6805b298c4f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227950, "uuid": "aeb2f3e7-d6a0-4bf1-9461-482309a5fe9e", "value": "12288:WPRP2B0xTGlxNqvNu2hZ+nUEsn9h6kl3RaiM49Y1LMf6N85zkmBhHe4lvR1v76D9:WZPLaVUH999h3rM49Y1L/mem/HbhH2D9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686227950, "uuid": "30a64e01-2438-4202-ab4e-6f3c1f8b151f", "value": 737280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686227950, "uuid": "c823bbc4-717c-4330-a6e2-287f35cee214", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227950, "uuid": "670ab52b-a3b9-4973-b7ec-3ba909cea3c3", "value": "47560478ac10be3464c9193150527e27af88e214e2c8acace019e7fe32df5197", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d0239f3-0611-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686238240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686238240, "uuid": "c4959f18-a940-4020-ace4-208a3e117a57", "comment": "Malware payload", "value": "88c82c3f255f6c836b4af0f3b89ffadf", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686238240, "uuid": "6ca5d88a-19e4-4b1c-871a-379d38331b75", "comment": "Malware payload", "value": "47675bb72ba7a1570c2c1fe4ae0abaedb4abef34075fae43f1859d7829786942", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686238240, "uuid": "e7887ed2-4bd3-4928-aaf7-22cb939aaf67", "comment": "Malware payload", "value": "a30c97b112b379b132c194d7ebaf5293f6957d3d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686238240, "uuid": "d1a21ecd-5611-4bec-96eb-c8a3c58e773d", "comment": "Malware payload", "value": "f8a0c43f32ec35f6e4fe3fa8ecd712982354a1505b969c0dc2b05f872b79df8c631fc7007502cb17ead7a466625fe17c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686238240, "uuid": "942c27ad-77e9-4cd7-ad1a-f88d9f10e40b", "value": "T19AE3D55460C3A4014B9A7F5772B784DAE11E0660C6C54F26E0ACED90A3EEF26D87D4BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686238240, "uuid": "31043296-7cfc-4fc9-ae41-af59f1eda77e", "value": "3072:gRzeIwVOOpMRgFAzMeTluFzdYfoJ+v9od:B6Op/FanTluFzdYf7Sd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686238240, "uuid": "7b2eed4c-e4c5-44bf-80b4-e8b8999ad0bf", "value": 152707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686238240, "uuid": "6a342555-dfee-4e78-8856-7684b9fbb1e0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686238240, "uuid": "138185ea-436f-45bd-9033-033ed8c1db4e", "value": "Calculation-of-costs-1090659998.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a12ca04-05c9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686207312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207312, "uuid": "366641d6-9ccf-415e-a724-d502a31d4b1e", "comment": "Malware payload (Mirai)", "value": "bb9d59e4b5ecc01a3f4ac293f146c66e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207312, "uuid": "8eb5c017-7a73-4117-bb78-f22b2efc6ff8", "comment": "Malware payload (Mirai)", "value": "4770ecfacb3a5e97708ef66f67950436435901b1ef9e7f2567bacb53267e6ef0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207312, "uuid": "130816ed-341b-46c0-8b1c-b9d1a6d41ff9", "comment": "Malware payload (Mirai)", "value": "113a65efd53e53778a87baa0317d5df4ab0e4aa8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207312, "uuid": "81bf8c83-f151-4dd1-b3ce-6292c6b198bd", "comment": "Malware payload (Mirai)", "value": "ed1ff612e1f02bbe80490ef9e2f910a2e636535bec158cec1b4178c96bfb7d04252ac2e5177e90e1a65e172a921359be", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207312, "uuid": "ceb63c84-af26-4d3b-a96a-130f09ed5273", "value": "T1E193B509BF610FFBDCAFCD374AA91705288C651A21A93B397974D81CB60B64F19E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207312, "uuid": "1eb8a304-f8c3-47b0-aa56-88adbed70e9b", "value": "1536:nYx1lEqPiJkH+upTgJTO0bvB7AzgwiiL0H9Fy:nYrljPiJk+7B7bcA9F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686207312, "uuid": "d1fd7ff9-8556-4ae9-a800-6252e38056c8", "value": 90164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686207312, "uuid": "c3304132-c1e6-46a4-ac64-35ea4a897fad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207312, "uuid": "fdf3447e-eba5-422a-a1f0-d9bbceb4aea0", "value": "bb9d59e4b5ecc01a3f4ac293f146c66e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ecd758c-05c9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686207320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207320, "uuid": "0e563fe0-2fde-4cb6-bbcc-744bb83530c2", "comment": "Malware payload (Mirai)", "value": "91ccf36d8bca44587e7a23f4a612c7d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207320, "uuid": "32dfa8f2-63f4-4ef3-bd5c-27731619424f", "comment": "Malware payload (Mirai)", "value": "48e3771679683828a29bc223fc10c5739993ff34a0ce8c34b235fc780b7c1b77", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207320, "uuid": "ce2e0770-8281-478b-86e9-b692fa6322fb", "comment": "Malware payload (Mirai)", "value": "656c5a8c2541729ac6bbeedfa3edfae38524663e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207320, "uuid": "d3b9195b-9c6c-4f14-a896-0fd59809dd75", "comment": "Malware payload (Mirai)", "value": "58925bdad295a84c57c2f42823f1b25b0919b54d77dd0692c2f809fd02cc2a42ae18a05b64e8ab33ee36904c9c5be9f4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207320, "uuid": "e4f870e1-ca17-4d91-bebd-566bbd5acaf0", "value": "T10A438D22FC111D62C43142FAF0B0DA78C3524DB642E65D766DEE9A4914FBE4DBC8E7A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207320, "uuid": "1e2f9311-a5cc-41d7-9599-0b997375f0db", "value": "768:trHzIgrXeLKR2Ts5LvfGZsnx0ONsNaNH1MMuQ9B1nyHjYGycW1rrCjw7IErr:WGO2R2TsBnSxNWHjekq/MLr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686207320, "uuid": "bdfa374b-d61b-488c-992f-f5a44925db95", "value": 58204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686207320, "uuid": "a0c9970b-b26f-484e-9a40-1b11d6731eec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207320, "uuid": "246e3749-d713-4b63-9094-d0f8c80d64e6", "value": "91ccf36d8bca44587e7a23f4a612c7d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b5eb1ea-05eb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686221782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686221782, "uuid": "1421bc83-c8b2-4a8a-a474-6fa7c71b481c", "comment": "Malware payload (GuLoader)", "value": "c10ce97e6544cd7e04b4aa1a9c4df1eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686221782, "uuid": "325857af-12b5-4dce-9c1a-42505999e6d1", "comment": "Malware payload (GuLoader)", "value": "4a274f08e6f2d51a2c34b022c9eb66bb8de77fa9fe05d2aef25e9c0dec6d6c01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686221782, "uuid": "029351ab-f85b-4bdc-8716-ca63fe489cc8", "comment": "Malware payload (GuLoader)", "value": "8549cd3ebaa0cbeed269cac3da0b41a43341951f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686221782, "uuid": "a80189c4-4a51-4cff-987d-654c05dc890a", "comment": "Malware payload (GuLoader)", "value": "8f48ca66afdb651e757d53fe4976f896805a55d4b9f8f9dbbed363d89c9f6c6d6abedcb0c2849be5b29312b59777f666", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686221782, "uuid": "f2cfd3d7-7664-4506-bb5f-cfa3872c6c54", "value": "T18664D0C7B58091FBED610DB4BF1E81E71E52BC7AD4D05B4AB3B0733A18E1136620B696", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686221782, "uuid": "a71c1ed6-d577-421a-98dd-1ea954bbd757", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686221782, "uuid": "43cc5af0-9f31-4350-b288-24a9de479717", "value": "6144:fQ606x5wOyFNKvLOsI5H8Tx836e1NputSMFNZc9t6nzNH45X:/wDSvysI58x83R1NpsVFfZn945X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686221782, "uuid": "db3bda3a-bab8-4d13-b0cb-0e2d8af3f0b2", "value": 334656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686221782, "uuid": "9434c237-451a-4c12-bb40-0896621cee2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686221782, "uuid": "597c33c8-0966-4358-9d51-470997ec69e7", "value": "4a274f08e6f2d51a2c34b022c9eb66bb8de77fa9fe05d2aef25e9c0dec6d6c01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c345363-0619-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686241729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241729, "uuid": "abb3a2ab-4ba7-44f4-ae02-3436f375a70e", "comment": "Malware payload", "value": "12969ea11a38149daf621ae2414887b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241729, "uuid": "b9b49d20-8778-4dac-ba30-cd697b6767a7", "comment": "Malware payload", "value": "4a9a6b98e12d8468bd4f62ad46e196cd4d63402cbc2b4cfa9dda07240065d7ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241729, "uuid": "ece3f2bb-8cd2-4f9f-909a-a9b0d00a441b", "comment": "Malware payload", "value": "f72284981bb560b3ffa655a0dbb2656622e23990", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241729, "uuid": "e9c74dd2-8b1a-460c-9b16-99a102125f03", "comment": "Malware payload", "value": "0bd3f54d2044859baf18438e42590f9cb36a7d3c23d84b85aa34391dbd84cc055ca15ca73e87c60a1ddbe137990c350c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241729, "uuid": "b133b220-6709-4fdb-9e1d-d131b94b7da0", "value": "T118E5AFA5B58702F7D655263144EAB37BDB38770E023BDF53A364DE721621071AE3A388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241729, "uuid": "7aa68986-7af7-4621-9ba3-7ca9785d6fb7", "value": "24576:DdE4avufTK3UcuiFzXR1S6PX8A6KT0t7o2igMi6w6l8a/fLPN61KUNOLdeXUuVOU:xE4HWUeFz7LPX8tjM2sJHZuVOXXxwBR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686241729, "uuid": "2c646cab-9f5f-4d33-bd76-d6eedeb553ea", "value": 3044352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686241729, "uuid": "b90455a9-7e84-45ad-842c-4b912fc3e716", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241729, "uuid": "aa76620b-d44e-4aae-9cc4-4b7900944266", "value": "SecuriteInfo.com.W32.A-62389890.Eldorado.19888.4381", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "875b4092-05f5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1686226259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226259, "uuid": "53002972-76c8-455e-9e63-9f19b3d28dd6", "comment": "Malware payload (RemcosRAT)", "value": "f61f9b08443f7198c91fcb44bf082ced", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226259, "uuid": "84727e78-d97f-41e1-af90-d8e4f02b6637", "comment": "Malware payload (RemcosRAT)", "value": "4b4d7fad903fbd86408ce49f2750903a6a8c3b8df6aa3726517fc8d8bd398464", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226259, "uuid": "3ca9a12e-3ae0-4884-84b1-e8dc287b9ce5", "comment": "Malware payload (RemcosRAT)", "value": "69281bbf7f6f73cf5701105306be0b505e752196", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226259, "uuid": "08b7b5ca-d5b4-4504-96ee-e807a6d70597", "comment": "Malware payload (RemcosRAT)", "value": "51e36a80fd859371a1271d8886114cef34f810ef7de9f6102e9f57f8861f7d61325525af8035029fdb243939b7fbf775", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226259, "uuid": "73e0f314-f0a0-45cb-a855-f26f7039041f", "value": "T16425228426EB8B27C47E53BC81A1597013FD979F7661F7868DC2B1EEAB47F000869907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226259, "uuid": "6d1a97fc-0d05-437d-befa-9946ae968cd8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226259, "uuid": "57079d64-49f1-45ae-93e1-0f1fa5059448", "value": "24576:0EmFxUXBkkpdP9agZMAZsu6ZYDwhYlIqKEl2AiCxGI:7mFxU+ktaqM6su/whYlqfAi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686226259, "uuid": "a1c3e775-d2be-4c03-a86d-6186d962e570", "value": 1043968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686226259, "uuid": "3de15edd-0251-4b8d-bcb2-b53fc0212e8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226259, "uuid": "4edeb670-6523-4d4d-9982-1f31d3da3bfb", "value": "4b4d7fad903fbd86408ce49f2750903a6a8c3b8df6aa3726517fc8d8bd398464", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5960a89-05e4-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686219062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219062, "uuid": "1dccf909-0a43-43e6-b5f8-2abf1bd7e67e", "comment": "Malware payload", "value": "9c642c5b111ee85a6bccffc7af896a51", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219062, "uuid": "abbf1c60-57fe-4767-a47c-aa82fdc8fe74", "comment": "Malware payload", "value": "4bbf7589615ebdb6c769d6d2e7bdcb26072bac0cda6e225a4133ba8819e688d5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219062, "uuid": "9c650f8c-2b38-4805-9474-d95debc748a4", "comment": "Malware payload", "value": "eca8571b994fd40e2018f48c214fab6472a98bab", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219062, "uuid": "df92fb36-6776-4d44-a772-14b1927ba8fd", "comment": "Malware payload", "value": "595dd36b6281c789b52859a58cb72a33f6104cc6a8785a82a8a64f38581cc14371bde3752b9bf5c3176feabd0a0542ed", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219062, "uuid": "900e8584-3dea-44bf-98a5-1e8375f2fb2b", "value": "T13042E88BBAE05007F1F1C57A24B56738DB7DBB631FA58ECEECB11E429A90C466407352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219062, "uuid": "a3c9765f-e3df-48cd-8a01-0fbf96761dfd", "value": "fa1a2f2198605213f450e3c9a78158a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219062, "uuid": "5a3d65b5-41cb-46ef-a82b-7bd7c54b4ed0", "value": "192:BCMfc/GinpRBueYDw4+kEeN4FRrfMFFp3+f2dvGhT59uay:AMfceinpOeRENYhfOj+eGdKa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686219062, "uuid": "61499e17-e47f-4bfe-b88b-07c7fb8a546d", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686219062, "uuid": "e02f282b-3c3b-42cd-94e0-57da2276a342", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219062, "uuid": "e60d3439-e37c-4155-8344-a9fabed8fe99", "value": "MEMZ Trojan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ccff96d-05f0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686224067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686224067, "uuid": "a8d889cf-692b-4026-ba21-befe20c19854", "comment": "Malware payload (Formbook)", "value": "1ac57b6a4e32fd681ad294051d342cff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686224067, "uuid": "f9fe36b1-6887-4572-8198-7d8c1b1f6aeb", "comment": "Malware payload (Formbook)", "value": "4c1132e899179269d4277653474d464788d1ec77c004c8658959dc63f955482a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686224067, "uuid": "617c21a0-f7e6-463e-b757-96aa5a656448", "comment": "Malware payload (Formbook)", "value": "89797f6e4993f072955fced7a786868da66e3194", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686224067, "uuid": "49a458c5-ad3d-4f27-9122-ab33893160b3", "comment": "Malware payload (Formbook)", "value": "40a3bc3f93b73b5a87de71899aa7cb111a07f4e29e0541642dedbd21e9cf91dff93ec26305e8dae1c1b3357f232d7750", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686224067, "uuid": "9897fa80-b45d-4cad-8f32-19d2b85a623a", "value": "T12CE4124032A9CB23F63A77F61151A9F007F6B92BB526E60A0DC277CF5936F045262B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686224067, "uuid": "46142377-02d4-4b31-bd3a-785c8ca6249b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686224067, "uuid": "50da86f0-e0e3-4702-9e77-d823d84bc185", "value": "12288:tK27z5GoJiGaq5auV/3SZM2Y3ycUNiKZWTIxcQgr4ouxiwH9/OYFd4:/5GoR5aqaC+cqiKwMxgUVEYFd4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686224067, "uuid": "1fa2d023-6dc8-4e57-b059-e8ae8df326f4", "value": 708608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686224067, "uuid": "947dfc99-7bf6-47fb-8b55-8e334a28ebfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686224067, "uuid": "165acadc-b46a-435a-8d92-0fa1edad079c", "value": "4c1132e899179269d4277653474d464788d1ec77c004c8658959dc63f955482a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "140906f8-0642-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686259136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686259136, "uuid": "7123affb-20af-48e2-9497-8fbe2e417449", "comment": "Malware payload", "value": "02e63fdd95ccad5f6c097a74f558a420", "object_relation": "md5", "Tag": [ { "name": "555756", "colour": "#CED47B", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686259136, "uuid": "4b6cbf82-7e82-4781-93cb-61ee97d09f8b", "comment": "Malware payload", "value": "4c2226cf7919ebd40ebdd8944a4793e18790a8e7cd272cb2e1a15d39d1e14df6", "object_relation": "sha256", "Tag": [ { "name": "555756", "colour": "#CED47B", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686259136, "uuid": "30baa6b1-0752-42c5-9e88-bef6b39d0785", "comment": "Malware payload", "value": "91c374339e8ef18a9302a2631b5d070912582d2e", "object_relation": "sha1", "Tag": [ { "name": "555756", "colour": "#CED47B", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686259136, "uuid": "8e431fa7-6b3c-488f-bd66-2626cbbf85a6", "comment": "Malware payload", "value": "24b0f7eb3dec9150689d867d88333280c6e5c1c375f0eff7f70bdb3e076570dbd3c95c28a051fb3c7b2c6dcacfffb701", "object_relation": "sha3-384", "Tag": [ { "name": "555756", "colour": "#CED47B", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686259136, "uuid": "4133dcae-c226-4e18-9746-7fc52cce6bab", "value": "T191A1E0EB2216F8DD402B8F7288CC564B3014E88BCD679252FA82DF74DC5CC9D468DE69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686259136, "uuid": "c6f1b979-e159-4948-a279-17d6f13a1a41", "value": "96:5sBeprD12YkUUGsgZislNRGBhWp5quaajeQF+fjsfK0kS6RdX+Y:SBOD1mUUGsBslTGBhU5q3aCQFGsfK0kD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686259136, "uuid": "472b38b0-a4e7-46a9-9b14-18914ebffc9e", "value": 5013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686259136, "uuid": "d12d9639-db67-4320-8e30-cd16e2a7511b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686259136, "uuid": "803f2887-41f3-4b5b-b8f6-5fecfdcad6b2", "value": "0742.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6fc9c8d-0646-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686261101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686261101, "uuid": "3046719f-987f-43be-b923-4c065abd7866", "comment": "Malware payload (Mirai)", "value": "38cbc7f6a883fb3c35e16ff09b9774b5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686261101, "uuid": "34ba2d22-14a9-4e34-bc2a-704d44efb8ac", "comment": "Malware payload (Mirai)", "value": "4c2cab01758928161a46477cdf34025d67ecefe62190d4ea427085d409c62b2c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686261101, "uuid": "7ea9c847-bab9-49b0-a7fb-0a621abe5c61", "comment": "Malware payload (Mirai)", "value": "ee5add4e5431838093bbdcd39eab1843450fbd73", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686261101, "uuid": "9558d337-9257-498d-a3ba-c84a91817203", "comment": "Malware payload (Mirai)", "value": "9e9b7da31768d30863d2f3e2819aa74af192db594274e5ec817fd94f9d57e74f8f9535d2867adc22b17eeadf5525edcc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686261101, "uuid": "f04c7ec6-e1c2-48b1-8ee0-9132a9247570", "value": "T1ED939309BFA05EF7E8AFCC3345D92745288D655A21A83B79B930D928B21B24F15E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686261101, "uuid": "bc258b02-e03b-4a5e-82b5-189e215d8ac8", "value": "1536:a5DnSB+v5XjQm2517xk49d6xZLu8vJ4TGo8S:a5TSB+v5XjQmI1GFrvhrS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686261101, "uuid": "12736f75-bbc1-4140-90e2-d9c6a48e369f", "value": 92512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686261101, "uuid": "ce7b928e-54de-485b-8820-734f6a842eba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686261101, "uuid": "0b26e8a3-9a8c-41aa-b4c9-03acc24a4285", "value": "38cbc7f6a883fb3c35e16ff09b9774b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c373f1e-05f7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686227018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227018, "uuid": "cb9d0f0f-f35b-4ef9-9637-0585ca2f23ed", "comment": "Malware payload (AgentTesla)", "value": "9ca574918c7a9128c5b19a11f2944ce2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227018, "uuid": "03ea1526-2d0e-4b01-96e8-6907ee0b98ff", "comment": "Malware payload (AgentTesla)", "value": "4c897b39e8d258a7bce7dc6b004dec05c1593c7d14246f92632ed6b49d82c109", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227018, "uuid": "57e893d2-2ab1-4ac7-96eb-d79790ff0a34", "comment": "Malware payload (AgentTesla)", "value": "08557b313c3eda1a56feeb8be710b538bdda86d6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227018, "uuid": "30329c15-1f04-40a5-8abd-18999e10ed30", "comment": "Malware payload (AgentTesla)", "value": "ae5c15bfa5086fe5c61abd4aca207b2ccf4a830f3b692df2d5de0c8dd3d58eb85f34a44f11f9bb072acc70d5ba9bec4c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227018, "uuid": "bcd4f5d1-2ecb-42eb-a8a8-be4ee6d09471", "value": "T107554B388B75637A91BBE39447C6B49FB1909C36B2103BE5F49123094931872FAC7E5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227018, "uuid": "974922e5-512f-4d15-a81c-edf024d813f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227018, "uuid": "88784956-7f89-4ca6-a58e-c4787a254aa6", "value": "24576:T+EmmAxPUhwijOsLA5/gLCLo5dkhBLinUtg0oLZ6UYK9afw2+x6:TpmNxY1jLLAtzskDLineg0oC6b2+o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686227018, "uuid": "ccdbe3c9-5e3e-4236-9ab7-36831cb82ac3", "value": 1358336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686227018, "uuid": "628bc8ee-f06f-4767-afe6-06bd56ea35d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227018, "uuid": "8981bd7a-bfad-4475-98e1-8038713f9bc7", "value": "4c897b39e8d258a7bce7dc6b004dec05c1593c7d14246f92632ed6b49d82c109", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04b6091d-05e4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686218738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686218738, "uuid": "06db1d6a-eee9-41cd-8cab-544d95358301", "comment": "Malware payload (AgentTesla)", "value": "fb81b6f7be05eba3a575a810863ba0c1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686218738, "uuid": "5e0a8716-aba4-4b25-b10b-877110f76d80", "comment": "Malware payload (AgentTesla)", "value": "4d1d0ec91dd5b6ad10221ecf97cb209aaf5bebb0a7110b22709fc212a6799de0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686218738, "uuid": "09045161-9112-4d26-9e75-225f1cc1c1f8", "comment": "Malware payload (AgentTesla)", "value": "8b2cfdbea9693a78d9581530c29757560e3b1a96", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686218738, "uuid": "57178490-7ea7-4919-a270-323a5308c2da", "comment": "Malware payload (AgentTesla)", "value": "4a49eea7eb96563a0fcc5d9d3a3cf17308519e021d487041100afa196d4d48a625af4d03b4e7ee48e2727afc49521bf1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686218738, "uuid": "51c70674-52f8-464c-947b-0c5a7868b7cf", "value": "T1F3F4603D4AA589EBC1BBC374A7CC499BFA73D857F15C9BA904D6034262436CEA0C21DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686218738, "uuid": "caba382f-3147-4c44-99a0-25cf6309ed19", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686218738, "uuid": "0a7a7de2-906d-4e06-b1e5-025b72e02c78", "value": "12288:jg2SU9TBnZvjHB/ucpIKLlq1nQ+dtaon66wiSljSx:jvSU9NZbHB/u7ywP/nYBa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686218738, "uuid": "b15fb15a-9670-439a-9813-8477a7d9b4c8", "value": 783872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686218738, "uuid": "6d2c1a77-e345-4cf6-87f0-6b8cef9f7148", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686218738, "uuid": "8fa05964-a984-473d-ae1f-30be875e2fb7", "value": "4d1d0ec91dd5b6ad10221ecf97cb209aaf5bebb0a7110b22709fc212a6799de0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d636ee7b-05f5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686226391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226391, "uuid": "4e1277b4-b2db-45fb-bdc2-5caae4261e03", "comment": "Malware payload (AgentTesla)", "value": "96365071c664e9f105d6c00795f591c8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226391, "uuid": "6d55f18c-6601-44d9-8ad8-c950aaaa5cb9", "comment": "Malware payload (AgentTesla)", "value": "4d6e6965c6ab38f3ebd1a2ec242f4226b6807386ce5a1755678e242023d04f7e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226391, "uuid": "86048648-d1f1-4466-9e81-4f371f8199dd", "comment": "Malware payload (AgentTesla)", "value": "adf3ca9a13eed33a4f520eac2a04e11da148a187", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226391, "uuid": "b81ac079-e3cf-4055-aac3-661043d8dbe5", "comment": "Malware payload (AgentTesla)", "value": "84c287a62aff797c53ea8c4be583194404b7408c4f8d1555064f7d43d685650998f7cc99834732fb4f1f3f67bc375738", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226391, "uuid": "1c0c0b8c-fde9-415d-a58f-116c0bce13db", "value": "T182E474388B75637A92BBE39447C6B49FB1905C36B2113BE5E491230D4931832FAC7E5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226391, "uuid": "558e9612-e77f-412b-b140-84fd128df359", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226391, "uuid": "02448011-d6f0-45f2-a56d-37a6d5ef64cf", "value": "6144:9E1zQ0exaVb40FNy/UTNeaw+Ud82tJITGK5wkHJ0Fqrq1Uj4+EH/5Xq:CRYaVbnTNNeQOaH6kHJ0F9UzEH/xq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686226391, "uuid": "409bb9e0-9b6c-4e08-87e9-2d82866b9528", "value": 711168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686226391, "uuid": "a857d787-771d-41fd-abe0-6c6bb15633d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226391, "uuid": "3e32aac6-d28b-4a12-aa18-fc8ea877e7ad", "value": "4d6e6965c6ab38f3ebd1a2ec242f4226b6807386ce5a1755678e242023d04f7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99f697a7-05b5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686198802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686198802, "uuid": "2fa8f458-c1dc-4e78-8e11-2086c7eb4f90", "comment": "Malware payload (GuLoader)", "value": "c6d2ae33edf3d67a0c2abe42836c2874", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686198802, "uuid": "9eb7af5f-9e5e-4999-a635-8d0863fd07cb", "comment": "Malware payload (GuLoader)", "value": "4e1e5ed444f1dd3c1807df4b9e6c41e9e53556a80e7c28701ef6571bd081fac2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686198802, "uuid": "d94a97fb-1b91-4686-b7d1-87a98e13a28e", "comment": "Malware payload (GuLoader)", "value": "c29bcdccea09e6f3ecdef77fac70d96c9d8acfa3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686198802, "uuid": "6968365c-72ac-44d4-a572-ed29a125c53e", "comment": "Malware payload (GuLoader)", "value": "cec4b29196b1832fff52552f306bc233692008de974d3088a140fb2c132169494f9dc2c0fcdc7611b540ab049a20c61a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686198802, "uuid": "9216005c-7ea1-4912-8ac9-02d82acae1a9", "value": "T1FA54124336F9A0D3E0160AB00EBEAD31B7B56E0C0779749B37923F6D2A771C24525687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686198802, "uuid": "3bb227bb-ec27-429a-a3ec-04e2e39794ca", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686198802, "uuid": "8e32577a-8426-4cf8-b28b-8685526210b0", "value": "6144:w6dmbMKjfheEC2iP/jUzD4xVuazSnsMDC8pv3IMRhhSygcTSD9N:g4Af3ChzUPGVuazhMDZT+ygcTSDn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686198802, "uuid": "32efeb8f-7d25-4498-82b6-ba2edf753021", "value": 287624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686198802, "uuid": "a35a0ad3-9e67-4279-afdf-fc1f421a941d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686198802, "uuid": "014fc63a-f9a2-40c7-bd8b-8b923480f94c", "value": "c6d2ae33edf3d67a0c2abe42836c2874", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45fb7d5a-05c4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686205104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686205104, "uuid": "e90f1f42-c4a0-4192-9976-166d54177171", "comment": "Malware payload (GuLoader)", "value": "8f25fe4c31de1a795ca154d7dacad298", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686205104, "uuid": "04acc720-ce82-46c0-9a5c-f537b6502dc2", "comment": "Malware payload (GuLoader)", "value": "4e57a7ae42e9005020df2671b6aa6cf19d044be264da5f8e1a4836d5a47b2f14", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686205104, "uuid": "f24f1e74-505a-49c3-b5ea-0a2ba90f9250", "comment": "Malware payload (GuLoader)", "value": "754e42ede6c7d66fee0c161538ba7f274b09c613", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686205104, "uuid": "ce6e40f8-8b11-449f-80c2-6d35b7224bde", "comment": "Malware payload (GuLoader)", "value": "6398b8737c9b982b7b32fd8b91a96fa8ec31826b6b2afcbe9fa9088c04e80e6252d39c9ade7d3f3226fab20336ee061b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686205104, "uuid": "b0c942c1-f396-4214-9dd5-caebce76f5c0", "value": "T1B725235249D44FDBF00852B02AE38A6B727A75241C27F1476B189FDBA6E7113C81E1CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686205104, "uuid": "081a5e43-c7f2-4201-86cb-6a415d21c722", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686205104, "uuid": "740dbb92-e555-4787-bee8-37986c271400", "value": "24576:ePLjh9E6G3VibpHIdebodR6jlKFtQVUv+iP8o79bO+:2jh3G32poHRS2tQuWikK9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686205104, "uuid": "9cdaf088-0edf-4ba3-8ae7-7e690612129d", "value": 1042896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686205104, "uuid": "21c4d8bc-f64b-46c0-a6b0-ebe41b759ebd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686205104, "uuid": "329a98b0-aa46-4205-b80b-dea35e6a5ab7", "value": "8f25fe4c31de1a795ca154d7dacad298", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a48bd8f8-05e4-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686219006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219006, "uuid": "ab09f3c1-6cd0-442a-a583-b0a8ab97de48", "comment": "Malware payload", "value": "f2b7074e1543720a9a98fda660e02688", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219006, "uuid": "ecff4146-0dff-47c7-89c0-9b99b07643a2", "comment": "Malware payload", "value": "4ea1f2ecf7eb12896f2cbf8683dae8546d2b8dc43cf7710d68ce99e127c0a966", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219006, "uuid": "d0383fe8-5e1a-48b8-9f2d-58ff7bdab7bb", "comment": "Malware payload", "value": "1029492c1a12789d8af78d54adcb921e24b9e5ca", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219006, "uuid": "f998f57e-f448-44de-ae5b-a2bc1f359052", "comment": "Malware payload", "value": "45b0d772d7c9378854cf652024ad3cd859c3458474d665e04056c452a20744bb011a16cfab45ddd132410427fba1f5bf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219006, "uuid": "d7796a54-aafc-4e8d-bce2-85651795c7ba", "value": "T11E66F39B5ECC82E2FD3E05314062F676A6607EE907D24FCB62F80D47FA502E56C7119A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219006, "uuid": "e5208eff-947b-49d6-9294-cdf2f8d2b39a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219006, "uuid": "158860a4-e7c2-4738-ace3-4fee1f5bfe2c", "value": "3072:eaLA1++iCeFj0im6X/AXpT8vVMCcHVcdhghUuz1o9Y:fLJlC6j0CX4XmvWHVcd62uO9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686219006, "uuid": "7e5d8c2f-c59c-4f8a-bd05-1bf44bcd847b", "value": 6983680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686219006, "uuid": "48c94444-f92b-4d6b-ba40-fc9a54afed01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219006, "uuid": "46253514-9a25-4cde-8241-e5785bb42afb", "value": "000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c3048fe-05c3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686204658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204658, "uuid": "0d309e57-1d88-42fc-afed-719467d1d4b6", "comment": "Malware payload (Mirai)", "value": "e699d452ea010560f332df1c2485aa41", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204658, "uuid": "55b76be3-e822-4a68-bf3b-38916e6f2b45", "comment": "Malware payload (Mirai)", "value": "4f590f28ac34f321186ab174af340fcd59adcec8a071fa27c618e614549f3f41", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204658, "uuid": "5f959661-772c-4703-857e-181685311e83", "comment": "Malware payload (Mirai)", "value": "021c0425adb4c0f808450568a37b4131e26fbddc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204658, "uuid": "bcf54fcd-dc8c-4826-8195-a08e66759695", "comment": "Malware payload (Mirai)", "value": "21d4ffc77458019eee82d06360dfab8db053486066bb0f27934758cbe078cc054b02a3f71dc49bdc318cc242cb8887eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204658, "uuid": "93c2b1f3-8184-4dc7-b420-37f6cd8c4a07", "value": "T1A743E655B8C25A6BC1E423BBEA6E518D3331A3F8D1DE3217CC111B64B6C952F0DA7B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204658, "uuid": "b918f38f-b3f1-4614-8bdc-24723121fe49", "value": "1536:jhZAFs6myVyXQPL5zcKQrrFRQ7VlG9Ww3fxHxd42+m:jhZbMrgKQr/Q7rG9r3JHrF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686204658, "uuid": "3e1100c5-40cf-4091-949d-14a988141b6e", "value": 55564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686204658, "uuid": "5d707f9e-6454-44d4-a563-c001d865c0bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204658, "uuid": "7299762e-6600-4816-8010-88e3125854ec", "value": "e699d452ea010560f332df1c2485aa41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa678816-05d7-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686213567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686213567, "uuid": "2f0c3d1e-be15-420a-a427-dc9f5c2f5289", "comment": "Malware payload", "value": "16cbd377e149ea2add2475274c8c01c3", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686213567, "uuid": "bfe3e230-9dbd-4417-8340-0150d59fdfba", "comment": "Malware payload", "value": "4f8278ffd439e3de95aae6ca38cf98c28271fb3b3824c13525f60a7ca604aeea", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686213567, "uuid": "72d53ad3-bb51-4ff5-a856-5b17b77b3b57", "comment": "Malware payload", "value": "a2c0bab9c30e5227292ebb1b847e6d4e5fba6c16", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686213567, "uuid": "45f63789-096d-4613-affa-b4602b17b197", "comment": "Malware payload", "value": "5eb064b0f181d88395223a10d69e0bdc12231f5c7a9a0def5fde147bf7c21b0be70aaaa77a4d4a98e5b3cb012157b298", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686213567, "uuid": "201f57fe-4dd2-43bf-9598-777a6ae9047b", "value": "T1BF22BF7157D83B3EF8DE0B3053168CA8DA14C423430993A90E299EE5115679BBBB9572", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686213567, "uuid": "86457e4f-1d24-4208-9780-86cb66cb62d3", "value": "192:2UAE9QReJoe7wE14yUSbMPDI+U+Gyf3LUaGl3OZfpfM3XiTXeTUB1VvILjF:TAEHJoWn14ZSbMPIPKUauOZfFM3XiTuh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686213567, "uuid": "5cd8c836-1c34-4836-8453-46e12824fcbe", "value": 10478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686213567, "uuid": "7234d30d-94b1-4bfb-9568-49daa1ecfa30", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686213567, "uuid": "f4885619-5a59-419f-9929-7bfb3e999c9f", "value": "ins96961.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d48b8aeb-05f6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686226818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226818, "uuid": "8098d876-058f-4785-a766-3f76b0de9bef", "comment": "Malware payload (Formbook)", "value": "8169d0fca16b51cc3f3b51dd59014517", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226818, "uuid": "496e3243-e4b0-454d-83c0-7eb329e21ff8", "comment": "Malware payload (Formbook)", "value": "4f9d49b16f9b752b0080488dc5a94f19abf0df27e50bd47126410f622d3d1cfd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226818, "uuid": "ff2a21a6-91fb-435c-a8c8-a62ee7343d98", "comment": "Malware payload (Formbook)", "value": "a091fd849f394ad1b086173e94d150d0aa924d37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226818, "uuid": "4eb05477-ab92-43c7-a84c-6dfe52245224", "comment": "Malware payload (Formbook)", "value": "37d2ce46fa7329bde1bb826d84939c0c580b1e450f21c362630b623d7be87678669e5f31b89cfa9f867fc8a7b96b008f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226818, "uuid": "9194ebb7-eb68-458a-8e2b-44c1f2aa047c", "value": "T14A05F151B1BB4F1BC1BB57F58504A2315BBE6A9CB872E3078EDBF4C62521F050A91B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226818, "uuid": "c47f9391-b4a0-4aa3-9af4-d5d588acbc9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226818, "uuid": "dc01d170-a2dd-4806-a2d4-09c9680d01a3", "value": "12288:kJ2B0xTGlxNqvNu2hZ+nUEsn9twjJD7O1rYq6ml4u6SUNAWDZF70r/y4U0cAWlHA:kJLaVUH999q9D7242WjoU0cAW+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686226818, "uuid": "cea18388-376f-4208-87fd-ae4f6aad0cfb", "value": 797184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686226818, "uuid": "d8681df9-e3f7-4eaf-971d-7623bf727b38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226818, "uuid": "ca79da4c-0af0-4050-98a8-cab198f24e0d", "value": "4f9d49b16f9b752b0080488dc5a94f19abf0df27e50bd47126410f622d3d1cfd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de07f6a7-05a5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686192044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192044, "uuid": "05f7ef36-4a4a-4c20-b904-4faf4a356c42", "comment": "Malware payload (RedLineStealer)", "value": "3ae4d6f6dca07adeff9d754d607666b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192044, "uuid": "51f9cea7-9cc3-46ad-a66d-ebd4d7b76926", "comment": "Malware payload (RedLineStealer)", "value": "4fb019873611c2b3f65add76d446d563710e291f8a2643d8dfd00837c80e2ce5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192044, "uuid": "28be5210-089f-4b88-a0c8-355976a3cf73", "comment": "Malware payload (RedLineStealer)", "value": "463cb7594c3feace1c70fa536daa073764b028ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192044, "uuid": "f5cb455d-953f-408b-b681-2bc14fac043d", "comment": "Malware payload (RedLineStealer)", "value": "9412fd2072a88ebbeebd584ad7ce5e8c84d409848e2dc6a2ff96cbe2c08b6b81e66198f881c901195d92b19b93d112a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192044, "uuid": "581dc57f-adf7-4826-85c0-1611a8ae99d8", "value": "T189F41253B3D95075D9B51BB09CF606830732BCA29C749B6B2782AD5E4D73284E23237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192044, "uuid": "99150f4f-d7de-4aa1-aa50-21aaa10f9281", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192044, "uuid": "b54a7a73-63e1-47f8-8ad5-5613e40ba2d3", "value": "12288:vMrey90QdbZEZN1O0J3LYcM4wkZgoin8axmYbEDoJGepA2c4NPghfuD1:NyzEN1fwkZ5inv5EDe62cGIhf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686192044, "uuid": "3e3a8d95-51b5-4fc8-b7ee-9be87005a74f", "value": 770048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686192044, "uuid": "08662ffb-e9d3-4293-8900-f915e54e1bde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192044, "uuid": "557a574d-c7f1-475d-87a1-5dcdb8726f0c", "value": "3ae4d6f6dca07adeff9d754d607666b3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "847ad934-05bd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686202202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686202202, "uuid": "082cba7a-63f1-45a0-a597-c7948a3fa939", "comment": "Malware payload (Formbook)", "value": "8f6f20b9800cc3739e08c986979fe886", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686202202, "uuid": "baa618ae-893d-49da-8a5f-5b28f70be6d5", "comment": "Malware payload (Formbook)", "value": "4fe0591d0c5bd1f27e2a384aa171139b371847c545e9eae6e7bc6269a954a58b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686202202, "uuid": "3818b2ed-4e3f-4bd8-ab70-51f0b71d540c", "comment": "Malware payload (Formbook)", "value": "945fc5d51604afd6e92c84fac68e336680d37abc", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686202202, "uuid": "333fd579-659b-4942-aaf9-e1b1e417f0a0", "comment": "Malware payload (Formbook)", "value": "1d23b129cfaa2814bcc46dec13662e18d6a8de6be3dfe784350504225bd4e75abfd70f66cdc855049f8990ad1f8af407", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686202202, "uuid": "ac1f3175-9e77-4d6f-b77d-a2cd461212a4", "value": "T1D5D225565F8C4C61E266F8BB865EA00E58BCF63634C205C5BD9CE2753B3D10E0B6B1B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686202202, "uuid": "d0d7b63a-df89-4328-8193-08d88c3f9821", "value": "768:DHe6wuA/+TFngTG1tl2qGOQP0u2kPdU8S7C5G3fljgBQ/sp:DHOuA/+TFngC1u2kl7wm7p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686202202, "uuid": "65955779-c299-4599-979a-e0c68c72aa1a", "value": 28296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686202202, "uuid": "ff96f977-fdca-4389-83ff-362aba2100c2", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686202202, "uuid": "8868ce8f-5c02-4156-9182-c7b112d9b6ef", "value": "8f6f20b9800cc3739e08c986979fe886", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86bf686f-05f6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686226687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226687, "uuid": "86c3bf63-9f85-4b9b-9a04-52dd428edd80", "comment": "Malware payload (AgentTesla)", "value": "46610a28dcd9f71fbcdecf628c0142db", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226687, "uuid": "f0e93e60-0176-4bc5-ad3c-8cc4a23fd477", "comment": "Malware payload (AgentTesla)", "value": "5058d993163b6a49d2fa6b102c03da4217787bbb50026e84d111f85cf0241219", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226687, "uuid": "804de45c-4150-48e4-86c6-128d1aa93a28", "comment": "Malware payload (AgentTesla)", "value": "d06bfec4542e700e48b8461dff345978ac271f87", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226687, "uuid": "53fcaa81-f669-4c44-977f-1b5e3e111cc6", "comment": "Malware payload (AgentTesla)", "value": "425225bd0be380492cf85b5fb20ce9103354c683636ea23e2041f9556e60618f5c8ab6345fc7b8a94d03a7477c19687d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226687, "uuid": "7caa754d-54c6-4827-bacd-516089cad9be", "value": "T136F422147B9B802FC2831FB8495473B895FD86DABE7BE7270D07A5E5EA16F0B105034A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226687, "uuid": "6be6c7b8-11b4-4171-92ab-26489ace3009", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226687, "uuid": "011f51e2-5a70-4e85-b1b3-b7a62b291d46", "value": "24576:JgPLaVUH999oAUUiUQLGE8HfOua5PYA5UDp:sBH9bqGE8/Odwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686226687, "uuid": "12d8bd87-1fd4-4683-b05c-c8c4ac0c84fa", "value": 794624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686226687, "uuid": "ce5178bd-8592-4a2a-8480-6bb451ab45f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226687, "uuid": "47f65411-8167-4857-9785-a1bc3b258ab8", "value": "5058d993163b6a49d2fa6b102c03da4217787bbb50026e84d111f85cf0241219", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0a701c1-05db-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686215161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686215161, "uuid": "0518b9bb-3937-4489-907f-6f19d8179744", "comment": "Malware payload (Amadey)", "value": "1cd5995018de998fa42c57646215e93c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686215161, "uuid": "163d5cb8-c8c7-48eb-ad4e-586a47af22f9", "comment": "Malware payload (Amadey)", "value": "51ea6a940e5c9651c10b8e2bf5bbc17b93748b268e351af5f787e7972685d7e1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686215161, "uuid": "a22bef18-92bd-44ad-8d10-37c36776c311", "comment": "Malware payload (Amadey)", "value": "b319a41adda3603a78ba092a70fb56dbe3c24ca2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686215161, "uuid": "b10ec070-f01e-4e19-b1c9-df81057fe793", "comment": "Malware payload (Amadey)", "value": "22a7e7ae549a12b61b8f8803563336fa693d71097a0beaa8917e4154e4625800b082549ceaa5ae0e6f1e1486c1d91396", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686215161, "uuid": "2307a46b-7243-4ab8-ba88-f1c81faf6c4c", "value": "T1C8F41202B7C94533DAF05BB048F603970F307DA15EB85757275AA84E1CB2199BAB2773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686215161, "uuid": "185fd677-59c6-41ce-b74b-c0d07be2f49c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686215161, "uuid": "30d093f2-f81e-4d55-b1cc-117155b6a1c5", "value": "12288:TMray90P6TFr3jLkHXYSj7h3iJCa75+UsmzndmNC+x09YArys2Kc7:1y/Tt0HoSfliJTd+UsYgNCBYFs27", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686215161, "uuid": "5600d2d9-0cb1-4c88-83f8-ddd6d9949cb4", "value": 790528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686215161, "uuid": "78e50f39-6c09-4c95-885a-368039fcba2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686215161, "uuid": "8531fd8e-33ae-43c5-af36-66cd6fde1ff5", "value": "1cd5995018de998fa42c57646215e93c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6d23245-05f2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686225130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225130, "uuid": "67682e8e-df9b-4039-ad45-8824a77db97e", "comment": "Malware payload (AgentTesla)", "value": "c068c13434c442bfa1e763b7fec9a58e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225130, "uuid": "1c748068-9ba8-4356-91d6-a589551057c4", "comment": "Malware payload (AgentTesla)", "value": "526b3f0974a4b191dd7114d56ac640c4658f96e6ee1b06a972c0bb247d1dd3cd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225130, "uuid": "198817e1-555d-4f40-82a4-40368f518fbc", "comment": "Malware payload (AgentTesla)", "value": "1f12e8c75ce9fd32b7b46234c4143459c461aa9e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225130, "uuid": "b54be915-2023-44f4-959a-de2e93e39d6c", "comment": "Malware payload (AgentTesla)", "value": "0261d66a6380e0cf32b56ea2d9ed634462d9511c4d0352b8cd012df4b18d442574cea5d63a206c7ec3b095732456ff0a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686225130, "uuid": "ef62836c-f67d-416b-9b06-b2ecf9726d4e", "value": "T1B8E4124173659B47F67A3BF21A62AAB017FAB82B7434E20A0CD273DF1662F405651F07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686225130, "uuid": "8cdefa05-6a16-4374-86c8-9053d93c521e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686225130, "uuid": "87b89fe8-43df-4441-a07d-031b04d4d31d", "value": "12288:IKt7z5GoJiGaq5aurHlOh4nA84mckFKqDi0vg+7IGbpTgAmpE/2+NLjXB28V68Y:p5GoR5aClA8rFKq9CLpz87l68", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686225130, "uuid": "53e8dcd9-c0d7-43d1-a36f-c994850cd914", "value": 684544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686225130, "uuid": "dc5888be-6069-4679-9c80-40cd44e15f02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686225130, "uuid": "cec1ddab-9797-489f-b8f1-2d9438cd8fe3", "value": "526b3f0974a4b191dd7114d56ac640c4658f96e6ee1b06a972c0bb247d1dd3cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "797c5049-0619-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686241697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241697, "uuid": "cae2ca73-5fa9-402e-9ebd-e05795c5123f", "comment": "Malware payload", "value": "aead08848b0d3300feb453da4c2244aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241697, "uuid": "4fd27d36-5e73-4d93-acc2-4b96c5a47448", "comment": "Malware payload", "value": "52a0aa3893bddb9647b389ea5f014b6db57c938de66b5ed929e74cb297a7aec7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241697, "uuid": "5e792e39-27bb-495f-8397-e676f6a5e1ab", "comment": "Malware payload", "value": "ed275cac041f7d1e67d0b020c7f8b7328c1e138b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241697, "uuid": "8f637935-6ee0-4ab4-bb07-f013c4877bd9", "comment": "Malware payload", "value": "7cfc6f89b4b492443f4ba90682fc65192b39a9948fe529548080f201ff8a3b7f27b8d2b3efcad2748abc224fe88704ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241697, "uuid": "fbf41f2e-634b-48bd-92ae-807997faf8a9", "value": "T131E34B52BAD0D252CC863477611EABF22E27B8247B14F6D77AF419B84F922D21F742C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241697, "uuid": "f84bf75c-948a-4d50-879b-fbe73ad533e7", "value": "1536:8Rpj3pwR66Ppuvb2Bi4RFk4TZMgMV5yaPR/GPcnVrtHlaXWUDrjPQnu0W:8Rpj3pG6opAiBi4bgT5yKEUnVXoMnu0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686241697, "uuid": "325568be-d4d1-4cb0-9fea-23410f85f9f2", "value": 151552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686241697, "uuid": "1f513d79-6f6f-4989-a1f2-77a6e7d310bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241697, "uuid": "9e9b0bcb-976d-4762-af35-a442b01b30ef", "value": "SecuriteInfo.com.Heuristic.HEUR.AGEN.1318457.12572.14096", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4ef50c3-05d8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686213880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686213880, "uuid": "32ae5a99-f12f-4605-9c0d-f7e7520663ce", "comment": "Malware payload (AgentTesla)", "value": "7b82bd8930780f085825d5a01983fdd3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686213880, "uuid": "347a6760-6e99-4d8f-b210-ef93149dbd74", "comment": "Malware payload (AgentTesla)", "value": "53acf275f382cb773df5e0a8fd71b11920593202078801fe4434bfb4c67bb370", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686213880, "uuid": "d183d4a1-f83f-466a-8981-9aa74f3767ef", "comment": "Malware payload (AgentTesla)", "value": "5fe3d77acc5aa939872bb08d2c290b72f22cada9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686213880, "uuid": "197aeeb0-6229-4587-898b-854f80f55ec3", "comment": "Malware payload (AgentTesla)", "value": "6f08daf5fc81f29380b2e4e94b3862742656f286e70108a488a4b951a4c999ba55348b6d9e6d923d0d35fd6c0331d9e9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686213880, "uuid": "2f1b0edb-bee0-4250-9064-4d8e83246fd0", "value": "T109E43316F8E53F71909FD271E5EB7C7E7E4843BA24109111732A6FB9C5B98A1030B9C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686213880, "uuid": "90f73540-0971-4ef9-8b90-fc81cefbb0c4", "value": "12288:4h7eE+Axue9DkroNUrBEvw2FKhDYV5tEIFETFlqtObGy1insSfblUv0E87:6qQxuYkrLrBa7I9YrGIFUFliObKnsSff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686213880, "uuid": "3b57b691-90a8-47cb-905b-29dd49866bcf", "value": 699010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686213880, "uuid": "74a2538c-7367-416c-9bfa-029befd9166e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686213880, "uuid": "2bbaef6a-69dd-4bda-aed0-14924f98b19d", "value": "Quotation Required for Shipment.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc2680ce-05dd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1686216039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686216039, "uuid": "1d4a952a-b013-4c86-b786-0b45872ea4ba", "comment": "Malware payload (RemcosRAT)", "value": "473b3909e911de8c27ab621986c02d0e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686216039, "uuid": "5d552635-f946-4d1e-b81d-16e279e59188", "comment": "Malware payload (RemcosRAT)", "value": "5564cb2776b7336df157a5d8133543aa7a55c59550d9c8095f660e9945f4d93f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686216039, "uuid": "3dff4d3d-1ec7-40aa-a18c-05f9df56cb47", "comment": "Malware payload (RemcosRAT)", "value": "bd0366e2416de0fa75b77414b82f31e7ede37255", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686216039, "uuid": "7431f69b-44a8-445f-bee2-31e035f1d25b", "comment": "Malware payload (RemcosRAT)", "value": "2c8cb2f0e5f53a2a5202121b4c8648594df22a970f3b0430a5ddcffc6ef5d7d218e4e93ee5afd0b0415f24da6a8240cc", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686216039, "uuid": "a9ca65ff-41e0-465e-9c72-dd699e28b2a9", "value": "T19D5423135CA01489D32C42346BC69441CB7A92933B29C96FDC63E5933DE4FDE4BAA5B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686216039, "uuid": "38b14339-c946-411f-a825-d5ab31ce9f3b", "value": "6144:yi7n5JRXQnl81RkVsBIPs5eK9U4zOu/lpW+1a5Uvk6pfo4sCy+ltOOCr0:yi75Ya1RkVTsr3OypRaOxJo4sUltOtr0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686216039, "uuid": "dfec8d0d-2f90-4364-a7a2-960c6fcdd464", "value": 299441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686216039, "uuid": "7f65f243-68ac-4e8c-8a02-d2f776effe87", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686216039, "uuid": "ddc0969b-40ca-4c4d-b86a-85d3a2ea1ec1", "value": "RO10098.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db649bb6-05a5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686192040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192040, "uuid": "af48bd4c-c4aa-42e8-8281-a5287a13dd9b", "comment": "Malware payload (Amadey)", "value": "03c37c6356f0e01967e28029a0b549a8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192040, "uuid": "567705ce-1994-4e3e-87b5-2f7e42e2f800", "comment": "Malware payload (Amadey)", "value": "55821e03c90762b4b02478d1678df88db7a0611f14fdd3a74b51ca17df1d5bb9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192040, "uuid": "bae70238-ca90-4dc9-b4e1-1ad95ce77e21", "comment": "Malware payload (Amadey)", "value": "09e8be08306f9e2bc05f7cf0536530d30396444a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192040, "uuid": "10702127-aa3f-4579-8cf7-4b547fea2dd7", "comment": "Malware payload (Amadey)", "value": "331d72c227e3bc6d89b5dd2a398df6ad95560a307cc2eee9fb5a8e8adf405ca3e4dc1fa19769bac5d87e0422a93894c2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192040, "uuid": "f4e4031d-d3ea-45ad-aa39-3dacf3e3f162", "value": "T12FD41202BBE99473CCB91B7018FB03830B36FDA1AD78966B2764994E5C726C0593177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192040, "uuid": "73409ba7-9fd4-49a9-a317-8f2c2ce4121b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192040, "uuid": "f96accb5-83ac-46e1-8818-e8206f47b0cc", "value": "12288:SMrNy90iEt8X3YFM5hCLh5zuOB4n+4/AYjx/Vr+uEM:3y48HC+hguVn+4oG9Vr+uEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686192040, "uuid": "6d5db723-2046-49e8-9d49-56d093937ba8", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686192040, "uuid": "741ef56c-4443-4f17-807b-d3c9620bb652", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192040, "uuid": "c3bead33-5db6-4e55-87f9-4aa58ef0eea6", "value": "03c37c6356f0e01967e28029a0b549a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "808f283c-0619-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686241709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241709, "uuid": "8ad5b4f3-ec36-4660-abf3-8a8c1223424f", "comment": "Malware payload", "value": "4e664ff612cde047acb9fc0b525c586b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241709, "uuid": "3d1d1e7d-1d92-4af1-8b4d-d7d8950a376f", "comment": "Malware payload", "value": "565319aee27c9774d3ea41b967e2913f2168c75448a296310037594c0bed1114", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241709, "uuid": "93a0c7f1-a6dc-4174-885e-16a3d44fa508", "comment": "Malware payload", "value": "29728b9e204874375118ee1b779ced8d1ff77ee3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241709, "uuid": "b1f9dfcc-ee34-4c3c-b243-1b3fb358c876", "comment": "Malware payload", "value": "7b975efa0a6f9a4dec82eff60f48ef25dbc16784df732849c4f3e19386e027c23fb39b42541197fb0d6cc9f47b51ae89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241709, "uuid": "52665cf7-6860-496e-8d0a-40f983363bad", "value": "T1B6E3CF767F1B858BC826D978E44A3F116A350BF7FE5900DBF528809C8E6B1C6AC191D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241709, "uuid": "b64865a0-02a9-493b-b9aa-dc5d0a79e99a", "value": "f80a2198e336339350f718214da6daaf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241709, "uuid": "3e865ce4-ab0f-41ff-b882-cccaf96ce37b", "value": "3072:MBIzhype6L3ifXn31IKvQ+fSYxWfmvEdxHeDjj8l74Jg8639LD2:vzhy4qyf3FIKvQ+fSZf9xHeDjj8+il5C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686241709, "uuid": "43e6c8b9-e3a7-47be-91d2-a13d1d7c71c0", "value": 146749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686241709, "uuid": "b45422ff-1a3d-49fb-9232-8a9c187b9680", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241709, "uuid": "fe262e72-ddb0-49bb-8884-a2ff19f20256", "value": "SecuriteInfo.com.Heuristic.HEUR.AGEN.1315548.8102.6161", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f00f349-05a7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686192663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192663, "uuid": "1a827c5e-7ed5-4daa-899f-13d19d5b6de9", "comment": "Malware payload (Amadey)", "value": "c0131ee320405e73ec49c32a593c5b7a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192663, "uuid": "4d09f5ab-9a57-4903-a53b-1d8a10261f06", "comment": "Malware payload (Amadey)", "value": "5691d384559f2499a7d9ad6fa892fb6b3bc2e25bf103d7df7371acd7e1905e52", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192663, "uuid": "5c0a601b-14e5-4e7c-9787-f6c96a78ca89", "comment": "Malware payload (Amadey)", "value": "d4467531af8ee236f8bfd4aa838c6ca41546da02", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192663, "uuid": "fa5cb40c-382a-4fa1-b79c-89beeb2caeb5", "comment": "Malware payload (Amadey)", "value": "428bd1e8c3cdf9802a627db9afda1931915b0d00904ef6b863d9fb1c5124b9c1446e2eb133a697460854ff008cf94f75", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192663, "uuid": "c4e232fa-31e7-4754-bd92-1021f069e49d", "value": "T1DCD4124266D89073DEB6177188FB03C30B39FCA1993483676B42991E0D73994BA7277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192663, "uuid": "1f21c7b4-c504-47e6-bb78-60e12aea717e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192663, "uuid": "8838cc26-dfe6-4e12-866b-2254ee3ed772", "value": "12288:LMr9y90FmlEhE9KDDlvi+iD5WfBYUtt0SzZFY8gsB2rkCoBg57bjj:SyDWDxvi1DKjVFY83F2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686192663, "uuid": "88690f64-3d62-4b17-9253-ec50733cc1c7", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686192663, "uuid": "21f345ab-668e-46fd-966a-b5e981ed656a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192663, "uuid": "454e517a-29a7-4be8-852e-2e406d17265f", "value": "c0131ee320405e73ec49c32a593c5b7a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "196588e1-063e-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686257427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686257427, "uuid": "f73406d3-3cf3-42fb-92b5-52125a7baa9e", "comment": "Malware payload", "value": "b16193047826dcf0da6b89504e8a51d2", "object_relation": "md5", "Tag": [ { "name": "vidar stealer", "colour": "#059359", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686257427, "uuid": "3d4d6e8c-7beb-4e48-9841-a853d7587cf9", "comment": "Malware payload", "value": "5692059079813d016862ac74de3ba8d255b4a208c615f4a7cdd9d641b2715e91", "object_relation": "sha256", "Tag": [ { "name": "vidar stealer", "colour": "#059359", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686257427, "uuid": "ccf49920-8232-43ab-902d-eac1669754d0", "comment": "Malware payload", "value": "c38cd9ace5d45ae434ebb1ca7a58112fd8d74220", "object_relation": "sha1", "Tag": [ { "name": "vidar stealer", "colour": "#059359", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686257427, "uuid": "d9815c4e-8b3f-4b69-b869-54ed0df721fe", "comment": "Malware payload", "value": "46e3531d5bc7b16b0c73315320b89c1bb6b0875a1ebb64388d1113539c361dcc8b67fc16f63133703754816a5c8a3643", "object_relation": "sha3-384", "Tag": [ { "name": "vidar stealer", "colour": "#059359", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686257427, "uuid": "bb4add02-0fd4-4c06-9f73-d75685a29f7d", "value": "T14DF533FBC6619BBF8D9F06E2167D86CAE5EA677C5887DC503ADD176A78430F20790800", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686257427, "uuid": "fc1819c8-4c41-4746-9e82-762d638e7561", "value": "49152:PZflGi2YXRC3c1SuLMEUTITcyApwDdRN2qIAXkGt1NMjV2wgb9DG7XF0f2:PGNkRC3AR/A42qIAX3NgV2wgblA+f2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686257427, "uuid": "a72dc983-ef14-4467-bb39-1293f15c8cc9", "value": 3441516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686257427, "uuid": "c6511147-a25c-40f0-a444-424b51ed9988", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686257427, "uuid": "a296177b-b3d6-4b1d-87d0-cfc5e071557d", "value": "757a441a4eaad964c783c5b072586b38.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0ad683a-05a6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686192371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192371, "uuid": "3818e2ff-ba6a-48f0-8e2a-a0fc60adf37e", "comment": "Malware payload (RedLineStealer)", "value": "6e25c5b68fefd8992fbcc4bb700e03cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192371, "uuid": "5aabf8b2-72d5-4a13-b139-cd771b4c6c84", "comment": "Malware payload (RedLineStealer)", "value": "56e27dc4849fd5fadf2412f049787ec0f0b34b487c6c9c6fb9fb30c7f855338b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192371, "uuid": "509e1b97-7fb2-45a7-9b49-02dab1d1ac92", "comment": "Malware payload (RedLineStealer)", "value": "8e5dcb14e5d5a3439facc5503c5e8a77128c4792", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192371, "uuid": "e27e78f8-9667-43fa-94bf-3fe677d40cf1", "comment": "Malware payload (RedLineStealer)", "value": "2a26c24952f743dc6131408134313647add00217bd3f36063c9b0b5f4af88daea0f90f7226d8c451f0ec5684d0da7da0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192371, "uuid": "0279ab09-ce82-4452-b933-c1536c8a5a5a", "value": "T127151213F7E48432D6F5173058F612D30A75FCA2497992AB3384361E5DB3690AA723AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192371, "uuid": "1345741c-a9f9-4e02-91ca-bb0ca27c1025", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192371, "uuid": "7c1ed4d3-3973-42c2-80f3-681848f496d6", "value": "24576:4yQ+qlFtrMrFfyOAHOHDbAr65VtA+yXFZwJh:/ilFtg0OjbA8VYA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686192371, "uuid": "a74965da-939e-4eb5-b91f-d2849e7ccb5c", "value": 884224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686192371, "uuid": "16fbe16b-6a49-412f-8072-bef9be82a320", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192371, "uuid": "2b2fb4bf-9ed5-4131-a2c8-4bcbae58d444", "value": "6e25c5b68fefd8992fbcc4bb700e03cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0414442d-0607-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686233769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686233769, "uuid": "1f21c9ad-d895-4fc3-84d6-8bc87f52399a", "comment": "Malware payload (Amadey)", "value": "2482fac203c2287ddfb04669cceff061", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686233769, "uuid": "5cf52d85-a7da-4804-8100-9934c52a40a9", "comment": "Malware payload (Amadey)", "value": "572f2c3bc9d097362e4029824f539eed980a9097d017cc4684bdacc820a858d0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686233769, "uuid": "b2402d4a-9c86-428d-88b1-f04d4d92d5f2", "comment": "Malware payload (Amadey)", "value": "6f9da2e6d6621dd7da4b3236c974ab5cc9025d83", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686233769, "uuid": "28760f82-3183-4611-8bdd-97091272bb4c", "comment": "Malware payload (Amadey)", "value": "33c5ff889f397969ec338e095244c155b18a322e86c0d5d1ce0b12932b84270da4f7a01987ad20bad257c9f29c4e800d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686233769, "uuid": "7d6b9df7-ee3d-4e38-8a32-562d0b56e522", "value": "T17FF41257BBE98071ECB517B049FB02D32B387CA19878836B3B91AD8B4DB3584553173A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686233769, "uuid": "9d670377-724b-44a3-b820-d13da157d12f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686233769, "uuid": "a6b0fdc2-fdc8-4dfd-aa55-0ca5574a61b3", "value": "12288:9Mryy90rPUtNYNRAFRqIC36MjfdFM/ImdpUXucjZNKnSLPUCesTnvaT4XoYXb90U:PyIctNYNRA3qoMjFFac+cjZNKnSbUCem", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686233769, "uuid": "d79113f2-637e-4893-8fc9-9c91747a5b2b", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686233769, "uuid": "30793305-c860-4c77-9342-6e3a1b06f907", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686233769, "uuid": "2be6e03f-30a7-4726-ba06-e9ae2db26ed6", "value": "2482fac203c2287ddfb04669cceff061.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0746e50b-05db-11ee-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1686214877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686214877, "uuid": "4b615c76-7fd8-4061-b0d6-69e1e3113937", "comment": "Malware payload (CoinMiner)", "value": "bd3e0120eb31b8c297ad672418fee135", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686214877, "uuid": "55f77bff-987c-40b3-98f2-baeed79e89e0", "comment": "Malware payload (CoinMiner)", "value": "586b231234bce80c4148b43a6c253486f961e182de06acf495337d044e2acfff", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686214877, "uuid": "a761b5c7-fd92-4ed7-9129-9f8a241a1d03", "comment": "Malware payload (CoinMiner)", "value": "4fe3584d9385b9cba69024fb7aee700de57e122a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686214877, "uuid": "bbc96952-25ba-436c-909e-422486a93b02", "comment": "Malware payload (CoinMiner)", "value": "8dcba888f2081d1ab7d71e90a16d901e77f69228225dc9b3eed6c3f7d8a40121f9e29decc8a42b06f4c5d7ce60329c95", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686214877, "uuid": "f25dfd94-baa5-4da4-b451-26cfb0f1771d", "value": "T16275291A79020C6AED8900F2EAE206385F90B54B0B44E5AB36D357CB97EF5D3D9CD18D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686214877, "uuid": "cf7f96ea-ae00-4535-9022-153855ff78be", "value": "24576:8bcADanwaoDgLRMlM1YKdS0zBfOnjDmNlqO/HUzbPpH:aanwXBdK40zBfOnjDmNlqO/UzbPZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686214877, "uuid": "9d17d443-bffa-4de2-b584-ea4c8dcb35b7", "value": 1613312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686214877, "uuid": "bd5fe488-a9d5-44d4-9e33-01130d6ac10b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686214877, "uuid": "eea0db41-681c-4c9c-98f1-cf688453fef4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "028a5f4f-0607-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686233767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686233767, "uuid": "ce0fd1d8-769d-4ff7-9422-4d1198f6059d", "comment": "Malware payload (Amadey)", "value": "772bdb43ed74195b7d71c47fc7f9a9c0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686233767, "uuid": "002dc5f1-3f2e-4255-bd45-ec44a4fdf417", "comment": "Malware payload (Amadey)", "value": "589b7bf4ecdbbcd5812f3948edc9d1c7a086975537c1b9538a8ee4f712d363cf", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686233767, "uuid": "a9dab3e7-8a76-4d4b-bf4e-815273897f52", "comment": "Malware payload (Amadey)", "value": "8a6aa9495f5d4060f4b543f957685d2ebc54e196", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686233767, "uuid": "a2f49fe4-64f9-4053-895c-05319941a163", "comment": "Malware payload (Amadey)", "value": "ed7c869f9fbb7fa8163fdf60886d94686085ed2a0a9d9402a370316d39c89f2bc29818226e2d412f608f31701bd6c4a1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686233767, "uuid": "ea1ef1b2-e79a-4c54-aa33-d94f05516707", "value": "T1A424F7257D12C032D56061B619F5BFF2C59C6828ABB049DB7B800F77DA122F73A61E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686233767, "uuid": "44314435-89d7-469b-9e1e-077998a253d1", "value": "f8cc61ade86cb7277d0ab974de6323cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686233767, "uuid": "38e6578d-16d1-465f-aec3-9e2a5b484232", "value": "3072:H/DmgskHbfHN+Pst60p0zuNmnKG7peNMQbuZAIqbey3lfbi:fDmfAfHN+wiuInRexuZAIij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686233767, "uuid": "2f1425be-230a-456f-bf63-944508a10235", "value": 213724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686233767, "uuid": "87cdc63d-62c1-43d3-88fb-9b005e09a6b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686233767, "uuid": "ef932d2e-ef83-46ad-8b64-fc05d93801da", "value": "772bdb43ed74195b7d71c47fc7f9a9c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5183ecb4-05ec-11ee-b3cf-42010a9c0076", "comment": "Malware payload (MassLogger)", "timestamp": 1686222303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686222303, "uuid": "aa548ef2-6823-4529-b8a1-2c3a1b290cb2", "comment": "Malware payload (MassLogger)", "value": "02f630bd197a94ac24badae6c183756c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686222303, "uuid": "daf9ba0d-ec3d-4ef6-a8a2-87279aa61f72", "comment": "Malware payload (MassLogger)", "value": "5922855fb22f461cc67e90ddd40091a0ea49595dc656d1acc938f23d42fd7a94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686222303, "uuid": "6469b2bf-e760-4ed3-b4e4-9b239cd28a29", "comment": "Malware payload (MassLogger)", "value": "e635466d561d248f8048f5887f4c4d451b0f988f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686222303, "uuid": "be27deeb-540d-40d1-9960-ed92cffbe5fe", "comment": "Malware payload (MassLogger)", "value": "a3f0d4d3f2ee4ac42f6afc9a1409b5533dfed8c11666a870ecfbc1f7b0bf5b74789a57e11a3b1cdb123f6279b4ff703d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686222303, "uuid": "d01c83c6-ec9c-42b1-bcb7-d0aa0ea0a66e", "value": "T15183280E33D48920EAFF847655B142610776F852495BD31E0EE1B8AE2F367C48A97F93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686222303, "uuid": "7ddbceb1-aaeb-48ce-9389-02ade8b83196", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686222303, "uuid": "3887ffc7-a313-4419-a6b2-a9fbb2bbe7e2", "value": "1536:smO+7ax6fzbn1sTfA3oHpRivgg1XU8kp9bLY/xQwyL:prNfzbnl3oHpRCggqr9o/x5yL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686222303, "uuid": "fe7c2a68-8e70-4190-bc9d-345446cdb729", "value": 82432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686222303, "uuid": "f3041386-5194-4cfb-9b55-f89482c899b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686222303, "uuid": "b7318938-4e04-4cdd-a295-da1139721f3d", "value": "5922855fb22f461cc67e90ddd40091a0ea49595dc656d1acc938f23d42fd7a94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aa155ac-05c3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686204682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204682, "uuid": "38fb3314-cf81-4787-b705-e38f4744c1c7", "comment": "Malware payload (Mirai)", "value": "5af109e0e51aba9ee7aa5899598631c0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204682, "uuid": "a5817f85-09f9-441b-87ef-7f3184d64f22", "comment": "Malware payload (Mirai)", "value": "59bcd6fa7d6dbf914568308814f54adc4b91f54eab471e666f4c63e4bfa162b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204682, "uuid": "919736da-0585-4ea0-82a1-24e0fd4e2e38", "comment": "Malware payload (Mirai)", "value": "60765d0ba6fbc8033f201ea22d8d5e6033961e81", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204682, "uuid": "6092382e-6553-4489-b0ed-f2da12910e1e", "comment": "Malware payload (Mirai)", "value": "a832f8624046367ffcb99c90fa5d942a428a629a12e595ecbdb4d6461690b9daacfcd14e027fa6080b73199bb9fb74ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204682, "uuid": "fc40c4ec-2471-4afe-ac23-aa24102ab1bf", "value": "T17663B65E6E329FEDF66CC23047B74A21A39923D223E1D6C5E29CD2111E7024D585FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204682, "uuid": "8ed82e34-d5c0-4078-9c9f-40c934431e0a", "value": "768:L3B86me60FBYIIdd7GitMkSWbVAqPW9kMxQTijyjh09eLK0cygLSvSjQi/IXH:VDS7GitjSWGq+TxQTif9eLKlS6jQi/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686204682, "uuid": "c5df3426-cee1-418f-866c-7ee7c30cc5af", "value": 72976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686204682, "uuid": "a8d7453e-7622-46b5-98de-10c61b335f8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204682, "uuid": "bc14bb60-bffd-4a95-ba4c-ad1a0a7dc5e5", "value": "5af109e0e51aba9ee7aa5899598631c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b088aa3-05f5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1686226050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226050, "uuid": "eada4fc2-4f7c-4e25-aceb-4179365f28eb", "comment": "Malware payload (RemcosRAT)", "value": "20a500fd451c33e49c77aaf6cd79b1d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226050, "uuid": "58d94a77-5d7c-44d0-bb45-81873b0947fa", "comment": "Malware payload (RemcosRAT)", "value": "59d705df5b4d6a3e818d5529de6270397899239ba61a19f746a7149768b47917", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226050, "uuid": "4c872c8c-90ae-491b-a268-107c5f4bdc1d", "comment": "Malware payload (RemcosRAT)", "value": "1e681faa82a3e65e1ea9f7e829af35aebf99da1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226050, "uuid": "f124e274-5436-4acd-a10e-e6f830920255", "comment": "Malware payload (RemcosRAT)", "value": "32e97566f8be2d27fb751a92565eeff5fb72838e4f64f5b40d3ce47a29ba152fea853675a3b7c6cab6f784b2ce162be2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226050, "uuid": "66361c13-00ae-4212-95ef-0b74ca0ae427", "value": "T1E42512A462D68B27C03F07FD40A18DB403FA599ABA31E7539DD370ED2B1BB698D05907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226050, "uuid": "59894939-687e-455d-9e19-2f432f409750", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226050, "uuid": "058f3f94-fc29-4ad5-adbe-9cb7b41d8053", "value": "24576:fEmFxUYl8y5VHiiR7Ya2yvTzLeTl28APMmQZglLam:smFxUYzeiR7DTEVfhZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686226050, "uuid": "0e672a8a-f816-4d37-8250-5343b29e3c29", "value": 1044992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686226050, "uuid": "6ed4619f-a3d7-4036-93c0-e248d0f2ebbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226050, "uuid": "941d88d6-615d-470b-bb68-8aaec374cb54", "value": "59d705df5b4d6a3e818d5529de6270397899239ba61a19f746a7149768b47917", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46fc216e-0620-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686244619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686244619, "uuid": "56181ffe-345e-41b5-b431-cd90fbd24c70", "comment": "Malware payload", "value": "cc042e71c5ba812f3d9c7a8cea9dac77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gonnacry", "colour": "#662A89", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686244619, "uuid": "28179d2b-eaf3-481c-be57-f0f369bd31f1", "comment": "Malware payload", "value": "59ec5dd442e436594e66b25fd2d348545f13df7549891db177a632875a192fa0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gonnacry", "colour": "#662A89", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686244619, "uuid": "37048efe-a9d8-489d-a258-53d72d40d617", "comment": "Malware payload", "value": "011491b7d276a017c305f0403cff79d38730922d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gonnacry", "colour": "#662A89", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686244619, "uuid": "b0a88d3e-6198-4965-843e-90322add693c", "comment": "Malware payload", "value": "766fb658eb779982f61fbd81499e1f9dc157116a0ca33830ca5d667f92d755e3e2c93dded74b2c50301b9976a0c7aeca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gonnacry", "colour": "#662A89", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686244619, "uuid": "c97f37d5-c855-44ef-9537-fac66b7756a7", "value": "T1E4028D0815A75824CFBED3F26418C369C3FA83378AAAA5D1D9940123D5893140EBA27F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686244619, "uuid": "cb0e5398-0ff3-4db6-9bb7-1583a3339892", "value": "192:k6uQ4Md04UduDzDM2saqRW1rj9ZWaPiIMsFQdaKHKgq6dMTp:klQ4MKSD023q+rFPBMsFzCdU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686244619, "uuid": "e561c8c0-56ca-4dcd-b456-786c11a77b58", "value": 8481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686244619, "uuid": "1ce56226-4b2b-4195-8bf4-aae4341b3980", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686244619, "uuid": "bdeca3f8-dad7-4ebc-b46d-0507fd3ad2dc", "value": "10733967037.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f06b5926-05bd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686202383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686202383, "uuid": "1eebd203-8e87-48b5-8c6d-0f2ece6bed91", "comment": "Malware payload (Mirai)", "value": "5901d4e3307a860d09829316e5f55f11", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686202383, "uuid": "2f6b6941-b5e8-4539-8460-f6f3a3ad1c81", "comment": "Malware payload (Mirai)", "value": "5a43283ed78f175f8a4b57b77d6ff9388ba58913ffa94183692b5f31bcaaf193", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686202383, "uuid": "1654ec9c-0b3c-4026-b4ff-efd187ab4cc4", "comment": "Malware payload (Mirai)", "value": "918b7a8bb5fbd6a748e2b5d89f3cfd01948c1324", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686202383, "uuid": "cdb317e6-474c-4035-b56f-4c3f841ad2e3", "comment": "Malware payload (Mirai)", "value": "ff8d2c0489ae07a93c0fdaf23835d0326956a25864bd553e3816c7c1950d047fe9852383cb720a8f8d871e21001e3b59", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686202383, "uuid": "3fdac05d-4d4d-4f22-a00d-e2d62216a072", "value": "T1C282CF4D91C40647D8E4F37FFA65BE197680A73C4368EE576E2458C26B190A10598F4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686202383, "uuid": "13074588-156d-435d-a9df-e8758e90c22c", "value": "384:MGjaGgsMNJ/pS+XqfHQE/V+HHtNiBYcNd9rV9I0SWIDKd5:bMNJ/lXoHHPBZd9rzCWeKd5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686202383, "uuid": "c01576bd-ad22-47e7-b845-5f3cf7d46153", "value": 17912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686202383, "uuid": "5c071ee9-b13b-4791-91cd-42ad36bd3a88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686202383, "uuid": "ebc70c44-33b0-4a91-b26a-9a263be5a154", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a398045a-05d0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686210415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686210415, "uuid": "43e1f599-2e39-4533-ab81-9c0705bd6a77", "comment": "Malware payload (Mirai)", "value": "7436ff85f37982cf09e136de11831a82", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686210415, "uuid": "e22ed212-646b-4c63-a8e5-9bff0a67dbaf", "comment": "Malware payload (Mirai)", "value": "5abcda1c9db2137fba98326b524fddd6059c26e3bb615ec999900122f5bb9b2e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686210415, "uuid": "35cf1445-e5fe-4686-9f90-6bc070d73b0b", "comment": "Malware payload (Mirai)", "value": "67325d8d1bd7bc5a8c4f96d01f94ee31f127df4c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686210415, "uuid": "0514af9b-15b8-4ad9-9976-2d24a786fc73", "comment": "Malware payload (Mirai)", "value": "0eff07825e52c8ffcf6ce8fb666ab74c9a1622c73323962c570d4ebdc373e5573e353e5ec5777bcb09259761d2b4a6bb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686210415, "uuid": "c5d6c461-6346-4424-9e3c-3df9d56a30d1", "value": "T1CD31DF91A2D05DBDC4F411BEBE5B0314B374AF00E1CE7222923C67586D2AE3C5D3714A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686210415, "uuid": "5778c03d-cf00-4291-8aca-d38bdb847664", "value": "24:uAd9KGpa7Urz/jlfQ+XK1G9Vev3gRGRP9ihBBuLl5I9gD10yd:uA9KGpa7UrLZERlPyBuME10yd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686210415, "uuid": "d9c334b2-b6ae-482d-a0fe-391723da0d4c", "value": 1500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686210415, "uuid": "fff930db-7475-4d09-a68b-0bf8c4372669", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686210415, "uuid": "d99c4ab2-1d5d-4827-8f12-e9141c489748", "value": "7436ff85f37982cf09e136de11831a82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7add303f-05c9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686207340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207340, "uuid": "a03f66b3-9fa8-4b2c-8adf-d2ca05c26e83", "comment": "Malware payload (Mirai)", "value": "da679d761f7be4009920d0897dded48c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207340, "uuid": "847318de-607a-4591-865e-dc3dc68ac45a", "comment": "Malware payload (Mirai)", "value": "5ad74322dccc724e7a0d4e03aca7f11f0ff9a8567b099ece68098d5f95965f32", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207340, "uuid": "46617a2f-c4fe-48ca-9712-e50650a49dcf", "comment": "Malware payload (Mirai)", "value": "838d9b6777885fe3797e84b82a81ce9e2600fbfb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207340, "uuid": "4ac80c6e-34ca-4bef-9ba0-8cd64280dcf0", "comment": "Malware payload (Mirai)", "value": "f59b090e240ceb8d3fe4c31367a62fdb715d25ac87b1f339349735498b021f5aa9f8a715ea4c6be00b6697082b620581", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207340, "uuid": "a05218df-6a27-4301-82dd-a4fcdb9dcc47", "value": "T1A6C35E86BF903FFFD81ECD3241A4DB0A129D590A2394BF7A1B78D408B65B11A59D3C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207340, "uuid": "7bfe56e9-09b4-4e97-9071-f1e279591398", "value": "1536:DAD1ymlxwpAJ/Yd86AbDrHQWTee8QDncElcgGr+:2MMipAJWtVWv1DJO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686207340, "uuid": "c590c9f2-449c-426b-bd25-b0b61771844d", "value": 128580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686207340, "uuid": "21de3b92-9196-4461-a06b-e4b7ea21733c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207340, "uuid": "3d728f38-3d0a-426e-a34b-5cd6142e9fe9", "value": "da679d761f7be4009920d0897dded48c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50289d65-05a7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686192665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192665, "uuid": "49a43f65-9f74-4e6f-b317-7c0475cef116", "comment": "Malware payload (RedLineStealer)", "value": "c237fcdbd58e6d0e55ce1e30b29da4ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192665, "uuid": "fde1ba56-511d-4590-b07c-f21957515ee3", "comment": "Malware payload (RedLineStealer)", "value": "5b03983f7a89fa845b2a940a06455848c42f84f88234052051b2a9e9ed1f7a33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192665, "uuid": "b6f2c2de-68df-402d-8660-996a2bfc7113", "comment": "Malware payload (RedLineStealer)", "value": "aee8a45256ad425dce17677a508b9c6824c39960", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192665, "uuid": "b7ec9e09-9336-4c46-b2a5-3bbfca19d981", "comment": "Malware payload (RedLineStealer)", "value": "3b38052ae8a509fc887c7626aa94a5442c54a3f2bcd94dd4c75b7470f89180928e4a3973eb7f255ab4491166041a6723", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192665, "uuid": "14f57906-b0e2-4379-8ac6-16697557d82e", "value": "T1B2151212FFE99037D8750B7069F242931F3A7EB20939926F7BA1580A49634C5F47272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192665, "uuid": "0ee64dc0-7f92-48a8-91ed-72939ff6fd5e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192665, "uuid": "90ffcd13-9695-4f98-9b35-3bcd4a108b24", "value": "12288:9MrAy90sogZPAFjPaNVWWi884JaJGpHptLSopkS0Y95Ff5h8Imu3epbyJR1:pygvTINiGkJGTDTDB93IyR1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686192665, "uuid": "bf092b03-27f8-43c7-986f-57e36b1a6930", "value": 886784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686192665, "uuid": "05d5435c-4c15-43ea-96d5-57a14d3f13c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192665, "uuid": "f5b23078-b748-4f35-89be-912b1ce6c1c9", "value": "c237fcdbd58e6d0e55ce1e30b29da4ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa94b591-05d2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686211420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686211420, "uuid": "24da7f9b-38ce-4742-b689-0e1a7df2a3df", "comment": "Malware payload (AgentTesla)", "value": "cf70d7ed921ed7e343839eec42491b9c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686211420, "uuid": "d4e15f56-d8e2-4508-8444-a00c4013bc75", "comment": "Malware payload (AgentTesla)", "value": "5c0faecac3112feeb9424bcb32f151ce100ac9146b09e366d3cf15daa756e841", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686211420, "uuid": "92f78ba4-e0b0-44bb-981a-38c1c87a45a5", "comment": "Malware payload (AgentTesla)", "value": "0fe312f94f832f42ab66447cc81bf2113c5428ed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686211420, "uuid": "b7f20364-1782-47e4-989a-3ac1fddca647", "comment": "Malware payload (AgentTesla)", "value": "5c85a8e2c4d46936f1c10a442bef5e4551552c44c7f328aab113adb941d5d5dc241bb91d9558a03040be76cdb309eb74", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686211420, "uuid": "de6ef254-3f5c-41af-a52f-fe65f74378ca", "value": "T167C423C6F73A20142DDD07DA311B300A012F2753583DABABB76F59530716D26E9DAAE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686211420, "uuid": "740b63fb-d54b-47cf-b98a-e68d5023e3a3", "value": "12288:iAwmpniyk9QYn5ZRLInTAggT00EsXahnvS4hniXruGiG0:7wmpi55ZRETAUUXah1iKGw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686211420, "uuid": "add3c9e7-0f0c-49d5-a0cf-17936ace54a0", "value": 584900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686211420, "uuid": "e8a92062-eba3-4f0a-bf2e-6a22a77f6421", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686211420, "uuid": "ff33379e-6033-4c57-9e3d-2d3f4333bd51", "value": "updated schedule.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "070a2bef-05f0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686223896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686223896, "uuid": "d255b046-e46c-43e8-a58c-b0cc372875a3", "comment": "Malware payload (Loki)", "value": "f9728cb3ed744c5cd430860fe6a736cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686223896, "uuid": "1e984828-3b3c-410d-8ac6-5ac045a88098", "comment": "Malware payload (Loki)", "value": "5cd94ff38a43122a2571b1fe66629357ceddbf43543e8327df5f5d8de10b8f41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686223896, "uuid": "ae5e0dfc-8898-4833-a61c-d4bf02bc78c8", "comment": "Malware payload (Loki)", "value": "d7c616e9ccac452bc23c2f66dcf3b054f21079d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686223896, "uuid": "e63c8941-7057-497d-b57e-e2e96023da90", "comment": "Malware payload (Loki)", "value": "e2cc26d12853fd31b0f5d1ed1950af4161dfc5348b1428dcbfbc9deb747acab22bc9603b798b454f0f391fd393c88573", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686223896, "uuid": "6569c68e-ddca-4066-8914-e4199ae5fc50", "value": "T150D4229873165C13E46B3BF5111267B147B7BA503024E7DA2CD237AF47E6F21A622B83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686223896, "uuid": "2e6fdcbc-d287-41a2-9e80-3d2a7def757c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686223896, "uuid": "2c5be27e-610f-4672-8452-2d28c3695490", "value": "12288:57z5GoJiGaq5auZnXCEY+/FRm7e5A9p8z5pEwdFyzDnzHz:V5GoR5aSS8FETovc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686223896, "uuid": "0dc9f6ed-207e-4315-9bb0-9790cef54a10", "value": 624128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686223896, "uuid": "9df18071-109d-487e-95db-aad1d8cc3dbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686223896, "uuid": "b739d1d4-4b77-4268-a5cb-4a94299a3b12", "value": "5cd94ff38a43122a2571b1fe66629357ceddbf43543e8327df5f5d8de10b8f41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0587f51-05ca-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686207966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207966, "uuid": "e9703838-12c4-4d7a-81eb-27c937a0ed35", "comment": "Malware payload (Amadey)", "value": "8cdf7f4232904002cef6c9931ae65f24", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207966, "uuid": "447ffae3-e14b-4718-a7fe-d6d490db2987", "comment": "Malware payload (Amadey)", "value": "5cfeac2fad035a1a351abd2d5734dcb858583fdbdb9cf7f9383f5c809593fe96", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207966, "uuid": "6cb34bd3-4e8f-40a3-8cd0-97dc8f15eceb", "comment": "Malware payload (Amadey)", "value": "adb8cb3cc5f4682b1c02d591ac801cdd96fbc7e4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207966, "uuid": "a1f7f496-d1cc-419a-9d64-cc0c36e5ce53", "comment": "Malware payload (Amadey)", "value": "ad544607d30854596ed71abb643ffa33f4c81a455a4730e8210a72ddd560c11510857e90560b8a42534e81bc0c88a595", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207966, "uuid": "479707d3-de27-4a5b-95de-b58182786c5b", "value": "T197F42246FAD41032DEB4677044F767830A35BCA06A38D7AB1B499D4F0DB35A4A87273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207966, "uuid": "44cbbfe8-5bf9-4b6d-b569-594a6eb752ee", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207966, "uuid": "adf9d422-5758-4ed2-8bf5-a98f088f194d", "value": "12288:UMrRor59+bbWOK6qaK6qaK6qaKhRBxhRBxhRBxhRBxgQAwgQAwgQAwgzy90SW2Ya:Vor59+bbWOK6qaK6qaK6qaKhRBxhRBxd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686207966, "uuid": "b9104501-f51a-4e3a-aa9b-7f72e5693017", "value": 769536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686207966, "uuid": "e0850a16-ef3d-4990-80db-aeddf4d9757d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207966, "uuid": "cc207d24-4695-4edd-a299-1f21a7680e45", "value": "8cdf7f4232904002cef6c9931ae65f24.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04752304-05db-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1686214872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686214872, "uuid": "038fa149-ec3a-4472-bb26-0fd3ca8c600b", "comment": "Malware payload (DCRat)", "value": "231efb7ab5b36cda91e06456480228c1", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686214872, "uuid": "c71e4d9a-8e7d-408f-b005-0bad4c5e1def", "comment": "Malware payload (DCRat)", "value": "5d876dee883aabe22c89e9332d18d41580e7dc5c5030be843538b5a11c053a1d", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686214872, "uuid": "b00f0487-5113-4dee-a334-0ba5976479b8", "comment": "Malware payload (DCRat)", "value": "11edb782a254ead91bef459fb4dac0ca393ffeaf", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686214872, "uuid": "87f62304-6d65-4b51-b018-8098e758deb9", "comment": "Malware payload (DCRat)", "value": "9228f76a6efacda6372ca4efc7a66153986ab919a26e66684c6805b6fc0d1183be311efd2a7e58e7ecd146ce513f9c94", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686214872, "uuid": "7bfb6c57-abfd-44f3-a2c2-af85e3e2f98e", "value": "T1DB555A01BE448E11F0091633C2EF454887B4AD526AA6E32F7DBA376E65123B77D0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686214872, "uuid": "eb8c35c3-658d-4249-9ec9-41ebb361ac20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686214872, "uuid": "7cce82fc-90bd-46f4-b964-d252fcefefad", "value": "24576:9urfikuV13mFFkwIuKOaZDIpw6P/KlBrJ/GB+8xNEJn:eiku13qF1jtpwG/KR/YxNEJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686214872, "uuid": "73b587d8-d347-434b-8022-c6aedbda09ec", "value": 1362432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686214872, "uuid": "60899b97-ed43-418b-9402-0a87c86dfb06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686214872, "uuid": "c8533bff-f046-47f4-92ae-6b4b908f12f5", "value": "231efb7ab5b36cda91e06456480228c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97796168-05a6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686192355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192355, "uuid": "839ec775-eb6b-4801-9aea-765bcaba0650", "comment": "Malware payload (Amadey)", "value": "0ea51fd6f0e74f0cc89e6738297f0de2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192355, "uuid": "6aef4836-76ab-4dbf-ae6a-cdc66a9901e1", "comment": "Malware payload (Amadey)", "value": "5d94faaa5ceb49449b8701fbbea44c2f54d47a9f96eb89e2846330a838da1d17", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192355, "uuid": "621228e7-7dca-4dc9-adf2-5bdcd0ee92e1", "comment": "Malware payload (Amadey)", "value": "6042524ebad5ee08e4f039066109a57981182339", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192355, "uuid": "6342b38a-e3ae-40a3-9e3c-b8735f532e9f", "comment": "Malware payload (Amadey)", "value": "cb301bc9c2b8f0878dfd54f12c9ffeca3a108f77385113c6f5f6128a59c24412ddc185bb750dceb2febede8205b7d058", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192355, "uuid": "8b740504-3d91-46ad-be79-93630e057e83", "value": "T1A4D41216F7E5D026CEB21B7018F602D32A3A7C724D38936A2B455C5F0DB2684F93572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192355, "uuid": "2df94fd3-0033-4a65-82cf-32bc0756c2cf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192355, "uuid": "5478e217-a4fe-4904-9f02-ffbc82d16c17", "value": "12288:MMrJy90vBFg/B8vNwdqmyosIjI+PWn3YUbFWc7sMJBudz:lyiBFg/WvN6ACEYUbFWcgYudz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686192355, "uuid": "c50df69d-0e08-4cd2-b836-672c3dd7dd9a", "value": 605696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686192355, "uuid": "c030bbd2-6253-4409-98bf-6d3d81bab4cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192355, "uuid": "b563e620-5400-4a2b-9fdd-1b665cab156d", "value": "0ea51fd6f0e74f0cc89e6738297f0de2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ea0af91-0611-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686238243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686238243, "uuid": "56e7ea2d-30ad-46d0-8579-3a7b89d6082d", "comment": "Malware payload (Mirai)", "value": "c245e73805b65be6dfbc1d5777b75f2e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686238243, "uuid": "c7189a98-52c9-4e90-99a3-c0424a25b82c", "comment": "Malware payload (Mirai)", "value": "5daf3dd4a0d4f21447483bf94c31447cfe50653adacb8e43f3c9bbce24d7b1ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686238243, "uuid": "a2fd998c-e146-4cd7-aa4e-f7033c72234d", "comment": "Malware payload (Mirai)", "value": "6d67a816f1ad8ac4556fb8fe2dc7fbe943df939b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686238243, "uuid": "22f70eed-1665-4006-99ed-78fe64cc50d9", "comment": "Malware payload (Mirai)", "value": "a27fc5934a145e8b36f71c9d07edf55f17c917c18adb6de9f8ff48ae83cb25ce348d4c6a23de550ad6e83a964cb4aee7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686238243, "uuid": "a5c04f44-163a-4457-b4a1-24f22124f7e2", "value": "T1534302EB06226373EDF22C75D735848AF6330CA042A676843791D178F7AE051E769CD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686238243, "uuid": "d81e0e4c-dff8-4611-bfd1-0fc6a6a7d84c", "value": "1536:gbxVDNur8IDoDrtia72O5fZmQk2kn9IM3/dubFl:mxduDU7/FvFO1ubFl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686238243, "uuid": "74f9c4ce-e4a3-4e50-86f0-3255b72f545d", "value": 59780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686238243, "uuid": "2a496a4b-ad85-4a78-bc61-3c06bf91ae4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686238243, "uuid": "c4c7fd86-8b79-47af-be52-30f1f5404ada", "value": "c245e73805b65be6dfbc1d5777b75f2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5dc4bd9-05cf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686210069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686210069, "uuid": "3a23ed2f-54a7-4018-8573-bcd60553ae3a", "comment": "Malware payload (Mirai)", "value": "62b68b13770a2db7379e190541c14413", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686210069, "uuid": "774596c1-001c-4fc3-a345-1372e60579c1", "comment": "Malware payload (Mirai)", "value": "5e1dedcaed3a2be553a0e712b985786d2c479c4b233f13433e5b6d3976520aae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686210069, "uuid": "c821768c-717e-4e82-a49a-fd44fb0c393a", "comment": "Malware payload (Mirai)", "value": "b71c38094156d7b1a04fdacb82e477d3d41a0297", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686210069, "uuid": "c2233fd6-b0c0-4e73-8b8c-a461fbaa428a", "comment": "Malware payload (Mirai)", "value": "fa0b0e63c37d4d3a37b495e1facdb8f9dcd0f6fea0d9bb526b0f2a34abb59bcf08fb380c279f82f13a58e587dbf3dad0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686210069, "uuid": "edc0ade7-87bf-436d-9c1c-719e9c9d5d98", "value": "T1DA13F15D707882DAC16CA1751D3FF98BC008B758CAB09DD7EAC4A43FD8A6F2E1E18195", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686210069, "uuid": "cdcb3883-20d2-4f87-af8a-88eb2a55a758", "value": "768:izViU8OuEAcj/T6qi3w/QwXC4YAA4ECGj+2vSYpVj8DqnbcuyD7U0yqZ:cV4XQjGLiQEn33J8npVj8Dqnouy8PqZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686210069, "uuid": "cd76c8a5-544b-45db-bd64-b70d8e61a145", "value": 44584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686210069, "uuid": "e1013ed8-2475-4d66-a959-2a215544e86e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686210069, "uuid": "24ece512-47fa-4758-8621-9aac958fb39e", "value": "62b68b13770a2db7379e190541c14413", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60599b58-05dc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686215456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686215456, "uuid": "16f42210-7c3a-43e2-abbf-af55a960a181", "comment": "Malware payload (RedLineStealer)", "value": "eaef20411b5a63d56a8ddb9d8fc36e9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686215456, "uuid": "03c8ac69-429c-4b1f-9bec-630574df238f", "comment": "Malware payload (RedLineStealer)", "value": "5ff17464c55bf46f82ada53994a81605dd239d8eb9397771cd1ee78003c20b76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686215456, "uuid": "448f8bbb-a7fd-4233-adfe-0d05dcf61818", "comment": "Malware payload (RedLineStealer)", "value": "42c8dfdf694b8baf9d833692a2cbe1382c615092", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686215456, "uuid": "4be70727-30ac-47f3-b7d3-2c2b9538183d", "comment": "Malware payload (RedLineStealer)", "value": "968d9471c0670a2a066cc27676b82f88b8847853ab98f388a17c13fbd27471ee09b2a8e89293398ca2e367196fc6e4bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686215456, "uuid": "b406f5a6-ea2d-43ce-bd56-ca062d3482a1", "value": "T1E5D41215A7E85133ECB517F018F602C31B36BDA29934876B278568DA0CB33C5A67673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686215456, "uuid": "2866afcb-9337-46ce-8d8c-f2014e63c961", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686215456, "uuid": "fd3e3bf1-c079-46a8-9da2-c45f2dc698b8", "value": "12288:+Mr9y90+0qtVvd7FNwamxwgw4sMaGR/5sxVlSGyah97WPdiYSMTdM:DyR0iVv/Gnrh8SFahw/fZM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686215456, "uuid": "c2dfdb39-4c3f-4dd7-9f95-7a1d24bbda50", "value": 616960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686215456, "uuid": "17daac3c-00a6-4ec9-9e3a-f49f1d0b5dc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686215456, "uuid": "0b717dd6-26ec-4522-b214-da8133c71010", "value": "eaef20411b5a63d56a8ddb9d8fc36e9c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d23999c0-05fc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686229391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686229391, "uuid": "b6cb22fe-8a74-4a4c-b63b-24e2ec23b94b", "comment": "Malware payload (AgentTesla)", "value": "0991921f66adfa9aa17aafe7dfe48e30", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686229391, "uuid": "3417bbd7-9490-473d-a656-64845f074178", "comment": "Malware payload (AgentTesla)", "value": "60221fe8c0c8b95270816c5f36f3e5c0f01cede1c822a7d7a115189dc78a0cb5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686229391, "uuid": "55482d8d-a611-4061-9fe1-01dcae2d8a56", "comment": "Malware payload (AgentTesla)", "value": "acc4c67aae96ee2b4fe59eb91b899e384132c1c4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686229391, "uuid": "f4aea883-b9a6-48ac-b75f-1e404ea6c7ac", "comment": "Malware payload (AgentTesla)", "value": "251eef96a871543368c535dbc471980c2e5f0f651da8ad3825dcbdf65a1dca6d38cfd87d71d04be1bb8535dc21ad3573", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686229391, "uuid": "61c1679a-3648-4aa2-a308-7ae9c7a644ba", "value": "T1F254135176FDC093D8121AF11EB59E7E6F8DE5322049C38367812BACBD621538E1E3A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686229391, "uuid": "05221ee4-cf1d-451b-a1e4-d1da82184882", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686229391, "uuid": "feb87027-4678-4df9-983d-61f65c0d8de1", "value": "6144:JYa68XB9yrCKKEf5QpRzpmPArHVc+uqdQuPSHFuzyEV7YYs:JYOB9MZ9fGP18ABUq1SHZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686229391, "uuid": "38a110fa-c885-49fc-aeb9-88c8852177b8", "value": 295207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686229391, "uuid": "f090a187-5804-43fc-8f54-20da318da827", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686229391, "uuid": "bc60f46e-3930-49da-82cf-22c68b99f3bd", "value": "916042500021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abf5f266-05a6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686192390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192390, "uuid": "e94713fa-03f1-484e-8004-669b5fa2ae8d", "comment": "Malware payload (Loki)", "value": "93ab3d819fe8cc655bba88caabeeaeea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192390, "uuid": "6ce22beb-c100-4671-ad2f-4dc0dc958223", "comment": "Malware payload (Loki)", "value": "6053c4c96027a86c60053056dc1f2a90142179b628d82f4ac73315ddf36bf544", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192390, "uuid": "b45d8a05-d1ff-4c4b-87ea-92a1c71f5d30", "comment": "Malware payload (Loki)", "value": "7dd0641c39e98ecd674fc0c47975a83c46cb4833", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192390, "uuid": "5b5e205c-70f4-4c28-b106-ef2202b8e876", "comment": "Malware payload (Loki)", "value": "e25c95631b5a5e0514bd2f6a27eeeb57044aa2648b898de2f8608bbf80a74bd6d950f4cb14eb5241f99906f1bb2e3b99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192390, "uuid": "f113dde7-415f-4e0a-b1a5-984afb25f1b1", "value": "T1E9F4D05433BA5F25D839ABFA0450593447F8AA5A383FD68A0ED2B4DB9D60F110F80F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192390, "uuid": "342c0382-bb51-4d3c-85c8-589948913bf5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192390, "uuid": "253a4a59-2a70-4838-aa89-219d67dd66b0", "value": "12288:AHrihaDnLMzIL2q+RTdOL8MHwn40Vi+it7irZ6vsFk/ycFibGbQjmP4kTX7:A0OyqGUL8DViPt7it6vsFS/FibG0w4k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686192390, "uuid": "0d3cc9e2-0989-4f16-895c-1bb714cb83d2", "value": 770048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686192390, "uuid": "8048838a-c90b-437a-8f4c-83dfb05dd8c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192390, "uuid": "e711e383-e359-4420-b581-058da4540706", "value": "93ab3d819fe8cc655bba88caabeeaeea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91ff2ea1-0646-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686261066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686261066, "uuid": "f9219002-f8cb-4c28-a177-0fb25346008e", "comment": "Malware payload (Mirai)", "value": "9ac86384c86f1c2a7a9f25154713f27f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686261066, "uuid": "7ec77e70-f5f9-4d0e-b708-43ed1de826a4", "comment": "Malware payload (Mirai)", "value": "609200009a8c5a534e4fa0f26f1732b1f16d040820169659c0884bab2e09a1c6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686261066, "uuid": "c6f68aa5-201d-43ec-b46d-753f97600230", "comment": "Malware payload (Mirai)", "value": "abc7cb49e561593ea645f915d2bad10b2a84758a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686261066, "uuid": "654db1c9-aea3-4654-9ba7-3b7b20c63d7c", "comment": "Malware payload (Mirai)", "value": "0dbea019c365e4e7b3601c2fe921dea2e7b599fc3721d729a217174be3e1f58408c4b3a3f238ed63f232a541ce1c3c4b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686261066, "uuid": "786b371c-493f-47c0-8f9e-b2a227a43e8b", "value": "T12163964D3E319FACFBA8463457F39E10A35823D526E1CA85E19CDA011F7034E645FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686261066, "uuid": "a0d483f3-fcd8-4789-8b41-6f00b75ef591", "value": "768:RzZWyvL5MsRXxPx2pqV2Ujz9HX8iJ3GecFgoSERFImpPxs6vvSp+ozXeyt42egHO:OKzPxkqV2UdGecFgoSWlHs6t0egwsnM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686261066, "uuid": "02169e60-5bef-4a31-a90d-68227604e07b", "value": 71856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686261066, "uuid": "f19c470d-9e7d-4450-87ad-cd89e3d4446e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686261066, "uuid": "42108c26-c6e0-41b4-ad0e-cf79ef2f9ae4", "value": "9ac86384c86f1c2a7a9f25154713f27f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "816fe4c3-0593-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686184158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686184158, "uuid": "421b09c1-3854-4fb9-a78e-9b3b479068b5", "comment": "Malware payload (RedLineStealer)", "value": "a28c0a5cc91f8bc21a6203c02f0277d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686184158, "uuid": "cc8a4161-67bb-479a-ba32-3bd18c5e0548", "comment": "Malware payload (RedLineStealer)", "value": "60f3d215179ef5bc78424b273565ae3ff061ae5b31bc3a2e9d8d7908f2aaf51e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686184158, "uuid": "c96b51a6-4485-4bd9-af3c-c057cb7bd4b7", "comment": "Malware payload (RedLineStealer)", "value": "367010d8311620e05e91bdc12674a6ca839d34e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686184158, "uuid": "35ce2b74-5ed5-4344-9ede-354ad735046a", "comment": "Malware payload (RedLineStealer)", "value": "ca06e53c1b3302328481e440ea0d1df66a28fbdf6e83a3e57f79f610086f384c4177508b41925a6d366618c99223f17b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686184158, "uuid": "f23ebd52-112c-496c-b5fb-1c0d430a9cd4", "value": "T1B954480237C68CBDF8AA073D60D48F3DC877ED60165464FA37A89A618ED0313959B5BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686184158, "uuid": "1e584c9d-d73f-49be-9715-8a66c3d55241", "value": "f264906d4975bf1277da66f2124faba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686184158, "uuid": "d3625a42-ae0d-41f1-9768-0ae6748d5dfd", "value": "6144:rQvoWvJfoZuwvTygXUNVS4MGh1aBFrvz1xcxcWh9rt:rUO/yR1aBFrvz1xcxd9rt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686184158, "uuid": "6cd9c9c7-6c73-44e8-ac74-4810246ad10e", "value": 288895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686184158, "uuid": "f7efc448-f69c-4d67-aaf4-55948131e722", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686184158, "uuid": "a609a882-6d4e-48bc-b2f1-e4cd0653c7d8", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71ce6de2-0611-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686238248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686238248, "uuid": "6ead9997-b928-4557-b9c5-1f968153ee5f", "comment": "Malware payload", "value": "56d2939e0462a042dff1526d46ed2cfc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686238248, "uuid": "d6446ef6-f244-4d80-a304-d17de44030b9", "comment": "Malware payload", "value": "6246a4b3acf157d6bada5f42345ca4685a454e8567eb308405d8aa72338dac6b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686238248, "uuid": "99cef8f9-ff7f-48d6-92d9-0a44a2f63286", "comment": "Malware payload", "value": "0ddd0469ea17b57f82406ccc7632deed8e14c8e3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686238248, "uuid": "ef6df5b0-2983-4ea6-9109-ed9635502ef2", "comment": "Malware payload", "value": "c47a1e0d2a2800bb465f216ca7b9d0663e675433aa426c90431550300850b19139ac0c1506de6065983bf0ee42e20d08", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686238248, "uuid": "43d293ae-0299-482d-9c14-860a835a7134", "value": "T1E803E12DD91530C5DECEBE38909D165C0A89F188728D1F8F8BF89C486D646CEA49E5FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686238248, "uuid": "4d8a758e-1b30-4752-a9be-7d5f164cdd1c", "value": "768:kE1hhWjGqeJ3LksvkNtY8ziiYEmSmbBRg1I4cHT29bWMx:PqGp3YqkQ9g0bjg1I9E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686238248, "uuid": "05fd8c72-baf7-47c9-95e3-3aef0683dd1b", "value": 38056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686238248, "uuid": "26abedbf-c03d-407e-b9b4-406c2cff8ea0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686238248, "uuid": "e47b82fe-8ad4-40ff-95a9-c926ba6d7311", "value": "56d2939e0462a042dff1526d46ed2cfc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61171246-05c9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686207297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207297, "uuid": "2e2a1d8e-0400-451f-a56b-ebd1824dae2f", "comment": "Malware payload (Mirai)", "value": "55831cae0579bfb5f39b541a3baa593e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207297, "uuid": "2bf11ce1-ceaa-4d8d-bed6-44f7bf7c71c2", "comment": "Malware payload (Mirai)", "value": "6256245fbbc0f71882b27b4fec652b794116ba0862c80b79446c7e5605a248b6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207297, "uuid": "14047971-fb7c-4470-af4f-e82394405d5d", "comment": "Malware payload (Mirai)", "value": "e9f12602eef9b87423f0acbbaef135b24966baa1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207297, "uuid": "663e244c-578d-4ab2-87ab-4a6c416b5bde", "comment": "Malware payload (Mirai)", "value": "9d430dba6205554890f98bcc516217191d1322c96b1420733f7b2dab2a523ef78111748b59a60f4b8ae43c47c08f9594", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207297, "uuid": "29193a00-0089-4192-8ee3-4dc4ccc53e51", "value": "T12F534BC5D583D8F5EC5609702077FB328A32F47B2125EA87C799E932FC52A12E60729C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207297, "uuid": "b5d851d1-6421-4e39-8cbe-8285529d9b8e", "value": "1536:JDxKGuBit24He5zE6d+T4sSXbmpQb0roNBpSl+S:JDAlBit2ccE6dssbZbg4BW+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686207297, "uuid": "3f358888-195b-4cf5-9c06-4a38c7f87b9d", "value": 62492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686207297, "uuid": "769f734a-d98a-485e-917f-772fbb5912be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207297, "uuid": "a2765c58-6d12-43d3-a8f8-eff3265e7d9b", "value": "55831cae0579bfb5f39b541a3baa593e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88b86678-063a-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686255896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686255896, "uuid": "28d7ab80-2201-42d4-9d83-c7b84a678eca", "comment": "Malware payload", "value": "27b17d2159cb2d376643dd6ecdd01224", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686255896, "uuid": "b96c2c0e-14c9-49af-88b3-e0d99de9cafe", "comment": "Malware payload", "value": "625ab7856c3c34a7be37ae4d7cc640a775dbea37bf5e81c0716de2d80aadfc04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686255896, "uuid": "03933b05-34c0-4c1e-b630-b92f7b2ba966", "comment": "Malware payload", "value": "05d53771c76bf429ca338c4baed199152d714ce4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686255896, "uuid": "d244db12-7178-44f0-9d78-e427126b73f8", "comment": "Malware payload", "value": "5545f69ea31c68536b0fb9685bc8e4c22a3180387dcbdf5fc361121a8822bddfb4610c63843deac1cdbabc5cb144fe5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686255896, "uuid": "f5f9dd03-16bd-457b-bfef-5f354a0871d2", "value": "T199168D12FA818036F59601F292FE0B7A5ABCBE30131054D3D3C8699C6F655E1BB36B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686255896, "uuid": "a2f3e1b8-b850-477e-a4ac-57e5a2fee05d", "value": "2d92ec84cfd9b3370fc4622edbae2a9a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686255896, "uuid": "762c6967-d819-4834-811b-2ebe08536cae", "value": "98304:Rp4/OosDaj0aK9xjcpzxoUVKz/PD091ky+6yq/vXX7P7CbXIKc5zD6sILTjblMSN:Jz/W1kBefiLIKcosI3jhMSN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686255896, "uuid": "a20b74df-523a-4265-9e15-01f5e146f73b", "value": 4223488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686255896, "uuid": "506452ff-5aee-4254-99e3-85cf914349eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686255896, "uuid": "91fbdd65-8225-4c04-aa59-8d1c1bd31c58", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44ab181b-05e6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (PureCrypter)", "timestamp": 1686219704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219704, "uuid": "f4376146-ef76-4cba-aa8d-2c15f6916b29", "comment": "Malware payload (PureCrypter)", "value": "e2d96a5d08a0d3b8b21030cef632a607", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219704, "uuid": "c8356943-8266-43ca-9857-7dd8fc232e98", "comment": "Malware payload (PureCrypter)", "value": "6283cd31be8101a896ddc2fe519e2e425db6df13128dee8d65b7abdb46db8a65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219704, "uuid": "7210f698-e6c6-4d70-ad0b-1bf5488e3670", "comment": "Malware payload (PureCrypter)", "value": "4466da6d40f1ba2d1a639f3b3b7baadd5e685732", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219704, "uuid": "a11f8c67-62e5-4148-a44a-a975887eb658", "comment": "Malware payload (PureCrypter)", "value": "ed0bbb25216e396c5ad8836fc2fe7e9a6b97568ff62d09a3f8ff55d63b99c00cdb76d7576701e0c1bcbc5756086dd7ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219704, "uuid": "b5d8891d-aecc-489e-94b8-e87682bb0a66", "value": "T16753097A5B9C4D93EB783DF5FC6154588EBFDF09B802E30E580A38981B353A517612E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219704, "uuid": "f8486205-8938-4673-a64f-634f2a90005b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219704, "uuid": "ac9d04e9-630d-42c8-9fa5-25db3ae3e31a", "value": "1536:N8203V6IlsSg8+yYsz5bUcx6AiO7QEsOKQ:A3V6Ile2bUcxhGOP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686219704, "uuid": "b39ec319-24b7-4620-a8de-173532f42e62", "value": 64512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686219704, "uuid": "57816c8f-f5b2-400b-a72e-dc72aa358fdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219704, "uuid": "5fb11e75-252e-49f9-b940-996dda70aa96", "value": "6283cd31be8101a896ddc2fe519e2e425db6df13128dee8d65b7abdb46db8a65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b183c6f8-063f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686258112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686258112, "uuid": "46303017-3639-4358-9e70-fe23820b12a0", "comment": "Malware payload (Mirai)", "value": "edce9d0157b50e199c0ed9467cc4f062", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686258112, "uuid": "bbb27fb8-bede-4e17-878f-74f7ad597c22", "comment": "Malware payload (Mirai)", "value": "63ad319b4540e23070aad1f3e9c7092779f8d1c89d151641dcb82d5347fc432f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686258112, "uuid": "fdaa14dc-4b25-4811-b15a-eadc448b7c0c", "comment": "Malware payload (Mirai)", "value": "a1a5c02ed7a7c5525f4b163dd472a516b3413f3c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686258112, "uuid": "461345d3-bebe-4baa-b1d6-0283356b5402", "comment": "Malware payload (Mirai)", "value": "a117c3ee61beb7e6d5618c795bf408e9079ee30566395010b6aaea0b87af7e81f097939811d2e276ed19ead7713e59ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686258112, "uuid": "7652ab59-5306-4016-a975-1cfaf45974ab", "value": "T147A2D015765F1E72F278283DC42C8252722B17BCE0B834BBB9211A26DB4E54B7D68282", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686258112, "uuid": "adbb8944-521b-4899-b1c8-e32305276e2d", "value": "384:TvtIoZxrSniaXs+qx+bwqPXTvmet2IAAnOOlPlbAOwhymdGUop5hq:TvQn4j+x9AAnllPlkOws3UozE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686258112, "uuid": "ed9eef80-4e7c-4e90-9f94-759b0baee83f", "value": 22168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686258112, "uuid": "d314667d-1f03-4c1a-afdf-9d50066d672e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686258112, "uuid": "b6fa1429-14f3-4870-bf5c-4953edfc20f1", "value": "edce9d0157b50e199c0ed9467cc4f062", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f358f81-05f4-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686225762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225762, "uuid": "d29af719-7de5-44b2-9e50-c04b234103ed", "comment": "Malware payload", "value": "fc4ca9cee8d153d46652aede6e882299", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225762, "uuid": "dfea099a-8668-4417-8c1d-7bf5aa36c420", "comment": "Malware payload", "value": "65ca3b5e72969ebb0de9144b603cc0028183ac2caf87f89c3e4cb34ad38b425b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225762, "uuid": "be5a63aa-9f3a-47fd-bae3-6102ba0a66bd", "comment": "Malware payload", "value": "9bf0c51564972a91d7528af9da41c8f7bebc5979", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225762, "uuid": "56ae344a-4314-46f4-b0f9-162a1614beba", "comment": "Malware payload", "value": "bbc09f4718e06c7bdaddef9dd1faed6e030151503d680305539f990e0edbbd157aca10db72d947e15847fc651ed759e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686225762, "uuid": "89b9efa6-d078-4bdc-adf9-50c818e2fea5", "value": "T140B501337A4D7FDFC3681D34F8B215630D989E63A1568299BCC4EE9E227A158DE058F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686225762, "uuid": "b632705f-e716-4240-847b-05019773552a", "value": "24576:nzqNuOI+X4677+HE3uXVnfGfw9pk5peQd7S0jbMExwpLKkh7a5+/ai2zKgjcC/jE:uNb4OaHxZ3PD+w1ra+Ybm7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686225762, "uuid": "d11b25cb-432a-4131-ab21-879c8cced1b0", "value": 2442752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686225762, "uuid": "34b263ae-2d40-4150-ae96-ea64b6aed49e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686225762, "uuid": "b8648e81-ba6d-4c5e-81a7-ec9dc47d225d", "value": "65ca3b5e72969ebb0de9144b603cc0028183ac2caf87f89c3e4cb34ad38b425b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76af5d0a-0611-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686238257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686238257, "uuid": "01098d5b-f8e1-4f50-97e2-610afb0b693a", "comment": "Malware payload (Mirai)", "value": "beb92674601906a481eaac6290d84583", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686238257, "uuid": "a062b9d4-ad09-4f20-93b0-7e5fd03d41da", "comment": "Malware payload (Mirai)", "value": "66bc9dfa5bc5d38eae4d8851153edb5ad32ef57908d8c0064fae0eebe867c858", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686238257, "uuid": "307c5d1d-79ef-49c9-82c3-dd3a5b2b7c14", "comment": "Malware payload (Mirai)", "value": "92333fb1cd87a3abd26fc49c67af852649a5c757", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686238257, "uuid": "805dfeee-5269-4d37-b444-7779a82bf4f8", "comment": "Malware payload (Mirai)", "value": "a81f89c268b04698d5243794dc84a0909a48e8f11f7ae771457a4f8331bb2354ab17dbca26ee091cb01cb497b78e9db4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686238257, "uuid": "fc461780-57be-4b17-94a2-01d743df3dba", "value": "T13003F158C2C5B2306A510975F6318A82FFCE1BB5F4C93001B20DE3DC6AE5C5BAC6F466", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686238257, "uuid": "73d7814b-11c6-425e-b25e-cc5869b4803b", "value": "768:/lExwAFd9tT0WMaretGv55sW/iNuCoXP4nyhj7S7ofNjbQNdgSK1cpAq3UIwA:/yb79MaCtr4P4ni67qb3R1GJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686238257, "uuid": "f1324e7f-11a4-491a-b6bc-a31d9b809137", "value": 39660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686238257, "uuid": "ce9652a3-c381-4a73-8c75-f966b341b957", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686238257, "uuid": "c05f2dce-a68a-467e-9d7c-ff47524e05b5", "value": "beb92674601906a481eaac6290d84583", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "951deedc-05a6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686192351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192351, "uuid": "b6a9faeb-ab2c-450f-af81-5571c2bba7cb", "comment": "Malware payload (Amadey)", "value": "551e187095f0924ce6d5e71cc9df20c8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192351, "uuid": "584582f3-c58b-4c88-bd96-87378c9e27b9", "comment": "Malware payload (Amadey)", "value": "6701f33ceeda105e3bdf5df00a93cb0d15323550b7e89298a0c9d6aa32f65492", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192351, "uuid": "9f9a2ed5-e0f4-451f-9717-ae3a5b233bb0", "comment": "Malware payload (Amadey)", "value": "37420a86784f19d79e6d0b1b86e3dc8abff0578c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192351, "uuid": "36b37c2e-8326-4ad0-b409-82d327f5ac3f", "comment": "Malware payload (Amadey)", "value": "ab964f9ec910d704330a614e51b5bfbafaafc2bb880fb2679604c95ba976ab9eda5478b4d69ff18944ef0243d5f6a7ad", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192351, "uuid": "5e76e0e3-58a8-4066-bcce-f8eb7bd36a75", "value": "T1EDF42317B7E41173FCB62BF018FA23832D31BC904DB486AB228A585B5CB3AA55435777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192351, "uuid": "8afb3567-24a9-40c6-a76d-bda914487f17", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192351, "uuid": "93477362-f3bb-48f8-8512-2daca7680458", "value": "12288:SMrZy900hmhzf74inIv8fAXzyuiSA0gLchqPzVOvW/KpKGEX:ryBWT/IvPyuid0gg0PzIWuK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686192351, "uuid": "e2581407-8c54-4ce9-9f54-92c500f95c9d", "value": 772096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686192351, "uuid": "65452013-c1e8-44dd-9c4b-80bd89499ba8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192351, "uuid": "223dd6b3-1435-4a5b-b590-d6f30ef1154c", "value": "551e187095f0924ce6d5e71cc9df20c8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf6e8329-05bc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686201871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201871, "uuid": "89a9a444-34d9-4cbd-a070-5081a7b31e61", "comment": "Malware payload (Mirai)", "value": "eca062703ff47d22c363f6159d92b433", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201871, "uuid": "1774b14f-1da1-4ae3-875e-295134993538", "comment": "Malware payload (Mirai)", "value": "6703aafa241815d02071068ed3bab8e5957876a9623ec9b4e5db5ab04985d809", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201871, "uuid": "9a06824d-7a3c-4dae-bfbc-9c82e7e5abec", "comment": "Malware payload (Mirai)", "value": "1776dc0a1f54262fb1a5fd9b084dad6c3a2be7d8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201871, "uuid": "23e3ea3f-915a-4ee4-86e7-6358ebd3121b", "comment": "Malware payload (Mirai)", "value": "b80375578d20417d45eb77734b141bc9d61e0b2ef22226aa4471c54c3b640423c8d50dcdb8f945b2c103ce1bee7c5cb3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686201871, "uuid": "eb6ef71c-d007-46b7-9c78-7f556ca4b97e", "value": "T11B533A01F7190847E1F31EB03B3B2BE583A69E8221B46249795FBB49D571D32548AECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686201871, "uuid": "cd61ab93-5970-47d5-b04c-19735f7f1578", "value": "1536:tDmk8awDsIzMtDoZzExi27D0MwV694keHbqYby41QazTqN4Y1HRdrr:lmk8awoIotsZwxX7DpesPvhr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686201871, "uuid": "f90838e5-65bf-4236-8f2e-4106e72efd46", "value": 66332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686201871, "uuid": "0f993f19-263c-4be0-891e-d86fe1577953", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686201871, "uuid": "d575c868-8213-4ae7-b90b-4f4b9f99955f", "value": "eca062703ff47d22c363f6159d92b433", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f4b0abd-05c3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686204743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204743, "uuid": "a0b06d37-8496-4af4-8a3a-2030b1b729c7", "comment": "Malware payload (Mirai)", "value": "02909c883f549a91bd2149635311dd4a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204743, "uuid": "46a11fb6-7cf3-49bd-a6e7-5c5629bf40e8", "comment": "Malware payload (Mirai)", "value": "67f346ca420333f32b45a7dac72d6ed5c1ba807cebe3ac94afcb7a7ec0a81f37", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204743, "uuid": "57aaf0cb-2fbc-418f-99a3-dff2e8b8f849", "comment": "Malware payload (Mirai)", "value": "cd874b864998843343551fe82f22070946250a01", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204743, "uuid": "978c9185-b74d-46d1-96f1-0497366789f7", "comment": "Malware payload (Mirai)", "value": "c2b9dc25f74543ad141b06fcc70b6712134c3a89f54031f0bd444d278867f526fdac4c75743925c6c26fdb585aeadfed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204743, "uuid": "fea42e74-bd26-459e-bc27-64e1d2cb4a26", "value": "T1DD53F58178819A17C5E422BBF96E018D373563F8D1DF3216CD226F6476CA82F0DA7792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204743, "uuid": "61bc5041-4420-4179-91bb-90b0447d256a", "value": "1536:jPcNNq4i/J+EoMvMgGsSAPRXlG9WkHYDd85d42+:jP6a75PRVG9bHud8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686204743, "uuid": "5a419355-2f6a-4c40-81e9-77854baa867a", "value": 64380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686204743, "uuid": "86ca750f-a8b6-45c2-9347-87f510b2198f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204743, "uuid": "74f493e7-3879-4334-8463-1c4b08648070", "value": "02909c883f549a91bd2149635311dd4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a2c30bc-05c3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686204735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204735, "uuid": "5d4d3350-fed2-48db-b8c1-1ae7366b9bbe", "comment": "Malware payload (Mirai)", "value": "35cad1eb36c8e59a5a2a53abfe7c4c7b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204735, "uuid": "928b410b-6e37-46d0-9f50-a4e40149ac0a", "comment": "Malware payload (Mirai)", "value": "68e6fdf53d29d3e30169a0c87e4102e5f96a84b957e436e3dc9001e1928a82e3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204735, "uuid": "595da274-d19d-4454-b384-f253f71ee7cb", "comment": "Malware payload (Mirai)", "value": "d33eb9f405354eba1b4cb7ef68d72840e5740555", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204735, "uuid": "0ca4b7c6-fee2-4175-bf56-36236cdaa8fb", "comment": "Malware payload (Mirai)", "value": "a0f4a2a450dce8c9205d7c99577c3c050659491cf29c69089d3c746dda03a916c13a505835098d4b721ec9a32250cfd1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204735, "uuid": "eebe5fd0-ed6b-4aa4-92e3-c06e1f8348b4", "value": "T1A913F130A242E7E0CC928837FD5C8682E5941775D4E836693FBB3650A2EB7D23BB1147", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204735, "uuid": "362c3512-1b79-49cd-b205-f5aea4cc0cf6", "value": "768:X8Ga3IWV8ELJV+/UvmtvyU8dSyVq3UInh0WBKypAR673/J:XoaEl+UvwadSyynh0WBKC73x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686204735, "uuid": "d2277421-8458-45a0-8448-7ed8f7a9b46d", "value": 42112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686204735, "uuid": "1df04a2a-08e6-4c73-8b7a-56f5904d76c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204735, "uuid": "c101cad0-eeaa-4b71-a906-1d8423d6d24f", "value": "35cad1eb36c8e59a5a2a53abfe7c4c7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97aaf436-05ab-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686194503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686194503, "uuid": "07fac0cb-5443-4867-984e-0cfa83bc3806", "comment": "Malware payload (Amadey)", "value": "986b6be14fb6f5fa5d3a0dc46e111af8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686194503, "uuid": "8349e815-0e50-4d32-b9e7-c9bc6b7e3f13", "comment": "Malware payload (Amadey)", "value": "6932aa2b259a43e44dd5ba561ff61db50480ae95aa6fbab7d875e411fd74befc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686194503, "uuid": "94cc3ac7-a2be-410f-8e3f-bab106e94a8f", "comment": "Malware payload (Amadey)", "value": "c6c8e1379bd6f2790e7d5ba4e9a7a3c77285c131", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686194503, "uuid": "86e3e177-5acc-45ef-a027-a404f314b1ef", "comment": "Malware payload (Amadey)", "value": "835ea55d0ebda2907c1dd3b3e007c65df783f0ae8f7961f2e137ce1c3fabb7d6285893213a5ac4424c656634cac137c4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686194503, "uuid": "0235a2c0-e13c-402b-8866-ed069c773dc6", "value": "T1A424F7257D12C032D56061B619F5BFF2C59C6828ABB049DB7B800F77DA122F73A61E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686194503, "uuid": "7dda0645-20b3-4854-8831-455f7a70623b", "value": "f8cc61ade86cb7277d0ab974de6323cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686194503, "uuid": "b65a0c2f-3684-47b3-b4c8-40cca5e36d40", "value": "3072:H/DmgskHbfHN+Pst60p0zuNmnKG7peNMQbuZAIqbey3lfbi:fDmfAfHN+wiuInRexuZAIij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686194503, "uuid": "a7592f7e-decb-42d0-a346-ae6f60180fff", "value": 212429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686194503, "uuid": "8573a331-49d4-470b-91e8-782d8b91a212", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686194503, "uuid": "973bf84e-1c9d-4dfa-a242-33df4a470938", "value": "986b6be14fb6f5fa5d3a0dc46e111af8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c98e1af-05f3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686225435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225435, "uuid": "0000b9c0-a920-4c58-a7bb-2b0946fdd294", "comment": "Malware payload (Formbook)", "value": "bf3e18325565c43290cb7c4df1e13e85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225435, "uuid": "53dc3d7b-5ba6-429d-bf07-2238122b3013", "comment": "Malware payload (Formbook)", "value": "6980c552a8fccf4806027dc577cb1be5dd3e12612053494ce81ba528667ddd9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225435, "uuid": "86406dc6-0c67-4ced-be04-424b27699773", "comment": "Malware payload (Formbook)", "value": "044f88248c883fcab57cd2e5fb7ca6766e22d6ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225435, "uuid": "201518fc-14d8-4164-8518-31fdab50420a", "comment": "Malware payload (Formbook)", "value": "67248e9e1e486ae9233a532f5bab272e4a72951d6107d391e8b49e4ada8d33581c16c785b876f1e6f7d24607a760528e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686225435, "uuid": "8600d56b-8f9a-457b-9ea2-9a031e3d2cfa", "value": "T1FFF4121042E79B6BD57E07FE21A2997103FAA74A3252F34A8EC371DE8E1BF440D49617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686225435, "uuid": "0193888e-9007-4fe6-99c8-f79d7be06d8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686225435, "uuid": "a329ee69-f023-49dc-be71-c0fc0d0faea2", "value": "12288:xHkmFx2iqNhujGjUThA2LiXvBCK5HpVkp5gSsRcn6idjiEG4YubxtEk38:xEmFxUojiXv0sVjtkji4YkxL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686225435, "uuid": "94ec6d94-f216-4c55-992d-2f71d7c2f6f7", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686225435, "uuid": "d844644f-e861-4d2b-a8fc-8444990a8ac0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686225435, "uuid": "50cb01ba-4a3f-40a4-8e17-b157e4bf9771", "value": "6980c552a8fccf4806027dc577cb1be5dd3e12612053494ce81ba528667ddd9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f97e4ae-0637-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686254619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686254619, "uuid": "d289bfa1-8bfd-49b0-a724-40defe26b3a6", "comment": "Malware payload", "value": "dd30198ea41d5015bbb55030481bee96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686254619, "uuid": "b501d307-8433-4bae-80cc-c56ab2df8570", "comment": "Malware payload", "value": "69ab392dfe42b299677871707364b4b59da9a4e466eda0065db4dc6da89f9321", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686254619, "uuid": "4b429aba-f786-45c8-a8e4-40eb87fb33ca", "comment": "Malware payload", "value": "14c16216f39e98e509e1e2025bb0413fa1ecc3aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686254619, "uuid": "0f7dcb77-521f-4ffc-aa72-4b8bb9d84acb", "comment": "Malware payload", "value": "215f9116d6c8c6f61250c416f97c68774b347104716e45700dca9d373363ece188ba47bd943c0ccf1fe904275811f15a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686254619, "uuid": "db34a016-387a-4005-99b5-df8c64e715ce", "value": "T19D54D70392917C55E9254B329E2ECEE8364DFA508F1D3B656A18AE1F14B1272C273F1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686254619, "uuid": "9f059977-257f-4741-9542-84ed594f5013", "value": "078c527316e58c8f8358ebd022c4bbdf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686254619, "uuid": "ad911de5-dd07-4146-af98-6153a3f391b3", "value": "3072:wCdRiliZsfO/cYB11Y0s78Qu+EI6w5Xjy3GjSPOVGfLBrje057oJRR:1RilhO/cYB1m78Q12wdjlSAG1rjUv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686254619, "uuid": "e720a171-f333-4cea-974d-5e448aee577b", "value": 283136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686254619, "uuid": "db0fe395-0c0d-42de-9768-f642d63f245a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686254619, "uuid": "a6001a78-671d-445d-8b8d-00b9127a6ab8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56b4d27d-05c3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686204702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204702, "uuid": "eef54c89-5251-41a1-9640-309f2a986fd5", "comment": "Malware payload (Mirai)", "value": "5d7bbd2c1f99c3f57608b7d6dbaf155b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204702, "uuid": "651cdcca-84ca-4c73-a8e8-4f6a343592a2", "comment": "Malware payload (Mirai)", "value": "6a63f89b879d5dbad4d31495463303a66ed5ef70609246dcedf564463b266e1b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204702, "uuid": "79def54a-b675-4897-b7c8-ebcd766f6c51", "comment": "Malware payload (Mirai)", "value": "5a47a67cd20d51f32d95cfa4ad3069c1a7aab22c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204702, "uuid": "3f1b01f8-974a-471e-a370-530a7f8c0521", "comment": "Malware payload (Mirai)", "value": "9a7d4af32096c2110a5b475b47aa0030e2cabdab91813342ce9d1aa625f4358c3364e264bec139208ec833ad198831e9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204702, "uuid": "6ef919a9-ce1b-472c-9cf4-6c22bdde7046", "value": "T114B2E1146ADEF2CECC3276BA76C73CAF5A912A21034A5D10FFF860177B1B1628595641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204702, "uuid": "d58c57a1-da70-4031-8ecb-c456cc78423e", "value": "768:htXxj3BBBAPkX48wre977Xewn1kmGIwRpCUQZJKE:zXwPkX4Pre9XzC/RI53", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686204702, "uuid": "c3e54b4b-aef9-4e9f-bb85-2b1db9468bb9", "value": 24872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686204702, "uuid": "b9fa366c-3edb-4169-93ca-73f987defa83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204702, "uuid": "330fb180-fe62-4310-88fb-e8c65e48a0d2", "value": "5d7bbd2c1f99c3f57608b7d6dbaf155b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c40fe958-05bc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686201879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201879, "uuid": "e3d3a71f-04dc-4871-b9f2-2a1fb0ae5429", "comment": "Malware payload (Mirai)", "value": "e8e5e8acf370bf88bddb54ecaa64174c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201879, "uuid": "ccf7bf35-1024-42f8-a990-7e4b67a20893", "comment": "Malware payload (Mirai)", "value": "6ba1d64b952c3ef10ac66a16f9a90ebb0cc6877be1a69f28e51a6c2b4d698d7b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201879, "uuid": "47d11447-b527-444c-97b4-e4afc17e13ed", "comment": "Malware payload (Mirai)", "value": "4da07f56d15dc9a22658ee5154b77133c48f4fa5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201879, "uuid": "fb4b4956-55de-42dd-86b1-4f5d7fd660d2", "comment": "Malware payload (Mirai)", "value": "a6bfcd3f3a2076fc6135bfe614737af7d8f9168af7bf4e200183964c9bf170b2f083c7e6a44e70fbb987647bbc454f28", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686201879, "uuid": "71b5e18a-12fd-4426-80dd-695590dc6463", "value": "T19C244C8B59A15EFBD208BB716C7A2F34071DF0211F0F05A6683CC674625F6DAB09FA58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686201879, "uuid": "ac646f13-e6ec-4609-a6c3-d80220f17300", "value": "3072:nHvAw31AyXM3alwigGThzXKtQprY7oEK35mXR1lXQPO/MIj1TXFQ:HZOyXM3axgwhetMs7oEKpKBAwMmtVQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686201879, "uuid": "8d71c3dd-89ef-467a-8cbf-93be152159ef", "value": 224677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686201879, "uuid": "0c9fab55-9a15-45b3-9cd9-5ed9c8e2aabb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686201879, "uuid": "2110ec2b-44e2-4b99-8cc8-de6e5db9a663", "value": "e8e5e8acf370bf88bddb54ecaa64174c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "499e122e-05a7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686192654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192654, "uuid": "2ad58838-3303-4e5a-bbe6-09185425fb60", "comment": "Malware payload (Amadey)", "value": "8bce84609d2aab90466d9e4b6a4ca6c2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192654, "uuid": "66e64841-1fa2-441e-9213-9988d19a06da", "comment": "Malware payload (Amadey)", "value": "6be7bd90117c1b5c35d2662f987bb01fde294a43ec6d0269471516a1a0a12f18", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192654, "uuid": "d4345507-9b21-4bef-b9ea-c472fd26cc76", "comment": "Malware payload (Amadey)", "value": "6f9c111e9ce00cfebc2961a7301b72a802196713", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192654, "uuid": "33891c1c-452c-4c47-bc27-86c69f4417e5", "comment": "Malware payload (Amadey)", "value": "aec09a03a9b60f3a09d0851abf55cdc35eb467cbee61373f4610017a1e513e7d7a7abe0a4ac47445072fe91624b2e766", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192654, "uuid": "3aa82398-b2b1-4205-8e2b-9e0a9fa85921", "value": "T1181522139FD85672D8F917704DFA13D31A767CA0A67807BA274B4A5F1C32284A93173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192654, "uuid": "7d3f72ec-dd87-4ad5-ae9f-2acc55e2f392", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192654, "uuid": "28e0f589-458f-4b40-812e-1eb0454a8f30", "value": "12288:dMrEy90xT2aw5+7Da/DXg4WinbNt8RefeBL0zxaQIs8U2bFOgVMGlv2C:Zyfau+GdWW6LExlT4ogV/leC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686192654, "uuid": "f9bfde07-24eb-422d-b381-5e58e6fe2e1a", "value": 885760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686192654, "uuid": "afb88f28-df53-4353-8182-1cfee6178a7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192654, "uuid": "e48251e9-26e2-4f9f-9226-4364bc5aa62f", "value": "8bce84609d2aab90466d9e4b6a4ca6c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "692c9110-05fc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1686229214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686229214, "uuid": "bb8a64c1-72ff-4052-ae0d-ee85592d742b", "comment": "Malware payload (DCRat)", "value": "520515be4e547ae6a4354ad8de413f66", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686229214, "uuid": "d5693315-f342-4157-8333-4fd74809253b", "comment": "Malware payload (DCRat)", "value": "6c64cb817eb68c8fd0f051b00fcb20a0a28e26062d06eebe2502d8e8077c6116", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686229214, "uuid": "fd350de2-bbb1-4731-a656-630724f2b475", "comment": "Malware payload (DCRat)", "value": "6a48a433bd0d9612f7e26c11e815d5d633f5e086", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686229214, "uuid": "c36f0db4-f9e2-41c2-850e-a1777fbe9a92", "comment": "Malware payload (DCRat)", "value": "98845092248b57bda5463fe45f0ecfabdcf69b0925e6b6ae99ce19a8ae01866baf297d66aeb1f7e294a4bea48cdfc5e1", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686229214, "uuid": "3833cfc6-4b92-436a-a5bc-45e45482509e", "value": "T1AE235C003798823AE6FD4BB5ACF3A1458275D65B6903CA5D7CC814EA1B13BC5DA036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686229214, "uuid": "15996d82-a404-424e-8eaa-a53091a9371d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686229214, "uuid": "add341ef-6451-46c4-bffc-629339fd845c", "value": "768:sq+s3pUtDILNCCa+DiA9anJupK/iflYbQge9frjarQvEgK/JbZVc6KN:sq+AGtQOA9UwpKkebXMz5nkJbZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686229214, "uuid": "ea20d8fd-ccf3-47a7-a78a-6d545c68494a", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686229214, "uuid": "58e47960-1568-4b8e-b394-522054416017", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686229214, "uuid": "c155975b-1979-4088-a158-19e70e36bfa6", "value": "xohtzg3sV1Pz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "814eef0d-05c9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686207351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207351, "uuid": "04372460-cfe2-4d26-aa5a-a9bbab89257b", "comment": "Malware payload (Mirai)", "value": "470d63b7451c9068cfc533cc51ac1238", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207351, "uuid": "0d01e4af-bba6-4b63-934c-a5e034884e89", "comment": "Malware payload (Mirai)", "value": "6d37f57d1ce3314a4276eb7edd54b562bbf86645ed4566b9291bd38f77e7d8e2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207351, "uuid": "ffcf6d3e-7865-46a4-b6f2-700944cbca11", "comment": "Malware payload (Mirai)", "value": "20a54455dc4416335e3fda8e52d85a0ad3b73d9c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207351, "uuid": "797fb779-3e92-4b45-8edd-2fe0be6b0305", "comment": "Malware payload (Mirai)", "value": "7c2b3dc9f4017125663b6867dbada72a25049500f5e71ff0cf56f0f7c93f01d6e45271603a86d5b7988519e0c7546c29", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207351, "uuid": "628ba8c4-da55-4cdd-8f50-e2090a71043f", "value": "T191733A42F8C16A12C5C1167BFA0E128C372753ACD2EF72139E259F623BE755A0E7B452", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207351, "uuid": "9336acc7-9cd2-48fb-aa39-642c8ef7cabc", "value": "1536:chxwjNAFdqlAKCCjaUjh3wvlbdVVgoT8FtxZHr2GcImdTvkq:cUhAQ15jau5wvNbyK8FtxZL2GcIYkq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686207351, "uuid": "5db853dd-f056-47b9-a431-fb1b2de22759", "value": 74964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686207351, "uuid": "4e28ff2b-ef69-4f5c-9efd-ab1faa54c28f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207351, "uuid": "de0ae07c-bd49-4fe5-95f2-9ed1c64a5f1d", "value": "470d63b7451c9068cfc533cc51ac1238", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73b5f141-0619-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686241688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241688, "uuid": "fee54a3c-b119-48d4-8865-abee65f642dc", "comment": "Malware payload", "value": "0307605c9057405795d365d78326d6e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241688, "uuid": "d97369ee-57d3-46b1-8f79-c11a96c8804a", "comment": "Malware payload", "value": "6e043d6bd32704e20638318101b6e7f403a78c12ed75a5dafe670913d87815c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241688, "uuid": "aa140ae5-5dd7-45f1-b1c8-c34505b5a9a5", "comment": "Malware payload", "value": "51790b611ae9eea9938464ea82cef70141be7a95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241688, "uuid": "de326a95-cc99-4732-b345-8ec7518d70ca", "comment": "Malware payload", "value": "81c6072decd7af368bfe95244b1b04594214fb3be6e1d022efd359836cbf5abc7396836ba5f4f984ebbb28864c686137", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241688, "uuid": "3bb3b941-447f-4561-8b41-a1793c8f1a64", "value": "T16C828C9AB210C8DFD18C45361D23D6FCB6612D3A9C246D173AE4239F3E31795EC06A8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241688, "uuid": "b521504f-5c14-457f-aba0-fc340861fc69", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241688, "uuid": "ef99c81c-5ab6-4163-ac0c-78eba58764de", "value": "384:bLDTs8hsF6qtK8lzQ8+Sych3mYvCPHxNrXKt:bLXVhaTtDE8VfCPHx+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686241688, "uuid": "605c37e3-f28e-4fac-b57a-07354f1fb8be", "value": 18381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686241688, "uuid": "8da2c36d-09e8-4075-9f5b-105d79780c5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241688, "uuid": "2017a9d6-c2c9-4dd1-a411-1b73d4a1a62d", "value": "SecuriteInfo.com.HEUR.1792.28544", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28b3b178-05e6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686219657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219657, "uuid": "b531e895-65d0-43e1-aff3-5ae069f9ba21", "comment": "Malware payload (Amadey)", "value": "b5949f6018ebecf5e05ed268f512e118", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219657, "uuid": "f5ae0e45-6954-45f6-8ce5-7130d2a44da2", "comment": "Malware payload (Amadey)", "value": "6e24a6419d1212814b6f6ceefc8f80d6a3e48fede5d34a89544ab5696e54b8bc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219657, "uuid": "9170f2af-2dcd-4218-a152-5664cfb5c94c", "comment": "Malware payload (Amadey)", "value": "1ac157f77e84651f973b8213ea219ba5c885b295", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219657, "uuid": "4e96e3a0-2685-49b2-8210-969509657128", "comment": "Malware payload (Amadey)", "value": "b8ed6a9a6efbb07dfb2b78bcddc1324d6c71ba7a95e52c850ecf213ff7381268dcbf8bcd7e3921cadd2639ae4504d415", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219657, "uuid": "c0e2cea5-a9cd-44f0-a03b-54656024371a", "value": "T1A424F7257D12C032D56061B619F5BFF2C59C6828ABB049DB7B800F77DA122F73A61E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219657, "uuid": "f542886e-af02-446b-a1bb-8a9f5c8df8b2", "value": "f8cc61ade86cb7277d0ab974de6323cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219657, "uuid": "718d5e01-7002-4ab3-8b24-fca089c36007", "value": "3072:H/DmgskHbfHN+Pst60p0zuNmnKG7peNMQbuZAIqbey3lfbi:fDmfAfHN+wiuInRexuZAIij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686219657, "uuid": "e4f97c9d-3c58-446b-a30a-c3d91258ec98", "value": 213215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686219657, "uuid": "890eee91-daf2-4017-965e-88d00207d3ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219657, "uuid": "d89f270b-0e3b-4309-99db-e102f3d0a5ab", "value": "b5949f6018ebecf5e05ed268f512e118.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efe44ace-05f8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686227722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227722, "uuid": "feba30f5-1c91-405b-8017-d712c06fc5b0", "comment": "Malware payload (AgentTesla)", "value": "9b424ada37d6007223f10dd3b980e2bb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227722, "uuid": "f81e0032-242f-4f9e-883a-67cd5774b217", "comment": "Malware payload (AgentTesla)", "value": "6f38fc7509204ef8b9714ab09f16697665bac64f6b1a3f239660fc6acc0eba3c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227722, "uuid": "aab6217a-ce40-45d9-99a7-6f7dd23fa03a", "comment": "Malware payload (AgentTesla)", "value": "7cf31fb73c1ecd2f31aac2392bfe6744e47de8b0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227722, "uuid": "2545fdce-85fa-42a8-a3a0-54ffc9fd73bc", "comment": "Malware payload (AgentTesla)", "value": "b6d2b2601d9c60b26c34a66416c438d20a19292935e1a0ed18e641a49de8df0847907e0e60e70fa85ab021cea44c4a7d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227722, "uuid": "6561658f-8638-43f8-a61f-61dd2c2cc775", "value": "T1BBF4F155707B5B2BC5BA83F5851473342BBE599CB8B2E71B8EDBF0D61921F014A80B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227722, "uuid": "7a43c810-da42-4a7c-b21b-8a3072632200", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227722, "uuid": "9b3f3af6-1b60-479e-a8cf-6f245e5c785b", "value": "12288:372B0xTGlxNqvNu2hZ+nUEsn9Goz5qs2Lqa3h48o8n27o0BU7VN2DpNhGfEeuEjA:37LaVUH999GozLao827uv2NN0fEeuqEz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686227722, "uuid": "d0028571-7c01-466d-a0ad-401c76bd2875", "value": 773120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686227722, "uuid": "dbab7645-4461-4cae-915f-2879b7ed67e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227722, "uuid": "ee61fa76-a97e-46dd-b50f-c96e20954dcd", "value": "6f38fc7509204ef8b9714ab09f16697665bac64f6b1a3f239660fc6acc0eba3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6be65950-0628-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686248117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686248117, "uuid": "db7b9bb1-8166-4d67-92b7-057fea9739eb", "comment": "Malware payload (RedLineStealer)", "value": "0aa67a0f5fe1e1f15b84f2f6c5728a59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686248117, "uuid": "a7fbdc5c-52f5-4ca4-abe8-0a75ce54e37d", "comment": "Malware payload (RedLineStealer)", "value": "6f4862590486f5484716a3b3006b57f91e87c45f1e65fe0d41f6e80086fcad31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686248117, "uuid": "c810d276-65ef-40e8-b887-8e2a5165e3ba", "comment": "Malware payload (RedLineStealer)", "value": "d6a5232b214ad81d4fb25770c2a0df1f45e0a8bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686248117, "uuid": "bfa79490-3d6d-468b-9d06-e5a3c01f10e6", "comment": "Malware payload (RedLineStealer)", "value": "4238a4da4d8ac4bf61392356cbc73f22399f8e46bb1adbe43ef41ff1bd932e4aa57d421894db2b84589b5fc92d78a779", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686248117, "uuid": "6f9decef-1571-43aa-9b16-6530491ad196", "value": "T18B458D1070C09032E8B265B78AFCD7759C2EB8614F8B49E72794C76E7F245E1A63D872", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686248117, "uuid": "d119df16-e8d8-4ae0-be6e-627a71d91790", "value": "65d9c1a9ed29f52599b050c6a36bebe6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686248117, "uuid": "74c95e29-1433-4bdb-906d-1216f6faf0af", "value": "6144:pYtehy3WQ9l/PL2DBaomZDwAOzvrqogFrOL:/h0WQ91KH1rqFK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686248117, "uuid": "934d63d8-80d2-4b09-977a-d546c89163b0", "value": 1171968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686248117, "uuid": "5e6ed208-b1db-4f80-8076-35ca042e61a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686248117, "uuid": "442327f9-4032-4568-8fde-aa93dd360e7a", "value": "0aa67a0f5fe1e1f15b84f2f6c5728a59.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f600a63-0620-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686244526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686244526, "uuid": "04068739-2b56-44c1-9ceb-e25b56f7c561", "comment": "Malware payload", "value": "844119e042920d31a7039f0624fb9e4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686244526, "uuid": "118d31f9-5b06-4408-bf3c-dbea47231991", "comment": "Malware payload", "value": "6f940b6d1eb918033db66fb1b8e4936e31ce0d8172ffc682bb1de1d4151d36b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686244526, "uuid": "85039a35-72d1-41d7-8749-92ee9168b6ab", "comment": "Malware payload", "value": "b406cd984f8060c8674e8e3487fc99ce9099139b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686244526, "uuid": "7319721d-21ad-4cb7-a364-89752abfd438", "comment": "Malware payload", "value": "1d8fd574704431eee5cba39b32bcf62bcfbf804212f4eed1fdffd5b13c180d1ec859bc5d9e863782ba533c28e4a7c029", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686244526, "uuid": "3d872a91-a639-4e93-8146-4c0344ae6954", "value": "T11A2533BD5A663984322412746ACBA0D3A02CB4FDEF8D178F04989FDF4F59B262E3415D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686244526, "uuid": "eae19448-6ea4-4432-a1f9-40d645e07905", "value": "24576:BCKzEVmmcuIILRLBQx37oXq+uV2le3yux2wgbn:cRVNcdIFLBm37Cur3rRS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686244526, "uuid": "dc652320-c8d2-465b-b00b-551ff3938848", "value": 980541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686244526, "uuid": "b25d451d-2d70-4d04-abc6-966dd546e478", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686244526, "uuid": "8f632161-208f-476c-8fab-6046fba5f845", "value": "10744216171.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27fed584-0627-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686247573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686247573, "uuid": "42a8d4dd-17d2-4c9a-b90e-ce78fadfc841", "comment": "Malware payload", "value": "65cfb7018b6aa3570daf0cef04e743dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686247573, "uuid": "8ffb9987-d71e-4dda-84f4-9335dda1c9b0", "comment": "Malware payload", "value": "7094cbca68bd05ba8068e7247cd8654e9603265a110adeaa30a604bf44efa078", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686247573, "uuid": "e74237d1-31ca-4951-a3d6-57dd73acb1a1", "comment": "Malware payload", "value": "77c34bae7e985024ad4ba000ba9d474c86128868", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686247573, "uuid": "0d323c59-e1c1-4fa1-bd9f-73ca71779905", "comment": "Malware payload", "value": "6fb1a6df765e8a55dda7e5ec12cfeb74277f5dd4c45d8e97b7bb57a35946ddb347c23d5e99622054814e80a6aea136ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686247573, "uuid": "f9f80e82-12f9-431b-a327-0a7e33e3a526", "value": "T11DC48E67B2F14436C1721A7C9C5B97AC682AFE202E2DAD467BF41D4C5F38781391B287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686247573, "uuid": "7a0f56f6-6a68-4909-b1a6-b422a578475f", "value": "35df5d5030aee289a4ccbd946e4688ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686247573, "uuid": "0937ecde-7204-4709-922c-98c7448d387d", "value": "12288:KQr8Wg6rhBWGORpPRriDVM10pYNmCqI+OvtAmQNqHvFT:n1LhBWGORpPURRPCS0QqHv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686247573, "uuid": "a86f5249-5b7f-463a-b5f0-a22642d31201", "value": 574976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686247573, "uuid": "db83f066-e9cf-41d3-9512-01591c4605db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686247573, "uuid": "39635265-e55b-4797-946d-889f0abf9bd6", "value": "7094cbca68bd05ba8068e7247cd8654e9603265a110adeaa30a604bf44efa078", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0966e05b-0607-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AZORult)", "timestamp": 1686233778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686233778, "uuid": "2165cf44-23ac-4973-a41a-b66100a9aaf7", "comment": "Malware payload (AZORult)", "value": "f425a74a9f8e2f4e27897019fe62b5e8", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686233778, "uuid": "1cfb6a96-4f79-40c9-aabd-f772dcd4e37f", "comment": "Malware payload (AZORult)", "value": "71b1f56e4cb3057bd942df693c5e4fc85430867949e1b903341a64782cb7fb96", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686233778, "uuid": "a60e47ac-fdc4-4b7e-8910-c6a9a80bf525", "comment": "Malware payload (AZORult)", "value": "2a43e1498bdedd2275aa1d9c432f974c160067ba", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686233778, "uuid": "941c41fe-2f3c-4fd1-b2a6-5cbe1e4373f1", "comment": "Malware payload (AZORult)", "value": "89832a267f3b60a8c46e7bdf3ef1d710adbb62ba8b77725806ffa48a571fe87858e01f741574b1c508ef49b74a0f01c6", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686233778, "uuid": "7639a7ad-658f-4554-8dca-45ab65e12b39", "value": "T18AF4AFA2F400808EEE25183FF576765C2AA56FED958B76E11351B7C71C72A42C38F60B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686233778, "uuid": "f7f5f95e-9838-4bc3-aad9-e04d6c94bf6b", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686233778, "uuid": "9821df0b-7fd7-4197-af97-7d668c7f37ee", "value": "12288:dgQ44tKEnhKAwhaSGKxtLXHRwiLRCH/ppnJML+Is4mKvGs:d0CKvAwhZttzHtLkCLcdKV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686233778, "uuid": "c9857190-33f6-430e-949e-fac1f2e7dbc4", "value": 785569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686233778, "uuid": "d0f65f7c-b004-4ab6-8e63-dacccfe78c12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686233778, "uuid": "7726f4b2-8c7a-4c80-bb07-6afc83474da9", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29f5f78b-05e6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686219659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219659, "uuid": "50023543-5434-4755-8886-129b33344c95", "comment": "Malware payload (Amadey)", "value": "60ceb3cb03a94ec551e6993548da5f83", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219659, "uuid": "59aaea28-12de-4173-a419-377a2c02421a", "comment": "Malware payload (Amadey)", "value": "73cc7c88381907e3d80cb2590db4d60f9e45b6afdccc6703b69e711640fb2358", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219659, "uuid": "c24db2af-cfe9-4188-ba1b-6fafba86e6d9", "comment": "Malware payload (Amadey)", "value": "5ddb8d713221c3e60de955c89d84123c365952ac", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219659, "uuid": "b415b4ba-0aba-4a53-b6ed-13fbcc426bf6", "comment": "Malware payload (Amadey)", "value": "14279807e8fac2e508834ebc7c30a3f26aa37dbfe2be71f379c61c50f55e34af52436a55cc7ae048039368d32603caef", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219659, "uuid": "00d7c9f2-0c0f-4556-a2e5-7598ba3f77bd", "value": "T101D41242FBD84032EAF517B059F613A30A39BCE19A38437B27026C5F1DB2691957277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219659, "uuid": "0d2856c3-79c0-4c2b-9dcb-c9467908cd2e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219659, "uuid": "d133cb93-a54f-4011-b1b6-86bf0a0f5b4f", "value": "12288:1MrNy902HV6Tju7W2wbjFe2cMAiGnFSGnxzgXjOFSYfYvjwU4B:0yVVU0Wtjs7QGFBzojASYfYrwbB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686219659, "uuid": "df19aa87-0bd4-4910-9b0f-5ad41872386e", "value": 616448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686219659, "uuid": "8e6664a9-aa7e-4c2f-9e09-5bf2dd095431", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219659, "uuid": "0db2b8ce-8e53-474b-abe3-1c47e213e704", "value": "60ceb3cb03a94ec551e6993548da5f83.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e422f06-05ab-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686194407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686194407, "uuid": "a23cc2ee-763d-4d1a-ae30-08a5cd6ce734", "comment": "Malware payload (RedLineStealer)", "value": "b80208db87959b5ab939dde5d35dec7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686194407, "uuid": "74954b13-c86c-42ff-8da5-8b28be8bc1f4", "comment": "Malware payload (RedLineStealer)", "value": "74206dad60a538ee15736cbb16144ec2e6efaeff136704a08a202b3d527c3339", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686194407, "uuid": "39fbca01-dc6e-4919-9feb-5fc12f1e84fa", "comment": "Malware payload (RedLineStealer)", "value": "e0800c8d84f50f2b2f5a1d5a415ba5e7fd375a17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686194407, "uuid": "b032b5ba-0d9b-4671-a298-e2baeb90111f", "comment": "Malware payload (RedLineStealer)", "value": "d96859f24c649ae68c03a928f1e889eb062e502eb931a29d8f8485e4c959cdc197c1d7f905c7f2ca215ef5131372e99b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686194407, "uuid": "a7e109fb-eea7-41e9-b5f2-5067b3781db6", "value": "T100357D136550883FD562113D6DEC7E6B96EDB97D0F28E8EF5BB0896B8F202D252301B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686194407, "uuid": "dfa8c68e-4aa5-4806-9993-11b0b084bade", "value": "bfe0d6c2dbe14a3f937f1b2759329c02", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686194407, "uuid": "38bab763-a43b-48f5-959f-bb379aa25dbc", "value": "6144:yJQDHOWz0mlq04FwbiajNhbxFZ8Z0AO+lA+xhGF5HMwEYO+3uwsTnshYar:y4HVPq9Fwbi0iAF5oYjUjiYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686194407, "uuid": "226a036e-dd5b-4f9a-acc2-fcad26de961d", "value": 1112576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686194407, "uuid": "a2ba756e-f154-4081-908a-d636b4c6c9c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686194407, "uuid": "38b06a4b-7db8-40c5-adff-5f0c60ecd5fb", "value": "b80208db87959b5ab939dde5d35dec7b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5b163a8-05f9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686228162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686228162, "uuid": "00f95657-60a0-4c4a-8ee0-9b56a96999e6", "comment": "Malware payload (AgentTesla)", "value": "fcac0305a0885e7ebf992e9612a338b6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686228162, "uuid": "3610871e-e34a-48be-a881-43216c93292a", "comment": "Malware payload (AgentTesla)", "value": "744d97984aa09fc2b01b43e56e0c76705031f79a4007e1ea88251b6dde4ccf76", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686228162, "uuid": "8c2ed445-b2a3-4efe-9d6b-b91d20c6fc1f", "comment": "Malware payload (AgentTesla)", "value": "910fc8c6e9b5a3ce98813b03d175bf252bc1f44a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686228162, "uuid": "0b47b4db-e404-4735-81b7-eb3ab771492a", "comment": "Malware payload (AgentTesla)", "value": "67b2b03bf1215e6106c5250ce25f4ec20ea53d649cfb5bcd24cdbe3773074ad9939f4aaaf5792e3feab3bd6b88504fa8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686228162, "uuid": "40944e19-13da-4330-aa03-58cbf832f44d", "value": "T1FE050185B5BB4B1BC1BA13F58104A2301BBA6699BCB2E31B4ECBF4DA1651F0549C0F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686228162, "uuid": "e3315835-3c48-484c-b381-d8b4ac96f72b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686228162, "uuid": "2e374a29-bfcb-4aea-99c9-81c9ddc0be31", "value": "24576:+CLaVUH999r0Pqe4FseXXPyRw+DsuteR:vBH9r0ieJeX6Rw+Dsu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686228162, "uuid": "7fa606bb-450d-4f5f-a1dd-8cf331125e09", "value": 810496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686228162, "uuid": "769ba03d-6c4f-4e97-8a43-8c398e07c1bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686228162, "uuid": "205e0ab1-2cae-41ad-b46c-e79d9af7e38e", "value": "744d97984aa09fc2b01b43e56e0c76705031f79a4007e1ea88251b6dde4ccf76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ec91403-0642-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686259128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686259128, "uuid": "98d1c1dc-c646-40eb-a0a5-6e35f5d4e3ee", "comment": "Malware payload", "value": "1ccfb26f7ad18fa2ef7441dd3a311dad", "object_relation": "md5", "Tag": [ { "name": "555756", "colour": "#CED47B", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "ifsb", "colour": "#50DF42", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686259128, "uuid": "35c544b8-68db-4ff6-b638-6bdd3f3e8581", "comment": "Malware payload", "value": "752c9c93f2141825079d882a17c28a818e57a8a6c2093f12896abbe7a1a255d0", "object_relation": "sha256", "Tag": [ { "name": "555756", "colour": "#CED47B", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "ifsb", "colour": "#50DF42", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686259128, "uuid": "793a2d6c-e92f-436c-9d1a-d8a3e483303c", "comment": "Malware payload", "value": "9a3204355530b690ebdb4ae26dcdc7252d5eac39", "object_relation": "sha1", "Tag": [ { "name": "555756", "colour": "#CED47B", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "ifsb", "colour": "#50DF42", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686259128, "uuid": "7533ea0e-01f2-4ed9-ad42-e05a6324df19", "comment": "Malware payload", "value": "2befeac9437568aad7a0ac04d98fdaed22ad3d847b42fa3e55525407e071dbf1de6724c07390f34d93ecf76f46fc5a37", "object_relation": "sha3-384", "Tag": [ { "name": "555756", "colour": "#CED47B", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "ifsb", "colour": "#50DF42", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686259128, "uuid": "53773524-9e1c-4a77-afcb-650e75b97fff", "value": "T15E127DB59FEC3892921740C166B567493E4D446F8B42CC92FD6D0AA8FFC690E0A8779C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686259128, "uuid": "bff9dc86-1040-4bff-a20c-50c056377f9f", "value": "96:gwmWQ4xlFty7JHliEdMVRdup2t7sZkAd6haYtNsBVYRCjDq2Ie2DRxm0lRfCl80M:Bh7sUxG1dWa1ARCjI1DXjbWLZggqRv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686259128, "uuid": "7f4819b5-df74-4633-bb79-f3e8d8a5c280", "value": 9389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686259128, "uuid": "6c8a23b1-4613-4977-841a-880944f593d2", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686259128, "uuid": "89ab8aab-fa80-42a6-89b3-3a94d7dadee4", "value": "Invoice-June-for-10-2023.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7627a3fa-05d9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686214204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686214204, "uuid": "8d048a41-efc3-4bc7-b759-be7cda14023f", "comment": "Malware payload (Formbook)", "value": "baf79ef144fd6110f2912e5a31947c44", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686214204, "uuid": "ac53e006-8a36-44db-a2b2-1e7ec5e5cf21", "comment": "Malware payload (Formbook)", "value": "76e70bebe85998279dd6a014734bed556ea8f0039cf5a95e6e0503d384bd598e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686214204, "uuid": "6eafd677-7aa4-4bf1-af0e-d68661018f30", "comment": "Malware payload (Formbook)", "value": "8289dbfae66ef48e6a52eb4cb6ccf24001b2a9ec", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686214204, "uuid": "540c486c-623f-42b4-ba07-d20adb2db72d", "comment": "Malware payload (Formbook)", "value": "1756675dc0249567f352197625e4a8890dcdd592bd6c6c13ffbfd3635a567235ca27aefbedbfc8c3246eed0b4e859644", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686214204, "uuid": "3e9a198e-6d2b-4db5-8e29-80a64130ae15", "value": "T147E423472EE680933C05EC2B4FF68593516994C3C194B493E64EB9F624EAB3DC06DAC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686214204, "uuid": "992952eb-8b21-4555-8f54-c7fc00f2fc58", "value": "12288:67xvo0uUwJNdFPu2jayUhdIoh0BJqXjDepLlM4/y2iSPtk36ET8I58UA:67xwnzBuJyHoyqXL4/VTPtW8IGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686214204, "uuid": "6b6e3eaa-8bbb-452d-98f2-79a397c7e495", "value": 709000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686214204, "uuid": "47282d7c-e1af-40ca-8250-89d0a7c9bc41", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686214204, "uuid": "ff86e563-82d5-48a6-913d-83b5be5d6501", "value": "Documents.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "334daac8-05f1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686224400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686224400, "uuid": "b9f323b5-493f-4cf1-aacb-382a2b7a8db1", "comment": "Malware payload (GuLoader)", "value": "5ba014955c42c1cdb8dfea5239073040", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686224400, "uuid": "7d5e736f-1c48-402d-8684-dda9d430ae44", "comment": "Malware payload (GuLoader)", "value": "77832305696c3092dcd15e5a169828f843cb1e4f52d1f7bc5b2fb84a32be8e4c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686224400, "uuid": "780bc765-34c7-4405-9340-2bd1a0b9decc", "comment": "Malware payload (GuLoader)", "value": "df15364c65cd4fa216ef4f31cd369cb3ce99ae00", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686224400, "uuid": "9935da36-9c01-4f2b-a3a4-a328140ea26a", "comment": "Malware payload (GuLoader)", "value": "6a33e3508f9927f1e3766728482ea2f59f8c8caa3a71e5adfe82a4549ae617034978ad928f3520d4617467fc97ce4c2b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686224400, "uuid": "5177ded1-d5f4-48ec-bba1-58b1926d3793", "value": "T1EC4501067B70C96BC0261270C6256F6AAB26CD453DA14643BF6C3F4F7F72652AE0E14A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686224400, "uuid": "2e5c877d-307c-413a-8e0c-07cd9bf5f6f5", "value": "3072:TPYrClLswbDkrcIA4Q2xJZ7bIL2yq1Rrtw6rVV+bmeXvohXpnouUBJE4leQxe:D7eDAms2d1Rrm6HQmM7BP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686224400, "uuid": "3186dd07-d1a7-4a4e-bd2e-5977e006520a", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686224400, "uuid": "877d62e5-5b35-4419-b632-0f6b1e441523", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686224400, "uuid": "6ec72ea1-db52-4448-9793-6fac418b19b9", "value": "RENDEL\u00c9SI sz.001-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70856be6-0619-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686241682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241682, "uuid": "28d107df-7006-4133-afd3-3532c6c1435d", "comment": "Malware payload", "value": "8aa0de07dd8becf892eb33a16ce3760c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241682, "uuid": "a3c7fdd6-b34e-4932-a1eb-2f05df86a7dd", "comment": "Malware payload", "value": "7917f42c75eea6954f7f7296532959cdfd1828e5e952f6ab53b68795de5c8cc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241682, "uuid": "9a398308-51c7-4658-af7f-67c99ad9100e", "comment": "Malware payload", "value": "ba64f5c2de71f458cbbd8dc9068ac8fe69ca36fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241682, "uuid": "0b17fcb2-6d0a-4c6c-aaa2-e738522f479f", "comment": "Malware payload", "value": "7d87760f7b4529d5c2be06564319335266feb74b4322bf5a3648d2ebd22da89d33857a932133bffa7ecd8b48640f2625", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241682, "uuid": "c941eab0-b7bd-43cf-8d14-cc35565a0486", "value": "T18DF1526B7E80C078DA8000B096EB97E5FEEB7C39533A56029FF1B41D99705A0BD1C589", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241682, "uuid": "dc40c66d-49ea-4a25-843b-1044ee3fc13e", "value": "bf269512e4b6322264ce4aa9782cf8db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241682, "uuid": "2acb0d02-3516-49cd-90b0-94818b89e07e", "value": "96:nP7eZPoOcR5Qa93shO2PyJV4HkdkafxEMFkWdSIliHo:nyoOcROa98hOcmViwxEYkWI0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686241682, "uuid": "ca770a21-1f77-4f08-8f91-759a427eccf1", "value": 7790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686241682, "uuid": "9b8e3180-7a0d-4dd0-88a1-7fc3289d779c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241682, "uuid": "a876353d-89fe-4e0c-a87b-b0e8d72b1fcf", "value": "SecuriteInfo.com.W32.S-9486086b.Eldorado.3664.15047", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "180ba972-05aa-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686193860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686193860, "uuid": "25046f4c-d477-49a5-a9bd-5763b803ab98", "comment": "Malware payload (RedLineStealer)", "value": "8ae09634f07084207594fffcad86459a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686193860, "uuid": "4063a3f1-4deb-4a25-8579-eac9e7ee6436", "comment": "Malware payload (RedLineStealer)", "value": "79529ca8805359b0154f3bf53b49a25ce366e91fed274cd7d2d16390fb86d2ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686193860, "uuid": "ef831c91-1ef3-4af1-8a62-5fa657773c9d", "comment": "Malware payload (RedLineStealer)", "value": "1256382d07f5f94d6d91e04ad07d09e19306c0d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686193860, "uuid": "4c081758-6f98-482a-8064-05e9f88c687c", "comment": "Malware payload (RedLineStealer)", "value": "de048dabc38cffcb3d79df2e326db4bae7cc33a7929de71e86b6c66ed9ac7fb67e7ebba94b1e9c4c5212aa662d3d3964", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686193860, "uuid": "f987a42c-7b8b-4e5e-b5d7-7430f41e2f7e", "value": "T14EF423036FD91071D8B25B301CF313E71A32BCA15EB4976B7395685E0DB26986A31B3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686193860, "uuid": "d05c121f-4872-4038-9292-7a13af0ea993", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686193860, "uuid": "bca3a909-6322-48bd-8145-9d12986531e7", "value": "12288:TMrfy90oBNVSv6KI/AARBD2pvERGkiFtFbEEeRRKDj+FS/ps5Zc1H085:IyPsv6KxuBDvjyzb9eRRsj+FSxa61Uy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686193860, "uuid": "82f1faad-3d29-41ae-af35-2bc342668a55", "value": 770560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686193860, "uuid": "040e870b-2e7a-49e3-b5c9-2b29f651e77f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686193860, "uuid": "07276c90-8980-4201-aee3-46fe8363722b", "value": "8ae09634f07084207594fffcad86459a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73170926-0619-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686241686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241686, "uuid": "c16c4b6d-f1ea-46ed-bd8b-5535346822dd", "comment": "Malware payload", "value": "c40b45182c1413b78db1d078bfab49d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241686, "uuid": "41154e6e-942d-4d0c-95e8-c60285e5646c", "comment": "Malware payload", "value": "797d23f319c53649760e9d3153b48442dc0b5b9abc959c3e4b1b4f53be6d1d8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241686, "uuid": "60e6ae54-c252-4a5a-be65-cf6e01ffa1da", "comment": "Malware payload", "value": "9d2eb5ddb21a132241fdbda8409ede69ef5a7ffe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241686, "uuid": "7b2dc458-1e8a-48b7-9792-fac74989ab8d", "comment": "Malware payload", "value": "8344ef40804e64a7dac051ad7ffd81b098d255ddbe69cf25a172a1fefa8cabe4d63043ff22e5343bc9b4b54ecb1ee41e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241686, "uuid": "06c5e3d3-4026-466b-bc41-b4fc28191919", "value": "T1E83328CF3EF65074FB42E1BA4940721C9DF125F1F610820F54BB2C449BFA9956A9F08A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241686, "uuid": "3cec6e9e-c0aa-48d6-9900-6937fde3766b", "value": "768:wPZ4JwV1Ws+NM+CF2uIknst7Gfi+vZ/2tLzN:mZJ1T+W+CguIys0TvAh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686241686, "uuid": "f475f73f-9c9d-4fc7-adba-fa6edcb6692a", "value": 54272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686241686, "uuid": "0dff742b-060e-4c3d-a5cc-b71902a0b94b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241686, "uuid": "7e8fc4a8-c977-42aa-8fcd-3cb42ee541d3", "value": "SecuriteInfo.com.W32.A-62389890.Eldorado.7637.19151", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "117cca12-05bd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686202009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686202009, "uuid": "f6ea668b-3c64-4830-a619-4ff305061280", "comment": "Malware payload (Amadey)", "value": "d3a9ff1dd4f912d978d66734141ac936", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686202009, "uuid": "41004b41-caac-4ae5-82ca-31b5a0fdf127", "comment": "Malware payload (Amadey)", "value": "79f55eabf76444b61614756bbf0bd79c8bfe27fe1984b6b61b960120e8534b76", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686202009, "uuid": "30d0d70f-81aa-4b0f-a84b-7d24aab76ff4", "comment": "Malware payload (Amadey)", "value": "4b9d4885d628ccaf51eab17aa544f9f7cb9e1f93", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686202009, "uuid": "d048b4b7-4fb0-4dcb-b649-ab8a7e8b4c63", "comment": "Malware payload (Amadey)", "value": "99386a14b403b3e585b4576b72d5dfe951f69204a919dc88ccd4348e1cc92371d0eaeeb2752d3a808924954a73ec628f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686202009, "uuid": "82ae1b75-79c9-4f1a-af8e-87c3c9a9909b", "value": "T124D41202E7D45132E8B467F028F617A30A3ABDA29CB44367379699560DB37C4A93077B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686202009, "uuid": "e2d851c5-b034-46cf-b1f2-4fd2a09a2f69", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686202009, "uuid": "2bf6fde5-0240-49cb-a940-53bc7f8a5fd4", "value": "12288:SMrMy90+x1t/H3GnDo2J71KhUhoqWNJQVwb11LCl7v7qCE+/Ir4bAJ:2yzx1AnDfVSU+JQVLlI+QrVJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686202009, "uuid": "da18044c-5cbd-4769-928e-869d0137f577", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686202009, "uuid": "4e52e7a0-18b0-467a-a009-40726c4beea0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686202009, "uuid": "66dbbbc2-1350-43b2-b17a-ea0a45a42afb", "value": "d3a9ff1dd4f912d978d66734141ac936.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "981a16fc-061e-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686243896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686243896, "uuid": "a9a2723a-2244-4fcb-8fad-f29b8aaa4903", "comment": "Malware payload", "value": "788f396393dcab0c3dee93fbd2ae8371", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686243896, "uuid": "23ce654e-717a-4d3d-b913-70123f792660", "comment": "Malware payload", "value": "7ba6ab30eb71e8ab3ccdc734633391c092b25160f62173d4b6237da6c55b5a24", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686243896, "uuid": "c57afa20-9af7-426a-a1fc-3de0ef2f49f5", "comment": "Malware payload", "value": "3ba5c566299ba91072f41cffa8894a237bcff71d", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686243896, "uuid": "19a47624-6cca-43b2-9cf9-3db174063171", "comment": "Malware payload", "value": "75b31a639bd2f8685923f158e65cba77e1b70e7aee868e0f3ee732c9c94f872872dab5a0fa9da5f3708bfd449393bfb0", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686243896, "uuid": "1c8eeb4a-28d7-4cfa-a5d2-c54f69d20d42", "value": "T1D0235C0136A88A42C2FE437565B24140A3FDEA769B26C34E3DD754DE9EF33A64702B53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686243896, "uuid": "839f636f-6936-4cef-84e7-6a9b01d46f54", "value": "768:RjFq7GFIOtbLrPg2Eln1eL2HLMGTay0CE5qb4rafyFZ:xF3b/PZEV1eL2rhTarefyFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686243896, "uuid": "634ccc9d-0125-4109-8fb4-da5640fdddfb", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686243896, "uuid": "c6982637-e1d9-46d6-beda-f7f664efe7f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686243896, "uuid": "face826e-8f04-4ed9-9124-2abc784b2cb4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13935d60-05bb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686201154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201154, "uuid": "1bd615bd-7bfb-4422-bc00-4e14baac331c", "comment": "Malware payload (Mirai)", "value": "53605da958f3f7a5048b9ee3a823433b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201154, "uuid": "e16ef092-ab26-4d68-aaf7-6715f5c48e35", "comment": "Malware payload (Mirai)", "value": "7bdbed26e9abf0a74b9dad2766ab45934f4e56de81e50e88e52f921a0d8d274d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201154, "uuid": "fe10312e-7a2e-45bc-bf91-50524ffb6143", "comment": "Malware payload (Mirai)", "value": "e700319c046f28edbeedc583e47632730271196e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201154, "uuid": "eeef8008-fb97-4aea-b6a4-0b619814af8f", "comment": "Malware payload (Mirai)", "value": "8e2d8fa74f83602a0bb1adf085522d242abbe7676c2607a768b3b7d39ee6a713505adf47fc705ee24ccf44fb17ab9b8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686201154, "uuid": "c9935ff6-ac76-4205-b5a9-921530777c82", "value": "T12754C6797B21BF2ED7B892310BFA2FB0D31510C636A1D251E27CDA14AEB124C589F794", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686201154, "uuid": "ea8b6068-2625-4133-b910-ceacb21de9d8", "value": "3072:9r8uW9w3S4LauhiJca2QJWbwP7cNgIGrXR+jO+ayKqsSRg2LgM6kds+7+dDStqLG:E4ayvRTN6ws+KFB0R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686201154, "uuid": "a546ba5b-41e5-405b-a59b-f5f4b9f3466b", "value": 286553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686201154, "uuid": "eee5683b-32c9-4479-82a6-257c25c113a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686201154, "uuid": "44ec5d0c-c180-430c-b85b-9b924165821f", "value": "mirai.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "044f2b42-05d4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686211865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686211865, "uuid": "887b7096-1b87-40c0-a86c-414a513d110b", "comment": "Malware payload (AgentTesla)", "value": "c4f50895ae98539be20263a46e61d880", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686211865, "uuid": "04eed38b-8e22-4446-b240-662c5ae3bd56", "comment": "Malware payload (AgentTesla)", "value": "7c6c062c2182c366b1103a4ed0540582d175a688305b9ea3712ba4ce92090573", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686211865, "uuid": "2b16302a-55f2-42ba-878d-7de9e5dbf9ac", "comment": "Malware payload (AgentTesla)", "value": "bed4757500e5825200e80c9a45ef0237512abae6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686211865, "uuid": "0e04d0c2-05d7-4a42-b59a-08a010a9f963", "comment": "Malware payload (AgentTesla)", "value": "7c850753ed7cebe17133ce67c57d303365bb8479173765eabd2e0c419598ee5d8af67a073c2790b0ca718337985c5a6d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686211865, "uuid": "8cabe09f-6dc8-4049-8bad-f60e44b8618a", "value": "T16EC4239BB6DC0A479A7D2DF9C4C11119C6A0AEE6E14305C014F3F30BF76A864A277BD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686211865, "uuid": "f17b4f6c-0fcf-42de-8c28-60ce4cd0ff56", "value": "12288:/+0euDXVlS2vapy5oHCWrKaD5b2vfbo8i+Q+/X:/BggQaXW52vfbo8Y+/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686211865, "uuid": "0446e137-aa8b-4581-b229-a139f8f8203b", "value": 549814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686211865, "uuid": "54730504-2c16-4a22-be9a-918353064535", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686211865, "uuid": "fef91443-0d4f-4fb3-bd35-43b93e4e1ef2", "value": "PO.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1269dc54-0603-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686232075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686232075, "uuid": "3d4e9c83-7ec3-4c35-98d2-c34d14db41dd", "comment": "Malware payload", "value": "e4ea1b0ad75662717ceaeb1c3f5c139d", "object_relation": "md5", "Tag": [ { "name": "htm", "colour": "#8E475F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686232075, "uuid": "c4945c78-bb8f-4b38-93af-ab01974c518f", "comment": "Malware payload", "value": "7ca6641f48e74bf8a4e8ef9dfd1ea40804e4692890b9617c5da32f3a641ce2f5", "object_relation": "sha256", "Tag": [ { "name": "htm", "colour": "#8E475F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686232075, "uuid": "3f4203a6-f3fc-4253-b8f1-305034d21dd8", "comment": "Malware payload", "value": "da3cfbc86ad260044e2a7516683e614f15d616c3", "object_relation": "sha1", "Tag": [ { "name": "htm", "colour": "#8E475F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686232075, "uuid": "b87ebc2e-46ec-47ad-b5af-13275169b91b", "comment": "Malware payload", "value": "385ce668b2467e27ce4919a4e751b56d5644a6465eb0d03108b5ab3af29a2c24952584ca8d139299f34a49c6323c5fc8", "object_relation": "sha3-384", "Tag": [ { "name": "htm", "colour": "#8E475F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686232075, "uuid": "3b2390e7-f9c6-4ad7-8309-f578d6b572c3", "value": "T1E3C2B51009C96668233393BBA71A5CA4EB1A03175241299FB67D35E2EFF1A15DFC2F31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686232075, "uuid": "989a183f-634b-4089-b36f-529d97286c66", "value": "768:g4sSxiMyLce7oBB6yKiUepdJy0uShpUjJjyKPlIR0:g4VKE9yMGOP0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686232075, "uuid": "2ea1da56-f625-4186-94b6-e8bfcc938eff", "value": 27359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686232075, "uuid": "d7515061-7ab4-4c5d-bb69-c8a8114ae5c6", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686232075, "uuid": "d6a6a116-5685-411e-a6de-41692fb401b0", "value": "\ud83d\udcdevoice094641-3_8(4).htm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0f37853-060c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686236207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686236207, "uuid": "dac91edd-dc8a-4786-a65c-969e73509ff4", "comment": "Malware payload (Mirai)", "value": "245478b86469bf31de5ef1337b5705ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686236207, "uuid": "f5d5a3ac-1051-4c40-8568-d5fb4e42e976", "comment": "Malware payload (Mirai)", "value": "7cac3a651950f241e59ca0ddd12a8c7faf84946e81157ab2236a40915dd4d892", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686236207, "uuid": "2af72fe6-ce52-42cb-afab-40746dc52609", "comment": "Malware payload (Mirai)", "value": "4170ab14c2c14832092ee8fe9d685c640acdc535", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686236207, "uuid": "89d2ad44-47ff-4123-8b1e-f86518722b70", "comment": "Malware payload (Mirai)", "value": "4899d6ffd026f0f38b9e2464fc3eae91efbc2ab1db255a349e4a64b30f481c1423febc4ef424aabbea1fd84327ee31e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686236207, "uuid": "8ac32e07-7c9b-411d-82ac-38aca805f08c", "value": "T1A583970A6E219FBCFBAC863447B38F21975823D627E1D685D15CE6012E7034E641FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686236207, "uuid": "e6957a3c-bf67-430e-967c-cf5620228926", "value": "1536:kuME36xlfx7YWOe+9tcZsDFXUusHvT1laedNMe:Df3olpOtccFXUusHvT1lRMe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686236207, "uuid": "20433417-3e4e-4131-81d9-d307ba3c52fe", "value": 85584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686236207, "uuid": "336e9a0c-41f6-45fa-98e4-728cb7b67e76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686236207, "uuid": "5650990e-608e-4f3c-878e-baa47ff2de37", "value": "a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7598f49f-0619-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686241691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241691, "uuid": "43a21d08-59d4-486b-ad0b-71c5d847747a", "comment": "Malware payload", "value": "c917331ab7468254e9917a5b284b54b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241691, "uuid": "3a3c5a3d-bc7a-4b0d-bbea-80ed18184950", "comment": "Malware payload", "value": "7d28ef183eaa1e57c41647731f000ee386281271f145ba17287978671d469fa7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241691, "uuid": "2e333307-678d-461d-98bc-034d87714018", "comment": "Malware payload", "value": "655eb8e2d9d134a832ee440be82180d3afddb57b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241691, "uuid": "a85fcbe5-7d8a-4822-bd6f-614cbaa3a756", "comment": "Malware payload", "value": "1d99e9c62072f708028c41f848e2d4af8170719498111996cfbaa619fabba10375c14f047df84800ed90994cd9b08e64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241691, "uuid": "037c2ba2-fa21-45c4-b4dd-2f6ab91b3616", "value": "T1F172F9EB9F990EB4E4A3007005858A737F73A0110646AD066B51A86F48F8B2389FD79E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241691, "uuid": "3f554274-14fa-4b92-b3c4-003e4b186197", "value": "96:YpJA+tVEJ55F3iERp2X5oBFooMfOeJbQvx0xcB03ctmvaTlLBvpX3hVOKAnkcBnq:t+XElFepiooMGd5nsEBL5pnhY5nkMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686241691, "uuid": "6e9e57ce-13db-4c14-85d0-9e2320753b8d", "value": 16896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686241691, "uuid": "bf8b1095-1089-464a-8120-06eb5b9f60ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241691, "uuid": "fa907a40-8a04-4b89-be77-e6e2a053a349", "value": "SecuriteInfo.com.Variant.Zusy.347240.20194.24023", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a1bb0e0-05fd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686229484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686229484, "uuid": "7b30daf9-e89a-4e4e-a51a-cc520549e742", "comment": "Malware payload (AgentTesla)", "value": "5722755984157a5fa1d60dacbf5e8f94", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686229484, "uuid": "798095ff-0818-4361-8104-7b8a01430658", "comment": "Malware payload (AgentTesla)", "value": "7e781f414da0e2f65ca8c1a8a103a9b88d2d8e4d6c53998642f271e40b29ff68", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686229484, "uuid": "557d5598-6a00-4f29-a5bb-6e5faaaa8cc4", "comment": "Malware payload (AgentTesla)", "value": "4a12e9ff88cf043af55832fed8f5d9f4fa48d517", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686229484, "uuid": "0c7fe8ca-a811-420a-91b0-551609c24f56", "comment": "Malware payload (AgentTesla)", "value": "7369522eaf86eaabf7fe4112c160ca867fa4a2017dc64dae3c6810f9ce4255e845fab108c9371eea4c45bf08c0474e32", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686229484, "uuid": "5832e9fc-7bbc-475a-a946-f5341c1c849e", "value": "T15125B3BC4C43E4EBEE78E23A95F02747B7291406769E798D22DA37415D93DC2B2C0A1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686229484, "uuid": "d557a7f8-68ed-4484-8841-5c3279412f2b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686229484, "uuid": "3ded384f-e919-4d45-9b05-eac1150015b0", "value": "6144:RbPRfXMfdA+aj59XR8DxHzxwr+Bp5rfFvAfaqKth1vilza0ZvZUZdUsiGQrxrD5m:RYkjODxHdwr+vAffKtkxZ+EsB0rgQ5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686229484, "uuid": "53a09958-1596-4ecd-a3de-2f8d2d3b1b39", "value": 987648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686229484, "uuid": "4f30733d-7036-48eb-8644-31c915d85b89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686229484, "uuid": "a755a49c-ea69-447d-b4ae-f322bf79d73c", "value": "PRE ALERT DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "544efca8-05a7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1686192672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192672, "uuid": "f9052ce9-f7d8-49b2-b654-8d061ad60a8b", "comment": "Malware payload (Smoke Loader)", "value": "aad159a32e28c0b84ee2d90e2788d27d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192672, "uuid": "20fe38a0-39a5-4abe-824b-7b763a7acec2", "comment": "Malware payload (Smoke Loader)", "value": "7fd46d07f2ce3bb4e40cfdc81ceb4211b82a8d2716cd90ecfca27514c1c312bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192672, "uuid": "8702cf83-4e1f-442d-971a-87f9fc29a086", "comment": "Malware payload (Smoke Loader)", "value": "b4bb8955e2acdd142e344dc65ee6b27619434402", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192672, "uuid": "32c17dd8-b8a2-4592-9b75-1751b59db058", "comment": "Malware payload (Smoke Loader)", "value": "f156514e3d5c6f5f6de69a14622881d0c5f4cafa141b624ecb0b75ed4eb662f1e7be311f65074079a54d2df2058113ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192672, "uuid": "3581ecbd-462b-43da-bedf-956d107afa7b", "value": "T1EA347C1272E0B8A1E5E34A328EEEC6F8761FB5F19F7D675A32065A1F04721A1C16F311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192672, "uuid": "486a8bcf-2591-41eb-b747-c7b1cf8c692e", "value": "ed6a070bf0eed3feda93e1f7e2ff5c98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192672, "uuid": "b74b09c9-3338-4a5d-b7d4-8571d0a01b06", "value": "3072:U3Gz0tgJLn4Gh6JY6ulbMeclBUEiWC12GSkICx6kI/Zzb525Rp1:Kw0tcsGhNxM17iWC11Jx6kIBE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686192672, "uuid": "0d2f4ff3-057d-4338-9287-ca1299ac79a0", "value": 250368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686192672, "uuid": "5f3bd123-ec89-4243-b1a3-500e795f6ac1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192672, "uuid": "fa4ff1e1-ce0b-4ac5-a3a8-ce39cff2836f", "value": "aad159a32e28c0b84ee2d90e2788d27d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bed63764-05a6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686192421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192421, "uuid": "9c11b463-6839-4c5e-8e88-6c3871a68fee", "comment": "Malware payload (Amadey)", "value": "722e4f3dc6772afd72428bf6a6a17eb5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192421, "uuid": "ea17a97b-7fd9-46c8-b347-01d43173074f", "comment": "Malware payload (Amadey)", "value": "7fdc08dcf1db01567075c9f51bec3a4cff3ca8a3b3d221e42a3e249a16493710", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192421, "uuid": "dd548f80-96c9-4958-acde-3370753bd252", "comment": "Malware payload (Amadey)", "value": "4395e2289e446cffabbf76b5d89f960c264ac1bb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192421, "uuid": "cffb6dad-3b4a-4301-9c88-d978d88b13f2", "comment": "Malware payload (Amadey)", "value": "f5eb324baf5c900115501026ec0dc707036aa8c67411c908d3aa7891d485a7615a2d798113b14e27964562b98e1991df", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192421, "uuid": "6b6891e9-d24c-4166-9368-42cffa772130", "value": "T1A424F7257D12C032D56061B619F5BFF2C59C6828ABB049DB7B800F77DA122F73A61E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192421, "uuid": "8545fde4-a1ef-4e8b-86bf-1c20c81ad0e4", "value": "f8cc61ade86cb7277d0ab974de6323cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192421, "uuid": "9b319c3d-276d-4fef-81ed-a73a68591ecf", "value": "3072:H/DmgskHbfHN+Pst60p0zuNmnKG7peNMQbuZAIqbey3lfbi:fDmfAfHN+wiuInRexuZAIij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686192421, "uuid": "27126eb7-b1ec-4774-be03-6c1a45f363e0", "value": 211082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686192421, "uuid": "80c349a7-6e58-419e-ac2a-25037254d7d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192421, "uuid": "73ff1a39-e7ef-4d35-b001-293a023f953c", "value": "722e4f3dc6772afd72428bf6a6a17eb5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09bae2aa-05bb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686201137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201137, "uuid": "4421b58e-6ffb-457a-b7cc-96a201a58c33", "comment": "Malware payload (Mirai)", "value": "15e154d33e54fd81361ef5d8eeac9d93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201137, "uuid": "c86f2a1f-7509-46dc-82cf-26dd2490a93a", "comment": "Malware payload (Mirai)", "value": "803b71991bedc3ff90f174a7f49a9c921853074d9c5fa1a78945d59c1f179192", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201137, "uuid": "2363c4c4-afd8-4b99-9cbe-cc8d90d1e2df", "comment": "Malware payload (Mirai)", "value": "84862c9e3622a557e5bae931750ba62fdf856d8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201137, "uuid": "b3a6cd37-0233-4bd8-9de5-59a8b75d5f15", "comment": "Malware payload (Mirai)", "value": "e5604c0cf2366aa935fa0fbefbd87972662f84cfbe0ce68f1e45c424950dbfffcab90a4dc2c6093dc9190574efb85583", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686201137, "uuid": "7d893d84-84a9-4322-928c-1e9ab2c2c0dd", "value": "T173341889FE18AB2BC3D227FAEB6903CE3339875877DA72115C31197437C6B646627124", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686201137, "uuid": "42ef18b8-17f6-42d3-81d6-b506d690946d", "value": "3072:gl9RwtZgZsyCDjwPIsv4bmsjPZXq4YXAei2w3FvnBtsrjqPlRSSOfbr:K9RwtZge1fek39Btsr8lRETr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686201137, "uuid": "ad99fdb8-6fbf-4b75-9232-0b7093e33fc7", "value": 235451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686201137, "uuid": "0759639f-c5e2-49fe-b7f1-4d827d4ec31e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686201137, "uuid": "c17fde64-dea8-4bc0-b30b-e188923c7275", "value": "mirai.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae8435a5-063f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686258107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686258107, "uuid": "8290a8ef-2a39-4707-8b55-49199c68189c", "comment": "Malware payload (Mirai)", "value": "62b57fa40a4bcf2e80e02ccff8dff7d8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686258107, "uuid": "210d6e18-895f-4d13-b6bc-abdbad1bf247", "comment": "Malware payload (Mirai)", "value": "80b11c83e07ab0c888bd7a5e8451b86894f3e73391843fa0cafd3aa2a2e0e7ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686258107, "uuid": "68646cf4-de7f-4712-a930-5bc51ee6c776", "comment": "Malware payload (Mirai)", "value": "7058a0f9425de8c5062d7c33c5cb08d110806f44", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686258107, "uuid": "605a62d6-eb84-43b6-9d73-0ddafed06fc4", "comment": "Malware payload (Mirai)", "value": "b93deb496c47b9a172398be8913f359e93dbadb8c9e80f0a4aafbceca739cf85dbea6c358fe9fef83f8f8b77bb1d8455", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686258107, "uuid": "059738d5-0e76-4c95-9642-ee67a5a19edf", "value": "T1AB432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686258107, "uuid": "ab435fdc-47f0-4561-a132-3a69f949731f", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIhQKqgESnmC/xO+KpAwh:RqtmZPuutfbltZFBSJsBcfDSTFInBEh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686258107, "uuid": "c2d71edd-f3a0-47ca-a17f-fe35a95a2d85", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686258107, "uuid": "550ad7af-7786-4adf-afeb-d03c0a5973d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686258107, "uuid": "e2fc48da-6a51-42df-a454-21637501c862", "value": "62b57fa40a4bcf2e80e02ccff8dff7d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b18d574-05ed-11ee-b3cf-42010a9c0076", "comment": "Malware payload (zgRAT)", "timestamp": 1686222668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686222668, "uuid": "1577103c-656a-4fb9-897b-ced387e6f47e", "comment": "Malware payload (zgRAT)", "value": "a1d5b812316039f7f55006c53c62ec90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686222668, "uuid": "91977de0-749a-4d2e-b836-6ed3051843d7", "comment": "Malware payload (zgRAT)", "value": "8159b5d7bcd4b59b3e6575e1de661a6db5acb5d377c09a13b6b6e4338976b941", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686222668, "uuid": "316ea8b8-cdc6-42c8-ab8f-c11955264223", "comment": "Malware payload (zgRAT)", "value": "78eb12a26216bc8d41c622b16bab04690bd5383f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686222668, "uuid": "6f3ae389-32ab-4109-81b8-cb373ca774d7", "comment": "Malware payload (zgRAT)", "value": "6fde14bd3d5e600569dc982deb69eeafa22396fd50aee7fd252e0bd20171a2e1d076bd3ab2907b92946e600eabcbc620", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686222668, "uuid": "430be7fd-4f8c-43eb-a9ac-c71f3debc685", "value": "T10B24E006BAC7A353C54D8A7580E3012553B2A78736B3D6CB3A8C03951F437EA5F8A76D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686222668, "uuid": "6b9341ef-aa9c-4ac4-bc76-524d1e4831f6", "value": "6144:RdEmHtyPf3dNTTtby3ATL/nUHzGOFWNwhInpvj5:XEUtCd9jUTrL6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686222668, "uuid": "626d6e6a-a642-4a31-9b2c-3567bd7199ef", "value": 227904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686222668, "uuid": "bc05425d-ed97-4c95-b12e-66d371168fc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686222668, "uuid": "551d46c9-2c93-4fb7-aad1-ea44ae73dd1d", "value": "8159b5d7bcd4b59b3e6575e1de661a6db5acb5d377c09a13b6b6e4338976b941", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c60e7bc3-05af-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686196299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686196299, "uuid": "f21ebefd-a193-4f6c-97a4-1f6524f9b2ea", "comment": "Malware payload (RedLineStealer)", "value": "4543abfb5694cd02e63d304d79acf2e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686196299, "uuid": "720695ca-56a0-494a-bd8c-8e2a26ab9b79", "comment": "Malware payload (RedLineStealer)", "value": "816f68d1972dccd92c37951dd777b2818cc812576c80e7e5201c35a8604dccb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686196299, "uuid": "8e11a0bc-c22f-4a67-90eb-dd3de9ec64d2", "comment": "Malware payload (RedLineStealer)", "value": "abe90ff82aebc92111cf0d62b8854b12108e9c5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686196299, "uuid": "28005271-662a-4663-bd64-c3dd388065a4", "comment": "Malware payload (RedLineStealer)", "value": "2c3a24a952e3c102bde5fc238707e858e2b26546e2de665ea05e9cb472b21c4d194005d566036b22ec49f650f23a0477", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686196299, "uuid": "92b94fa5-fe0a-4feb-897b-d926f974a115", "value": "T13CF41256F6E801B2DEB4177098F707C317357C628E79922F2B4AAD4D2CB3690993172D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686196299, "uuid": "ef233c3e-3e93-4997-8847-402b46ad290c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686196299, "uuid": "f9031dc1-f597-4759-a10a-e4023ed7e6d5", "value": "12288:WMr1y90U/Z6dH7i+vqbEaVly+tcvOHHZOm9LiL1T/XNDFJvsKnA8zSz:rytZE7inVlL8OHHZOmQ5F9VA9z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686196299, "uuid": "71061cb1-9760-40d3-b828-e274c47064c5", "value": 771072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686196299, "uuid": "21be72ba-1e4c-4318-bbf5-81efca65849c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686196299, "uuid": "bdc7b9a4-f308-410f-96d7-12d382002709", "value": "4543abfb5694cd02e63d304d79acf2e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c2146b0-05d3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686211691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686211691, "uuid": "a371fe03-800a-4161-bb12-353a24727c61", "comment": "Malware payload (Formbook)", "value": "cd6fb304e78881a2a4e39a0f0309511f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686211691, "uuid": "8f4782d4-3f20-4ddb-9271-176e16e23c3e", "comment": "Malware payload (Formbook)", "value": "81d15499dbdfc176f42105554c45a7c836eff3330d8e23a4c9f99431c80137aa", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686211691, "uuid": "183861c7-4d16-4c84-b374-0158bbd9064d", "comment": "Malware payload (Formbook)", "value": "976160d43365ba58333425d11edc6eef7fd81d28", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686211691, "uuid": "9729d8a5-b24d-46b9-823e-fff8891f3038", "comment": "Malware payload (Formbook)", "value": "d9eef4d12a87e835f8bc2e290d7f3fc1fb66ca17d95ff57962fe0430dc71921c2273a3fffb0b758150e4da7433bfeb74", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686211691, "uuid": "3a94a061-26f2-4964-b55a-88e853418574", "value": "T160D423329584D0BE4322EB96E3E6307D05A794B6B6510C9DA7AC7D01BB86C14CEB49FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686211691, "uuid": "53fe9e26-4d66-4f19-8b83-e2c36737c927", "value": "12288:3Ts9HPhIY0H10xrI9ZBgTVn49lABfK6/2AaSFBs3h5fpV3uyNcHE0MR:8HqvH10xURgTa29/VE5fpV3uRkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686211691, "uuid": "abb4acc6-995c-4779-941c-2815d748f55e", "value": 649630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686211691, "uuid": "3a12a13c-5a26-4bca-863d-35524876e908", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686211691, "uuid": "59304e4e-71c1-419e-83b6-b5f7d943c1d6", "value": "Documents.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff18d723-05e4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (WannaCry)", "timestamp": 1686219158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219158, "uuid": "5cb7ca21-2e41-4727-aaa3-deef5ed70f18", "comment": "Malware payload (WannaCry)", "value": "dc0dd21c96ee6150fd7113a2ff66ae26", "object_relation": "md5", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219158, "uuid": "6696eec7-b93f-4bcb-86a2-1630e4f777c4", "comment": "Malware payload (WannaCry)", "value": "82e34351115b01948c0ed5ba16337e6ddd3f519a0b6f681061fd5f50f95fda46", "object_relation": "sha256", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219158, "uuid": "cb47bc57-9c62-4226-88d3-731c7f239880", "comment": "Malware payload (WannaCry)", "value": "173b2d647e31d7c520c462a4a162183937c00070", "object_relation": "sha1", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219158, "uuid": "66ffbc9a-f14d-4ef2-8965-598951e58797", "comment": "Malware payload (WannaCry)", "value": "f99f5336f4755b77024572dc82c909bb1a502780b235f4598ad4098ebc8e27a308ada8c279599607c5ef9621314bcb04", "object_relation": "sha3-384", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219158, "uuid": "1e647451-4b24-4df6-bd0f-a652de66cc13", "value": "T1571733888FBF74C8DB4D793989E84CDE45CB52C8327D654B47CF06A293BA581F812693", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219158, "uuid": "d0dc406e-702f-44ed-a2e0-723d2112c102", "value": "393216:OkwMafXDkKz600Y34smZkNV2K/b55GgJP9r+yNyvV/tQfCNIJ1w3vlB3ihXxbA:9LElZIkNV2I2gBk/tICNIJu3vlMfbA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686219158, "uuid": "1abfa555-78e2-4a58-8129-8beedc4ed445", "value": 19696340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686219158, "uuid": "02dfc7ef-43ae-4a05-91be-2ed5cea030f3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219158, "uuid": "f0de4073-9033-4ace-aa7d-5df61700659d", "value": "Malware-database-main.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ca31d40-0607-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Glupteba)", "timestamp": 1686233945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686233945, "uuid": "c533cf44-a8bb-424a-a964-3ae7c09b6ea0", "comment": "Malware payload (Glupteba)", "value": "1d5c8c5f65ece8bd6c534c2a4dab103f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686233945, "uuid": "2c0f5afa-40e0-4e3a-814c-199121e93177", "comment": "Malware payload (Glupteba)", "value": "8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686233945, "uuid": "58f60100-604c-4b84-baa2-c974a9a26ef6", "comment": "Malware payload (Glupteba)", "value": "cb982786f558208767bc171a4c3b718b0db0ce3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686233945, "uuid": "ee0d6935-4418-4110-9ddc-824814a5e017", "comment": "Malware payload (Glupteba)", "value": "883871567ea3c13df70125089add41651ee281d489622f22405c80608e6a4a9b21e33c44d1efbab9f1bd62dfbd07496f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686233945, "uuid": "05f08cad-7ee2-47de-aaaa-0f5dabcdec8d", "value": "T1B116331052DDBC12F9F64A368D3F87F4632BB6A18FAE5A6B13025B5A05739F2CE11305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686233945, "uuid": "adf36041-c6d5-453a-813e-d17f4ffcad38", "value": "04fcc8db11b5c1b7316151fcbb546c01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686233945, "uuid": "d5c7ed0e-0d4c-4f89-982e-e08ed2a62ad9", "value": "98304:rPc9FcYO05ihGHS9WSnwj8q/RLdadqz/Y0RFELZvszSs:7c3EciILSnqdBdamY0RyeWs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686233945, "uuid": "e4fd4c62-194a-4a78-aa56-728e30329827", "value": 4383104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686233945, "uuid": "c419e465-62f5-4d1b-80a2-4414ab847e17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686233945, "uuid": "6270c256-8b22-40e5-be58-a05759b0d2df", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e41fe16-05ed-11ee-b3cf-42010a9c0076", "comment": "Malware payload (zgRAT)", "timestamp": 1686222807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686222807, "uuid": "600196f2-3b50-44bd-840c-25df46dd22e5", "comment": "Malware payload (zgRAT)", "value": "e3fb5a0ef8a0d509ebd00e10446ecc6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686222807, "uuid": "a7b3be86-1b91-4c7c-9e27-94c66f44af98", "comment": "Malware payload (zgRAT)", "value": "830bfb21d58767b944db5fb9305818869afb5c6683711b11a10d47521b54fef4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686222807, "uuid": "8ffcb70f-fcd5-4554-bff2-20e76cac2188", "comment": "Malware payload (zgRAT)", "value": "abac33a9a375fd1293b39aad8616ecd44fd15695", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686222807, "uuid": "769176b3-445a-47f4-a3d9-4bbbeb98b0bd", "comment": "Malware payload (zgRAT)", "value": "f7e70c5fa007372a81836abdd3e6b7b3dc1bdbca0de83ca8f6d46af78aaf94a3a3c35d90e97f52ce19a2159b11d71e3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686222807, "uuid": "918b17c9-3f57-48d5-8d06-efbf5598e139", "value": "T17CB40152BB921271C9499971D1F70424A7B2E7073673D3863F8D43AA1E873EA4E193EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686222807, "uuid": "6b3b97fc-d96b-49fd-8a8a-0de4cfd9013b", "value": "12288:uhK95F77f6Qj6W6oIujQicBWE/svyZTxyd8qVhTco:r8Qqyj8svyZ1yWqjTco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686222807, "uuid": "9689d923-c959-4b89-95f7-d94b784c2523", "value": 506432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686222807, "uuid": "98cb9b25-d761-41f3-9902-1138f698e290", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686222807, "uuid": "bbdedfa6-3ac9-4765-9b74-45ab93c6cf58", "value": "830bfb21d58767b944db5fb9305818869afb5c6683711b11a10d47521b54fef4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3f2d907-063f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686258116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686258116, "uuid": "048742ff-e647-46d0-8494-bc1286e5449a", "comment": "Malware payload (Mirai)", "value": "fe9d8bd9d6f95c930d066c54a229352e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686258116, "uuid": "e9701b23-38c2-4cdd-93b1-6105e3534e2c", "comment": "Malware payload (Mirai)", "value": "836b3f3df9be14fbab9d681aea36536813eee432c3cd11b86c0ba1895eab744d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686258116, "uuid": "96a35cc0-fb38-46da-ad91-40d05aaf918c", "comment": "Malware payload (Mirai)", "value": "b750e064e41b3a421df416c8987a7f8ddf43ef1d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686258116, "uuid": "199aa2c1-61f1-4f6c-b39f-096f50686ac4", "comment": "Malware payload (Mirai)", "value": "cabc23742d36ed96f660413cd546d859baa04d839c7428af59e388025222e0e3b30771a16f2661d280f52bd0fd5eaaa6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686258116, "uuid": "8360fe12-d300-450b-97a1-1ce3f30f2fb6", "value": "T1A423F12455198CB5C6303472FB999763B4D2BE73E2E7716767210A3C2E248931BA9B07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686258116, "uuid": "a2fb8588-36f6-4f39-95ce-0f06aed33a92", "value": "768:a/TYCoIxdE0fz/XJf2b6rm9s7BSUk9g8Owt+9q3UELbUXfi6nVMQHI4vcGpv1:aECF1zvN2oHoxHLRQZ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686258116, "uuid": "9d7538b3-f8ee-453c-aeb7-2a783b2c659d", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686258116, "uuid": "8d24d617-6168-4991-b936-e585eb9da282", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686258116, "uuid": "d5ab71be-7ded-4275-aaf6-3b3421ec3670", "value": "fe9d8bd9d6f95c930d066c54a229352e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8930e345-0619-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686241724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241724, "uuid": "dfb98daf-7f18-492b-b659-37414a77ebd9", "comment": "Malware payload", "value": "043bc8ab5c7cb681e812648f3b6727cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241724, "uuid": "8ac06f68-fb7b-4399-b4f9-2ded7d2ab266", "comment": "Malware payload", "value": "83d9788dddfef0809379d87976f80887d0e4718ca6b1529d88058efcae5f3a02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241724, "uuid": "cbd5c4a8-d7f2-49a6-96d7-b1f00e2913e1", "comment": "Malware payload", "value": "a126814ee7865d2131388c0fa0f48ee63cdbcbbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241724, "uuid": "88c2548a-8b73-4a6d-99d3-2d56852e6542", "comment": "Malware payload", "value": "c6c77966d7ea7e2d30901c7acc76e38fb4c2056f5761722e8ce6ddf19101d499b379466656dc5cb291dc5e104ab1ea81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241724, "uuid": "409a2765-114a-4a3c-8dc7-2a75b3c5b1b0", "value": "T1274533462A35053CE3CE463E1177AFAA02D96E9D2E2052FE203D37C5BFF75268643562", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241724, "uuid": "30878a17-12a4-4284-ab62-f83452962604", "value": "65f0ea4d59220808310df9abd95e0122", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241724, "uuid": "b5a0800d-e2a7-43ca-8b66-a84cd72d987f", "value": "24576:J/cuUDO80iJ9ZdgNGl0qzeHUS3M4U/OyP5zGtA:JEuUDv0q/gNf7t1yPmA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686241724, "uuid": "1728decb-6558-43b9-9c52-24642ee35d73", "value": 1264640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686241724, "uuid": "7bc102f4-a546-4dcc-bb01-a41f4f77f21e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241724, "uuid": "51363cff-24db-4b0f-ab30-ecf35e5ff9eb", "value": "SecuriteInfo.com.BScope.Trojan.Download.9620.18212", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72779a55-0619-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686241685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241685, "uuid": "a0f5cd9e-cbbe-4ad9-b340-eccd34fda8c2", "comment": "Malware payload", "value": "658eaeb53733da4b7bcce787042b2b23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241685, "uuid": "d0ce7513-9d1c-458c-80f9-5c5dca1f4fb7", "comment": "Malware payload", "value": "840c70d31f3e33fd33fdd9e5fc9002e8ebd28a97b3d8f38ee322403a6bbb5053", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241685, "uuid": "f7106b49-b5b5-40d0-a04d-5fb82675a6bf", "comment": "Malware payload", "value": "50ffe82aefbac0414718299ff84768cc46256b06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241685, "uuid": "7eb51e7c-1af1-4fc5-8aa1-6b60affc1dc6", "comment": "Malware payload", "value": "05acd497a0c0f659e5a7860a5313881d8da5638f92c4a05fdc779339ad372f63affed8dcee8a679038893ed11423e1e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241685, "uuid": "bc6be6d3-2eb8-428c-bcc1-9cb6a042fa82", "value": "T17BD47E62F2E04937D1331A749D1B86AC58277E113E24A88B3BE87E4C5F3A791353B197", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241685, "uuid": "1c1f329c-bf1a-423b-a67c-1ff693d94260", "value": "6144:Cbr4c1GA8s3ZZahORhbRCAY3KoZqtp03zTxBjMW3riqseNakuRzkA++lrHmjPR:CYLA8s3ZghOvwKRp2zXrswbuRgdUbKZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686241685, "uuid": "1a9a1eb9-7f8b-45b5-abaa-93e07f879147", "value": 639488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686241685, "uuid": "ddfc2acb-248c-4f63-aea6-5203e1f21bac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241685, "uuid": "5512f13f-51ed-4d77-a4bb-76b524ea772c", "value": "SecuriteInfo.com.W32.S-909ca299.Eldorado.13226.8565", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f3cd453-05e7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686220098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220098, "uuid": "d563cbaf-d505-4454-af9c-235df5b75707", "comment": "Malware payload (Formbook)", "value": "f9df3670e25d3846200606958b47c4e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220098, "uuid": "b1f789e2-9230-4d26-89d6-bed250cb67a3", "comment": "Malware payload (Formbook)", "value": "841f916fd211961d16b57c00fede97127720d6d2ea52e914fa13661b1d728410", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220098, "uuid": "21bed6fd-9fd7-4b09-a475-d3e84553a99f", "comment": "Malware payload (Formbook)", "value": "1177bfdae58c9f07f1bfc4d873a02562423c20d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220098, "uuid": "466bbea6-492a-49bb-9fb8-046855960d32", "comment": "Malware payload (Formbook)", "value": "b8daedaed0fa40702ad2946b102514a4f749bcf75644d0ed3adb5a97f5d9282bbd8c0fd30e3b226934c7a04334d8c938", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220098, "uuid": "b71c40a6-5b95-4fc5-bf35-8ecbd992b8ed", "value": "T10205BE2062BC9F5AE03A93F544A1D2B447F55EAAB47ED3478ED6BCCB3A64F110740A13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220098, "uuid": "b9967331-3c8c-4d8a-9310-e35c2f1607da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220098, "uuid": "a09e7746-51ba-46be-b7ae-a56bb732c790", "value": "12288:1S8hue/3H1OdvmnHKpBnM8NU1TwBiW7okCT66tk0riptH+VO8kevckNx:1BOdv8KpS8dBX7o7Fctekk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686220098, "uuid": "2e994eed-769b-4c3a-b7fa-5162400c7d15", "value": 835584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686220098, "uuid": "1b3e1791-a9c0-4c84-854f-15f081cb3167", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220098, "uuid": "c5bb364f-a3db-428f-b227-d07411fa4908", "value": "841f916fd211961d16b57c00fede97127720d6d2ea52e914fa13661b1d728410", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a37c72c1-05a6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686192376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192376, "uuid": "db20dff1-7706-403e-970a-7ad3c5857c93", "comment": "Malware payload (Amadey)", "value": "73bc6a7f1834708767bd31ffee6702ff", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192376, "uuid": "7724d764-8881-4879-869e-68826d2af0d8", "comment": "Malware payload (Amadey)", "value": "843df6a1ec38288ea650840256cf30114411daca4741cc83cd4acd16127efb70", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192376, "uuid": "0c7e571d-269e-453c-8664-29b7a3e52b53", "comment": "Malware payload (Amadey)", "value": "936541d65ec3887d8f0f10ca48de4e8c42cc107a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192376, "uuid": "dd043c3b-7476-4d68-99ac-84f16381edc5", "comment": "Malware payload (Amadey)", "value": "faecbdb11b4604ce9ba4b775d4557ddfa29f235f2a56df0c140e33db41250235da5bed12ed6cfdedbf4ccd36b67eb6ff", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192376, "uuid": "32eec9c7-94ef-4730-884e-9e5b6b5725dc", "value": "T1CDC41217BBDD84A2DDF56B311CF611931A37FDB159B0521B2386A82E09B3694A23133F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192376, "uuid": "ef6d33ff-4ce8-4702-b052-ed8739549373", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192376, "uuid": "970e095c-d415-4e3d-9129-079f1649a202", "value": "12288:iMrKy90vwbbnEhEeSKn6vcaqAi53AE7wFsgBuudF8ugP3i+tQH4I:cyhnEy3sSOAi3A5FsgWu8tG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686192376, "uuid": "bba20d2a-66f9-40f9-aa81-b47625c1455a", "value": 591872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686192376, "uuid": "2fa940d9-3b7b-407d-bdbf-f8ecb803f3c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192376, "uuid": "4d78c566-f425-4709-a3df-997470c7c627", "value": "73bc6a7f1834708767bd31ffee6702ff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eb31dc4-05aa-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686193898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686193898, "uuid": "5b209f1e-b5dc-4973-8602-9418386d0ed3", "comment": "Malware payload (Amadey)", "value": "aa0f3f38a51a722da6c41a7192f6b743", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686193898, "uuid": "fbfc4bbb-5629-4389-acf5-9711a5d4ac63", "comment": "Malware payload (Amadey)", "value": "849e0d41109a83eec9597c602a4e2de57db0add383fad4e18886893cc428815b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686193898, "uuid": "7939dcdf-d366-413a-81d3-266506d61516", "comment": "Malware payload (Amadey)", "value": "8cf2bb76a8fd1ef3d1c510ae8d6ea92142ce0646", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686193898, "uuid": "d61376f1-5d90-439e-8623-cb4e8a1ccd25", "comment": "Malware payload (Amadey)", "value": "2c96c64264837d8ae8817aaa2e3d6e12f4eca5d5bbe227782b624a12e8fd3eafd3d1dcb24024e5bd4a4797d7ef98fde8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686193898, "uuid": "b9e4a7cb-3484-4b6f-8ae8-1f3a4afd3575", "value": "T17BF41213FBC89072D8B5137098F723431B35BEB259B547AB17469C9A0CB36A8B572327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686193898, "uuid": "b26bd3d0-b3a3-4c8d-be80-b1bad1883f43", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686193898, "uuid": "0b5a5bbe-6039-42e7-bcd9-8842a50fa4fe", "value": "12288:0MrLy90/FCqVUgrTIIgI9394g0DwVonCNDorWtVgpHOIHmV:Xy2CxSxg2ygswRiJT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686193898, "uuid": "d4cacc66-9590-4071-842d-23f3ea65a992", "value": 770048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686193898, "uuid": "95a7382c-ef4c-4667-ad0b-75231c62d181", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686193898, "uuid": "2be93f69-5d96-4dcc-a322-1ce128c96dd4", "value": "aa0f3f38a51a722da6c41a7192f6b743.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2897fb87-05f4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686225670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225670, "uuid": "a8c8cd05-53ac-42c8-9506-bf5ca77dfbec", "comment": "Malware payload (RedLineStealer)", "value": "4bfbc32bc1ce3d683c7865dfe58d41ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225670, "uuid": "2d3ae00c-76d4-405b-847a-8650978e9067", "comment": "Malware payload (RedLineStealer)", "value": "84ba801e7d36fc19bb411b4ff5786b570b1a904a57b486ed11921bb52a1128e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225670, "uuid": "79370886-a59d-4159-b92c-d9c180aaef70", "comment": "Malware payload (RedLineStealer)", "value": "b39dbd254594346ae124c5e7ffde8f17dc8bd0dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225670, "uuid": "20432e58-5f3f-42a7-89d8-aa04f275bb57", "comment": "Malware payload (RedLineStealer)", "value": "01c1b76293bc91c9212c9c24410f5d1c8c3a0ec79ed2acc12614986080534db19cc59264ddba4213a631f7035cde35eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686225670, "uuid": "7fb02f0c-96eb-4310-987a-4e76ef867b38", "value": "T162F41202EED99476EEB61BB048FB03930E35BD614D758B571286A92E0872794B43273F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686225670, "uuid": "a7f42e76-6c65-4972-ae79-648aac7ef6bb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686225670, "uuid": "6d49caab-ec07-40b2-a02c-3aeeeaee9add", "value": "12288:aMrXy90vjnZ4KA63A+rrFjfxCT5YV7GR/MF/AWu73NHOyUckShc3IXZ3maY+Ze:pyKAq1jJkYV7uBWa3wckShkEH3e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686225670, "uuid": "30bb76fd-5ad7-4fa4-93ae-14c755be2735", "value": 791040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686225670, "uuid": "8ed199d1-a832-4eca-918d-21ee20b41b99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686225670, "uuid": "8ea33ce3-8386-47e6-bc23-46c3669854a7", "value": "4bfbc32bc1ce3d683c7865dfe58d41ab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a736d79-05fd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686229566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686229566, "uuid": "37aa0a4c-bd93-483e-bfb6-ed59ed263e26", "comment": "Malware payload (RedLineStealer)", "value": "6227ed61522396a6c569edcc43e224d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686229566, "uuid": "89e0a197-7efb-41e1-80ac-8508195edc9a", "comment": "Malware payload (RedLineStealer)", "value": "84d8810135474d2a463e02b107182cde5d10620e72b854a510a18dc5e7265b7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686229566, "uuid": "d7cde269-b9f1-4e0f-be52-b081d9ea7d49", "comment": "Malware payload (RedLineStealer)", "value": "c81fda860fbaf7baa76eb2976ccc786eb327e3e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686229566, "uuid": "5215d90f-b831-45be-82e4-640cfbfcedda", "comment": "Malware payload (RedLineStealer)", "value": "22beac98b6a20683fd5210d6e950f85b31ea4b3ef97d41b61d68bc330d37835911da55d901aafcef4ad8528ef04dd87f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686229566, "uuid": "f2e03a8a-addb-4bfa-9f58-880e5efbaa70", "value": "T117F42213EBE59176D4B817B058F701431B31BC924E38873B776998AB4C72688A631B7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686229566, "uuid": "e2ad6fc7-2ae9-48a5-bf9e-aee44f3c1f03", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686229566, "uuid": "d4c2dbea-38e9-41bd-bac7-01ad3f926ade", "value": "24576:Jy9Q54TS9Pcn9bJiQfOw8Ix2OjTfsAi3I0igb:89Q4TS+9bbWbOPfsAi3ti", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686229566, "uuid": "984689d8-fc41-4944-88e1-d085a1b25149", "value": 791040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686229566, "uuid": "e053d3c1-74cf-487c-bd02-dc972be2654a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686229566, "uuid": "bbb79d97-bda3-4463-bd47-823a93af21ca", "value": "6227ed61522396a6c569edcc43e224d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f1158a3-05c9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686207293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207293, "uuid": "2d924307-4f17-4bfb-bb18-5276d96cfe76", "comment": "Malware payload (Mirai)", "value": "76a58586a7a5b79475836c01ccca7463", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207293, "uuid": "02efa8ea-d27e-4ca5-a32a-6b73b8559ef3", "comment": "Malware payload (Mirai)", "value": "85db7d5e2f06004d88090958273da576d3352be89782cec3b3cbf07b3bd23b00", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207293, "uuid": "1b68aa38-371e-459a-b2c9-d4c166957b52", "comment": "Malware payload (Mirai)", "value": "a107ad70a190dc91734bec1d42bd69eefc370a61", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207293, "uuid": "33a681d9-4be7-40a3-9b54-0868455f7e00", "comment": "Malware payload (Mirai)", "value": "ebf8d83b0ef46f778e7c509adfde8218429e042d3af47b3d34f6186a85426c934d05e580a3e5d55b763c659f966183ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207293, "uuid": "fea3e455-80a6-4c88-80dc-6a6cd6747abb", "value": "T107831956F8819B16C5C412BAFE2E118E3323177CE3DEB2129D106F24778B92B0E7B955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207293, "uuid": "6aed0c22-9464-4a40-b6d5-19e06a9bf92c", "value": "1536:/JnHShhrtQmcBIczJhZXantBlu/06blQaJUJ35MOijaM370vTl5bY4:EhhhQxICJhZKtBlx5ahaM370vTldv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686207293, "uuid": "64d0b126-4cc2-4a99-8c81-c17dcdce1670", "value": 83200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686207293, "uuid": "f2070e53-2c4b-41b5-87cf-76eaa692c6bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207293, "uuid": "8cb7de9a-57b0-49a1-b014-46f1210f22fe", "value": "76a58586a7a5b79475836c01ccca7463", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fb7828f-0607-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686233950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686233950, "uuid": "00756112-1da6-4046-bd40-5e9d96970d5c", "comment": "Malware payload (GuLoader)", "value": "8f62a1c24abe9caaed3a96b080f33ed6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686233950, "uuid": "7d781bdc-e7d4-44fd-a781-98774a95eebc", "comment": "Malware payload (GuLoader)", "value": "869f790d57a50f69dea8c50c016d6c2301ac8618e1abd684af127f14a6a35661", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686233950, "uuid": "48aa11ce-5fd9-40e0-8822-144650bb28a9", "comment": "Malware payload (GuLoader)", "value": "c2bfe47753df633fe764e78ad36d755a0d9f3405", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686233950, "uuid": "d262462c-8754-49c0-b0ea-8adb32455dc6", "comment": "Malware payload (GuLoader)", "value": "486122c3a6792e91a5467429adbe9e9b1668e746982457158e1b853e62bbe3e6e572814d82d8decc6559b02647294cd3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686233950, "uuid": "592d9dbe-4fa8-4d82-8546-2a22692dde99", "value": "T13B941200A572CCA7E5624A70D4BE5BFA9EBDDE06D4429B8B17517E6DB83B7C04308387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686233950, "uuid": "40a352ce-b787-421a-9df1-f47b23a65d16", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686233950, "uuid": "790307fc-13e5-4754-9436-d8c18c176819", "value": "12288:50+FrXbGM2i28hs/mfPRtfXYd46sMD5ibuWNa:50YraPL/mfP/XY/Rdi1a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686233950, "uuid": "bff2896f-c525-4d67-9051-714e87a33fac", "value": 438136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686233950, "uuid": "7c333882-c985-4f22-ae3b-b5d6b65e355f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686233950, "uuid": "8a5e69b9-0fb9-4b49-b129-1510457fd795", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "136ed0cf-05f2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686224776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686224776, "uuid": "4f6ffbff-cd89-41e8-b656-92ea10b3f106", "comment": "Malware payload (GuLoader)", "value": "af1883e14cdc91fdd97eec7cfb364570", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686224776, "uuid": "20c648e8-fb70-4f33-ac31-e7c5e2619197", "comment": "Malware payload (GuLoader)", "value": "86a558475c11037f063e487cf1f4d8a711915d1a9a07e760c49d2092e627ea66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686224776, "uuid": "c21d8eb7-e132-41ac-8e12-65e74d3a5452", "comment": "Malware payload (GuLoader)", "value": "3c6efba498492113cb3616a73bbcb4699ca9e19e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686224776, "uuid": "316fb782-219f-480e-9990-cf94fcfc31ac", "comment": "Malware payload (GuLoader)", "value": "636001fe8c3fe513e7aa50feb093214f90df8d1e9561dcf1b034e913a16f99c1c32f86c16b1b80f6b91bfa14dda85e2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686224776, "uuid": "197ec4f4-6fc0-41f6-9869-c4ab394c84f2", "value": "T137F449301F98C813E34554B872E2CAD8EE75FD0C366ACD52AEE7786E66785C168F9103", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686224776, "uuid": "634bd91a-bce3-443a-853f-4f739a91bdfc", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686224776, "uuid": "edd60774-d740-43d6-aec1-00cd1d054515", "value": "12288:9PKcWfPW1nUOMaJid6G7kItgiwxmRiuU6wJT6FKZ0B:FWonUZaEd6GdtgiwxalU6wJJ0B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686224776, "uuid": "3010e50d-fcb4-4fff-9646-62919d32de07", "value": 775189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686224776, "uuid": "af596df9-7808-4fed-841f-18c6ef2fd9c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686224776, "uuid": "18e33a1f-524b-45df-a9a8-d9e2dfc89558", "value": "86a558475c11037f063e487cf1f4d8a711915d1a9a07e760c49d2092e627ea66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c40e5fe5-05e6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1686219918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219918, "uuid": "bcbe5b57-86ed-4e68-aacc-e327d0a542dc", "comment": "Malware payload (SnakeKeylogger)", "value": "f16988d34c31b551436e97f8ec3f59fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219918, "uuid": "28a37c9b-60b5-40ab-9957-730234c26a67", "comment": "Malware payload (SnakeKeylogger)", "value": "87089c3324fbcadd16d3535a3eb947c630d135d0d939cbcaaac7f891b7a53285", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219918, "uuid": "0dfa5d76-cbfe-4b5a-8bed-c1b61ba64b7f", "comment": "Malware payload (SnakeKeylogger)", "value": "f310742f11c4ad71e9518aaf8a998818ed1dcba5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219918, "uuid": "e0400dca-adf8-4b5f-acae-c3eb2843eefc", "comment": "Malware payload (SnakeKeylogger)", "value": "eda34f27c93de799760bf55139f7294bb5d04331ce2e00468309086a84dff28c534ff9ea3247429806c2f1f1748ca1d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219918, "uuid": "ca060610-a810-4213-85d2-891842318631", "value": "T14ED4E02027D6DB1BC02B527984E1C2F05776DD84B9A6CB838EDDFC4FB28E3A25711256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219918, "uuid": "733f9c61-0808-4828-8d80-a52e305fdfd5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219918, "uuid": "33c2ece7-a0b0-437d-887e-28aa31808cb1", "value": "12288:iSg+dYxW7SIAQH581o8h7IwsTEPc53NdEdRKi:iSdeo55/8Glkc53XeL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686219918, "uuid": "3ebf9c9b-2446-4319-aecb-b2ba542d37f4", "value": 624128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686219918, "uuid": "c0e6e83e-07be-4ff7-b10b-83231ee45664", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219918, "uuid": "22ceecd3-56ea-46b9-a647-d44635e63e07", "value": "87089c3324fbcadd16d3535a3eb947c630d135d0d939cbcaaac7f891b7a53285", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e788f42a-063b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686256485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686256485, "uuid": "029b9cfb-af2e-48e9-a5da-519792c0b87f", "comment": "Malware payload (Mirai)", "value": "52dd20ea18458ed93f1d7aa465562c45", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686256485, "uuid": "5afde469-4b02-4753-91f6-d6d9aac38304", "comment": "Malware payload (Mirai)", "value": "884699a3a29e3e214f587b55849ad3447eaa6a7737050036afb75dd2600ab53d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686256485, "uuid": "2a62bb04-3355-4501-9fb8-3c09c66f3b3d", "comment": "Malware payload (Mirai)", "value": "4f0ddf6a58d3703b277bcbc94450492f82dc895a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686256485, "uuid": "cda95960-f2e9-4efa-88e3-ce041cd28578", "comment": "Malware payload (Mirai)", "value": "27cd578bb96d13fd437c7796daedd44a95186600f67ba2addda1805c88eb3de972fe4a7eed7bb893b7a44223188fc1fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686256485, "uuid": "d825a1eb-9248-46bd-990d-197df0eff260", "value": "T10AA2E119BF1C858BC832697555E9EAD21362FC71F2DDDC182A40C16FF0A33A95874F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686256485, "uuid": "0bd96386-ee17-47c7-86d2-d5add475be0b", "value": "384:MgWLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkBaqOKV14b+502F2vwA9dWuMW21bAKP:O98o08kxofBE+ZkBaqGbp2F2TWul0c5q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686256485, "uuid": "09a46676-cafd-4fd2-8a81-dabfec25bf4c", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686256485, "uuid": "a30b0235-544b-4368-9649-dc998f764e28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686256485, "uuid": "76abfc72-ed3f-4ca1-9797-d45385e68098", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c79aad8d-05ea-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686221642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686221642, "uuid": "37086584-b993-42fb-ad6d-9f7b757bb702", "comment": "Malware payload (AgentTesla)", "value": "3cf4b6aa2b62152a350831922b7fdbac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686221642, "uuid": "589456d3-d1d9-4851-a3da-e63e460a4205", "comment": "Malware payload (AgentTesla)", "value": "88ac7d9f157d80cb2aec269591e6386fc57ddb114d129a439ff66a596baf7f7b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686221642, "uuid": "786fe522-4f76-41e2-85dd-270a807a5bf3", "comment": "Malware payload (AgentTesla)", "value": "02a2dbaf2a6e6932eb568eb284f7955d52855806", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686221642, "uuid": "47704d38-65fa-4dbe-a488-f92dc0609849", "comment": "Malware payload (AgentTesla)", "value": "9e8dca864d7c3ce261a402449754fea26819373a6aec6b123dfd3b55f93a25590f7ca10a0ebf19e3b04067c3c43183ba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686221642, "uuid": "13fcc84e-cb33-4a27-b703-457b8ada1301", "value": "T16115F1912AA48C21E1AA6FB947B3F23853751D51DB63D34964F02D9B3C7B9837E02783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686221642, "uuid": "e7bd3815-bbbd-41bd-8886-2ce06065204d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686221642, "uuid": "791fecf6-0d92-4873-99a9-8f5a2aa32dba", "value": "24576:mP0tMLsXf1b3Q3QC2QU84QevhedWLcVfF71shAsC:mP0CQfRQv2QlGBLcVfF7qhAZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686221642, "uuid": "ab99f9f1-cc50-4d64-b74d-56c19d5167fa", "value": 913408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686221642, "uuid": "7fac194b-0098-4349-bbca-51e8e86d9204", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686221642, "uuid": "b28b0faf-f9b5-4d28-aea5-88a4faa24dcc", "value": "88ac7d9f157d80cb2aec269591e6386fc57ddb114d129a439ff66a596baf7f7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7fb9e10-05f4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686225964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225964, "uuid": "88a2fda8-156a-426c-a845-e198844de44e", "comment": "Malware payload (Amadey)", "value": "bad7fd619393765384a5bdd578fe96ec", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225964, "uuid": "55288ba2-1342-443a-a14e-8921b3d8e263", "comment": "Malware payload (Amadey)", "value": "891e1d30541129ff6f2ea20454c9a342c207ea4f61a688dcd7f34722ee295ad0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225964, "uuid": "b9abd9f7-d087-47c4-b234-561fae9cb65d", "comment": "Malware payload (Amadey)", "value": "4bfd174835028163be15dc71ec13de57d06697a2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225964, "uuid": "d33388f2-eb09-4927-825f-906269a6b807", "comment": "Malware payload (Amadey)", "value": "17ac44e2aa30e09fc4414f0d96c5a0db4687dba539101dae4787977a44afc970471cea36db78cff70a3832c39c0b29a2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686225964, "uuid": "e8b61ad3-1a99-4e46-b892-be6401f8053c", "value": "T1C8D41266EBD98036E8B61B3028F707932E367CA26D74436637468D5E4CB36C06536B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686225964, "uuid": "bcc25727-c6c1-4c97-9185-13db38dbe1d6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686225964, "uuid": "26b69747-5af9-462a-b2ba-3df7512465e1", "value": "12288:ZMrsy90lIV/ULhy+LUVXthYwnYf6qTsM5x6bZrjR2UR6vFc:tyTV/UhYVXzHF4sj2UR6vFc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686225964, "uuid": "19569ec7-424f-4383-98b0-3e18729b25a9", "value": 616448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686225964, "uuid": "b05df8f9-362b-44e0-ab92-7fe7a7e1f5a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686225964, "uuid": "41bf107c-d25a-4093-b40f-bb025e6d0556", "value": "bad7fd619393765384a5bdd578fe96ec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "744f89f3-0619-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686241689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241689, "uuid": "d6046683-8233-4d4a-b0cf-c3b697ef90c1", "comment": "Malware payload", "value": "6faec3c824d9bad6985f16ed179e7cc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241689, "uuid": "7f936564-bfda-4db2-869d-3f5195fe5e32", "comment": "Malware payload", "value": "898301ab974be864ddb7d5f2481280837810cda351aa8e877248dd85a74f853c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241689, "uuid": "619306c3-e770-4c49-a446-898f81956bee", "comment": "Malware payload", "value": "13122dacccb3ad46d2b8702b92eaf1c8dbf2e49c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241689, "uuid": "de8be089-3f62-4a3a-a86c-33bf0741675f", "comment": "Malware payload", "value": "502fa9d1e81fd117284902dde839fc46630010e77b2c0987214141bd55cb21d01c0a61b47df8487fc1ef8a8e889b04f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241689, "uuid": "b351069d-d765-4db4-89bd-fbd27dc4118e", "value": "T1AAE2C0B34F944812F0CB2C7116856066E93FD812D662031E1DEA1B2F2CB77E2CA68DB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241689, "uuid": "095f184d-49b8-43ad-bb8d-e9d4cfb73bc8", "value": "aed65442afe6a427110d6187d4408cfc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241689, "uuid": "ee96ca57-2929-43f3-87e9-2be28ac3f426", "value": "384:iqx18Y51w+8HtPnkaTA4lEA1bkESyTNnGYVctKLya8Lj7Q1XWlAxhr6+e9Pfqbn4:UYonnkj4lXRkpKhV8na2Q1xxsha5y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686241689, "uuid": "f0842c65-4992-41c1-a0ac-dc1af049b74e", "value": 31236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686241689, "uuid": "6080903c-9ef9-4693-9205-5575f14454c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241689, "uuid": "d1697f64-9e14-420c-9714-38ae0270946e", "value": "SecuriteInfo.com.PUA.Hacktool.Gen-Patch.27610.19845", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87181187-0619-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686241720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241720, "uuid": "015c5fc9-0bb3-4ce7-b76e-2d00eb7f3d3c", "comment": "Malware payload", "value": "81e03f63fdc0058b7c9aadbf227b06a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241720, "uuid": "ca36da68-bbbe-4f53-95e7-d991864ee139", "comment": "Malware payload", "value": "8998b9602a8b39d2cd0bfed4c57584244de6c015570ab37e64989cb67e5ecf1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241720, "uuid": "f410f8bf-872d-4a57-b93d-57ffaacee0a9", "comment": "Malware payload", "value": "4fb09778f361ea800a78b7d6f39f29fb066fdc8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241720, "uuid": "fe0e866b-f8a4-4587-a84d-eef6fc88e17c", "comment": "Malware payload", "value": "33ccfa53a31410106eb9346b68ec115b882219701cd6915ed258b08f486583a1f70f41311c6f5b952f068969c04bf9c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241720, "uuid": "12b124dc-30c0-4461-a390-4693dc2f7277", "value": "T1D9B2C09DD190787FC4AA0E73352F92BA4659BC16930857C60B03DC0FBC7A6F5B948901", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241720, "uuid": "f76daa59-71cf-4551-898a-4a66efb46770", "value": "c2728f76e43fb2115b5a43687fb9f561", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241720, "uuid": "edcf6bd0-fd83-4259-ad36-5cc851f19389", "value": "384:mkNxkhQIImQT7S3M655Eg4NxhRv+ngOVxYN2iBEBvp0MCXTknPWl4:93IZQTwM6rEdRvsh3YkioOMCXT0Pu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686241720, "uuid": "5a1f1362-7007-4674-b562-4d3317f3f9ba", "value": 23552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686241720, "uuid": "0fda7a25-ac3a-4cd5-812e-ccf47be888dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241720, "uuid": "9c37c820-d245-47a3-9635-142e2b17ce7e", "value": "SecuriteInfo.com.W32.Generic.AP.30314E.tr.343.13331", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d677cc0-05f2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686224766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686224766, "uuid": "1995da03-1df2-4706-82fe-2f3f94afa49c", "comment": "Malware payload (Amadey)", "value": "2262a7e4d41ff63b09a6011c3c5c4c12", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686224766, "uuid": "b9505f04-6812-431e-a1ca-7ed4ff75cce8", "comment": "Malware payload (Amadey)", "value": "89ec8d53563bb001c812244947aab14cc22b4cb858edc9b061ac6f8083e30626", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686224766, "uuid": "6823e59e-4273-40ca-b396-96f932d4e820", "comment": "Malware payload (Amadey)", "value": "08ed202ead257cabadb4f7e84959579fee6a3a5e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686224766, "uuid": "435d8437-1206-4431-8beb-547f4f5dc42c", "comment": "Malware payload (Amadey)", "value": "cb0fa5500c29966324c6a15406623cc114a67897472fd5046cc8f5aaf48e457a97436774e2fa26179dd78e57a31e1b49", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686224766, "uuid": "d30cf820-c8bd-41c3-8a24-59a0f73c18b0", "value": "T1A2F41252A3D58436E9F1277048FB43C30F35BCA65DB1839B6765C81B4D22BA0A532B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686224766, "uuid": "6d1ca6a1-9c30-4ace-8100-b6191afa6e53", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686224766, "uuid": "e0dcb8ec-a5f9-478a-adaa-913e59971d6c", "value": "24576:By9zEkxOC6YeZeYmkh5oyzPCPKZbAJAL:0yo2YKeqzPCSu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686224766, "uuid": "54e96058-4df2-4733-b1dd-7e847e6dbec2", "value": 791552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686224766, "uuid": "8c055a1a-4be4-452d-9905-07d214c44016", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686224766, "uuid": "6af4617d-0514-42c8-a6b2-b32b41ec939c", "value": "2262a7e4d41ff63b09a6011c3c5c4c12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82670df9-0619-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686241712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241712, "uuid": "38b7a342-9f7f-443c-a3d3-977290a600c2", "comment": "Malware payload", "value": "eaf870e529860212e5ebb04236900fb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241712, "uuid": "401cc3c0-c5b3-4af0-8ae0-fb6a7fe02357", "comment": "Malware payload", "value": "8a59f121f9c0dc7ed6663d2abc16a4e12723f70a82ffe98ed8976f7c99943e77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241712, "uuid": "168f5aa6-df8b-4c63-98c5-a0f91f181327", "comment": "Malware payload", "value": "1ce27108036fd585dd803ae290f31fe68b18bf27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241712, "uuid": "15517339-13fa-4903-81a5-16a9bd8e3052", "comment": "Malware payload", "value": "65f85ad0b9809c91271e4c7508a61e9c33b6b728124b37d5f5317a1b37f8f129e8bff9ea7ace234f9f06a64eba259dac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241712, "uuid": "b73d0d9f-a074-4de7-8a26-63bda1dae5c8", "value": "T125126E0697204AD2F49412397E7237172156BE52C4539B84A52C35AFFBB6D2AFC33907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241712, "uuid": "ea5db851-2fe5-4ca4-ac42-322d84045c7b", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241712, "uuid": "842a3f57-5899-4df1-aa3b-2f84786055cb", "value": "192:NLQN+PgeEoP5ad8XGPLmlmthhkx2i6Df/cwSPhPkmiyuzm:NLQN+f2jHt/kN6rzSPJkDyuz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686241712, "uuid": "80d7837e-387d-4b35-a8ec-79e720f3a3f9", "value": 9088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686241712, "uuid": "017cb7cb-e174-4c78-9f7e-f2917eb5faf5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241712, "uuid": "1725b79d-dc07-446c-959d-77314d789d10", "value": "SecuriteInfo.com.HEUR.18095.3259", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65a8ebf2-0593-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686184111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686184111, "uuid": "2dad5a85-15c7-4967-a975-6aa2db602669", "comment": "Malware payload (RedLineStealer)", "value": "32c5c3c526199fbd94cbccc42a8f9980", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686184111, "uuid": "8e213050-f658-44ef-b10d-5514f8fe89dd", "comment": "Malware payload (RedLineStealer)", "value": "8b02aafdaf8e6c677a913190683cb23aa3c93de75bfdfb42f4b6174d8a8ff27a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686184111, "uuid": "d05ba273-2378-47ca-9efc-73fa9e680ec6", "comment": "Malware payload (RedLineStealer)", "value": "174294222d453e8a3c332b0b8c60a82ea9973fca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686184111, "uuid": "4c591b6f-ba74-458a-b17a-ab79f860913d", "comment": "Malware payload (RedLineStealer)", "value": "26e5e05d748eb929958c4de3cfde8f38fb50314005fa31363728e00d26f2ba7db1da2bd9d3ef7ea9a400f085cc565930", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686184111, "uuid": "6f797492-3985-4741-912b-a35e02a9b7b8", "value": "T16454480237C68CBDF8AA073D60D48F3DC877ED60165464FA37A89A618ED0313959B5BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686184111, "uuid": "9db7842a-a575-42c7-8b91-a5a8e1c74acb", "value": "f264906d4975bf1277da66f2124faba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686184111, "uuid": "cdeb7bc0-4336-4ba4-90ea-de1d21b4fb87", "value": "6144:rQvoWvJfoZuwvTygXUNVS4MGh1aBFrvz1xcxcWh9rt:rUO/yR1aBFrvz1xcxd9rt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686184111, "uuid": "0b4ca5b4-dfd0-4815-9666-64ba8e05f955", "value": 288898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686184111, "uuid": "819e688b-85cd-4e4d-9ce5-ce82e5d64ef1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686184111, "uuid": "b9e7efd9-f582-4834-97f8-4e18cfbff86b", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f302c94-05b7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686199562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686199562, "uuid": "fa6fa2ff-c2c5-4ad7-bbdb-cd34233613af", "comment": "Malware payload (Amadey)", "value": "1a907dc464208feebe264353d4266307", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686199562, "uuid": "66381ba2-7a51-49bd-98ec-fa4271e22368", "comment": "Malware payload (Amadey)", "value": "8b5ee4c0a1f3c34f10d440f4051f1770b5f960c117ad608ce1bb81379d201d1d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686199562, "uuid": "a81b6e81-c166-4f3b-add0-1299bc6c2ac5", "comment": "Malware payload (Amadey)", "value": "302eefb6e354ac7038bed8af5e37bf6893454f30", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686199562, "uuid": "1096104e-2b9b-426c-a0d0-c77d914ea70c", "comment": "Malware payload (Amadey)", "value": "021e9ab2ec77a57e08bd7e4c6baab91e8cb9cbdc2ff2837d5f8f74397109de2316b1abb2ba79563f54233a1a9106f02f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686199562, "uuid": "4282d13a-4a6e-4068-985c-b31793cc81c5", "value": "T127152363E7FD4072DAB4177058F602931B363DA29AB443974B46685B2CB3B90A83177F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686199562, "uuid": "5fd7127e-6a91-42c6-a761-6a3180a656de", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686199562, "uuid": "abba378c-1fa2-41f8-aae9-5081ffc5141f", "value": "24576:bygqalC9NMpvHjIoyc6aKZSHxvZdxrRDTJbNkGrx:OlaIaIjYKkHxxzxVbV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686199562, "uuid": "8ce23c85-7bdb-4e63-aba7-6dddc03ab9c8", "value": 884736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686199562, "uuid": "5c4e1d00-ea57-4496-b00e-6e31c7e71c2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686199562, "uuid": "cc2823be-0279-4ae0-806b-e80de8160c98", "value": "1a907dc464208feebe264353d4266307.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27708d5d-05f4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686225668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225668, "uuid": "44ef43df-230d-4f9d-a385-145dabd7ab51", "comment": "Malware payload (RedLineStealer)", "value": "24690a59b6b8575f8fd277aad7e1a7fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225668, "uuid": "56e86756-7a3d-48ad-98ba-1741e7434729", "comment": "Malware payload (RedLineStealer)", "value": "8be8c1c13e71961b96a33d88c6e7e08b4e436f31fb6da32a3c610f8ac75ededa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225668, "uuid": "6516e1b0-492e-4f21-ae34-0865baf8dac6", "comment": "Malware payload (RedLineStealer)", "value": "7499f094cbb502ec1e32352c873363b891260fb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225668, "uuid": "79e1ec62-6555-4a27-894a-05b7c3c39dd2", "comment": "Malware payload (RedLineStealer)", "value": "b47cdcf26548534b872e59e7e92dafa553a360a74a3ff8efc7d4b50393c22b29ca0991fd0371851304c6f79b69468359", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686225668, "uuid": "38212833-45f2-4fe4-ac78-d09bcebb3fb2", "value": "T18CF4220A63C94026CDF82BB19CFB57D31B34BDA19A7857435386A9AE1C72B44B170377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686225668, "uuid": "44546d41-e718-48d0-817d-3e63607da934", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686225668, "uuid": "cc8af2f8-d7ab-4e16-be75-6019b6c3a672", "value": "12288:rMr0y90fHrnscOf0tXze/zuD1piA94DUrTE6VPL46kKOr/8+vbx0ofk9ep:ryIscXXze/C1pwDCPL46D6/LbYep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686225668, "uuid": "32314292-af59-493c-8dba-578685c2b884", "value": 791552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686225668, "uuid": "4dd01636-756e-4c5d-84b2-199054aa604f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686225668, "uuid": "2dbd9fb1-17b4-41b2-899e-f227ddd246b4", "value": "24690a59b6b8575f8fd277aad7e1a7fb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "867cf280-0619-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686241719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241719, "uuid": "9ddafb60-da6e-490e-bed4-45d9b271263e", "comment": "Malware payload", "value": "c07f73de02c086dd33cb19d3c46db590", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241719, "uuid": "888bce83-e995-41c4-8fc8-4a80054b72ff", "comment": "Malware payload", "value": "8c27626a0f7d1c1a3e80ab1a0897307773ee4e2acfb679b5ff5d6d9800ad2a1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241719, "uuid": "d5a6412c-9f23-4024-85d0-b60be891bb32", "comment": "Malware payload", "value": "979d210c222c3b88987e150030ac67cb8a6088ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241719, "uuid": "42075c6b-f9de-499f-94d7-14570f708e6b", "comment": "Malware payload", "value": "90f70a6698e28af693dbf2772006dbc174506868d85356e1c87145f8c8d296947c5fda7bb81806ea668dbb3d1d1a1485", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241719, "uuid": "fff5f4bb-3dd4-489b-81fa-8a16a78c68cf", "value": "T1D295333C27151800DA15EEF9EDE60F3C406498BD6A874E58263F05D99E3761F8F48BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241719, "uuid": "8ef1f8d4-11f6-4cdb-9cfc-268a95492b1e", "value": "ac2a060407b89f17e00e7be27595660a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241719, "uuid": "1bc15e15-3ae6-4903-b536-0267ea99ebad", "value": "49152:djM3ErQY6cnjXyqzjpCpG/1t2Qv9ec/BMrvqN5Ab:BbAcnBRTttBarvqj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686241719, "uuid": "e33ea3c1-dc85-478f-99c2-df597227194d", "value": 1967104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686241719, "uuid": "cf9c9470-c5c3-4fd8-9f5c-93b1d8318cf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241719, "uuid": "2e900b65-bfbb-433f-8902-8e00277c10a3", "value": "SecuriteInfo.com.HEUR.12475.23129", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85f73bef-062b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686249449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686249449, "uuid": "07584e10-45fd-4889-9ca9-ed74d3e6fb3a", "comment": "Malware payload", "value": "87c8443a664240d005a686eb2e10506f", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686249449, "uuid": "b9b03cbf-6d2f-4fe4-8aa1-385653ea97b8", "comment": "Malware payload", "value": "8cf5cff3205cf674ee41d3f7b7fe10ff2aaaf578cbf0da49c9f8be27054f84e7", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686249449, "uuid": "5395eb81-e2dc-456b-9365-d9c848b1a9ef", "comment": "Malware payload", "value": "8e6b12aa9c0a245b9a025ed37161a7bd4a7c675b", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686249449, "uuid": "1985be1a-77c6-426f-9673-b82a90cebcb6", "comment": "Malware payload", "value": "cc46a365e2a0e4b023f58676aa977cb92fda07e026f7896e74dbc1286efa9539804bef1f85d301f360ead03832496b17", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686249449, "uuid": "8a6b091d-96a1-409f-ab12-653bff15d4be", "value": "T1FF248D9D765075DFC84BC972DAA81C68FA6074B7930BC243905352AD9A4DACBDF180F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686249449, "uuid": "c92b113b-e706-47ea-924b-205f8ba6c415", "value": "6144:OmpbEf1ei2XTQTMGoW0orTO1r0JTbav6+fSvj5:OdZ2XMTMQdvY0Tbav6+fS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686249449, "uuid": "b8c2b73a-3d3b-47e6-b01d-84816188c868", "value": 228416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686249449, "uuid": "1e25c6f3-5292-4d51-ab11-f58f4a710a82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686249449, "uuid": "1a433eeb-83d4-4938-ba7b-20696b929b2e", "value": "87c8443a664240d005a686eb2e10506f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a0e402a-05a6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686192360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192360, "uuid": "6c3f1261-cffa-4805-b720-3251f989d7c0", "comment": "Malware payload (RedLineStealer)", "value": "6291db066bfd8e64ef5649b66a61e3e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192360, "uuid": "9d9872ee-1036-49b4-be1a-669aa943b50d", "comment": "Malware payload (RedLineStealer)", "value": "8d44920f9b4c4d24cc6083d9d0d4606147cd17780bcd84a9cbc066e17d6cb527", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192360, "uuid": "89071ba2-fd26-4c53-ad6c-6c7ac4e66539", "comment": "Malware payload (RedLineStealer)", "value": "c63577e7f464fdb64447e62723c1be0e1f73a6e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192360, "uuid": "596ffbe8-81eb-48bb-90b3-790477dfe820", "comment": "Malware payload (RedLineStealer)", "value": "18731773344f6877997a6b1841dc5e11e4f5fd55f76cfa0ddbf653f8c732893b26d45b0f5fb88096e92edd57df12fd96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192360, "uuid": "ecda70d4-c25a-4165-867f-edb4e291a01a", "value": "T1FC54480237C78CBDF8AA073D60D48F3EC877DD60165464FA37A89A618ED0213959B5BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192360, "uuid": "6e7bb5bc-47d3-41da-b601-f4ce4ad293b5", "value": "f264906d4975bf1277da66f2124faba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192360, "uuid": "65ad0a07-8019-4d41-a619-23f1a208453c", "value": "6144:UQvoWvJHhn6wvTygXUNVS4MGh1aBFrvz1xcxcWhDrt:UUbRyR1aBFrvz1xcxdDrt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686192360, "uuid": "20fe9cae-25ca-4fe3-b1e1-07d51ee5ad25", "value": 288904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686192360, "uuid": "9802d709-a3d8-45e0-be67-2200a223ff47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192360, "uuid": "4dedf2f9-379e-4f2e-8da1-4d29292bc8dd", "value": "6291db066bfd8e64ef5649b66a61e3e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c33f243a-05eb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686222064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686222064, "uuid": "eec3c49c-4836-4bf8-a76f-844347b052ac", "comment": "Malware payload (RedLineStealer)", "value": "9d47774cd4c05f227828924c80b306e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686222064, "uuid": "66ec2552-b8df-45d9-9545-b77d9add5ede", "comment": "Malware payload (RedLineStealer)", "value": "8d59f28ea6f198c40bb5c016ec6228a5da71f0db9d90ba89d0eb242a9149ba4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686222064, "uuid": "a758f9ed-319e-49dd-bb53-895ef37627d4", "comment": "Malware payload (RedLineStealer)", "value": "e702a760958d680b517ff49fef661691c490c89b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686222064, "uuid": "12a5a677-a300-4beb-9214-60e8632ffb07", "comment": "Malware payload (RedLineStealer)", "value": "d9e21ecc492061109f13a759d3a393b40886f63203fd7099fd361a27ab0e25951f614aff5c7bc64c28358a8d45aefc11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686222064, "uuid": "007e0a0c-fae4-4063-975c-243f7e55b589", "value": "T1A1D41203E6E85463D5F62B70A8F113D70E367C602D38866F2B81A98A1CB3594B57637F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686222064, "uuid": "b20f9cb3-d0d2-4470-84f8-f9970ad42c6a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686222064, "uuid": "1e59821c-eaf7-4e06-8455-4c66828a4610", "value": "12288:/MrXy90WyoKSu7e9FnYtqYAHTGjP6jlIcvDBRNfXr8DrHCe0:Myzy9U8qYATWPHmtr6eP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686222064, "uuid": "a4a52a8d-458a-410d-80bd-fe01134374ab", "value": 616448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686222064, "uuid": "e759be2d-5d30-4d18-8849-3b8246e72b7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686222064, "uuid": "461f1ab9-5b71-498c-91c2-2fd56d5538f0", "value": "9d47774cd4c05f227828924c80b306e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c3d83bd-05f6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686226723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226723, "uuid": "b826c7c4-11a5-4306-9216-10b48cf1b131", "comment": "Malware payload (AgentTesla)", "value": "cf7858df1787563d33deee4dc6d48e63", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226723, "uuid": "0223c8d1-5d48-4b66-9684-889f321ba87c", "comment": "Malware payload (AgentTesla)", "value": "8e1238ee55d0c74551c0be2c2da6f3a184368242f5c66f0d01e0487f804a40cf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226723, "uuid": "f9b74a9d-be56-443c-bab7-3d21a6ca7d3a", "comment": "Malware payload (AgentTesla)", "value": "86f2f8f8db6510daa818506795ec5375e05d8c55", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226723, "uuid": "87cdf3fb-2288-46a0-ab1f-e9fc815e91e9", "comment": "Malware payload (AgentTesla)", "value": "b441d2a20edca4943ff59bf1aabe714c781abe74fb5d6bcf6a1084a5f14b3106414c37df96ab233ace2f75a25b8ff696", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226723, "uuid": "34992a99-d967-4406-873c-7bbc101dc9db", "value": "T155F422A8BA9BC42BD68B1BB40884377101FDC3D9BE32EB271E9756A4F717F1954403A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226723, "uuid": "0f97d738-fb67-4370-b8d2-43bc02fea1fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226723, "uuid": "4d2381a5-ec46-4500-9c8a-0a3cf1ba49e0", "value": "12288:pIRP2B0xTGlxNqvNu2hZ+nUEsn9au1a2REqA9C1ikkug2K+Ljrh5lO+cv8YyzwjR:p8PLaVUH999au1aMEqA9C1zvK+LjrDlS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686226723, "uuid": "4b995e73-cdb5-4a29-9b73-1272c87f082f", "value": 729088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686226723, "uuid": "02c4ffad-412d-444b-89c0-9df2716444a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226723, "uuid": "f30c16fa-5769-4a1e-96df-04a70ca9f082", "value": "8e1238ee55d0c74551c0be2c2da6f3a184368242f5c66f0d01e0487f804a40cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77b3479c-05bb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686201322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201322, "uuid": "2e04e685-e2ad-40a7-845f-452cad4606a9", "comment": "Malware payload (GuLoader)", "value": "39669a47b553f5d6b3ed6b730d7852f9", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201322, "uuid": "99912390-1331-48bb-b858-339bcf396705", "comment": "Malware payload (GuLoader)", "value": "8e353c1f1a7b0ddea3289b04cb2fb2bde6eacb21298cca8a0c2af37081e5be8d", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201322, "uuid": "d3c8411d-881e-46b4-9b16-ffc399eeb92f", "comment": "Malware payload (GuLoader)", "value": "74b365ae0dc316eee5de6df5911019cabe512efb", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201322, "uuid": "d5185a07-3b71-40e2-bcb8-2ccf30578d32", "comment": "Malware payload (GuLoader)", "value": "f3dc77c6136226d9cf21b7bdbda81717e5b4e20ded0ac678e3f0ea3a91eac7d9c0d1f60c31cf00bb46ca8b81883b8ccb", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686201322, "uuid": "6b5265bc-5e64-4d54-ab53-529ab8c5d10c", "value": "T1F4A27F565B8C4C61E269E8B7874EE00E58BCF23630C215C4BD9DE2B47B7D14E4B6B1B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686201322, "uuid": "0b73f68d-c5c2-45dd-b562-1e6fab0dc03d", "value": "384:d8eKvpZlj7bLrJU/Wx1mEIZBFhqeq/d7SZ7DPvZ5pfiZcp2k4V7qQsqG14uT+hS1:dBeZljnLrJUOx180luZfp3p2kA7q1qED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686201322, "uuid": "a4a8b896-1fe2-41e4-85e9-c7b2f1f380f9", "value": 23100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686201322, "uuid": "6d9cd0e0-b892-4648-a25d-ae9e1fd07350", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686201322, "uuid": "5b0d4b6f-c2f0-4dac-ac6e-7766185bbd55", "value": "39669a47b553f5d6b3ed6b730d7852f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ff1b49d-05e5-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686219428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219428, "uuid": "97f3e9b8-86cd-4ed6-97e4-9820c097ea47", "comment": "Malware payload", "value": "a4621eeaf8187f8fd4a5bde054119f00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219428, "uuid": "e7b74730-9577-439d-9116-ebbcd91c2fb0", "comment": "Malware payload", "value": "90b3683c2bbcec88f5e954f8044bcae587fa7c5dc02f305a978828c43847700b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219428, "uuid": "9a4e76ba-6339-4f99-bc67-ef6d8f2fc10c", "comment": "Malware payload", "value": "af5c8075578b31a55ac3eb64b7a501ca7b198097", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219428, "uuid": "e5fca97c-4f62-4d8d-b532-1b711a4bead7", "comment": "Malware payload", "value": "6e293be3460b0dc6fbd6d1f2b751765fe139e08250723c817dc8bd975f5b18f0ef6102a437095b35b0bfb3e8f28f39e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219428, "uuid": "1b6e7d37-04e5-4a6a-a28f-f27692e059a0", "value": "T1F033D580F350E6A6D66D8BF28133D9280267BD2A8CB19B2E7088B5EF3D713471476D57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219428, "uuid": "2975a419-a1fe-42ee-a335-fae788892b8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219428, "uuid": "3b82771d-24e6-4a3d-a1ff-92b164159612", "value": "768:ICSfwlOM2hI9R6wRfK1ZzBNttC/5t+CElMTA1JY9v:sfwlOM2O9bfK1ZzBNer+CE+kJyv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686219428, "uuid": "727b374d-1556-4e52-b581-8d664e0e8485", "value": 52224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686219428, "uuid": "bce00053-610d-40b6-8e7a-174de8bb7bc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219428, "uuid": "7e971874-f90c-4dc5-a80f-5d9f956b21f0", "value": "90b3683c2bbcec88f5e954f8044bcae587fa7c5dc02f305a978828c43847700b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc6c08ee-05fa-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686228522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686228522, "uuid": "5e265f3a-472b-47cf-9656-8414732c07a7", "comment": "Malware payload (AgentTesla)", "value": "337c2a0bfd717ba1c64e992e51cb05e6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686228522, "uuid": "a74f88b2-25eb-4c6c-a291-af1fa7085d29", "comment": "Malware payload (AgentTesla)", "value": "917c513d52d8faf6ca2c31557843db054a818a1b47d370b515f9ccb7348975a9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686228522, "uuid": "e0341de3-5560-44f5-9a0c-e06884055c32", "comment": "Malware payload (AgentTesla)", "value": "fd5fc6e17dd730012c1334f1e568346b0a6e538d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686228522, "uuid": "0ddd54fd-1a83-4f3d-83aa-c7ad27c02ea4", "comment": "Malware payload (AgentTesla)", "value": "63dc2d2dce3a1a43573b569d6b36f7049d039c62507fdaa7afeec9cb8dc90f80e575766290656444232332ca8694319b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686228522, "uuid": "c4ff0678-83e9-40a6-a014-ae707129286a", "value": "T17994DF7DBA502DAEC8AE833CD4A83E15AF7094275A07D327494762F46D6BBD28D140F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686228522, "uuid": "513b9350-840a-4db5-aa0f-82287cc42ca2", "value": "6144:7yD863U2VTx68eD5jCQjuttev3KMaBYhn2m4iMwYzAL1mcTdAd1//Fh4dV0o4Wwb:7i83oxjY5WQjqePyB7OVYzmC36rJ4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686228522, "uuid": "4eef914c-d435-44fb-9163-c0eab410f024", "value": 436736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686228522, "uuid": "fdb9ac88-368a-4fdd-b368-be869ca80804", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686228522, "uuid": "73796cf1-eca2-4c82-b7ef-6346f6a25414", "value": "917c513d52d8faf6ca2c31557843db054a818a1b47d370b515f9ccb7348975a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60c81c50-0635-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686253682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686253682, "uuid": "22ed230f-6492-4c0f-8329-41274963a998", "comment": "Malware payload", "value": "a5250dd29acd44f9cbbb1575d9a31454", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686253682, "uuid": "6b04a379-7e52-45fe-a4cd-a9285fa45f68", "comment": "Malware payload", "value": "9208e906eeb23ee392919954cc64260ccb3e57160fb720a13524821c4e09f5e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686253682, "uuid": "a2f3ee9d-aac7-4027-816d-a29ad5901bb9", "comment": "Malware payload", "value": "344ed2c8a5e35709145dcab5a4cbd2ee6a4559ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686253682, "uuid": "2d63d8ed-1946-461c-b353-51231c792f15", "comment": "Malware payload", "value": "7be63b53c7c024eac4aa452d792f30b950b40e542e21c4cfb24a915fec325935d19fb4c38cf07487072cc2310e6dfae4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686253682, "uuid": "4d9160f6-ca61-42ea-9688-ce7d1c52c998", "value": "T1B8853347FA9202B3E5B1C0F9AF6DF909663B6E24146144E94459CE8F3B3F4982704AF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686253682, "uuid": "23b2a78b-b497-4396-b8f9-d01bd2a392d5", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686253682, "uuid": "750800ce-ae10-4a86-98ea-56fa814e6ab8", "value": "49152:56dS67IoQNQVeZasXvZRFgrA1phy8YGH/tj/bPDlih:Md37N8LhgA53Y4/J/bPDsh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686253682, "uuid": "826f5f84-c5a1-4fdb-8f54-4617c6b085e6", "value": 1873524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686253682, "uuid": "facb2af8-5fd3-442d-b6fc-11c65786ed50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686253682, "uuid": "df2669ee-d142-4e8b-bdbc-96ed8d6afe35", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bf87fe6-0619-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686241701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241701, "uuid": "3fe06016-716d-4e10-985c-2f6b35a21d06", "comment": "Malware payload", "value": "28ae9209410e83578989f79bfef08327", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241701, "uuid": "29b1259e-c9e4-476f-8a88-3eca3169f7bb", "comment": "Malware payload", "value": "927b02522c72bbef46e7d82880309acfa7c9388b94540f6d19eb484543479e5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241701, "uuid": "f4c61743-bbfb-4970-8ab9-203b77ce4a21", "comment": "Malware payload", "value": "e934cf0569aea5603e740b675b1ee2026a99f7b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241701, "uuid": "3d56e484-d57c-4bfd-8015-6be500142e16", "comment": "Malware payload", "value": "4f433e7cf75ee71b0769d0b5e517b3a6920c5583f7af68aedb4a0984b9c32a69b277a063ed8842a37a84c5a193621137", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241701, "uuid": "478d7a36-1027-487e-bce9-260e2fc70392", "value": "T1A4E423844AFDDBDBF7A261F72D2207F34466A15993F254F5380A088CA87E7763056B0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241701, "uuid": "72957082-12ac-4a75-9ff1-dbcec5af9e86", "value": "5a498eee87e4d89512a84502f500181f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241701, "uuid": "be286433-38ad-4a5b-b00d-ac15ea48b723", "value": "12288:50/rqJ1QY99L1I8MZ17x2k0jyOZAU/99CYJLfLVYBvGIlUFjUNQ5tYUd9:WiiY9RQ1d23hAO9QYJL5kvGTFjCQLX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686241701, "uuid": "2722f2f1-efff-4eaa-9328-f216224bea1a", "value": 713728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686241701, "uuid": "3cb5f203-d3db-42fe-93b7-96918be01dda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241701, "uuid": "b4ced7c9-5964-4227-b5d4-8952b0aefc63", "value": "SecuriteInfo.com.BScope.Trojan.Wacatac.17077.7031", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df77ef4f-05cf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686210086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686210086, "uuid": "5bf6bc94-d659-4bc5-bc02-c3635e8ece80", "comment": "Malware payload (Mirai)", "value": "41568b51fbdadbe54bac55c67b42c089", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686210086, "uuid": "c6062706-dc48-437f-945c-816d536012a4", "comment": "Malware payload (Mirai)", "value": "92d7aeaa00b6f578ecf8dae91664f02b2c9bf2d8c34bc769cdf96f1631b98f42", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686210086, "uuid": "50afeb58-6c44-4eef-8382-cdded35ed900", "comment": "Malware payload (Mirai)", "value": "f48393dd145274aa67eb7bc815cff30ab5bb936c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686210086, "uuid": "54b50fff-2c3b-40fc-928b-80769f8bc0a0", "comment": "Malware payload (Mirai)", "value": "c2c6889d83290691bc5d10ae23456c03a50c63d560d1286f6b5a7cc179ddb7106cf548f9501151e9670dc9ffa523078e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686210086, "uuid": "a9855d5b-af4a-4ba2-b373-36c15f59c9e6", "value": "T1836302226D5AD477E5203C3A6968A135F1E5CE3C04C2E2D4E56088ECAA772C7E97C437", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686210086, "uuid": "d9753b07-f6dd-4692-913e-afa2c189f09e", "value": "1536:phZTRDjZhI3CrZ/EcK/OLnA4nkc6O8tqVtYQndpNCI50r:pt5m3CrZaOL1kc/8ytBjR50r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686210086, "uuid": "c7f3ff0f-bb93-4e59-b4b7-2080ba915794", "value": 71508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686210086, "uuid": "037c6f16-7bb8-4ba8-971b-e3ece18663f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686210086, "uuid": "0f849305-6688-4519-9a98-d1c341c89b63", "value": "41568b51fbdadbe54bac55c67b42c089", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8810fa4-05a6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686192384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192384, "uuid": "39ef8439-e3f4-4207-a886-e69ec604ff8a", "comment": "Malware payload (Amadey)", "value": "87762c39eba17b1c076d7e25b21b4735", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192384, "uuid": "91a39937-d521-4e00-bfee-9f0d5047af74", "comment": "Malware payload (Amadey)", "value": "930d178ce162bde584c93c9ef735d73020a1029fbb2eb6e625f95dd8f82c0b0e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192384, "uuid": "6058f89c-8a95-4900-b5d7-b3bf566df099", "comment": "Malware payload (Amadey)", "value": "f82f2bd51ad3d03f8c7032787cd89b817e719280", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192384, "uuid": "e44bf7a1-1276-4b15-a7d3-d73b9af1edda", "comment": "Malware payload (Amadey)", "value": "b0e2769e9177f95e5d41b93e0c3a429f88f1331bbce67c3ec64344203fd54934fdd19da303def77036f400ffcf5517bf", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192384, "uuid": "1c6f5d85-e785-4735-89fe-1f6f498f599e", "value": "T15CD41203EAE8D536CDB42B715CF603C30735BD229D78C26A27419E5F1CB2AA4A53176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192384, "uuid": "63737764-85a6-4cf3-b9e3-8a0791c7d23b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192384, "uuid": "41a63e7d-8eac-43a4-ba65-e59d71801a0d", "value": "12288:6Mrzy90CBmUpKrhPbAr4/+lcA/7zMf5M+AXk8rT59EQ:hyeUWsEGtDzMBMv08rTL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686192384, "uuid": "22818fc8-ef8b-40d5-80ba-666f9233ec03", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686192384, "uuid": "9dfa9b90-8bd0-49d0-a0ce-02f81fe79b58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192384, "uuid": "a1104e1c-5c95-4d99-b7fa-9060da8bf8e1", "value": "87762c39eba17b1c076d7e25b21b4735.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "655a5b69-0611-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686238227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686238227, "uuid": "123731de-2aec-4497-a542-bee6be303f3a", "comment": "Malware payload (Mirai)", "value": "6831ef0e84549e631b5bce3aa69171b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686238227, "uuid": "8daff9ed-a79b-4170-bf8b-834546b6f8a8", "comment": "Malware payload (Mirai)", "value": "933f5372bf941c10a89fbea3bb9342676502ec7519d20fc072aab8fdfc99b0ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686238227, "uuid": "5348933d-efd6-4bd3-9e99-80043657db02", "comment": "Malware payload (Mirai)", "value": "1e55b3c25c76d649574339e5c1248f235aeb3650", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686238227, "uuid": "fce21691-016c-40ad-9db0-cb52ded64ba5", "comment": "Malware payload (Mirai)", "value": "fc859ea8ab501c94ef19007b51153a4fea2e299151096ee1ec7130a91610f6cf3937a6156fdb5c19a1979d481ee68438", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686238227, "uuid": "e5b6e333-8ff5-4183-8027-d3a990396f04", "value": "T1B7F2F1F1E24255B0C5F15839D5932083125EEB74DCAD65FA263083BCD2FAD416ADCAB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686238227, "uuid": "a28fe73f-9adc-4215-b7f5-31eacc309c16", "value": "768:T1EwhfSpYxZbwJhITmH0+ZSzQ/Yv1aOheW3UZ:TmiQY8JhwiZWv1O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686238227, "uuid": "2b640fc1-6764-4036-a124-3a03bfcecada", "value": 35176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686238227, "uuid": "a5adb461-c521-4b35-94d0-9bbae848aadc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686238227, "uuid": "b0676cb1-21ae-4c19-b243-adfd3a12540d", "value": "6831ef0e84549e631b5bce3aa69171b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39ba9104-05c3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686204654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204654, "uuid": "5459b285-e788-43a2-bc38-f65edeb04e09", "comment": "Malware payload (Mirai)", "value": "27ebd5e8da7ff7948f1b1a3791e58579", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204654, "uuid": "7908167e-9790-4bae-9fba-734f1f6d6f0d", "comment": "Malware payload (Mirai)", "value": "935c45d0d05a357b31b270fce901ed743c923bf9f36c348ded070e987d3826bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204654, "uuid": "dda80d80-1642-44e4-93b3-613c9422cc23", "comment": "Malware payload (Mirai)", "value": "a2f07caa9ec83fe15d5d1b323a3896a7a60fccaa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204654, "uuid": "c1a6f0ef-5f3f-4926-88a2-4778b5c7d420", "comment": "Malware payload (Mirai)", "value": "f03fe3a75d7823784f5ffbfecab89af236527d005bf9c2c8ecbe49db86ae7db88c079c724db4997658c6a17a05851082", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204654, "uuid": "66f897a8-a976-47f6-8977-e7ae4c8d86d3", "value": "T113E25C66F4761E68C14A027474289F382F2395C0A3535EFA27658AF1D49398CFD09FF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204654, "uuid": "d13616cd-209f-4f4e-8fd6-6bbdfaed833d", "value": "768:Ca6lLrfUCVKPoKqff2y2egXCVZoeKfCp:CacLDKoOy2dXfRfCp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686204654, "uuid": "9aaf5617-d3ce-40bf-afcf-6ffb16d5bdf4", "value": 31520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686204654, "uuid": "f547ffe6-c096-421c-941e-11a6ebff4250", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204654, "uuid": "eb1b1917-a84d-47a3-9c11-c8969dac2e01", "value": "27ebd5e8da7ff7948f1b1a3791e58579", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5500c9d1-05c0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686203411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686203411, "uuid": "c2356e79-cff2-4048-b8c3-5726d0aa3c11", "comment": "Malware payload (Mirai)", "value": "8edac12bb9cefe85aaa6d6655c28039b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686203411, "uuid": "dee55bf0-4339-4ab6-be4c-dbb074277dcf", "comment": "Malware payload (Mirai)", "value": "93908b705d68df14f8894e09f8fb4e3c53334a0d325f8d1ec0376c5b06255ad4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686203411, "uuid": "27708072-4b28-4b87-9dd0-06bd6d883b0f", "comment": "Malware payload (Mirai)", "value": "14f1563a6697ec4197f66879e805b5c3323cab56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686203411, "uuid": "ce220fe7-2d17-4d0c-9493-28f47adbcb11", "comment": "Malware payload (Mirai)", "value": "ea78c230b39d44f881fa753312549c3b6a2f4d4d47d2b8b17a95ded78cf03b12d4250e23a4bb071c6a96ce09b37b6d8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686203411, "uuid": "ffdb98b2-c640-4955-b765-59c0556f06b1", "value": "T155436BC4F643D8F5EC8715702077FB379B72E1EA22A8D643D3B4D932AC52611E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686203411, "uuid": "ca07bc58-468f-4687-bb83-3bb8d45da311", "value": "1536:JeESt/basV2rcZhG6ySN7nayBOBezWOIaEjrqM01s:JeESt/basVTgS7nayQB4tXESD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686203411, "uuid": "df18c660-1e1c-4679-9947-1a9d427bce63", "value": 55632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686203411, "uuid": "9444eeca-85be-49b8-a2b1-f5321ecc93af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686203411, "uuid": "3104c496-f277-4200-8935-dfccf976b9ab", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbe4acb9-0594-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1686184739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686184739, "uuid": "4f32e2b1-23c7-482e-a83c-0003a2e9241b", "comment": "Malware payload (Smoke Loader)", "value": "c2a1406f1b6bc321fc6a0635cab61ab6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686184739, "uuid": "0eb2ca0d-c46d-4adc-a752-21e171917431", "comment": "Malware payload (Smoke Loader)", "value": "9415bc706e008686567a053900450ad780414dbe3b86bc44c20a39d99e8df2c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686184739, "uuid": "1fd708f4-1321-4f37-bddd-189ec44beea9", "comment": "Malware payload (Smoke Loader)", "value": "6f6a3c2995311c1de605ee7f2f13b7ed7ea66b95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686184739, "uuid": "edada71e-e6a8-43da-a667-b5d01ec5feab", "comment": "Malware payload (Smoke Loader)", "value": "d24ac72c2d3fd6a2f66b30d380863fd4f5ae1655892a2eada2afcb65a7250bdeb31565f223eb5e1575a75ad3b50f2efd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686184739, "uuid": "276e6039-f042-41de-8bf3-7cb8583657f3", "value": "T1A2247C9252B078A1E6E74633CE2ECEB436DEB6618F7D675A32065A1F05723F2C523311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686184739, "uuid": "eb6490e9-9679-4cc3-8a67-9b758a0dada7", "value": "2e4173d4094e9bbe81d0a2fc8ae0cf99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686184739, "uuid": "df6d8152-8633-48e1-bed2-838cf93a666f", "value": "3072:cGxyroW2uKHvYG1tlIvLWHG2NN+iltqKSy5m4bFp1:fyoW2fPYGbl6FtpR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686184739, "uuid": "90c57469-30ea-4edd-ac0b-e7d6e1f199a1", "value": 227840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686184739, "uuid": "3af474a5-f8a0-4578-9551-131a19571614", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686184739, "uuid": "1fac2aef-1279-4ca9-a02a-659178f35900", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4af8dc6e-05f1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686224439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686224439, "uuid": "40467295-fe6b-46a7-87a1-89b3ef982662", "comment": "Malware payload (AgentTesla)", "value": "371d0b20cfdf1144f35a6da1c5a39bcc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686224439, "uuid": "d0851832-57b1-4d1b-a36a-851ddd0fab77", "comment": "Malware payload (AgentTesla)", "value": "941a01878f1694106f0822a8b332f62135e5c61412c6e144ece4f2ba1d481927", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686224439, "uuid": "e273eb10-07fa-437d-b665-21c34fdfb771", "comment": "Malware payload (AgentTesla)", "value": "242f22d126fd8ccc7c1a1d441a8a9a1503fe79d3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686224439, "uuid": "aaafc899-04ad-4117-8284-332382ce62f0", "comment": "Malware payload (AgentTesla)", "value": "729623219cb9ff2e6858c862de80b602de5f80f3343984c499b445cecf6b615883ad660ad8f37d2e9dff966e0a8ad1d3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686224439, "uuid": "026fee57-c81a-4b3b-a0be-ad08cd884bfd", "value": "T178E4124472698B43F9B93BF916619AB003FA791B7432E30A0DD173DF5672F44A422B4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686224439, "uuid": "f9c4111a-6792-4a8d-ba45-8b5c2ae7985b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686224439, "uuid": "82638a07-8f2d-4b66-9509-7227be4e0df9", "value": "12288:HK+7z5GoJiGaq5auY2AUdWkUd+xJqh5ietodjV+FuH0XNXMxbSlHbZuDGzKJcEcd:l5GoR5adyE+SKNdjV+U0XN8glFLz2cEI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686224439, "uuid": "c5ecbf48-2f52-43a9-b24d-c5e91f4ff50b", "value": 685056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686224439, "uuid": "a898ecca-d791-43dc-8e34-18d242da726c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686224439, "uuid": "da856d17-8010-47c3-b1e1-475f21aec06d", "value": "941a01878f1694106f0822a8b332f62135e5c61412c6e144ece4f2ba1d481927", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0806a0e-05a5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1686192075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192075, "uuid": "d05c53ef-ea66-4fc2-920a-80150fd5aa3b", "comment": "Malware payload (DCRat)", "value": "6bfbf792786f767bc33a9dc54d7b0201", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192075, "uuid": "88fd4c07-451f-42c9-b765-d1a1c2ee59f5", "comment": "Malware payload (DCRat)", "value": "949c549fbf47f559d9e0aa2cb247c955a1d9f35d8b7e4bcb675bd8697b081fe2", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192075, "uuid": "15b457f1-300a-43dc-802b-a94864acab7a", "comment": "Malware payload (DCRat)", "value": "672dc2b722a925f1a114adaac97c53929eed1c70", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192075, "uuid": "f6c37529-d758-49e1-b9c7-97bcf384a806", "comment": "Malware payload (DCRat)", "value": "a5eee8582fc60a0bd177efe53dcc182620b5613320a8e6310ce8443b3e56f37abdb96a47d3c20fe7a2efc0b85fa5af69", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192075, "uuid": "09104856-7585-495e-9dc1-431fbac0493f", "value": "T13E5506BC4C47E4EBEE78E23A95F02347B7291506765E398D22DA37414D93DC2B2D0A1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192075, "uuid": "ec4a429c-9002-42c7-9fb2-c3d8418cdb78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192075, "uuid": "7306bdac-e7b0-4e7f-9a23-5558b7bfb9ae", "value": "12288:tFsdeqmxHyByzDaTzcykayUbdxXb3jr9vm1s+Wl9XDTJ48BIwr+:t+e7H9zu/cykatbDrX9um+6PNB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686192075, "uuid": "fca21a14-9d16-41b1-996d-0bb7e5a4c109", "value": 1305600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686192075, "uuid": "d8455508-fe5a-4fee-9691-800020e838ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192075, "uuid": "16be3996-fd1a-4ace-9b1e-607f4281b2c3", "value": "6bfbf792786f767bc33a9dc54d7b0201.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4ca9d1a-05d8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686213960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686213960, "uuid": "51ea42d0-04b5-45da-b09b-1658227cac53", "comment": "Malware payload (Amadey)", "value": "5a91b9ff784d8951b75a8e87b428e8c7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686213960, "uuid": "02a09bf1-fac8-40db-a686-3c005733f41e", "comment": "Malware payload (Amadey)", "value": "9595cd59fc567afc3cea916e70b7a6b02576960030913c28c5431c9c950d7738", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686213960, "uuid": "b51bd759-4b6c-420b-9b11-ae8d4e94d46d", "comment": "Malware payload (Amadey)", "value": "e2cbedf4b0963fd0083de547634a1d2998fce437", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686213960, "uuid": "e2da3d49-0a68-4ed5-913f-f3a88e54edf3", "comment": "Malware payload (Amadey)", "value": "72307f79e1c05f1d89a8028b7fdf5b635c9e75d1954f3e4a217c86d5477af089fdb54460f5a57480d0ccd4029a97d336", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686213960, "uuid": "ec7de342-dd2e-4d26-85f2-262f7581279d", "value": "T178D41283FAD4453BEDB517B048F703D31B3A7D605D78A26B2649A84F0CB2650A93537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686213960, "uuid": "1ad51b93-6ae7-4872-8ae4-b2fd9dc42e35", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686213960, "uuid": "d7d7bce5-896a-4522-9014-ec42c1bc944b", "value": "12288:EMr1y90OhPInn4Tx3YqcS0gapCQVbQ9UZpI88Qca:xyhPtGqcSBg5VbQGG88/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686213960, "uuid": "4b92dcc7-7641-4d7c-8885-74d82e6cf9c4", "value": 616960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686213960, "uuid": "860fdb32-5e57-4c38-8bda-7a55dae1fd05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686213960, "uuid": "6c98111d-f27f-4861-8e1f-ec7547dcd325", "value": "5a91b9ff784d8951b75a8e87b428e8c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91af0ddf-05d5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686212532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686212532, "uuid": "30fe3445-8431-4e99-9c8c-1a9b4f91a4fb", "comment": "Malware payload (AgentTesla)", "value": "acdc75598827e2d6e2bc0825e2181240", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686212532, "uuid": "34b63b5b-131f-48d1-9683-e572c6188518", "comment": "Malware payload (AgentTesla)", "value": "95d49b0ec839ae800171e648c1768b328109028032d4ee7d00e9f4153c7dca1d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686212532, "uuid": "64aa96fe-cfee-4d93-8fb9-45081d75564b", "comment": "Malware payload (AgentTesla)", "value": "7bac8711ceead6ccc530f03af699646ea07e0b11", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686212532, "uuid": "bacd372a-d3a9-4cf5-85c0-b5450d27486e", "comment": "Malware payload (AgentTesla)", "value": "5e2f8bcf8bc5a32f7e35cd781b876dcf49cff4995320e57989367cc58d02023d2a3294aa01bd2ef1235db4609f780693", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686212532, "uuid": "d647cb83-f2eb-45c5-b4d4-55820aab4189", "value": "T118D433621F681A2B10EC34D6205172D5095D65CC83FABF0664156FEABC0AB76F9F08FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686212532, "uuid": "d286bd82-283a-44cb-a07a-42e0d9163187", "value": "12288:vfUnHQPCnYyuGBwjfK95tzqi/5DSG4SOJvFTF3DLZoFkk:UnH+lGiK95tzl/EG4S8TFvG5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686212532, "uuid": "b25b4fad-1639-4287-8c60-14de6fb57050", "value": 625238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686212532, "uuid": "3f8ced3b-4706-410c-9e28-495d49c731fa", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686212532, "uuid": "24dd939a-47cb-402a-9517-bd8b9fd53aef", "value": "NEW ORDER ENQUIRY-JQ2341024749.pdf.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89f96c4d-0619-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686241725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241725, "uuid": "f2efdd85-3795-4d70-9ed0-49253627fac7", "comment": "Malware payload", "value": "9577c2ffffe9ff8e69d8895e6578adf6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241725, "uuid": "d4c585aa-fc7c-483a-a945-0a00b5863004", "comment": "Malware payload", "value": "96d304245367164367e9baf4d263bd5960d2b465fd524d6c2cbfd82c51d6d0ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241725, "uuid": "2b43e738-5f29-4339-8da4-6e0330e773a4", "comment": "Malware payload", "value": "942bb01b5993a0cb8248bcd0162a8836d32c406d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241725, "uuid": "71b6b8b5-a893-4444-bb90-2cb1c15c772d", "comment": "Malware payload", "value": "9573a21822f1f10077c9bdd9a58547f385dd2ff76d7c29841e40ef56ea1f6dea1a9b9eb72d2e9189a8de2a149a3c0bea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241725, "uuid": "9d062a25-9760-4f46-b4c1-9adaec27dc10", "value": "T15F75D097B3048A93DC5D26322A1BC1D56AB4ACA63F13579B334CB31D2DB3390369A74D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241725, "uuid": "e95ade7c-7249-46fb-968b-1a023453d053", "value": "12288:tE18jmJyTllt8fYoiT5STYHBuWrKJW+ahvaB1CTyu3EjaV:tE1QjxlLds6BH6W+sv61Cj3E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686241725, "uuid": "784be3db-b941-4234-95b6-ed1475e773d6", "value": 1618944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686241725, "uuid": "b232d45b-f6c5-46f1-b12b-d43cae78fb7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241725, "uuid": "ff29bea9-dce2-41ce-b235-4d5ec2838528", "value": "SecuriteInfo.com.W32.S-909ca299.Eldorado.26150.20380", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36fbbc5b-05c3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686204649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204649, "uuid": "13a9c4a7-0c74-44e6-833f-474bd57ab638", "comment": "Malware payload (Mirai)", "value": "89732be200041bf9265540dd3e58deee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204649, "uuid": "319d266f-43ac-4ba3-8b9a-9457f37caf15", "comment": "Malware payload (Mirai)", "value": "97008e4d35054a88fbfc191e596404caa1d0e0801cbd93da0931242ecdbd5cd6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204649, "uuid": "dddeff92-33d1-4793-996a-e840064fce5e", "comment": "Malware payload (Mirai)", "value": "91949b4946691cb1e8c5c1f32e965029df334f91", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204649, "uuid": "5b815157-26fa-473e-bdfd-baae228a6f81", "comment": "Malware payload (Mirai)", "value": "43d81dbc2a87f66a943e37c4ec1b95319f216aaad6eb0ede4b79daf305db1be45e952be090a0b62c3b597eebc25408a1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204649, "uuid": "30bfdb5e-1c21-43f3-98df-0c3b77a45723", "value": "T10073294AF980AF11E5D525BAFE4E014933534B7CE3FE72129E20AB2563CA96B0F77501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204649, "uuid": "2f183342-7fc7-4aea-8a53-62bd218ce837", "value": "1536:NfnfqszY37yo/xsVHLGaa7NVfnWNlrLiXYQDjz78Z6YHSZiqo:0szRVHLGaa7NVckYyjz78oZQqo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686204649, "uuid": "6fdf99db-07a5-4377-a69f-5e25d8819db1", "value": 77696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686204649, "uuid": "ce2cc332-374c-4788-a6ff-6c42711f800d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204649, "uuid": "9148fd89-70ae-40f4-baec-a6bdde73e575", "value": "89732be200041bf9265540dd3e58deee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "374ee391-05d6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686212810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686212810, "uuid": "b5dbffa7-1c43-4f8a-b918-a687d0d47ef5", "comment": "Malware payload (Formbook)", "value": "929cae2b67f0dc2fd8f7616d0bf2a203", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686212810, "uuid": "e0434c87-d22a-4e45-8e1c-c3adce1e70ab", "comment": "Malware payload (Formbook)", "value": "98636575f13e34031b0ccae5e2385decdbd8bd51fc08e1a755694534043390a4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686212810, "uuid": "4e174c98-98a2-431b-ac45-f67971b394f8", "comment": "Malware payload (Formbook)", "value": "d574088473011ca006de849dba5b27d7f466427e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686212810, "uuid": "44949721-1ccb-4523-b194-4e49659f46b4", "comment": "Malware payload (Formbook)", "value": "b0eb9c39c004bee7cf68237bfdd22cefbeca8fd2098d64c7a1ce09d73c63c76b006648f81b698cf7ba85bbbe02841953", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686212810, "uuid": "79cea2f3-fc0b-4d0c-838b-dcf8d6276759", "value": "T14105E15437BB9F6AD43A6BFA4840693447F86A1A383FD2465ED3A4DA6E50F100EC0F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686212810, "uuid": "cc65237c-839c-4a8f-9c78-91a6e46cd9c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686212810, "uuid": "b0cff4c0-ce37-4b3a-8b89-8b8e627caa80", "value": "12288:LHr9haDnLMzIL2q+RTdOL8X773uQbpBC+q44khVZlAmVWysV:LbOyqGUL8r7eQWYvlAm6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686212810, "uuid": "f5f12003-c80e-475b-a54d-c98a9f2460db", "value": 867328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686212810, "uuid": "cba8e614-7f95-474f-bd57-96f04a0556c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686212810, "uuid": "0eb151a0-65a6-45f8-ac28-56be90096e0b", "value": "929cae2b67f0dc2fd8f7616d0bf2a203", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f2e6a71-05ea-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686221440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686221440, "uuid": "f0e6cae0-7c42-4609-9018-f4aa444de0e8", "comment": "Malware payload (Formbook)", "value": "31b4c9a8410d02e19dfd38ac81944b90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686221440, "uuid": "fe9ea1a2-aa30-43a5-beb1-8fe27c8eefc9", "comment": "Malware payload (Formbook)", "value": "9867dc4c4aad89a47aa9fcdc726b5296dac1a3150520140e6d7da4836448d970", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686221440, "uuid": "1ba5e634-05bc-4c20-83fc-911cecf88014", "comment": "Malware payload (Formbook)", "value": "3196a4fa70bae053fa9c4aabb34eef6d6c8d1516", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686221440, "uuid": "c20dfe37-99da-42cc-88b2-2d829b98f30f", "comment": "Malware payload (Formbook)", "value": "73a68fc9e16167a9d751fbda6158f0072af3a5687ec1921f219e35561eeedb3890b4284db0b39e4c16a9c8d6011eb491", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686221440, "uuid": "a722c454-ccb1-41f5-ad12-ad4327099df7", "value": "T17525E05126A88F55F6766FF56672E13843B12C15E626D20C5CE02CDB3EBAF813701BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686221440, "uuid": "a75bb52b-009d-444d-b626-b81f0a85d2ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686221440, "uuid": "0ae00891-0e50-4325-a740-b883d8cd0097", "value": "24576:ddeb8P0iW3NMWVp+0w1Nj2dglxwmEgwF96fk:rP0iAiWP+0wDggsmEgmqk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686221440, "uuid": "e836fe94-f038-42fb-b55e-7efdc11c97a9", "value": 991744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686221440, "uuid": "51a558df-0c8f-46e1-8c5e-d76c428fcd0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686221440, "uuid": "57fdcc3c-04ca-47f9-a11e-71b6cef3c208", "value": "9867dc4c4aad89a47aa9fcdc726b5296dac1a3150520140e6d7da4836448d970", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4ee2d00-05f8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686227597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227597, "uuid": "899103e6-83d0-43bb-9162-d04184186ef4", "comment": "Malware payload (GuLoader)", "value": "d6dfdb792e1f9bbee6a2fe377006794e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227597, "uuid": "6dfc7864-215e-4344-99cc-190c62326dfd", "comment": "Malware payload (GuLoader)", "value": "991ab8c38fea82c09c29d8ba23996b3626d0a6d6dad0493e95081cee5eab039e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227597, "uuid": "64d361b8-e7be-4d49-a1ee-e4efd8ed7dc9", "comment": "Malware payload (GuLoader)", "value": "82a6d7951dde88ec69e22c2d3f5724526bb63c7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227597, "uuid": "6c09597e-5952-4772-8876-30331c89e0a3", "comment": "Malware payload (GuLoader)", "value": "48789615fd04b806aba27454d5bee73de932f82cf969f576b0eab49139db413b4d8333a259f3f411fc637e2074d7ca0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227597, "uuid": "20ff7221-e51d-490e-b431-14267d565f11", "value": "T1CB6412265761C0D3E4628F313A3D9A778FB1963205158A473764678CBE32720EE2F76A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227597, "uuid": "0154fe55-011f-4e00-9c48-d2ac6b4772db", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227597, "uuid": "277a229d-6a18-42e6-912f-d6f11d764fce", "value": "6144:xhgqhwXoAOKpH1ZWK9+nOncdln8JdkGZfayfkBSyeshL6zhq7nHoK:EqapHB9+C2l8Doy8IxshL6zhq7Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686227597, "uuid": "f6e0ad41-eedd-4bbd-aefd-efe99fe3c779", "value": 317640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686227597, "uuid": "8d36522c-a57b-4549-af0c-f494f858ffb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227597, "uuid": "c6b25c00-bacf-455c-806a-ca9ada4d7eb8", "value": "991ab8c38fea82c09c29d8ba23996b3626d0a6d6dad0493e95081cee5eab039e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "735ea6b2-05d2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686211193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686211193, "uuid": "799be312-aefe-4102-8f12-5ace02754cad", "comment": "Malware payload (AgentTesla)", "value": "0f4dad3d81f4663166950f3d0618c31d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686211193, "uuid": "602398aa-cbe2-404b-9624-1b0889002d03", "comment": "Malware payload (AgentTesla)", "value": "99df2efba44d4a76e1571f155eabcc66879d0b0d183a6f49c9785aff814105da", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686211193, "uuid": "64225705-8fcd-48ed-a60f-0c5d20b8af8c", "comment": "Malware payload (AgentTesla)", "value": "d5dd3fd07b02ef8bf993e627041366d45cb6fb20", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686211193, "uuid": "aae5a64d-55f7-4547-a27e-a28d0fc505e2", "comment": "Malware payload (AgentTesla)", "value": "1100b1b40f58560fdcfaf2353e0cf6b81f003bb89bd612bd95f91621f5708288a16d137a730ca6fa79389627a62600ea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686211193, "uuid": "092facff-a2be-47ec-b734-5bc62e644ac4", "value": "T1DBC423C6F73A20142DDD07D6311B300A012F2753583DABABB76F59530716D26E9DAAE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686211193, "uuid": "fbd0c670-9077-4a21-ba52-a7208d25a1e0", "value": "12288:SAwmpniyk9QYn5ZRLInTAggT00EsXahnvS4hniXruGiGu:rwmpi55ZRETAUUXah1iKGq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686211193, "uuid": "c597ffb0-ccde-46bf-866a-b108539833a6", "value": 584886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686211193, "uuid": "6b9fd068-1e56-4efa-af85-44cda1e92a26", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686211193, "uuid": "2cd1626e-7194-4aa0-928f-a0c966f27e3c", "value": "Statement.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "344b2540-05c3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686204644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204644, "uuid": "5fcfe579-2513-4a26-a624-7b0ef09ed07f", "comment": "Malware payload (Mirai)", "value": "464f1f98b2127c62d85a7f8e93a478dc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204644, "uuid": "a06157c4-1941-4e4f-abeb-7f2a48efcc42", "comment": "Malware payload (Mirai)", "value": "9a668f8b38a83d4dbf9054d2020d11da126224ef0e31f90312bdcd88d913b629", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204644, "uuid": "26e35e41-7a56-4652-a3cb-7327e824124e", "comment": "Malware payload (Mirai)", "value": "7d7b6518f8a3f5ff7c2725a4881b5a62c58a8c35", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204644, "uuid": "11fa43c0-52ab-43be-9c1d-162a09829c91", "comment": "Malware payload (Mirai)", "value": "1a5421c243574efee6dd86b8be34587163639926fd2621a887b95f4101ff424db9e1b01a997d7edccd0e5dc47f4e89f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204644, "uuid": "27340bb9-0152-46ea-b5ec-da91ba20d414", "value": "T12C83D606BB510FF7DC6FCD370AE91702348C594A22A87B367634D868F65B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204644, "uuid": "4d47af68-d065-44ac-ab78-a38ead751898", "value": "1536:iVLyut5KeJkj752dCOMulf8kZlDAfkJ4cYvW0v:iVLy8glFeDMuplD1un", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686204644, "uuid": "fb6dcb95-f90c-4ed1-9a8f-81993de0f14b", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686204644, "uuid": "af3ef5b7-6370-4b1e-8809-48b7d240376c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204644, "uuid": "697baf4c-4954-4b65-82e8-925c440127bb", "value": "464f1f98b2127c62d85a7f8e93a478dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e949b984-05bd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686202371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686202371, "uuid": "da8800a2-1d30-4821-a67e-d7bf00781852", "comment": "Malware payload (Mirai)", "value": "4714b8a32ebce54b46f5a14328795248", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686202371, "uuid": "c580b8fc-bf3c-4e8d-a618-f44ac8032e87", "comment": "Malware payload (Mirai)", "value": "9ad0760ef327eb0b77a3707f6b94d8025620533351e281bb4181f2be57720bf9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686202371, "uuid": "1fde1bb1-679a-4c1e-a690-c522d96621bd", "comment": "Malware payload (Mirai)", "value": "d9e3378f337f16ea0a403d044f201224c50ab87c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686202371, "uuid": "89c8f2e3-a626-4c6c-a227-85985e8356a6", "comment": "Malware payload (Mirai)", "value": "38cd70e8c8c5e74a4e220813950836e23bd80ce4fe877d71dc6ab058d4203247b8242f55139aecc65cc1b45855355dd9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686202371, "uuid": "ac1dcba2-396d-4e4a-9765-3505005bf4a6", "value": "T175235B82EA83D5F5F85341B512B79BB28673F5391069DA86C334DD36EC23600EA2B35C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686202371, "uuid": "d0e88264-e79e-4fc7-9009-919548d05f41", "value": "768:3F3LBAu0qhPcCMNDV+0i/VVd2DFTqIGGxje/IjjdNpucDX28hJYtClBes+lDkjzc:3F3LGulh8Nx+0i/VVIYBG1e/IjjdNpVO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686202371, "uuid": "e53fc325-f1e9-4ae0-a87d-ae9e1a43e14c", "value": 46800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686202371, "uuid": "6ccc2dff-07d9-4f0c-a303-e17844324abf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686202371, "uuid": "4af29dd5-1c23-49b5-b030-3ab20a90e4d1", "value": "bbot.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76389bc6-0619-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686241692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241692, "uuid": "4d3ddbed-ae82-454e-a977-77abff52ae4e", "comment": "Malware payload", "value": "99fb5d481794e633db3c4a9424e78979", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241692, "uuid": "38f02247-7c95-4095-82db-7421f08fe3b3", "comment": "Malware payload", "value": "9b37813b96a63e55cc53ec8e7ad7981cb5e0b966630e054177dbfb1d8654fdf0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241692, "uuid": "9559963f-761f-4160-bc78-0e64b2c39833", "comment": "Malware payload", "value": "7694729385d7092908adf10953ca7a3a23f29bcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241692, "uuid": "5f081283-53ea-46ba-aada-8e37437cce26", "comment": "Malware payload", "value": "6e3878800186937c952adae2a01ed67b801f8f1b0d9d4e77174637d1d73bb521671a84b2bebbeb873cf4b7993504af4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241692, "uuid": "60974960-addc-4c65-b345-1ba40dcd56cf", "value": "T1B572C0C272BFC2EBE28A8E7E564BFE0B34BC645917D9EFDEA9043047A9D4245C630550", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241692, "uuid": "4ab2055b-d934-4376-9655-9332b89ad722", "value": "91a362a54e716f5d5ad0f91b08714154", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241692, "uuid": "7cd2494a-689e-4978-a56c-f469c6db1792", "value": "384:STW9rfGnp0BVYAIrS/soWc+Xj1P5VKp3Rq:xrunWVYAgSUDVKp8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686241692, "uuid": "20caac6b-7e1c-46bb-9766-ae31192712a1", "value": 16896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686241692, "uuid": "e78a230b-efdb-4fc2-af76-070a339bb767", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241692, "uuid": "131199d8-e01d-4fd1-a4a2-2c65e5a04700", "value": "SecuriteInfo.com.Trojan.Win32.Liewar.13210.25425", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "051fbb71-05e5-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686219168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219168, "uuid": "e8ea225b-43c6-4e47-a74a-646da49e2273", "comment": "Malware payload", "value": "70108103a53123201ceb2e921fcfe83c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219168, "uuid": "c7f16569-5695-4502-8869-a7dac5a52c71", "comment": "Malware payload", "value": "9c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219168, "uuid": "df17e235-03f9-4a0c-b046-98e0f640136e", "comment": "Malware payload", "value": "c71799a6a6d09ee758b04cdf90a4ab76fbd2a7e3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219168, "uuid": "70e5ddd6-fb86-4723-8de4-97f8d61fbedd", "comment": "Malware payload", "value": "8d9f68cde57c048861eec5028cdfb0c6a485b27fe0baca667e1992a0ccd6567e10dee1d7f6242d0e9bbfe8c879bcf45c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219168, "uuid": "b38401eb-2114-437f-ac16-da9969ad6113", "value": "T128D339B3AC82C8D5FB2D38FB957FA97C816FAD083918B4129905310A187EED3657345B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219168, "uuid": "802258d1-b341-40eb-8dd9-3114e9f44615", "value": "91b2790c505bbe69e215e722d884b1b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219168, "uuid": "5527254f-9d19-4ac5-829f-806ee13326be", "value": "1536:3VrdxBvcGdDHHtWv8udA1JYREgJ/qEOpsChnU4V1lyqHv4vAmOG9HSDKRppppp5B:1H5D0dSgo7ppTV1lyqPOAmOG9HSOD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686219168, "uuid": "849eaf86-52c1-46ad-b9b1-1a0a1f4e4b67", "value": 139264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686219168, "uuid": "281f48d4-46ee-43eb-a4f5-7e547a534089", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219168, "uuid": "1a6b66d9-d202-41b3-89c7-292d847b7f33", "value": "PowerPoint.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbda87b7-0625-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686246989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686246989, "uuid": "1a58a43b-ee5e-4430-ace5-5e71e69e2e13", "comment": "Malware payload", "value": "f388a356ad0a5bfb91813775e2873f1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686246989, "uuid": "d332876c-8ad1-4d97-9d4c-89bee9d986b0", "comment": "Malware payload", "value": "9da1a1cb09b2547decbe6b0e9d408ab6406ef15c5f4a83ad1b5af1a6c406cf95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686246989, "uuid": "179671a5-b346-4992-9618-923a79dad55e", "comment": "Malware payload", "value": "992f2e349adb8059ece6e827b990c082fea1b1ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686246989, "uuid": "6ec857aa-186b-4135-9b9d-d1242ced2055", "comment": "Malware payload", "value": "79a623c6a522d4c387a3b4e6b3ffed9707695b170e3b20549c4824428a765bfda6b61cfc88702500207172f34cab8347", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686246989, "uuid": "ff1aeb21-5f02-4a15-9976-bc303c32a0e8", "value": "T1C4254A8FF9D4DF8EC57D5171C69F425289B6A2902F228A2F723D41D436277082BE672C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686246989, "uuid": "b6045e01-491a-4e9f-8a6b-2887e747bd76", "value": "4765a48a5d71693d69087bc502279347", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686246989, "uuid": "49b2fe2f-1c73-4ebb-9d19-1317838785fe", "value": "24576:gSO1xhHJLGwhSe88YtrUF++F5hna9j91xi:gSAaD1xi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686246989, "uuid": "3b2f8a7b-d2f1-4896-bb33-f1724369fada", "value": 977408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686246989, "uuid": "467e9052-a9e1-443e-a1b7-7442ad70a164", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686246989, "uuid": "f202b25f-687b-4703-9f58-7bb1b7b61ae1", "value": "9da1a1cb09b2547decbe6b0e9d408ab6406ef15c5f4a83ad1b5af1a6c406cf95", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9404a68d-05a6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686192350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192350, "uuid": "e58d025a-9386-43a5-8888-bd4a457113e5", "comment": "Malware payload (RedLineStealer)", "value": "025ab0f49ee3d39d7e323a0b0f9f33f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192350, "uuid": "f2c140c1-82d3-4d97-b059-236b13ee99eb", "comment": "Malware payload (RedLineStealer)", "value": "9e1ad9c58bb93d23920a109f81e15acd7ef54e5b7e0effc9338493880712148e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192350, "uuid": "9142ad3d-7025-4483-91a2-5dfc33305f7a", "comment": "Malware payload (RedLineStealer)", "value": "ac2138e224a25432fbc8c781285a28781cf987fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192350, "uuid": "67c17ba0-06cd-4ffc-90c1-5599a5dc6ba0", "comment": "Malware payload (RedLineStealer)", "value": "c17c2278d68c62ca7db913c097b2767e3dfc0bf8007484d3b9fbb5c4aaa0546197ed44cb96f7df220f69227123f5cde5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192350, "uuid": "e93dc9a3-bac5-4271-8ca4-bbde2e8808a0", "value": "T12854480237C68C7DF8AA073D60D48F3EC877ED60165464FA37A89A618ED0313959B5BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192350, "uuid": "925f9cb5-4565-4dc0-93fb-41e23e9b01e6", "value": "f264906d4975bf1277da66f2124faba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192350, "uuid": "c27b8b98-1549-4fcb-ac35-46d034b15327", "value": "6144:LQvoWvJaFUqwvTygXUNVS4MGh1aBFrvz1xcxcWhFrtl:LU4IyR1aBFrvz1xcxdFrtl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686192350, "uuid": "a356f182-8403-4c0e-9e14-aeb649c3b8b5", "value": 288891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686192350, "uuid": "71a58dc6-7ae7-4de9-9ad9-5440418a8cd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192350, "uuid": "2f9dbd78-04ff-4a77-948c-ee4cbadcc797", "value": "025ab0f49ee3d39d7e323a0b0f9f33f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15a72908-05e4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686218766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686218766, "uuid": "994b2f02-de8c-407d-a4f3-5679b70b7e44", "comment": "Malware payload (RedLineStealer)", "value": "7ef2fd7f736aa48e19ba20d4edef5925", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686218766, "uuid": "d0d908a7-5846-4b13-baff-a7323983cab9", "comment": "Malware payload (RedLineStealer)", "value": "9e5d51be3e1fb0abde0af294467df84f8cc77cafbd399472b07ddc4bca198518", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686218766, "uuid": "dc523da6-46fa-4fd7-acd4-a6a627c1c836", "comment": "Malware payload (RedLineStealer)", "value": "ef673b45f613d1d6a70f4f6e4614109538edc23f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686218766, "uuid": "9760db7d-b97f-4af1-a313-60211dc39064", "comment": "Malware payload (RedLineStealer)", "value": "c046f4085f23129d179315f2eb65ed50c73eb420cabdd70f5514afee6f4695b938649690de10d5092b72b842c4ec39ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686218766, "uuid": "d0f76c67-d6b7-4aae-91dc-c573fb75ea2b", "value": "T1B5D41242B7E94127DEB6273059F207931B35BC926E78526F2302A94A0CF26C4F535B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686218766, "uuid": "4f7dda8f-b31f-4410-ae8b-59b9d9a9831d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686218766, "uuid": "7ab210c7-6b91-458f-84ae-ce2b6f2aa74c", "value": "12288:2MrTy90kkYcfs+4GOToL0x4hSnDPW/JgJ+eo7h:1yVkYYsiUo+4hSnD8Jg47h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686218766, "uuid": "a5098ad1-d0a2-4c25-a658-85b0751bcc4b", "value": 616448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686218766, "uuid": "23be9adf-3b0b-45c0-ad5c-b8abc51825c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686218766, "uuid": "09610cfa-ce8a-4703-aaf1-f7b9e790b562", "value": "7ef2fd7f736aa48e19ba20d4edef5925.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ee803e5-05c3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686204716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204716, "uuid": "87f33b25-97d5-4493-b045-9f6e1a2803ec", "comment": "Malware payload (Formbook)", "value": "4c46bfbd4f6224963065eede69e80f7d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204716, "uuid": "50daf2bf-039a-4b24-9ff0-380e610480e8", "comment": "Malware payload (Formbook)", "value": "9f649df261b4acb42fd9bef068c1ec6dab2728b4cc351f10abe779776c57903b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204716, "uuid": "d94fcba3-b7a8-466e-ab77-9cedb1af747c", "comment": "Malware payload (Formbook)", "value": "d5c1857db95050686b3fff8039dac0e60520d65a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204716, "uuid": "c3d53eb5-1a83-464d-babe-e4a9164a7386", "comment": "Malware payload (Formbook)", "value": "14b6d79023a28d663c37b9e5dccf9a66234a394c9e4adb31c989a46efe6fe13536d513e14c99ee4abc98f87c908d423d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204716, "uuid": "2ad0a0f7-e3d4-4724-959c-2e2b08e2d459", "value": "T1F614232F9921AC3EE5B47CB661A1037F9CCD8CB802629168FE5ED4CC5B514D76222F39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204716, "uuid": "7de0669e-6f4f-4375-9458-7b0104e4719c", "value": "3072:KM0EfxEL+nQslvNqn93DqLaPazjL3q2BiwX1fCtPzSJ/wzKJuwmT6yO:K1L+nzA9TqLw4jLfidPzlzKJo6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686204716, "uuid": "5d9afdbe-a225-4146-b98d-efcdcb24a2f6", "value": 191488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686204716, "uuid": "df0731bf-3bdb-4ff7-8489-d9e43d2d9d7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204716, "uuid": "a4adc47d-7791-4c22-a8ce-6800e80d7edc", "value": "4c46bfbd4f6224963065eede69e80f7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db4cb5d9-05f3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686225540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225540, "uuid": "f6497f42-8f4a-451c-8e84-649f55a155b9", "comment": "Malware payload (Formbook)", "value": "1d9a80230f2436d0ce8fbf9a7b11a7c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225540, "uuid": "fa5764a3-3bae-4a90-8152-86680c1730a5", "comment": "Malware payload (Formbook)", "value": "9f7df9aa07cfd95be6465d8234bae2a1332e7627932b0b345962a766a696212d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225540, "uuid": "e4e8147a-fef1-4d37-9086-53e6c0fe0bc3", "comment": "Malware payload (Formbook)", "value": "d94fa0691553ea5a341a97d05819d33ec8bcec9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225540, "uuid": "aead0701-ad2c-4918-8967-a1817bec96e3", "comment": "Malware payload (Formbook)", "value": "d543ec1352c996b6bc3ed2281df168817bbf0372ac327f911c1f57a26649740fe17865e70c7d1b8eec0d364706aa529e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686225540, "uuid": "fc8b192b-f9cf-41bc-b840-4297d4616f07", "value": "T1E4E4092B05BC16E2C177D2B95FD4ED57F6D088967D08CDA986C24FDB3612A13209BC2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686225540, "uuid": "7aaffb7d-b453-4f6a-9fc5-122e508ba6b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686225540, "uuid": "ac0a9b37-e0a2-421b-9dd5-5618de8b6f4b", "value": "12288:X1bZZg95Lrk1gBhJfGDAWCbghPMtazTpaT2pjuu6nRzAk:X1ngHLrkKhJfUzlPMioT2pjCnBH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686225540, "uuid": "4404794e-1843-45d3-bc8e-477a0603ff82", "value": 718336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686225540, "uuid": "b50429d8-808b-4bbc-b3ee-44f06d237053", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686225540, "uuid": "0d517907-94be-4118-b83f-cf74df58a1bc", "value": "9f7df9aa07cfd95be6465d8234bae2a1332e7627932b0b345962a766a696212d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cfe4595-05c9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686207290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207290, "uuid": "6476b401-c8e6-4601-94d8-0a0b40ea9d0f", "comment": "Malware payload (Mirai)", "value": "991c3275b94ca844f48ebe037ed6df02", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207290, "uuid": "b70350f6-7136-4c25-983b-4740c6702128", "comment": "Malware payload (Mirai)", "value": "9f8802662f435dae26809300d8caa588e09a137653c43f0d18410158dcfe2410", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207290, "uuid": "5b2cbe61-3440-4f5f-bd09-7ad0eb206009", "comment": "Malware payload (Mirai)", "value": "8b9c319c563e9db126dca4b41f33fdb5b147b70f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207290, "uuid": "7198982c-2bb0-423a-8bf7-5c800f74b46b", "comment": "Malware payload (Mirai)", "value": "a60b25221ad5004cb87807e1dbf7c658b2267eb8f094943e2b083b2cb66539161fbc5d1eb32650ccd472453e357de84a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207290, "uuid": "5a1a1722-c067-45b2-9a2d-1affa68217b2", "value": "T1B9632A95BC819A13C6D122BBFB5E018C332623B8E2DE3207DD256F21778B91B0E77655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207290, "uuid": "f463cf6f-0623-4981-978a-bbc33a2a9d1e", "value": "1536:d3MHhzzgHtF5els++dWKuPRt5ncdSJ+09Q/eaoV00c3vk:JMHhzOey7u5bn/9Q/aqjk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686207290, "uuid": "1a4aa41b-eee3-47e4-aa0d-034e450ff561", "value": 71452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686207290, "uuid": "2c221bf1-b9cc-4294-80d2-992ebd0079d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207290, "uuid": "e2c5bfef-11ee-4ffa-a15f-2419ef0f6431", "value": "991c3275b94ca844f48ebe037ed6df02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dadc3486-05d6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686213084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686213084, "uuid": "d7162f7d-8891-49f3-b114-04019c927f99", "comment": "Malware payload (AgentTesla)", "value": "f51cf76cf938c6d32e888aeb20ca7e16", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686213084, "uuid": "5793b13f-a64d-4b77-a243-e9889780a46f", "comment": "Malware payload (AgentTesla)", "value": "9ff3cd3ff6bb45bd888b2eaeebef3aef2784182df2ef03449d435098166882ba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686213084, "uuid": "3af75b43-0ac8-445f-af86-fcbd5ca32cdf", "comment": "Malware payload (AgentTesla)", "value": "94a3f002f2aed6bfb35a555853bd313dccda59d0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686213084, "uuid": "e3c10ec2-301c-4595-b3d9-61d4ca5d27af", "comment": "Malware payload (AgentTesla)", "value": "49df44283dea4cc6efa986379e7a1e0c4863a6b28eec3047d15f903ded0d55a244e3d1c0eafd01dcef2d552d381a74c1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686213084, "uuid": "b931ec59-1d06-4653-86df-0eb0f36d859d", "value": "T19605010862FADB19E5BE7FF844D0A5B047F0516A7246E70A0EC378DE5E74B418F019AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686213084, "uuid": "cf744b63-3e7e-4a84-b1ff-001108c899bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686213084, "uuid": "bdf1572c-d180-4ff7-b720-0257130cf2a1", "value": "24576:yMOMsHlWxMiQW/O4ue7Aj82dNuUpnTo9Um7GWtv+:CxlYMiQWmS7W89MU9v7GW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686213084, "uuid": "efa18961-3ce7-4142-bc6d-eb640ff46f0a", "value": 834560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686213084, "uuid": "98605380-962f-4ebe-9910-4fbb27ec35f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686213084, "uuid": "e2add105-6d0c-493c-b2da-e39f1050fd81", "value": "Invoice.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41a8cdcc-0600-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686230866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230866, "uuid": "77d13020-eabe-4965-95b6-00084392faa2", "comment": "Malware payload (AgentTesla)", "value": "8435e86ee14c67d6fcb49f49fb545342", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230866, "uuid": "53cc0bbc-10f2-4cb3-aaab-64329f4b30ed", "comment": "Malware payload (AgentTesla)", "value": "a0e36e1304061d275a18be961c4c1360b54865437d29da94725c65b44b95fcb0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230866, "uuid": "16b9d623-0f66-4a21-bea8-a04edf646a66", "comment": "Malware payload (AgentTesla)", "value": "7a6cdc2bf771065c82e9726505a890b9b3bdc2ac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230866, "uuid": "7fc144ae-cd9b-485b-b353-fca2747557f5", "comment": "Malware payload (AgentTesla)", "value": "deb580b076a3791485fded23fb6681f2d4e2611e005eb98f0f58a37ba36f8eb3ff59c6199e2873e344d6ee04f95b9136", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686230866, "uuid": "9eeec464-490a-4e72-babc-5362d5201921", "value": "T1362423F459CB89EE2CC2423160B974137EB15683E363EE44086F7417DD8C9E713A5A76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686230866, "uuid": "e84c2c32-1ceb-45be-a2bf-1df0793a8343", "value": "3072:znIfh3wB6fz4Qr5XPrGsGDysO+Z7dBqBW06LPNAkLmV+D6s6csvbuk:rg3o6fsQJGsoO+Z7dQcBxmVGx3abuk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686230866, "uuid": "7a4a6fff-c1f4-42c5-8f30-9138698d4ac2", "value": 222524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686230866, "uuid": "9a60dbb0-dbe6-488e-b811-1bd3be98c93e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686230866, "uuid": "42c42c7f-fdf6-4653-9817-237a6d0e17bf", "value": "Quote SZC 10219 R.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5cc1db9-0607-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686234067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686234067, "uuid": "a95fe268-5c7f-4f7c-9841-c0e48822f711", "comment": "Malware payload (RedLineStealer)", "value": "7a31f8c94dba9e51b15b1745a231276f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686234067, "uuid": "41e67851-8524-4d02-b2a1-0e48807c8fb9", "comment": "Malware payload (RedLineStealer)", "value": "a14175927d8c630b1d7a747aae2b6ad1918d84f7c03f67ab513cbbeb352d8de9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686234067, "uuid": "cb6cc1d3-ae57-45f4-a175-9b0becaa8647", "comment": "Malware payload (RedLineStealer)", "value": "387ba294c8b282996947672d5b83f72e716e07b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686234067, "uuid": "c2c307ff-223e-42fb-9077-2f9e223df037", "comment": "Malware payload (RedLineStealer)", "value": "92f5b59b6ff3d6a9d7a2f5b415693a56b93879ff62012dd5e49aee02313725a28dcaafc53b466b4e1c92c366d2acd671", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686234067, "uuid": "6c3877db-3174-470a-918a-f23db06a3aa9", "value": "T127D41246FBE84032ECF62B7048FB03831B36BCA24D74875B37456C9A0EB26956935767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686234067, "uuid": "483055cd-74ee-4325-8416-8b730be5c623", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686234067, "uuid": "dbbce5ff-126e-4f11-92bb-246bd12f80c4", "value": "12288:uMrsy90RwKKH7nAwvlrxoGyhEi3pUtZuxHFQZ/cq2xavSzOdGLPXy5sO:iyrH7DHWEUqKFQZ01AvSzkGNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686234067, "uuid": "9242db0b-e0b9-41a0-af59-5b8f3fa859f2", "value": 615424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686234067, "uuid": "c2cbce00-eadb-4f71-8ea0-adc797b4aa00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686234067, "uuid": "07e88f04-8a66-4e1c-b432-981df93f892d", "value": "7a31f8c94dba9e51b15b1745a231276f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3717134c-05cc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ModiLoader)", "timestamp": 1686208515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686208515, "uuid": "f5c31ba7-ef4c-4e8a-8aa0-f6bbc1439bc8", "comment": "Malware payload (ModiLoader)", "value": "cfe0a5ed578441217dcbe804f7890d73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686208515, "uuid": "875e4559-f831-45eb-98cb-67447302c758", "comment": "Malware payload (ModiLoader)", "value": "a1eaefe2af9f5f3580e4aa4032aa6ff8caa5ba4317c3ae7f33edbcbad7f9397e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686208515, "uuid": "bb8b3349-8131-45bc-8f58-dc8e30a3f963", "comment": "Malware payload (ModiLoader)", "value": "a302fad4ea30b0f8de1118c8cadc71b06208da99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686208515, "uuid": "02a8ce72-a24c-4989-b6fd-dd4323c3098a", "comment": "Malware payload (ModiLoader)", "value": "98964beb92184d5104c5bc0252c3e5d2e4509bb73683e7cd8dca815571151079cc138d6e955e024682fab8e36c467837", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686208515, "uuid": "99160c03-24d1-4746-bb39-7341c75ad8d1", "value": "T13115C026B1A01873EBA61676ED2F2374D839BE541F1C98B96AD43F0C6F3424578242F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686208515, "uuid": "20df84e7-b456-4d29-8303-51712f7c96ff", "value": "56b9ee34a3c873bea4afe3c0ca147de8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686208515, "uuid": "d143c752-65c1-4fc1-abb8-c0a155538c6b", "value": "12288:l/AeU0+lRGAb9ROvbNuMmUn/LR4q8M+nqwtv07f1O9noM5:lIBljROVrn9J8M+nqwh07I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686208515, "uuid": "b789da1c-05ef-466b-b089-d996ecee56e9", "value": 926208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686208515, "uuid": "cc55017c-187c-4c67-9f69-dba904f0cc00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686208515, "uuid": "388075ea-3173-45b6-9b99-e75006417b84", "value": "order z.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d447dc4-05b2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686197465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686197465, "uuid": "f4c1ba76-32a2-46e5-8858-eb4d8862ae1a", "comment": "Malware payload (Amadey)", "value": "18087019ffcd53306a3f70fba03d5817", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686197465, "uuid": "b7343b9d-adda-4b73-846e-ecd8f9f2f5f8", "comment": "Malware payload (Amadey)", "value": "a26e3efe10db4a9e3edf399d14392bc4657d866d0aed148463b7477043773b3a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686197465, "uuid": "e23a2ce4-232a-4f19-b1c3-ca7b164e90f9", "comment": "Malware payload (Amadey)", "value": "cf79c8b286177587f00b32480846743bc6fe65a1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686197465, "uuid": "de505391-45c0-4c85-9cca-51f86a6e2696", "comment": "Malware payload (Amadey)", "value": "7c022b1cd2671fa7cd4dd3377870d7addb7c0a5d79489249748a7dbc8eb6e7f81c788f0fd8868c1489a3e952f57ba8e5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686197465, "uuid": "fc072441-d447-4c3a-a22f-0e80ad906a17", "value": "T1F0F41253F3E84432CDB8577015F713830B34BCB69D7986676392A86E1DB2A906931B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686197465, "uuid": "183e11bb-346a-45be-9159-e0091f41bc09", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686197465, "uuid": "b2bdcb4a-e925-4854-ae65-0fe0b25d4279", "value": "12288:ZMrcy90Hh1a1jD7n4HJGYA5hw4W3aQyLAnufaiK6v0KQM4fmpe0oTI:tyora1z8ZA5hJ+aaiK674fmo0p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686197465, "uuid": "ec8c42b4-8364-4ee2-85af-b1886bd6707d", "value": 770048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686197465, "uuid": "adcdd89a-b0a7-4b5f-bc0d-6b45af7cd358", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686197465, "uuid": "d3e4dc71-a16a-4fe3-916d-47608497b887", "value": "18087019ffcd53306a3f70fba03d5817.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24eb2604-0593-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686184003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686184003, "uuid": "2dcb7ddb-cf69-42f6-9236-f1b4db8986f6", "comment": "Malware payload (RedLineStealer)", "value": "de07e78a240f89170cda1c43a350b028", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686184003, "uuid": "375bacb0-7da5-4838-a419-67337265a1ad", "comment": "Malware payload (RedLineStealer)", "value": "a277a655e200f7cad165bd15bd93917b97364d2f5b2c30fe67acc80a0b487690", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686184003, "uuid": "c614a5f6-a489-4b8b-8c2e-097f1519c4a8", "comment": "Malware payload (RedLineStealer)", "value": "7e3cbb973a8a736eac503c825d0f277472775ace", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686184003, "uuid": "10a1ace3-c255-422f-b6d8-18e606b24c53", "comment": "Malware payload (RedLineStealer)", "value": "954e8d16597f4c3a80280b6f70c63275d6dc4eb75db669a211b85778d917fb128cac05ee19bb2ac9a72fc752a96414c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686184003, "uuid": "1b1c48ac-53b5-4ebd-b963-a2a658976759", "value": "T18F54480237C68CBDF8AA073D60D48F3DC877ED60165464FA37A89A618ED0313959B5BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686184003, "uuid": "942ed869-3ced-49a4-8d00-c2f8f83832d0", "value": "f264906d4975bf1277da66f2124faba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686184003, "uuid": "b23176a8-345a-40ef-bffa-024181948332", "value": "6144:rQvoWvJfoZuwvTygXUNVS4MGh1aBFrvz1xcxcWh9rt:rUO/yR1aBFrvz1xcxd9rt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686184003, "uuid": "8575b540-2338-49a3-b5c3-f025487178c6", "value": 288901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686184003, "uuid": "fce7cdc0-32d6-4f67-a1ba-43003fb0c013", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686184003, "uuid": "f137e381-0c51-4ac9-93c3-ffa189c4f17e", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46960cae-05c1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686203816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686203816, "uuid": "b4669bd2-ebce-4291-bdfe-8e6dc766504a", "comment": "Malware payload (Amadey)", "value": "eeed9b9b988f46dfa390eadea99a776b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686203816, "uuid": "d59e9ca0-8f11-4977-8699-e1ef528bd037", "comment": "Malware payload (Amadey)", "value": "a2f602e8ced3fd3e09cb5079828c05e9cc93a43ce83aace21c46a3810f72c665", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686203816, "uuid": "404517e3-eace-495d-a1b7-7e255e07eb69", "comment": "Malware payload (Amadey)", "value": "b5aa537d708fc85718bcc7e6f313b34658dba25b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686203816, "uuid": "d78a1373-9784-41b1-9ed7-e15c2ccaf183", "comment": "Malware payload (Amadey)", "value": "7eee68b3fa0432bd7fc5ee08e541ec4f23de7a5bc09907d04bcb07f425b1bbe9ad25287673493fdcf393b2963d850a49", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686203816, "uuid": "ed304c7d-87eb-4ccf-a10a-46fa76e07a35", "value": "T1A424F7257D12C032D56061B619F5BFF2C59C6828ABB049DB7B800F77DA122F73A61E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686203816, "uuid": "7df722a8-2587-4291-8152-5054d9d49c74", "value": "f8cc61ade86cb7277d0ab974de6323cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686203816, "uuid": "b698941e-9d55-42e8-b98a-b3ff8e8ad675", "value": "3072:H/DmgskHbfHN+Pst60p0zuNmnKG7peNMQbuZAIqbey3lfbi:fDmfAfHN+wiuInRexuZAIij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686203816, "uuid": "581687dd-8d00-47fb-b6f3-ec500c987710", "value": 212883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686203816, "uuid": "bf26728f-ea41-4caa-8cf1-e92b82ac9464", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686203816, "uuid": "981423be-6584-4e73-8bff-838e9d962178", "value": "eeed9b9b988f46dfa390eadea99a776b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9ad17b7-05a6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686192386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192386, "uuid": "ee9f423d-e012-4acc-9417-a9914d32d94d", "comment": "Malware payload (Amadey)", "value": "3c32a908066e3cbea340713904049e32", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192386, "uuid": "8c8d27a8-c73c-41d4-ad31-f4c87c46333d", "comment": "Malware payload (Amadey)", "value": "a311cbe483c50532d5ce8b62abb9b10905546acfb05ca48992a29dd9532e1f51", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192386, "uuid": "b24c9927-4c06-4d2e-86b9-5b96034a4110", "comment": "Malware payload (Amadey)", "value": "078217fe7e4330c1d5cb55dbea89b7c21c6798d5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192386, "uuid": "12217783-e8ed-44d8-b341-c53b09ad229e", "comment": "Malware payload (Amadey)", "value": "421d2a040aae90a879ec8219c4bd2b36b06122adbe1635564e98fe22e8a30c0b6ec49e695aa9d90824638fc8c05bd619", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192386, "uuid": "8867234e-3d82-498e-a987-76662b6bb245", "value": "T12CC41217FBE94432D9B82B75A8F103871A32FDE18C74432F2A45655F1DB2684A83277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192386, "uuid": "1a9617fa-fa7a-4c40-9e06-a78519990619", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192386, "uuid": "7209330c-2b84-4acf-bc92-fc5d307ea151", "value": "12288:jMr0y90/CyxWSOARRMAOxJXek7GZfvO9qeTGCXFiFyni/TE7saN:fy0CyTUFek72+1rnibEgaN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686192386, "uuid": "17567853-fb0c-4540-a2f1-1590bf8bc48e", "value": 591872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686192386, "uuid": "72c98c16-d634-4b2a-bd1c-39cdd82bce39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192386, "uuid": "b38e2c91-f565-4693-a152-d6b32ccce273", "value": "3c32a908066e3cbea340713904049e32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c76addd-05c3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686204712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204712, "uuid": "0bd6bde0-3989-4cd1-9522-8d0ae76d601b", "comment": "Malware payload (Mirai)", "value": "25f4df8d4d0183610293da4b512a36d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204712, "uuid": "f6a81d47-0f26-4c3a-a1d7-b5c631cc8023", "comment": "Malware payload (Mirai)", "value": "a335aac1e1ff9aeadeb1a0af90c37dbac36fc813d2e15c83df892310fca20af3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204712, "uuid": "08c65035-dcd8-4fe7-9dca-a8e819c4b324", "comment": "Malware payload (Mirai)", "value": "1a1c71e11c5e59ddc2d56a4e3eeeda5ab8f20bcd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204712, "uuid": "cfd57c51-b480-484d-bc24-3b7491674c42", "comment": "Malware payload (Mirai)", "value": "11e9c67fa89d82330e36563b2fa18f282b183b3e164fa066627d4052524bcac8d2e3c2bddad9a39be78c137fe9d65f96", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204712, "uuid": "01db11a2-256d-434f-8736-aaf42a46b05e", "value": "T13682C023DD848C16CBE576BF8147037FB2D22CC69FE676590170A6626CB8163249AF53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204712, "uuid": "2546ffa2-1ec3-439e-b6f4-348bb1b1a7df", "value": "384:dOibkM6XlvBLNaDStxwTNjoD+vA/PjjDW2ka4du5n:dO0kM6FjaDScTnI/PjjNL4M5n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686204712, "uuid": "b6eeb191-102a-49b1-91bb-4be64ee24144", "value": 18160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686204712, "uuid": "ddaee334-ac4e-48a2-979f-2918947e76ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204712, "uuid": "9ab29be5-9cd7-4c4f-b457-042637f798ee", "value": "25f4df8d4d0183610293da4b512a36d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7870815-0621-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686245345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686245345, "uuid": "d7b9da3d-36f0-4c22-95da-8f2a5bafeded", "comment": "Malware payload", "value": "dd30110000f4eb79f048adbf7e107613", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686245345, "uuid": "fb56e95b-dfb0-4711-92fc-1fa2d77ea1cc", "comment": "Malware payload", "value": "a34e7e55590805d831aa12016560c4c4087e2d2aeb3f390e97e4c8fd2becbe19", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686245345, "uuid": "5bb2a10e-3729-4d27-92c1-49399c397861", "comment": "Malware payload", "value": "3964ab3bd85fc943afc04b311cb5e0523ea1e342", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686245345, "uuid": "967e1155-e8d8-44c7-a768-1a69b5c9a893", "comment": "Malware payload", "value": "170908b54e49c911f549437c79198cc2e3abcf8cc5d6587b07ff605167ad0598a4641a027780106144079cf2fd87afdf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686245345, "uuid": "a4a64f63-7d03-4b03-8143-a238aed4b058", "value": "T1C8F2E169826700FAD2C291BE465DE7003E3C5FDBA876DD4936A1FAC69F032B0E4127D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686245345, "uuid": "119b69f6-5b0d-4f52-ba1a-14a19fe73b04", "value": "768:2xDoIF4MqYZARntl54BnI7vzd17fgiSBOtrNNX2BHQyJgGlzDpUYsA:2CIpU56gvzjgOtJNGBHQ2VqYT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686245345, "uuid": "19c99c91-d37f-4ca6-adf1-a1706929b0b0", "value": 36392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686245345, "uuid": "860dcbb0-9266-4053-9a10-9dcd6054b0ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686245345, "uuid": "da792a0f-1cb2-4c1a-a276-434095cbb40f", "value": "SecuriteInfo.com.Trojan.Linux.Mirai.VYV.9577.17075", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a08e7b9-05e9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (zgRAT)", "timestamp": 1686220975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220975, "uuid": "8bd0256b-8c50-474e-8d7a-8e9775613059", "comment": "Malware payload (zgRAT)", "value": "e6c46ff40eefcf4132bc2cd0251a9a95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220975, "uuid": "5d3b7173-34be-47ff-b81d-9a8443e33e7e", "comment": "Malware payload (zgRAT)", "value": "a362a0ac0490aa37a4b86f9377a27ca649a69f0489a012926f4168ab68cbdc92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220975, "uuid": "a7d1b96c-5c55-43d2-ad41-e1c779249617", "comment": "Malware payload (zgRAT)", "value": "6072405b29ccb89474fb84e12dafddd62ab0b7d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220975, "uuid": "76b01771-09e1-456b-ad7f-633ba12bbc38", "comment": "Malware payload (zgRAT)", "value": "d802e4e3184d9cb3dd2be163a3b819723447a2a9c3706e7a3c2efe957a009255ed1787ecbb13aa03e714d82a9a9ccd52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220975, "uuid": "e0ef257a-e5f4-49cc-89db-4aa7bc1687c7", "value": "T13E05126AB6EAC316C1545235D0E3052103F9CBCB39B7DB4B794A13A71D12FE4AE41ACE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220975, "uuid": "240ee53b-d7ab-48ad-a272-4029ddf4fe0e", "value": "24576:NRq/uegxfwkKJZRlkDygkbBUcdz59zryrHX:L7eo0Zfkm+cBUX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686220975, "uuid": "ca1de084-b63b-452d-934f-de7912215920", "value": 796672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686220975, "uuid": "4a5e0b6b-afdc-45fe-a4b7-88b1effacec6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220975, "uuid": "2a3b1da2-dd81-4a38-b59a-51a81cd0feee", "value": "a362a0ac0490aa37a4b86f9377a27ca649a69f0489a012926f4168ab68cbdc92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f51cb32-0619-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686241707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241707, "uuid": "484d4d4d-8494-4f0d-8083-ece00eac14d2", "comment": "Malware payload", "value": "708a713dd89c2bf91728c6bcdb3639f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241707, "uuid": "af6b3eac-5f44-4fa5-9516-a7e5663f1b50", "comment": "Malware payload", "value": "a42e197824c26a18a48488653d2a9ae0ba09f15daf44187c1e7cc47907cf477f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241707, "uuid": "519f1a24-0cdf-482d-a1d3-471c610678ef", "comment": "Malware payload", "value": "c414b739677503ed3cb1769c5e88762e1fd2ac80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241707, "uuid": "63232803-84e6-4ef4-a6c3-9bcd3f1ada4e", "comment": "Malware payload", "value": "f9848b85cf2a2ed0e5ea267c6f3f6674c70a893157a06bdccec7037023a629cfe6d2ba6c54d8232fd10381ff68cbb6e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241707, "uuid": "fc345b78-f847-44f4-a46e-e9b097ccd2fb", "value": "T168F36C10BAC94162E4F721358FB472269B5A78712FB090CFB48C98CD67347D09A7E7A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241707, "uuid": "ffd1ed29-9945-4a9f-92c0-62061cd2b9e6", "value": "1c0011ae5416a1054e6ecf68ba70f94f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241707, "uuid": "2d961ddf-b3d2-4208-9554-9f0303e5c4ce", "value": "3072:e5DM0uKcF8JOSTBfFKROTpx+GU1x+DnbWeZ:pVjSTBtKROTpx+GUD+Dnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686241707, "uuid": "5e03a7b3-de9e-4acf-a9db-d6b88ade463a", "value": 158720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686241707, "uuid": "a55bbc35-0522-4b7b-a3ac-265de55400c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241707, "uuid": "145b56f0-efe9-4089-b5ee-1ca44c263807", "value": "SecuriteInfo.com.HEUR.Trojan-Ransom.Win32.Encoder.gen.9689.345", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14f2a88e-05dd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686215759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686215759, "uuid": "fbec8bb4-7f10-4fd6-b1cc-4c172fa5470c", "comment": "Malware payload (RedLineStealer)", "value": "edf0c3327dfdaf3e8bec140ff9627e32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686215759, "uuid": "20061e39-fcfa-434a-957b-91df0ed60e94", "comment": "Malware payload (RedLineStealer)", "value": "a460368fac0a3d1404988860cc8e9a151fa63ef6be02cd1d327853e4f3da4ecb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686215759, "uuid": "48972550-28b4-48dd-9fc3-992b4b88d234", "comment": "Malware payload (RedLineStealer)", "value": "8c268955e6a6a950f323ddce7a0ead95c4e1666d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686215759, "uuid": "19d7b2ca-39fc-472a-b3eb-a3df04921a55", "comment": "Malware payload (RedLineStealer)", "value": "506dbe4265d05564cc5fae6b5d17a0ee0797ad412572e0729489c9c83f5dd1bf362c978fe843c035f69dbbf95f73e7b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686215759, "uuid": "c00eab50-f7d3-4d2d-a40f-b73bca48fda0", "value": "T150F41262E6E88173E571577164FA03831A32BCA19D7863AB2711989E0CB36C0F47677F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686215759, "uuid": "e181ec08-156a-4750-92c0-8efe226c9359", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686215759, "uuid": "02691bd5-b852-4297-a5d4-e64a995b6651", "value": "12288:pMrSy90pDbSgrgB0IUTdJ4eLPJX5gCbHcvTIxBdFbdm2SQiGHg2EM6m:vySS80Uz4E5gk8ULo2SLEg2E6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686215759, "uuid": "eb96fd64-b189-4e8b-8ae2-5f20d3850cec", "value": 791040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686215759, "uuid": "77634432-fe6d-4a3a-81ab-1bb3d9316b42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686215759, "uuid": "62cb457a-934f-4aa7-b6fc-29a9e48236ee", "value": "edf0c3327dfdaf3e8bec140ff9627e32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6d8f51b-0609-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686234928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686234928, "uuid": "36868462-7d2e-4973-b84d-5a2041c4b91c", "comment": "Malware payload (AgentTesla)", "value": "8fcb61050131568e07e6b9e0aad5ded0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686234928, "uuid": "b29a7568-bc34-418d-a7bc-b98908417635", "comment": "Malware payload (AgentTesla)", "value": "a4d917b6696ddef08d0f4ea5a2dcaa8de85e639684a5f869e353c2c80315e2d7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686234928, "uuid": "36428d56-4039-454f-9725-518315f9c397", "comment": "Malware payload (AgentTesla)", "value": "2de79e22e26c6b8873684c475f669e1ecbc80727", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686234928, "uuid": "d11be8ac-9373-474a-b9e8-3ffedae34465", "comment": "Malware payload (AgentTesla)", "value": "2c91bb63997e2466d907cfaeb7e559bdabca4c28f264322898b04a152033a21b6de0f257f254b2ddf6ee36184d5f5308", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686234928, "uuid": "40a41480-229a-45c5-9cf0-9d1ff245e0a2", "value": "T100F4F11B36FE061ED6AA7FB818310170C6F86E477162D34A7FC6799E8CB1B450A806D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686234928, "uuid": "50b3b604-44b6-4c34-88c9-427013ce6cd3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686234928, "uuid": "e97b1b93-dc58-4447-978d-7eac733b2407", "value": "12288:rTu3as/16/YHmM9mARLAV+/33O2+6M0RvND4Ti8cQQxcRiLKyqniEqNx:njs6cV9mA9ImnO2+61NrCvi2yqi5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686234928, "uuid": "86c35262-16c4-465b-b7c4-a3d29646c4ba", "value": 769536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686234928, "uuid": "6e558206-a4af-48dd-a451-81d8330821ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686234928, "uuid": "8acac5f4-7590-4055-a04c-a3d941008f4d", "value": "doc20230706#USD13653.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20699a86-05ec-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686222220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686222220, "uuid": "09f46b8a-f70e-4040-8d68-5ac5f5a60157", "comment": "Malware payload (GuLoader)", "value": "78a14bcd3b2a961319a19b2bf2ae0d6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686222220, "uuid": "d8f39c0d-51d7-4871-9909-18c8d3025264", "comment": "Malware payload (GuLoader)", "value": "a537283e652fc63c91b592a6c5a7cbbb286da7fb6c8dbe9214bdfbf150cc995d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686222220, "uuid": "ecddabd6-574f-4052-bb68-895e852d062d", "comment": "Malware payload (GuLoader)", "value": "5580c9b82bd82e3e904535b94cb046ef4ff46d6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686222220, "uuid": "6e5e0f1d-7b7d-4239-88bd-ddc6924d4180", "comment": "Malware payload (GuLoader)", "value": "19b65946bfbe1450767516ba6b5ae92cbfa99dad07e86138bf6e48d8f666dda445a9bd49f5c74e5ad98fe04c93ff55dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686222220, "uuid": "97edee28-cc6c-4ac1-93bc-bce134f6d4f7", "value": "T1E564CFC3B68191EBEDA20D30BF1F85E71A92BC79D4D05B4BB374733A18D1532620B65A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686222220, "uuid": "f0fdbe39-05f5-4c1a-b1fb-1e9912c117f8", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686222220, "uuid": "db7a21f8-90ba-454b-96ef-8ef88f87f7b9", "value": "6144:fQ606x5wOyFNKvLOsI5H8T/87vV7HlZ3vYZawHox:/wDSvysI58/8x7FZEox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686222220, "uuid": "91c51c7d-a2d8-41b2-a7d7-dfc31aafe951", "value": 328432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686222220, "uuid": "d49b8dbb-1aed-4077-8c2d-2824f7745dfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686222220, "uuid": "e8eb8d57-3119-4ff0-81bd-1fea402d87e3", "value": "a537283e652fc63c91b592a6c5a7cbbb286da7fb6c8dbe9214bdfbf150cc995d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b339ccd-05a6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686192362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192362, "uuid": "4ba3f6ec-7c77-4490-b9d4-387be2c57b05", "comment": "Malware payload (RedLineStealer)", "value": "3b753de9856aad70a6e89de6aea4bed7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192362, "uuid": "9364d140-5e64-41f7-bb1b-c600ae6e95f9", "comment": "Malware payload (RedLineStealer)", "value": "a58bbb64e7d6e16037aa141b1790c0dd7578281010c69185581f179bf9fbb7ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192362, "uuid": "8c0b0da8-523f-49ae-9190-49bbb3c8f85f", "comment": "Malware payload (RedLineStealer)", "value": "9d822fb07294ad7618365388367045f3e7bb5478", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192362, "uuid": "e58a05a9-a5e1-48ae-a869-eeecdab6532a", "comment": "Malware payload (RedLineStealer)", "value": "f0bb4e6a4107c7a7c94992c8f97242b65a5b555a12ae8ba294d025ac02e905a3a2a302085efd99bda57fe4d0a6548d3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192362, "uuid": "a018b0ed-0171-423c-8fb8-2817d9cf9c37", "value": "T164C41213A7E99476E9F50BF024FE03C30A35BCA55974432B37129C1B0EB2A94E87477A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192362, "uuid": "92bc4c90-e0ea-46ab-8af0-37306442125c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192362, "uuid": "7a26d9c8-4740-4534-9927-7d83deff1dc2", "value": "12288:OMriy903YkfnoFs0JkTKaM2BrbTSsLec8V6pj2gkO2C:Ay4gW9KmB7SjV6pKmz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686192362, "uuid": "18ff15d9-c380-49e2-873e-f532c952469a", "value": 590336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686192362, "uuid": "2c19db1e-ff11-40f9-84aa-5486d83db589", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192362, "uuid": "a561aade-429d-4d53-8aaa-b91b191e68f8", "value": "3b753de9856aad70a6e89de6aea4bed7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe0741d3-05e5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686219586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219586, "uuid": "cf493f7e-33de-4b71-8d84-b2ef43b7c191", "comment": "Malware payload (GuLoader)", "value": "23205d2e4ddfdd601a7dee48eabbf61a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219586, "uuid": "938dea54-ab72-40f4-853e-f2198e6360eb", "comment": "Malware payload (GuLoader)", "value": "a5af3b1b785e6572862fd1bfcb7fa786c94e9701c0a6f5862432ea880257e983", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219586, "uuid": "1177a0c8-4e94-4ddf-9037-537dcb509130", "comment": "Malware payload (GuLoader)", "value": "e4376a3dcaee025625931dd9bd5bf7ce361245c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219586, "uuid": "3064fe61-1200-4dc1-b64e-7a822e6fb18b", "comment": "Malware payload (GuLoader)", "value": "353fe16501aa0f9c5adf34af9fc0a07952fc0262796d2a99802a4c64bf184c10e15a3743fb40b77242874eb7d0907898", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219586, "uuid": "d2d43640-e586-4b39-9cec-871b79b49a7d", "value": "T182A4F181219CCCD2E5A8FEB4E87655F119B49E0ED0F4513F82B6BE26B4F5201A77E10B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219586, "uuid": "37674c08-9997-4849-a3cb-5f0f9b2590ab", "value": "24f4223e271413c25abad52fd456a9bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219586, "uuid": "9f8c7d89-d7dc-4cca-9eff-705a62746b6f", "value": "12288:WDu1s+hQ2GgG+xoJbhjdKDUJRz8rTnMcAq7btyJb9eHqhZ6OqLLGvOuVqeiwegxm:WDu1s+hQ2GgG+xoJbhjdKDUJRz8rTnM0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686219586, "uuid": "958287bb-a667-4b63-96e7-2bd20f52806e", "value": 484448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686219586, "uuid": "4314fc77-5002-43c2-b031-583805f7cc00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219586, "uuid": "3fb8d3d9-d0ac-4653-afa7-660e1042e0be", "value": "a5af3b1b785e6572862fd1bfcb7fa786c94e9701c0a6f5862432ea880257e983", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c196cf11-05dd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1686216048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686216048, "uuid": "16c4e2be-d510-4ff1-b661-efc7004be5c4", "comment": "Malware payload (RemcosRAT)", "value": "7e59937dcacd711b717c66c93b90e398", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686216048, "uuid": "6bf8f1a3-2256-4600-9da4-b6af135b04ba", "comment": "Malware payload (RemcosRAT)", "value": "a6ab84a16ff322997f35be4f417d8989d66fee60fa075477892e14b5c631ffd2", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686216048, "uuid": "43a4a734-2c99-4f3f-af93-6a76b2ac3c4f", "comment": "Malware payload (RemcosRAT)", "value": "aa234257efec0d8e3aed263c657ffb1b5100c293", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686216048, "uuid": "84f82f6f-8173-4900-8278-db51e1dcd3e8", "comment": "Malware payload (RemcosRAT)", "value": "a5cc3dfa8f43656d45ea09089ea20ae4ff0d457028c229b53b4afe2d6df70e503d34441dbf3b364bd9cc5850d9d13991", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686216048, "uuid": "f33a746b-27f3-4e0b-8faa-fb365f7069ec", "value": "T172B2E6565B8C4C61E26AE8BB835DE00E19BCF23631C215D4BD9CE2743B7D14E0B6B1B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686216048, "uuid": "6597a085-6a92-49fd-941a-4afc1fe7661f", "value": "384:a7OchXQ6aiiSYxXux5JZQT+48EA03XDN6XFwBzxuLvFBnydxF+ZPWuErxuwpeY/7:a77q6PCuxnw8AXUXxv7nBErXpeYelV4n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686216048, "uuid": "b05019f9-5fea-42ac-a04b-12a5304e9c88", "value": 24250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686216048, "uuid": "41ae1cc0-70a5-433d-81a0-83d8437137c6", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686216048, "uuid": "6cfa1774-76b6-4688-8fc6-2903d6c9e515", "value": "fbfbfbfbfbfbfbfbfbfbfbfbffbf####################fbfbfbfbfb.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "228a289e-064e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (CobaltStrike)", "timestamp": 1686264315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686264315, "uuid": "da67c436-31ed-4936-b239-5a640afeae7e", "comment": "Malware payload (CobaltStrike)", "value": "110a8c9bc0b05658197940b691361b3b", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686264315, "uuid": "6016159a-4cf2-42f4-b866-f85c7dd5fe14", "comment": "Malware payload (CobaltStrike)", "value": "a702f08fea420c2cd59729219237cdc186d3c9a0298f637c1f1a5a015c3ca268", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686264315, "uuid": "adfd19a6-472d-4494-99b8-06f2ee6ae105", "comment": "Malware payload (CobaltStrike)", "value": "bb7e8b4a39cc532b78048ec7e0028c556615dbc4", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686264315, "uuid": "b6340a12-7368-4b33-98cb-abad81e294f2", "comment": "Malware payload (CobaltStrike)", "value": "85940a0810391106baa5c71b5107d86a4f3688328fbb316dd78b8fdb3ea629c09856cab863de288eeb50262fa47c585f", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686264315, "uuid": "67bbeb69-985b-4bf9-8f9a-ef8b6093d331", "value": "T161557B4ABCE414B6D5E9D3328DB501917B30F8591B3237D72E15A2B83FB2BD41A353A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686264315, "uuid": "9d7094e6-9231-407a-b3c1-13c0f42403ad", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686264315, "uuid": "c07a6b9a-f264-476f-8c47-f64b2ac24c3f", "value": "24576:K38Zd8JUeDAtRpW8DPugy9bNmg0uN4yDF:K38H8JULtjWkugyNh3DF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686264315, "uuid": "f4606d45-2936-47ec-9f93-1381344425fa", "value": 1399808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686264315, "uuid": "5c5b4146-749f-43f6-94ea-10dc42a3204e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686264315, "uuid": "55b919ca-5343-4152-aeed-62ab8e3579cb", "value": "110a8c9bc0b05658197940b691361b3b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa9e2a27-05b5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686198964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686198964, "uuid": "1d07aa42-01a8-4026-b3f7-34d0bb4cff90", "comment": "Malware payload (Amadey)", "value": "bfcfb45e9b4520f8426f9644c824d754", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686198964, "uuid": "94a19c18-dc00-4445-afe5-ab191c7786e2", "comment": "Malware payload (Amadey)", "value": "a7effb59980b70b29a2658ab0644081b2fc09cbe6df21a986b478a7256107f2a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686198964, "uuid": "cbeb2123-a235-4268-9720-75c8c905c886", "comment": "Malware payload (Amadey)", "value": "33113504dfa7fee76fd4e1a271cd4648fe8b8c5c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686198964, "uuid": "4d04e725-dd88-4fc6-aba1-9adac31c031f", "comment": "Malware payload (Amadey)", "value": "cb8fa117c00482591a4d093b33ccebd393c0777ee3ab3a514b675a82a71c630fb546c5bfdfa86000833b1ba0ba30e9fa", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686198964, "uuid": "a1e637b1-c97a-4989-83ca-f26286822164", "value": "T198F41213BADD4933DEF52B7098F213C70B317CB18868875B278A690A5CB36C1997176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686198964, "uuid": "1f3724d3-208f-4f47-a181-97f97cfc9525", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686198964, "uuid": "5f7fe100-ff29-42f3-a991-670119758885", "value": "12288:EMrvy90FUfUD5D3JqLsYc+JGz3/MeUS4ppZI141oO3ITPMy1dM3vlmzqUpa9MO5f:LySlpZqYJPM5SGZ34zbg9l5v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686198964, "uuid": "f86fe40c-0a61-4c51-ad5e-13a3620b6497", "value": 771072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686198964, "uuid": "2d3c8c10-3fab-4bcb-a314-8fd07c03b250", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686198964, "uuid": "9c0c8bb1-5eea-410a-80a1-8b17945fed77", "value": "bfcfb45e9b4520f8426f9644c824d754.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d34d0550-0602-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686231969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686231969, "uuid": "a25773d5-3251-497a-8837-372cfe71f3f8", "comment": "Malware payload (RedLineStealer)", "value": "609a34e3e22e8369fd2986afc2cf9936", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686231969, "uuid": "6b009927-631b-49db-ac66-6253aa904f11", "comment": "Malware payload (RedLineStealer)", "value": "a89559a89374f23ddfc5556dedaf72e1b841eb652b96bd060be855b192e0b893", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686231969, "uuid": "5a25a6dd-2c03-4b0a-a0c9-d0e996053f3a", "comment": "Malware payload (RedLineStealer)", "value": "c9594970d7e698b97c9b21b7300d298bd745a906", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686231969, "uuid": "367c6e94-903f-47dd-9677-d4f06fa79c72", "comment": "Malware payload (RedLineStealer)", "value": "52d4a9b32ef442537305bc3bee69d9e9fa0592bbdafe1cd8905185484e3243f1eaf47cef865ee8b7cacd651d831e5def", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686231969, "uuid": "3969132e-5d43-4dcd-9779-8d8085cf01b2", "value": "T148D41243FBD48037C8B0137058FA13430E3A7CA69D64936B3794E9AA5C33699A636777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686231969, "uuid": "ad2cc289-fb93-4a67-8a71-a8bc97e2f30f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686231969, "uuid": "05167f03-0f74-4711-9658-33822203aaa6", "value": "12288:pMrxy90yOSf9rwBN3Nzt1lMtVmEqVQvTjeGNo9Js7lNkmaWMKen:MyLOiQRltHfevTdG9Js7/+Wxen", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686231969, "uuid": "e22d63a7-4edb-4dc6-8a4a-9fd6d72b39ff", "value": 615936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686231969, "uuid": "a3c32bfa-380a-4c40-ae16-a2bc1709cbe5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686231969, "uuid": "406f607d-0474-4f33-9feb-fa0f311de844", "value": "609a34e3e22e8369fd2986afc2cf9936.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a63db216-05e7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686220297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220297, "uuid": "cf898dfa-7f10-465f-83a2-2fc186da2202", "comment": "Malware payload (AgentTesla)", "value": "aeb5aec0cabfdad17f8e2804db8f2e32", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220297, "uuid": "3656e622-c1c6-4248-9ac6-d057e8518c32", "comment": "Malware payload (AgentTesla)", "value": "a8b37953e55efbe21f59764377b1c523a1bbd65af57bb2cc74bf18f727bfbd9e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220297, "uuid": "7cf94b64-4466-4689-b0dc-5fc62749b4ce", "comment": "Malware payload (AgentTesla)", "value": "31cd644977d90a8a060886aee8de0c880d6b3ba7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220297, "uuid": "b5eba2db-636d-4ea0-8ddc-fb18bb5f3db5", "comment": "Malware payload (AgentTesla)", "value": "a483f9a854899cfcbebf51377c5eb63ae6d268ead807e7d231c3f4e526c395123bc48383bdde81681c7ef6a691147ad3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220297, "uuid": "7e734a5a-8bb1-446b-b795-7718dab818fb", "value": "T172E4E12023D48B4FD12B5279C8E5D2B01776ED94A476CA874FD9FC4FB5FB2A2127210A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220297, "uuid": "b5f00cec-c86d-420a-821c-4dd3451f4cb5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220297, "uuid": "5ef55247-9248-4ccf-b64a-ddde1905bba0", "value": "12288:H8rgLb4/axC0HCES+CiSWFJYMfPv4BRELtfAZz6L/BYU:HswUaHS+4Nv2LtYZo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686220297, "uuid": "bdbcd8b6-354f-4f38-8c6f-869b55c9d706", "value": 677376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686220297, "uuid": "16da39cd-76e7-44c1-a70a-4cbb13a6aae6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220297, "uuid": "ddfa5487-6057-4947-9b6b-17d6952d1c77", "value": "a8b37953e55efbe21f59764377b1c523a1bbd65af57bb2cc74bf18f727bfbd9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19d10bee-0642-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686259146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686259146, "uuid": "fc092ac6-fbf4-476e-823e-9ef0efa0eb64", "comment": "Malware payload", "value": "bdbfd5eb20f9160c7b84097fb823037a", "object_relation": "md5", "Tag": [ { "name": "555756", "colour": "#CED47B", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686259146, "uuid": "00a36db7-7ed4-451d-b4b1-5af0a0756328", "comment": "Malware payload", "value": "a8c9c3b481e9f453c9dce5939a7e8c6c220ebbadd6cb16a7d7436d55ed19d971", "object_relation": "sha256", "Tag": [ { "name": "555756", "colour": "#CED47B", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686259146, "uuid": "051d06c8-2d99-4bce-ada1-69e243975a89", "comment": "Malware payload", "value": "bf1caf2073ded5474244d9811f953c30faadbc5f", "object_relation": "sha1", "Tag": [ { "name": "555756", "colour": "#CED47B", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686259146, "uuid": "b495da4c-3e25-4e13-b6e4-91fe6fd9244d", "comment": "Malware payload", "value": "f9fcee3010a9661afde021494a2c2aca7dfe95ecd2a63a0374c79ddbfc93ba9c1e6adbfad5f3c4425500982622990e45", "object_relation": "sha3-384", "Tag": [ { "name": "555756", "colour": "#CED47B", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686259146, "uuid": "ee0c6a9a-c5ea-461e-8526-d892232000d5", "value": "T15EA1E0DB2217F8D9402A8F7289CC564B3014E88BCDA79252FA82DF74DC5CC9D468DE69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686259146, "uuid": "91ed2377-f499-49da-b884-02cbae5f2bbd", "value": "96:5sBeprD12YkUUGsgZislNRGBhWp5quaajeQF+fjsfK0kS6RdX+Bw:SBOD1mUUGsBslTGBhU5q3aCQFGsfK0k5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686259146, "uuid": "d572423a-5823-4afa-a007-2ad77e26171d", "value": 5017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686259146, "uuid": "da1e2ed4-e7a0-4dbe-affa-76cfe8921c29", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686259146, "uuid": "8ead2f18-7f5e-4f3c-bc37-9cccf5e5a367", "value": "239909_749.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79d0c79e-05be-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686202614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686202614, "uuid": "666e2705-17e1-4006-a083-17b476f090c1", "comment": "Malware payload (RedLineStealer)", "value": "e41179b3268d089443b9c8e47afe84d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686202614, "uuid": "f28fbfa9-6271-47ff-8ccd-4cae3e2d586a", "comment": "Malware payload (RedLineStealer)", "value": "a90022e3ee1062b911b80d37dd715554d750e585a1a4c9b42c2521f892308f0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686202614, "uuid": "89db2062-99a3-4d5e-b6e6-571b361e2374", "comment": "Malware payload (RedLineStealer)", "value": "df0c399eb3e84e27912429f12137a3b44607e38c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686202614, "uuid": "2a41ab63-39fd-4b63-b880-fd31d7879743", "comment": "Malware payload (RedLineStealer)", "value": "f1d5cab33f7164c4baf26d6628cfd18233d34343e137a9d445b0dc681444712d583e11ec782f4189131f4e6fc27e027a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686202614, "uuid": "4b53f94d-2bcb-4ffc-bb94-a2e587699635", "value": "T1F7D412527BEC4423D8B82B7198FA07D71A75BC616974833B67875D8A0C729C0A83673F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686202614, "uuid": "b7402b80-1bd2-4464-ac2b-784d14fce15f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686202614, "uuid": "25820a4c-8e4d-4df4-a24c-485f6f87fcb1", "value": "12288:0MrXy90qRscpIQFD2SaTWnGW5wcpf7HG/CgjP0Lc6ZLp4P7ZjaxFy:7yjrG8qyGW5XdC/1b8c6X4QW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686202614, "uuid": "ef4610a6-2587-4f79-8774-dd6e8ea533c2", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686202614, "uuid": "a462c974-f15d-4bc7-99f9-d1765c0927f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686202614, "uuid": "d49f45e8-5a88-4c51-98fb-65c56f96831d", "value": "e41179b3268d089443b9c8e47afe84d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36042d2f-05ca-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1686207654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207654, "uuid": "d74c6288-0434-4b95-9d16-cecc48597f30", "comment": "Malware payload (Gafgyt)", "value": "004919a6d6703c7b124c773225295470", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207654, "uuid": "f7e4fbba-30cf-406f-a1d6-57459df7fb19", "comment": "Malware payload (Gafgyt)", "value": "a98f7231c975a2a4debd357f0244153b2786e3803732e081b3f3aed00c60e5cb", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207654, "uuid": "a8405345-871c-4ead-b7d4-a56bfac74ff8", "comment": "Malware payload (Gafgyt)", "value": "e5633bae7ed2824014fd6164c75ebcbf5b774500", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207654, "uuid": "dd3a1786-2fc4-4d50-8134-1a25eb23dd56", "comment": "Malware payload (Gafgyt)", "value": "dd095ce4936e9690c9e92032c59e44d8629e9935c056e33b9a926ec7c80f032d84516352f9539202e20ec1db8509a899", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207654, "uuid": "b8cca350-09e4-405b-9fb4-1a15fa2eeff2", "value": "T163534B17B58280FDC09AC1744B2BBA3AD93775FD0378B2A677D0EB262CA6D211E1DD44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207654, "uuid": "fc50811d-84c6-43d0-b871-979fcf412984", "value": "1536:dpmbSQ6U3q7cCBT/lZsK/0DiQALiKimfFoktCe3fYRM0w:WShU3q7cEDlCK/0Do9i8Fok06fYRu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686207654, "uuid": "1a71f207-2868-48c0-83d4-db22271efa69", "value": 63296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686207654, "uuid": "8cecf3a9-a147-46ed-aea0-f9364606cea1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207654, "uuid": "4a7b94de-1293-4caa-8985-07536c6ca558", "value": "004919a6d6703c7b124c773225295470", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4684e703-05d7-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686213265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686213265, "uuid": "70d82efe-3a7f-4b68-b9b2-f642706ddfb2", "comment": "Malware payload", "value": "0470d07cd9dba9e29f0042cbbce39495", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686213265, "uuid": "b37bc1d2-f202-4718-9446-9f72b43580bb", "comment": "Malware payload", "value": "a9f64538d1f27da97bbf7fca432f110ff47a3b19ab8624005fa33c37e8a5ab72", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686213265, "uuid": "d6221cf9-acd9-459d-a50a-5424d46ac8df", "comment": "Malware payload", "value": "6b73d9b6e1ee4db83b434fb97d47181ffc65061f", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686213265, "uuid": "13f489f9-1e52-4d72-860f-bb62bcb02e5e", "comment": "Malware payload", "value": "c8b6c786999d2d415cb815592260006e9f3adbba20204d0977ed09286384c13fadd42464e6902ca3fb2a8b20e7e8a337", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686213265, "uuid": "d3cbb328-6d3a-45bd-9d3b-8cf94a87215c", "value": "T11D751201BBC194B1D06128324A766B11A93DBD201F64CEDFB3DC6B6D9B325C1DB31B6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686213265, "uuid": "d6868bcc-7405-45b3-9312-380d6ed5e07a", "value": "24576:5TbBv5rUDkeIayutZfb8ZcN523fBnX7SWXMdAfRd/:zB9vgZIyNk3RXPMUl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686213265, "uuid": "a82792bb-d8df-42ad-87ed-ff042588a867", "value": 1703936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686213265, "uuid": "1d2f914f-7b0a-42ed-b1a9-24562cdf516f", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686213265, "uuid": "8113b05c-e67b-49aa-bdea-66afdf05a01d", "value": "ORDER #QRD566789125667KRMGMALOM-DSADMT+HFGAOLTMTT.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1b755b7-0606-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1686233658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686233658, "uuid": "b7f321fe-28cb-4f0b-976d-ad0b0f874d6a", "comment": "Malware payload (Smoke Loader)", "value": "be6e9cd366fa388e1e8483039ac1ac5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686233658, "uuid": "58167b08-7022-49af-a9e1-49adf2e9ce55", "comment": "Malware payload (Smoke Loader)", "value": "aa3e655ea61df5356c286183a3d6a22fe192553df4b2995ba068f9c52fb27163", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686233658, "uuid": "16a1c681-1e0d-4b85-93bd-c53929bd559f", "comment": "Malware payload (Smoke Loader)", "value": "e9c53899171b81761e6362d7d3380a2047fd7546", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686233658, "uuid": "b3627c3e-771a-4775-b978-45cc8ac7dd18", "comment": "Malware payload (Smoke Loader)", "value": "ca8186d4452018e3f0b81d381b5aa84420d41dd2844b12d74160ccb8822cd273d8f48689279f29d2a9ad9baf8b55c1c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686233658, "uuid": "f9ae8a6f-2c78-4e33-8b7e-fbcc41791f24", "value": "T13E641B1392917C51E9255B329E2ECEF8365EF9508F093BA65A18AE1F14B12B1C173F0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686233658, "uuid": "d485d0f1-676a-4dd4-8455-6e3384076a1e", "value": "ee55eb48a3e3a4949e7507357f34cccf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686233658, "uuid": "787518a4-8130-4fb4-aac0-8a6645230c73", "value": "6144:Lmb51Fb/S+Avk8EEEEuADeVOrni/xBk+:LOFb/S5EDVN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686233658, "uuid": "80c8c6cb-0622-409b-ad58-03b12d2608c9", "value": 332288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686233658, "uuid": "2a5ec06f-e67f-4a75-a95b-aa642ce3801a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686233658, "uuid": "241ea656-e980-4b53-9544-34806903f4af", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43ed16eb-05c3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686204671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204671, "uuid": "93843135-eec8-4eae-9483-497fbba81974", "comment": "Malware payload (Mirai)", "value": "64d9617447b60e1b93f74404a44234c8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204671, "uuid": "867f8c96-ec80-44c5-aec0-7b9285a5458d", "comment": "Malware payload (Mirai)", "value": "abbd4e2d9c0e2912d7bbf0f4a6568a2a0ac56ad263d899b32bcd0a89433613be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204671, "uuid": "d4b05a7b-9f22-46d3-8c86-ba406570bed7", "comment": "Malware payload (Mirai)", "value": "8922ee2247c09538f8878f4e05111631409766dc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204671, "uuid": "cc4baf0e-ef76-45d1-b2a1-4e5c509ec865", "comment": "Malware payload (Mirai)", "value": "37bcc71c74fd017ffeead39c499b24e985681c3dcbd207501cae62309fa5a056fe672778c6b4b42605aed1a5ff7c0150", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204671, "uuid": "499a0850-3f92-4b83-b307-a2f313c9b43c", "value": "T16673980A2E35CF6CFB5D823697B78E21975833D626A1C649D15CFE021E7024D341FBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204671, "uuid": "388daeba-870a-4e47-9e34-a131c298926a", "value": "1536:HogWL2T87i8qXc3SEyNlnXLKgLhaV4+6uHO/YQBSmP9AA1d42+Is:HoB2T2qX4+JXLKgLwV4+6B/YQBSmP9/Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686204671, "uuid": "be65facb-f6d7-43fc-9f6f-e9ac5781b139", "value": 80072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686204671, "uuid": "2776bdd2-a6eb-480f-bd1a-fa726344c7a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204671, "uuid": "42f634a8-b149-49ed-82ef-ca49160cbfaf", "value": "64d9617447b60e1b93f74404a44234c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f7dfa7b-0600-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686230863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230863, "uuid": "c2e8d54b-4413-4bac-8fe3-c22c41a8053e", "comment": "Malware payload (AgentTesla)", "value": "1e68a08518fc2cd69a657969b88c7c6b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230863, "uuid": "ffcd8cf7-0417-4675-a8b3-0684a2a7af29", "comment": "Malware payload (AgentTesla)", "value": "ac916054ec07cfb535f5861321750c1fe83c45e1032f633e2d009b56ff63c8f4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230863, "uuid": "f7d42caf-f90e-4b10-b450-40ec7a47e658", "comment": "Malware payload (AgentTesla)", "value": "6ca4a127b619a61566091f3dfcfd540c1d098422", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230863, "uuid": "217ae34b-6829-40ff-96ae-c397f706934d", "comment": "Malware payload (AgentTesla)", "value": "d816ec69a7b441d0dcb5e3d373752591a57702c3e833a87ba3afb87fa250f6211a9fb2c28b6d134cec270ced6d2af33f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686230863, "uuid": "7d38e7b6-bede-4be0-aa78-72db478d579e", "value": "T1D2E433F8AA69BF03A87513710317299B1B77013099D606A56F43DD32B889703FA3D6AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686230863, "uuid": "91ddd915-1fa6-42a5-bf78-eb59c5f03964", "value": "12288:6Gr56tFxwMspTJwqfgWR5eKYLjTd/rXzW8+6DD2j9oz9+/rvIR3UOtxvYc:KFJspVuWqXTlXzW8XgKacpU8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686230863, "uuid": "ffaedeba-3fa6-4ae7-9887-2299dcf654aa", "value": 666602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686230863, "uuid": "a4603efb-bc80-4b5b-9ca6-24ee7170eb80", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686230863, "uuid": "34e2030e-c7d0-4dd0-ac08-d0debf66d1b1", "value": "PO ME-625923.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eeb42ee-05d9-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686214219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686214219, "uuid": "8431eec3-1798-4ef8-aec1-82bf79976ff1", "comment": "Malware payload", "value": "7adb7f935d2a0d4965acf2823b46f92b", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686214219, "uuid": "8549975d-b470-4462-99e6-0723fef3b0b3", "comment": "Malware payload", "value": "ac9a43007d538c9103b578a18ed431c96669bf6359b820fed6a7bd4410604631", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686214219, "uuid": "56a03958-d703-4245-ba3f-b339db5c5d08", "comment": "Malware payload", "value": "21901519ab06a08efacbd303a6e031e5aa7121f3", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686214219, "uuid": "16d72d1b-827d-4091-b570-a9155e095505", "comment": "Malware payload", "value": "43765195abe6a354ce7d8e92f10ef3a0e31985375c3d96293a18a4dcaec573b62eca73eb3af17d8bd44b5ad8f6754e15", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686214219, "uuid": "6eb986bd-4b53-45f1-88d5-c26a5c05a432", "value": "T172110C2023DF1FD6F2E351313E36AA92C2277C17E5389A1E814942880C7931D6E58B66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686214219, "uuid": "d0a2f0e6-b004-415e-bc03-190ca1521dbc", "value": "12:8mXCO0YXShzu1pdpF4EVUCZaelDyOjA6RsL10bdp90Zwxbdp90ZQcvlZTlZsr7IS:8mvdOCZd5ALid4Zwdd4ZLvTsr7h8an1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686214219, "uuid": "7168dafd-7cf8-4352-953e-434c1681a22b", "value": 986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686214219, "uuid": "b1cc1f78-6477-4f17-b55c-4b65cc7e6b4a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686214219, "uuid": "afc015f0-d409-4137-9077-72035b545a45", "value": "Thunderbird.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "831b2f24-0619-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686241713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241713, "uuid": "7f509af0-a450-4450-adcc-fcd86070b0e2", "comment": "Malware payload", "value": "4a09fe44aa90b61b702808b1185ec90b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241713, "uuid": "96c1cf89-3abf-4c75-882f-1e7f640bd798", "comment": "Malware payload", "value": "ad7c4b87ed91d36bcc3e4ffee33cc77cfca9a29bb9cf41637bc0c7be5525e0a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241713, "uuid": "14a1b358-02d2-465d-a68d-085c21486ee7", "comment": "Malware payload", "value": "3e4c97cda7c69a4c8198adadd62d2ed85ecea4a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241713, "uuid": "b77169af-40c9-4c71-9553-fea1888bda28", "comment": "Malware payload", "value": "f4d0098e77432941ff5289d07ddf9a9dc2477f8fd366b9ebd426c71eb5e36bfe8f54f444c477d93186a2971802eee61b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241713, "uuid": "121a24ac-cace-4408-a78b-d561dc554fa9", "value": "T1F4B3028FA1EBB05BF0911C75A84E13720ABB3F114F31989ABD5C067B9576942C122F4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241713, "uuid": "ac7e52c3-711f-45ed-8ac6-b9e3560bf02a", "value": "fa3ef71a6a41502614e39d72d196f39c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241713, "uuid": "2e337dd7-d2e9-4b1c-9307-f35ec47db30f", "value": "3072:LchOnhCEQmn0VqKiNIJ1qGhkhkT5WDcB:LcwnhCVo04KFJ1vXcDc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686241713, "uuid": "cbe5c77c-fc0e-4694-876a-60f07aa1c7ba", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686241713, "uuid": "32f0d4a9-de80-4de5-8fb5-86a88fecf981", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241713, "uuid": "712609aa-c6ef-406b-92f4-fb2c3c1d45c5", "value": "SecuriteInfo.com.BScope.Trojan.Wacatac.15970.32281", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e3ac627-05c9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686207345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207345, "uuid": "58b77078-730a-4377-9212-2fda20afb5a5", "comment": "Malware payload (Mirai)", "value": "039df2204f3b99fa3977c4864bf10962", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207345, "uuid": "692059c5-45ab-48e2-b343-7d0406c0b01d", "comment": "Malware payload (Mirai)", "value": "adac3e37ab6c4454faa8aeba4307dd4598a469633dba5b0ca113f1ca7c4321e7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207345, "uuid": "3e877d57-1c8a-4838-bb54-f0f0367b6d1c", "comment": "Malware payload (Mirai)", "value": "85d7d4f0fb7e2284b53486a9f46e5c98a0454231", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207345, "uuid": "a2f3da24-b665-42a9-8649-f483b82ffa1c", "comment": "Malware payload (Mirai)", "value": "2dc26b40adb93c9163fd4133a4329c833426aa51d76d1bb7f52767da5a0c1cd23a45a7597f168a6bbb5e3717472598f4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207345, "uuid": "59f897fa-039e-4c40-aa62-8df1625f57a9", "value": "T12683185AF8816B01D4D926BEFE0E118933535BBDE3EE71129E204F2037DA96B0F76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207345, "uuid": "58521f59-5da9-4aee-ac3d-821cacf9d7ce", "value": "1536:fUnq/pkwBxGvK7XK7KIKyKkKJCBIj4K+Sa6ZCjnMSYdl9uiz+n3sBY79+D:PpxwKTK7KIKyKkKJC+jF+Sa6ZCjn6j+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686207345, "uuid": "d2c7f507-abd9-460e-a653-50741e6603c9", "value": 87568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686207345, "uuid": "84c656b8-9d82-4ef4-9b15-73dd1a27183d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207345, "uuid": "fecda5e3-1f04-4f91-ad01-7c43f102caae", "value": "039df2204f3b99fa3977c4864bf10962", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71a9da71-05c9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686207324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207324, "uuid": "8a8b9637-d1ec-422d-a098-43c02ed146ef", "comment": "Malware payload (RedLineStealer)", "value": "e64cc1894f22ad69da37f5b703b827de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207324, "uuid": "f09d2b77-2960-4a9b-b975-5357af9a7e6d", "comment": "Malware payload (RedLineStealer)", "value": "ae1af8d73d68698a1a0920e00c0030d9c9bdbfcfa18ddd3499499a3158757a60", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207324, "uuid": "ec6ab4a6-ff6c-407c-b91e-a73b4c92776c", "comment": "Malware payload (RedLineStealer)", "value": "996d631f13bb0978fe077c3154441dc9d5c95dbb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207324, "uuid": "09162138-b024-4c8e-98c5-8d1076583721", "comment": "Malware payload (RedLineStealer)", "value": "ceaa3589ae0156c45d189ad09050cacd4975c883428324d79ae4a404702e0d365c675c49979fbdfab511e4130c898982", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207324, "uuid": "1ea0c97f-f6d8-4c14-9f4a-48555b217ff7", "value": "T184F42313EAE81473D8F8177098F617A31B797D91AD3543BF2720AA0A0CB36C4A4B1767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207324, "uuid": "c4bf0668-9cbf-4bae-97a1-1f14443a51ec", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207324, "uuid": "8700b169-f9f9-4d58-90c2-2ef1d357d4ee", "value": "12288:VMrEy90FcqN0q8lQCkxCd/kFpg7FpMjq0PjD7huqfm15vnaPXlhGykeWq:Ry2ciba/epg7nMxbD7I5CVsm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686207324, "uuid": "16ce8c29-4b06-4070-b1c1-fabc59369446", "value": 771072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686207324, "uuid": "2dc88d59-045e-4d20-a39e-dcd510c03fc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207324, "uuid": "4360c9ff-2ed7-4269-895e-8b328eeb6891", "value": "e64cc1894f22ad69da37f5b703b827de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9de070a3-05a6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686192366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192366, "uuid": "197064bb-0f67-4772-b56b-26f69dc1053d", "comment": "Malware payload (RedLineStealer)", "value": "4c5d9b472f511d53b3790234578659e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192366, "uuid": "5dd1c6e8-0bdb-41a3-8900-367ba9d17532", "comment": "Malware payload (RedLineStealer)", "value": "ae6d4c73623b5cb8d70a1fca0e83de2d8a29c6e9167e705ba94acd292526ac05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192366, "uuid": "3e88cef6-0d8b-47e4-850d-7ef0afa97551", "comment": "Malware payload (RedLineStealer)", "value": "e66f013aaae84577e736485054ac6f37cafe307e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192366, "uuid": "59b04a76-2d89-4e17-916a-9ad378250b94", "comment": "Malware payload (RedLineStealer)", "value": "eba713cba21d9c1daeb024f441f50b6dadae19946aae191d49658bc34ff45c767bd8317c718754b607a1485b99f1820e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192366, "uuid": "a0fb8244-249b-4790-b567-f865a68e2988", "value": "T1B8C41257B3E98223D5F527B018FA46C71B31BE717A79527F3B81945A08B26C0A43273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192366, "uuid": "d0510d4a-f979-4048-9ec7-5d9df0c947e6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192366, "uuid": "e341418d-213b-47a2-bf71-a4fd869ba83e", "value": "12288:MMr/y90i/fHN/47r9zeorYkK3jSB1B6+FQc9olO8:Dy7/1Ad6or/y8n6+FQQolO8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686192366, "uuid": "644cb15a-4025-40b1-af44-9b8ba7b4eab5", "value": 590848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686192366, "uuid": "62b4504d-37dd-4d2f-af32-6b9d75f6dc41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192366, "uuid": "f6b949aa-f649-4e7d-a973-a01a28212a38", "value": "4c5d9b472f511d53b3790234578659e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ac4b7a2-0600-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ModiLoader)", "timestamp": 1686230855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230855, "uuid": "2a0acafa-7f60-4287-bb35-9455be0b124a", "comment": "Malware payload (ModiLoader)", "value": "e0eb6a06f065f2facdc5b1dab89b450d", "object_relation": "md5", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230855, "uuid": "727624ce-6800-4e39-8415-5c8749ea5008", "comment": "Malware payload (ModiLoader)", "value": "aefd7180d0e0f6a967ef79d69e653adb2c0ed5204170a728f2e2c50f002687d9", "object_relation": "sha256", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230855, "uuid": "2738d322-b0f7-44b2-be94-12488dbf4928", "comment": "Malware payload (ModiLoader)", "value": "bc9463e926f71353ba39c5d2aeea4c9d7ff6153e", "object_relation": "sha1", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230855, "uuid": "5fec4c93-dd9a-4685-8502-40936d9e1e74", "comment": "Malware payload (ModiLoader)", "value": "06b2e4f8fbae1b80ae01c5cd334129170072a916d97273cbb7d2124e8c285866344c21a77a97c466ea345f298178af82", "object_relation": "sha3-384", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686230855, "uuid": "cdf209fc-5de4-4541-a48e-ed9684514c3b", "value": "T14EB433D15884E659AD54C8658EB708E1B33D777FCE9829CA04EF2A99C78B3303E1412F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686230855, "uuid": "de8ef70b-1250-4008-bb6c-eecf6f939bbf", "value": "12288:Q53P85WfXXCoc982tRA5eiDUFdS2oqSfZ/kpQ4i+9zDnc4x:Q53E+XXC122vI3e5lpksDlx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686230855, "uuid": "30bab778-ffb7-4939-b6c5-17615db29a13", "value": 534074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686230855, "uuid": "dc4f4e6c-3d51-41dd-a200-1e1f77f45b68", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686230855, "uuid": "c0e1ec99-5f03-4d4d-ae31-3019f432baa5", "value": "Needed order .pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "679cd0a6-0601-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1686231359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686231359, "uuid": "f55ca7f5-907e-4a5a-8d26-5c46d26e858b", "comment": "Malware payload (RemcosRAT)", "value": "683810600892cacdf665444dd2433bf4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686231359, "uuid": "86286857-ca6b-4e16-9819-d7eeb9e7bc49", "comment": "Malware payload (RemcosRAT)", "value": "af4302878827cd62e91d7f42d963b213f4dbb220b28148f86f63a799666b1931", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686231359, "uuid": "87bf7682-a0d9-45e0-8656-bb6370e4d881", "comment": "Malware payload (RemcosRAT)", "value": "4c6dd1cf0cc29c46faa5d0ed62cd300893c00120", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686231359, "uuid": "c44f827c-ae57-490c-8344-56f01f393136", "comment": "Malware payload (RemcosRAT)", "value": "e836eeb9ee60ef1f47caf899deced741a2a65ec8a1e95ef3c3c0c1b0af0a6669febb781497aa352db09b7433cb484ca4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686231359, "uuid": "906c2a98-b124-420c-a530-28c8c10e6055", "value": "T16555D111E2F18037C7561F34886F57A89925BF201E6C6C7A7BE87D489F39241389A27F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686231359, "uuid": "97e9515f-0d41-4f17-9dd5-6cf7e80efbea", "value": "ca172f18718117d8f2637d28f8c14a6e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686231359, "uuid": "57e37925-24c4-4f06-a783-1b616bd1fe09", "value": "24576:xcUMsJkI/T/O7N/Rzor3Iu0aMp/7YcTgXkV5GE9q:xcEaWOhZor3Iux+zVTJ5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686231359, "uuid": "fc30987b-1b6b-43d0-ba3c-0bbead002aee", "value": 1281536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686231359, "uuid": "5ae66143-84bb-4314-9b11-c96a88115cd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686231359, "uuid": "6a438228-6bc1-40e4-8f08-d3535a97c445", "value": "BANKNOTIFICATION452968460273244222567875432FERTYJHG2U20.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40f0ee41-05c4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686205095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686205095, "uuid": "4b8bd476-68eb-4482-b040-b987e596a4df", "comment": "Malware payload (Mirai)", "value": "93fa71cd956675704cb055dcfa54bcd7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686205095, "uuid": "d0fa1c60-649e-4566-8ef4-d03c9d4df2cf", "comment": "Malware payload (Mirai)", "value": "b0762ca8d89122620f10731e82fee3922aac25dc492e7acf8f4193d61cda7075", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686205095, "uuid": "b19f351f-7d30-4e07-ab5d-e496c3dbd8af", "comment": "Malware payload (Mirai)", "value": "7acd4a39305c6f8efb43e824195cf4a55e760f8e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686205095, "uuid": "5e38afc7-70fc-42e5-a43f-0acdff43dd92", "comment": "Malware payload (Mirai)", "value": "24319d1cd31259303bce6282cb8efafe690bcfceee7585786c4eb5fdd9e7ea966cbf07637a0d1e369acefed3cea0c2ca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686205095, "uuid": "f2fb05d0-3f6a-4614-9044-4567b728c384", "value": "T15183A51E7E228FADF76D823147B74E25A69833C627E1D641E16CD6012E6034E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686205095, "uuid": "da752c82-089d-4f1f-a5ea-924753a27b08", "value": "768:2ty6IP7M/kq0INRhfuN2Eo9tl/de2YIAHKRH0I84EH6UTm7JDVmcfZ73xvHb8y8l:Rakdn2Eo3ePe5GTmBVmctt1ek37W0v8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686205095, "uuid": "069fa256-a521-4c3f-a273-d864cb8eabe0", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686205095, "uuid": "8b975094-fa86-464a-9211-d46645bfd515", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686205095, "uuid": "cdcad88a-4ad2-424d-af5f-78450a229cd1", "value": "93fa71cd956675704cb055dcfa54bcd7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36a331eb-05ba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686200783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686200783, "uuid": "5644cfec-38ac-4a52-bfae-d294a8c9caf4", "comment": "Malware payload (Mirai)", "value": "b892651fcbdee342c3d11f79e3e30ad1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686200783, "uuid": "34bee59d-cb52-49d8-bd12-288efa17f2f7", "comment": "Malware payload (Mirai)", "value": "b0b1e3095e915f7bc95c45887227a65ab7e1cf32e529db75506a3da312d0e22a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686200783, "uuid": "bc9327e7-259b-4dfe-905c-fe6881790fb9", "comment": "Malware payload (Mirai)", "value": "c4f3165c1043ecf4348cbdef03e26806357e14f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686200783, "uuid": "67890c1e-db58-4217-b3c2-b2eb5c1cdaa0", "comment": "Malware payload (Mirai)", "value": "9c5f40f1d8f4b93cc15a50d68b3de36723fe5136cd96c9afcb7cef800445736288227966d1455db9adf3780291b9deb2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686200783, "uuid": "cb86c657-590f-4d0e-aab6-01ef645a6dd4", "value": "T1BC434C4AE282D9B1FA0B85F0055A977DBB32AA331000D85FF3887936EC71EC2D54636D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686200783, "uuid": "cc0d45d2-8448-4396-a02b-feed48bca555", "value": "1536:om3caYYBA4kZV7MCXM+iD6SJ60YoyKU/31M8+7Yr:t89M+gh8hKXA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686200783, "uuid": "76eea3dd-9abb-439e-b0a1-596f7391c47b", "value": 55388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686200783, "uuid": "b1ad62de-df77-468c-a80c-f51b239b2c02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686200783, "uuid": "cbe62408-85f6-4e1d-8053-fa7057856fb7", "value": "bot.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ae5f02e-05c9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686207286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207286, "uuid": "f07a4a60-8249-48b8-a471-225890c74af3", "comment": "Malware payload (Mirai)", "value": "8617a8e18cff38344b5d56980d29a64c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207286, "uuid": "3ce0280b-122b-4f53-872e-3ea7a29e1ad1", "comment": "Malware payload (Mirai)", "value": "b0bf1a9fa54d29d1f374f3ff7fd52fe4da281a7a03e6c03167ad7cd867394205", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207286, "uuid": "c8cb77f6-9f2b-4edd-bf0b-1f0f79635e22", "comment": "Malware payload (Mirai)", "value": "1fa548c47ae6f48a2a34c2a149a4c3e88491e398", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207286, "uuid": "9327dbf0-2678-471d-8daa-701bea5ccab9", "comment": "Malware payload (Mirai)", "value": "9df6b6790ccec92859555587599bae7a8a93577e5f1d4e5a16802d153e008cec398843129f5dea99a7a2bcc75561137b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207286, "uuid": "07514f4d-21df-49a2-92b6-3ec04e0c654b", "value": "T159633B9AB800DDBDF84BD77F8453490AB630A3510A930F3A676BFD53AD731A44926E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207286, "uuid": "11874a8e-5e50-48ce-a67c-c996e7b7420a", "value": "1536:OxxN1DV/hl2nx6e11c/ArRFW8AEzrMKP1jieJN/z/VQ/GJv:OjN1DV/ReE/qRFxzb1GeXYGJv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686207286, "uuid": "9227fc58-594a-4d8e-9b07-91c88faf1a47", "value": 72992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686207286, "uuid": "ba83433c-71a7-4dfc-be78-c921aa41c201", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207286, "uuid": "a5082f4f-4003-412f-8dfd-db97cd10d014", "value": "8617a8e18cff38344b5d56980d29a64c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95320e65-05b4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686198365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686198365, "uuid": "774dc65f-158c-4615-87f7-09bc8fbb6bc8", "comment": "Malware payload (Amadey)", "value": "f146097d385f9d720b583e4aee44feae", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686198365, "uuid": "697c4358-08ae-4e18-92a8-45bf16b545a1", "comment": "Malware payload (Amadey)", "value": "b0f4425522b27e3f50d2f662255a92d764fab66f5cb3fdd691e7b842b691b0b9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686198365, "uuid": "03608223-0802-46ed-9423-9b538ac67b33", "comment": "Malware payload (Amadey)", "value": "2a83c08e3748bb4819c3e1fa4c9d9d50058efe4e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686198365, "uuid": "9a595682-17ca-42fe-8d1a-bd5ea7e647e8", "comment": "Malware payload (Amadey)", "value": "45afd021d2ecafa8783cfdb0a4977695525c3a7be1d2aa8583a4713ac1f8066bc67670f41d0479b9a9bbd06d7fe65471", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686198365, "uuid": "19bf5d0c-f396-46ec-8e52-db1a08683a38", "value": "T1F9D41213BAE99877E5F82B7008FB02C31E35BCA1597887271B95985E0D72AD0A53173F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686198365, "uuid": "3d68d361-e87b-442c-8360-e5cf7388212a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686198365, "uuid": "24bd52ee-0446-4985-a609-58f5c6f0bb6e", "value": "12288:OMrby90iDd9aDYuGPZywmIiAYx+L95GSwnHq14MR9Zn:NytxqYjy4iAYEL3kK1L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686198365, "uuid": "5eed0658-7bbb-4b98-b53f-ccf25ffff34c", "value": 605696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686198365, "uuid": "1bf1c111-df30-4e7c-9102-40d2edab245f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686198365, "uuid": "323b8f84-9116-4325-8b0e-ed556011b03d", "value": "f146097d385f9d720b583e4aee44feae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e2c90fb-05c4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686205117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686205117, "uuid": "a04d740a-f105-4da3-b418-40bfcc202842", "comment": "Malware payload (Mirai)", "value": "2fe11a24aa90dca30c9b74ef401c1426", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686205117, "uuid": "b5b8d8e8-817c-4b0d-8bab-f0bb158a10d4", "comment": "Malware payload (Mirai)", "value": "b1a80c9a555b8ed5d0da3a4f0bc50a847088cbdb12466d1cba43e73a803442bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686205117, "uuid": "84103347-e842-4a43-9b28-16ec780b091d", "comment": "Malware payload (Mirai)", "value": "852a9b4e046dff0fdb122fe1fa7612e4a4e6d930", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686205117, "uuid": "cca4c3f5-8bdf-4c5f-a16b-44a90ec02b42", "comment": "Malware payload (Mirai)", "value": "f96c44e61efd5edaa199ab380bb4ba554f126615f95f9e21ff1798b56ae14c6d6b009a991831934eb93f23967225a613", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686205117, "uuid": "4d8fabba-48df-4c8d-b0f0-5269d3f0e766", "value": "T1F6E33B56EA408B13C0D61779B6DF42453333ABA493DB73069928BFB43F8679E4E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686205117, "uuid": "b1ef3679-3639-4917-9c36-28e501302634", "value": "3072:iJ7cOn5CZmA7GabXrz4tt34ZscYjV1pnXkkTM/9VBY:iJ7cu8GabXrz4tt4Z03pnXkYM/9jY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686205117, "uuid": "c670ae84-6ca0-4ff8-a57c-67c10a3b1e2b", "value": 150610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686205117, "uuid": "4819f84c-209c-403e-aa4e-65793f82332a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686205117, "uuid": "6162324d-0d73-4045-83ae-4cd9e8824fe5", "value": "2fe11a24aa90dca30c9b74ef401c1426", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42c97b60-05f5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686226144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226144, "uuid": "b9a46368-d8aa-405f-b2bc-5ce0d4979591", "comment": "Malware payload (Loki)", "value": "602cbd61ad087ba06daf995cc46ce677", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226144, "uuid": "1a684ac8-e91f-4b44-92e0-7d1bbaca20aa", "comment": "Malware payload (Loki)", "value": "b3b03d6eff59070c3049aecc702de3bc10b5117d1ed18e96ee6f2675c5301ab6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226144, "uuid": "62c8dd6e-7c1d-49af-a73d-7fae33754807", "comment": "Malware payload (Loki)", "value": "8ac28e12f1887abe56ef886330ea71dbf5d940e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226144, "uuid": "bfda19fd-4afc-4827-a2a1-68210918b5af", "comment": "Malware payload (Loki)", "value": "15a79e71785f40e41ceb416b9396acbe8cea993d1371fdf98df27a39129de7f1f25c67a152aad93f57ca382f8a13698e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226144, "uuid": "d5fc9cb1-26c8-49ab-8532-aa986758e99b", "value": "T143D4121422F68B27C47E47FE60A45E7003FDA38E7A22F3564E9370DDAA16F414E19A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226144, "uuid": "0fd3d872-a28e-47a8-8993-457b15941686", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226144, "uuid": "3029e728-1c80-4982-8ced-97a87baaedc1", "value": "12288:KHkmFx2iqNhujGjUFyV69oFzpYomEi/fNI1//Uw/Ky0+z0nJuL/W17os6R:KEmFxUi0YhrNW//Ut+AYAosW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686226144, "uuid": "a99527f9-daa5-4220-8e13-6ba892cb0e40", "value": 656896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686226144, "uuid": "6e933acd-8669-458d-8374-5a3a2db10149", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226144, "uuid": "65021d39-4476-4763-9161-9228d4f4bbf2", "value": "b3b03d6eff59070c3049aecc702de3bc10b5117d1ed18e96ee6f2675c5301ab6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31d40121-05c3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686204640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204640, "uuid": "d4a1de8d-298e-432f-8cc3-0124e7c326ce", "comment": "Malware payload (Mirai)", "value": "f1ac60c117a8ab04571f829b740d8608", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204640, "uuid": "48a6b809-65d3-49a5-ab96-3012438eff4f", "comment": "Malware payload (Mirai)", "value": "b44b02ef090fd42bb19661c0faa1ec101c65cdca74cbe6d73679c9407a16516a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204640, "uuid": "a5ae7326-64a3-4629-b5ea-ae2917085381", "comment": "Malware payload (Mirai)", "value": "7297c3522d0e5410dce4f663265a34c16a3fd2e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204640, "uuid": "5bf87074-fe80-4e04-aa6a-5181d16f178d", "comment": "Malware payload (Mirai)", "value": "8ac96bf22f1e71653d0d90bef02b9a9321e4eb691c7617bf19ea7bfd6041822e0f7a9e6b0716a05986cad4f0e9001329", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204640, "uuid": "30460754-ef26-43b8-80b4-0d07a975e9e3", "value": "T1A4838116BF601FF7EC9ACC378AA8170528DD611A31A93B75B830D428F25B25F55E39B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204640, "uuid": "0ec38470-e752-4f6f-96a6-662cf1b89c07", "value": "1536:LsMhLMLiQAlHvBoaAopJpLwA9Z5lsird42+:LsMhLamZvBkA9d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686204640, "uuid": "6f9a7768-6e4c-47ec-ad1c-c189ce7eb3cf", "value": 84168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686204640, "uuid": "eaeb771c-feb0-4b51-ae65-62002e037402", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204640, "uuid": "282e7a48-9d07-4dd3-86ae-8969ff09cf6e", "value": "f1ac60c117a8ab04571f829b740d8608", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cde46e9-05d3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686211638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686211638, "uuid": "7eb23456-8a55-42e6-9e73-153a5b65f0a6", "comment": "Malware payload (AgentTesla)", "value": "f2ceda16cb4f8c48c1ff52bf34940357", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686211638, "uuid": "92cb2451-15bc-4a83-b88c-6169be0cc72b", "comment": "Malware payload (AgentTesla)", "value": "b483fa2b04ee2305e50ec070450c43c4feef6d98a30f01aa1f003f11ffad2aa4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686211638, "uuid": "b0bc6301-bbcf-46fc-9895-cba7b3069180", "comment": "Malware payload (AgentTesla)", "value": "988bd0e3ce8203e9e3ccd9f1d48d66e378ca0bd2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686211638, "uuid": "33edf2e6-280e-41b7-beb9-c80aaa006e84", "comment": "Malware payload (AgentTesla)", "value": "8619731657f74c50cdb2bff47e8d9d829214e15dece2238a7c8d31833bd50155e8f5893102f40ab3626e49a34d8d4131", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686211638, "uuid": "3857f3ca-0612-4c4d-a117-25b1053a0531", "value": "T16A25A03D16651C62823AD23E95DAF90BBA544CC3360CDD1E97C64F9A0A037B6E4CEE1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686211638, "uuid": "c7259d32-3b43-4612-ae18-aa72e004dc03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686211638, "uuid": "8b11265a-fcc2-4c40-9384-604052399b35", "value": "12288:QqGobbGt3gaI4RCEYKwxfX6t8vcIgEmUL7MRxVq8xQGOqtFhWIl+30ucVY:M+5fXlcOBc6qtFhn+30", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686211638, "uuid": "2f25c3e4-a577-4eac-8633-e67889912052", "value": 1037824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686211638, "uuid": "7a21e08b-dc5e-4564-b755-92d767b60297", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686211638, "uuid": "09cadeb0-fbd0-4d05-903e-b454a1518b26", "value": "PAYMENT SLIP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81c8bba2-0619-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686241711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241711, "uuid": "a043e0ad-d17f-495c-bab1-9db6dfbd19e0", "comment": "Malware payload", "value": "5084145f7834e91ae118be975086816b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241711, "uuid": "3a9422ab-58a8-4594-a083-428d2bd35cb9", "comment": "Malware payload", "value": "b5066ede23cd0c76e274dcb1ff756d015f5b2299a0ebb382a758b7f3dd4cb0c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241711, "uuid": "c33f4a36-a068-4e5c-8e0a-70286af24046", "comment": "Malware payload", "value": "5897fe82013a4d4ff8e02708ef0f337cb966cc10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241711, "uuid": "df8296ca-5606-476a-94a7-3483d68f8adb", "comment": "Malware payload", "value": "bd85d59ad65eaa43bec4a8f513ce33a724bb419f2f5c9dca6a06f0dca60bc8362217944f8bbcdb3d0050a30336bea3bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241711, "uuid": "e0a847d0-4094-40a8-8f51-7d5eb463a245", "value": "T18194FB68326B32CEC0386B7C37AE1580DB2C87330A51DD47F9AE79395DFD81992B541A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241711, "uuid": "fbb721f8-e21f-48d2-a855-d0572aaee9bd", "value": "dd8fee771863b7e20716bcfa26d9377c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241711, "uuid": "49226bd9-12b2-4d0a-a331-b8b5a9949ed6", "value": "12288:bfUsfZC1k2xg/5wWeQiej1T3DPUQ6TVvyn6AcPdym:1PwQ8ynzPm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686241711, "uuid": "7f4b19fa-365c-4e3c-9c84-473785eda7f0", "value": 428780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686241711, "uuid": "515d42e6-5cff-4c55-a18d-86ee8f270b80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241711, "uuid": "36c28b44-ae1a-49c6-9ce0-00fabfc3b022", "value": "SecuriteInfo.com.Trojan.Win32.Rabbit.129.4017", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adabe8b7-05f7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (BluStealer)", "timestamp": 1686227182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227182, "uuid": "f77cea16-8c9f-4de1-9ca4-81c84365f077", "comment": "Malware payload (BluStealer)", "value": "84bcb19b24fb3cf44188d8ea5e8a080f", "object_relation": "md5", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227182, "uuid": "4107a2b0-7312-476a-a38b-c6b09e5e4968", "comment": "Malware payload (BluStealer)", "value": "b5145ccf5ded090001d3a5368ad32b5b4853f1b2153e55beae9ff0ba543e449e", "object_relation": "sha256", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227182, "uuid": "8e58e5a9-bdd8-4bde-b3bf-f0fafce2caed", "comment": "Malware payload (BluStealer)", "value": "f6a1b91c039a3ce6cff9bf160725a4d2dae6df81", "object_relation": "sha1", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227182, "uuid": "ade851f8-79ec-49f8-aa81-424881bce3c8", "comment": "Malware payload (BluStealer)", "value": "1ab863479379df44e4ff874b6fe76872f9d6e7dede9e9fab9819c0e3bf0d8d5f16a4099a653810353c8fe575898ea49e", "object_relation": "sha3-384", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227182, "uuid": "39c63400-ebc1-4e97-8918-6a58d0f09ff0", "value": "T16E2523547F1784ABC2EB0FB844907371A5EC87ECB5729F2B0C43A5A4FA13F864285799", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227182, "uuid": "ec7f9c41-0365-4e89-8561-155edba3e692", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227182, "uuid": "20a1e7d9-4044-4c1e-b343-aae58d1e667d", "value": "24576:8qPLaVUH999QYDtn9pvEni933gMciIX0GJ/llyoWD/H:fBH9QYDvpvwXMcpX0GJ/llQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686227182, "uuid": "203d36da-d5b4-420f-9168-2d68a1fa2873", "value": 1015808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686227182, "uuid": "7281d965-db96-4f3a-ac6d-70daaa2384cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227182, "uuid": "e0501021-7c40-4ab1-a401-352cb1b21f8c", "value": "b5145ccf5ded090001d3a5368ad32b5b4853f1b2153e55beae9ff0ba543e449e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ed8d76-05a8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686193262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686193262, "uuid": "127ad74f-765d-41a7-b82f-42b3f475424d", "comment": "Malware payload (Amadey)", "value": "755a0ad5b6ff8a3cf54bbfb9d16baedd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686193262, "uuid": "b2535460-baf2-4077-9056-216b0e81874a", "comment": "Malware payload (Amadey)", "value": "b522b8f586cccad064fbec79a924fafa15ef45416d84304aaa9c6ed642241e3c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686193262, "uuid": "a1310fcd-d3d0-4049-9ed0-d779295dabb3", "comment": "Malware payload (Amadey)", "value": "948a31326daef7df296904fa9df7279cec5f7257", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686193262, "uuid": "99e16971-b8e3-45f0-ac56-a22af28e97af", "comment": "Malware payload (Amadey)", "value": "c03ab67016108e4bf3df1e0edb3a4003259ceb7da4516e7ac13d99c855d791bfcb71ef0c4b028a75277226763414946f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686193262, "uuid": "d5210127-b31d-40dd-8bf6-f6574121e79e", "value": "T120D41203B7E58422E9B127F018FA13930B35BCA55E3A533F2B45985A4CB3598A97173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686193262, "uuid": "f290b2a6-8d98-457e-add4-cf5d239763f7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686193262, "uuid": "01aa1425-2815-4748-8e4a-fa12b380df5f", "value": "12288:lMrxy90cdnDa5TZ1MJwFI7GEsq+OEY/ZNkYSZMa7:cyLsTkJwCyECaNkYVU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686193262, "uuid": "722bcf4e-c41d-4c71-a018-cc55944be78c", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686193262, "uuid": "cb8d8d2b-1c07-44d9-95f2-3dcc665d4fc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686193262, "uuid": "91dbf6f0-1ba5-4471-9419-195fa596895e", "value": "755a0ad5b6ff8a3cf54bbfb9d16baedd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eb5e7ee-0619-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686241706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241706, "uuid": "f6f14457-1f55-466e-bcc0-6b58a9749141", "comment": "Malware payload", "value": "bda8b4af10526c42918307e7106108d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241706, "uuid": "4ee63b6c-b703-40cb-b516-3077667c3b2f", "comment": "Malware payload", "value": "b58782c2b0a2233ef3bbf0b2797302ceb02214fb3cccb297bd858d11d0a2b988", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241706, "uuid": "87614478-1951-40bd-85d8-606e823a901c", "comment": "Malware payload", "value": "7711831417ff70d787faa56cbee1f61f4eafc9b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241706, "uuid": "1d6a4b6a-5432-4aa7-bb73-a0b84f70cf01", "comment": "Malware payload", "value": "969c5b2eb2fb46c62876d7257542d8195c6423479918b3f07ba912d7f6a8c011fe92eb9ff22335b75186d42691f58c84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241706, "uuid": "a24458ce-b79e-49c1-b804-f135b8803e1d", "value": "T1CE336B93F85082B1EB87907121FE6B3BEF3F48BB07596683D488EEA71C31561786D205", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241706, "uuid": "2bd95128-a018-4e60-ae31-e2ca0fc8b82f", "value": "384:O2Acgx9MNGpCbVMlgQbBC4wSz4s+8bt9Tx5sHSHc+KLmi7Cz+73uyGDa0w:zAn+GpCb923TzDnmdVCzw3kDa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686241706, "uuid": "1b785b1a-993c-4a9e-bd85-1a8b23e47790", "value": 53248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686241706, "uuid": "826445f9-eb68-4d32-b507-c0da79078afc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241706, "uuid": "1daf65da-38f3-4ceb-9298-107f93b412de", "value": "SecuriteInfo.com.Heuristic.HEUR.AGEN.1343841.27225.10521", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fb63926-0593-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686184209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686184209, "uuid": "6dc3bc23-9277-4091-b6d0-85222994fda8", "comment": "Malware payload (RedLineStealer)", "value": "225af3ef0183c20d3ecd190c0aac1611", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686184209, "uuid": "585cf42d-1fc9-4988-8613-f4734d112158", "comment": "Malware payload (RedLineStealer)", "value": "b62c2371f3dd1cadee871fa7dfc17aa9bb611bdb458196de00e235328a808ba8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686184209, "uuid": "57917850-b7b2-4c96-95a7-81eddd4db981", "comment": "Malware payload (RedLineStealer)", "value": "691feebd5f1b37e2852e3447d604bbe2ccfd281d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686184209, "uuid": "95ed305f-538e-43b8-ac2e-41fb525da827", "comment": "Malware payload (RedLineStealer)", "value": "7386d1df180b3e3b8f8ce58879c2bd32b6602b1e21cd994a229d3080c43446465e6ec0ca12846c76837f87bdb6a617ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686184209, "uuid": "d8144a71-cf9b-492b-9466-c4b577200d3e", "value": "T15154480237C68CBDF8AA073D60D48F3DC877ED60165464FA37A89A618ED0313959B5BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686184209, "uuid": "b853143f-b89c-468a-a4fb-96dbbd5650dd", "value": "f264906d4975bf1277da66f2124faba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686184209, "uuid": "bd9d17e1-7ee6-425f-8ed8-5864b8646c01", "value": "6144:rQvoWvJfoZuwvTygXUNVS4MGh1aBFrvz1xcxcWh9rt:rUO/yR1aBFrvz1xcxd9rt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686184209, "uuid": "7d1aadd0-c111-4f9f-a0df-a8fa411c36bb", "value": 288894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686184209, "uuid": "c9a37f01-054f-412c-86a5-4c61bfaf5a07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686184209, "uuid": "c97560ea-8d02-4e3c-9dd6-e69201453054", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "096d8262-0593-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686183957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686183957, "uuid": "1db2cf7e-1217-4e68-b564-c0d0d5f363b7", "comment": "Malware payload (RedLineStealer)", "value": "902e11085780e7d40fc76d1efc5b6836", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686183957, "uuid": "717de436-c5f9-4532-9f16-1e6dd6203a3d", "comment": "Malware payload (RedLineStealer)", "value": "b637d5f9b16c613c21d47fcbbe7e6a86e1e07ef0af0d78bd1cd6b369defc573d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686183957, "uuid": "97268a54-7973-46a6-9642-5a5d654ffbd2", "comment": "Malware payload (RedLineStealer)", "value": "2b6603fd915669f4f8c7322bc4c5c477e1373779", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686183957, "uuid": "4e220ef8-de5a-4ea9-aeb2-90d68267f614", "comment": "Malware payload (RedLineStealer)", "value": "12acef5e063f266bce59598d27314659d0d6cac157f26ce9f6714592405003e94988163f8e3015a4485fa5b5cd493b51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686183957, "uuid": "6a2f6c6d-ff21-46de-a206-23d89ce88f8d", "value": "T16D54480237C68CBDF8AA073D60D48F3DC877ED60165464FA37A89A618ED0313959B5BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686183957, "uuid": "4c0ca3f9-2ad2-413b-8b5f-0a9cb758d0d2", "value": "f264906d4975bf1277da66f2124faba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686183957, "uuid": "dae2082f-2b2d-4729-908e-6358af01407a", "value": "6144:rQvoWvJfoZuwvTygXUNVS4MGh1aBFrvz1xcxcWh9rt:rUO/yR1aBFrvz1xcxd9rt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686183957, "uuid": "981c0f04-2a6e-4aaa-9f55-08ea3092b147", "value": 288902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686183957, "uuid": "73b4adda-1c2e-465d-9f05-17719b480780", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686183957, "uuid": "34bd0df6-ec9b-45c0-944a-e9a2e76201da", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2081990-063f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686258140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686258140, "uuid": "d94a8c06-e845-4894-930d-c8f10718094b", "comment": "Malware payload (Mirai)", "value": "0aa48742bf67556b33726e71143f0ea9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686258140, "uuid": "550c1149-a017-42e3-91ed-7a4186f2cb44", "comment": "Malware payload (Mirai)", "value": "b663a3c76e31d32f4b22eac6371107053c4d0b1787f5ad46f9d396ff5b996dae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686258140, "uuid": "8c962f78-a07c-4358-9951-1db21d96e2da", "comment": "Malware payload (Mirai)", "value": "9bc34e71506d8f48227c50a957dbafb0fdd3c7df", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686258140, "uuid": "14d385db-09f4-4120-bb8a-c46928845cf1", "comment": "Malware payload (Mirai)", "value": "5153283131a0f0568b3316ceda2081c41b3107d3ef41428e93cf6214477997c8b9e6a03ec9744bc24ddd095401913321", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686258140, "uuid": "0831bcff-44bd-4185-a029-9aaf9ce5fedf", "value": "T182336C36E029DED0C6560134A4E88F751F13F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686258140, "uuid": "fe07ff2c-d853-4de5-9c4e-0d5ed6654089", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9Mm3CZQoV/bnmCozw:Oa4U7G7SvT6ftBpm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686258140, "uuid": "256be4e5-4a54-4409-974f-4cd2dee88f3e", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686258140, "uuid": "b3f5a7f3-a099-43fa-9f34-02b84de9e302", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686258140, "uuid": "5bf1b15b-91d5-42bd-90f6-d03145791a8c", "value": "0aa48742bf67556b33726e71143f0ea9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4522220a-05bc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686201666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201666, "uuid": "1ef949d0-dec1-4a9c-9362-cd0418649d91", "comment": "Malware payload (RedLineStealer)", "value": "922a01631ed814d55884f63c543f7d1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201666, "uuid": "af1a1e5a-9c9c-4f20-80ba-ac460184834a", "comment": "Malware payload (RedLineStealer)", "value": "b6b2ae64276946889a9d2e1858dae29cf7c98c870df586d82d993185dc401157", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201666, "uuid": "e3de3820-a192-424f-97f6-62705dc68397", "comment": "Malware payload (RedLineStealer)", "value": "c5a41516fc9ad17ba6d41766e11bb4249ba74037", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201666, "uuid": "c6a2bab4-4e6a-4844-97e4-e4170055f854", "comment": "Malware payload (RedLineStealer)", "value": "609a431689d7943a6cd836f838e1618f5fde53918583eb3c77d2336dcca5fdaeb0d4504dd2f9901c70576a05eae90f5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686201666, "uuid": "88865ea0-9b38-437b-be73-a0a5235000ff", "value": "T19B54480237C68C7DF8AA073D60D48F3DC877ED60165464FA37A89A618ED0313959B5BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686201666, "uuid": "6ce72d36-3bc3-495f-9a0e-f8030c34256a", "value": "f264906d4975bf1277da66f2124faba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686201666, "uuid": "a30cf948-eb57-4ce2-a887-9b7399f146d4", "value": "6144:mQvoWvJw5U7wvTygXUNVS4MGh1aBFrvz1xcxcWhGrtl:mUI1yR1aBFrvz1xcxdGrtl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686201666, "uuid": "ca09583e-62d1-45af-a306-6ad509e139ee", "value": 288891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686201666, "uuid": "44db8910-2554-45f0-a295-675af5f42069", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686201666, "uuid": "33248857-ce0a-4d0f-872b-e0ac994d7d89", "value": "922a01631ed814d55884f63c543f7d1b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98e84933-05a6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686192358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192358, "uuid": "b7058015-2b06-4351-92b4-9d4de417755c", "comment": "Malware payload (RedLineStealer)", "value": "59180a5d097c997bf96a52ffafabf97e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192358, "uuid": "36136028-b4cd-48e9-8125-19aa687cb267", "comment": "Malware payload (RedLineStealer)", "value": "b70726ab6feda64e2127916ebe416bf98d6df7fc543bcf03c568d23973b28308", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192358, "uuid": "f3ca83b5-6293-4524-a17c-a00db96ab51f", "comment": "Malware payload (RedLineStealer)", "value": "a37f09fd1a0f18e480eca08de82a3845f8200c70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192358, "uuid": "d6e648f5-69be-440d-b8b5-3838755ec4a8", "comment": "Malware payload (RedLineStealer)", "value": "8f54c90e3f39e4f34cc3777e67be5b9d9903bf2f43e6817a1012086e45ac47aedd1a1e7925684f08fa3ee5299bca8ae7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192358, "uuid": "e8192227-9c99-4a4d-91d7-42b6914f9c77", "value": "T17F44270327C68D7DF8AA473D60D58F6DC8B3DD50125860F83BA9DA618ED031791AB1BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192358, "uuid": "79d35c18-2e3f-46e1-89d2-f3412ffd385c", "value": "c56f8dc2b5654931656ac896522ebf3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192358, "uuid": "0f178747-b558-4c3e-aa97-22695da9f2f8", "value": "6144:haNgzwvTygXUNVS4MGh1aBFrvz1xcxcm:oNgYyR1aBFrvz1xcx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686192358, "uuid": "f73a4c9f-451f-4a1f-b2e8-c4ae74f5e8eb", "value": 258195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686192358, "uuid": "059a9d44-675e-447a-b955-d1e7cb7af5bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192358, "uuid": "700369b0-4016-48c8-82ff-8675ce382b4a", "value": "59180a5d097c997bf96a52ffafabf97e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96501ac1-05a6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686192353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192353, "uuid": "f3aebb29-d296-4cb1-8cf3-2558db7f8c8d", "comment": "Malware payload (Amadey)", "value": "5d3db0228e7e74a77ec80ed014405439", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192353, "uuid": "def6302b-ee58-4cea-b3ac-fbffd2a7657c", "comment": "Malware payload (Amadey)", "value": "b80fbbb545c315c2fa3e99071b2353e1eb22a1aa07a5694c06918cfb7a493210", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192353, "uuid": "f3c9f675-bf37-4985-af52-2bd8aaafee47", "comment": "Malware payload (Amadey)", "value": "93a461e15765f2aa8028a09f61f3131df4e1488c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192353, "uuid": "40305c1f-bf0f-4ee7-ab0e-4ce065c55225", "comment": "Malware payload (Amadey)", "value": "257d52271b942a1b830a0db767a06835a674f4e5544899cc1f595ce9f3cfad060e95714560e3f1124d97462ba84707a8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192353, "uuid": "9f37bae1-a93b-44ad-adc3-1c3079b42377", "value": "T1CAD41206ABD88136EAB41BB458FB06931B37BDB24C38477B17858A5F5C72194F832736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192353, "uuid": "885ee033-0b5d-478a-a84e-7285e800f5fa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192353, "uuid": "1674e53a-3da6-4078-aa6a-104394000ccd", "value": "12288:3MrAy90fEKPAmUGRl9dvXQ+/jaCwKnwY:/yWd5j9RXQ37Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686192353, "uuid": "40cf5de8-7eeb-43a9-98fb-e4894cf64651", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686192353, "uuid": "843862c6-16bc-4bf7-8489-13c10c49e83f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192353, "uuid": "ec3638b3-ea23-40d2-b75c-15e865f07142", "value": "5d3db0228e7e74a77ec80ed014405439.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce60abc0-0609-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686234968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686234968, "uuid": "3e5e20d4-e337-45f2-9fcb-272a9b446e1a", "comment": "Malware payload (Amadey)", "value": "51bdb8551f1e2c94496ed9930a9b61aa", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686234968, "uuid": "1c15184d-4405-4ef8-9675-db98017a3613", "comment": "Malware payload (Amadey)", "value": "b96d28c0c43a8bc8c124dfbd69b03e2ea83c698024a7bd4e3770a2465e425c44", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686234968, "uuid": "d446b795-c9ca-4785-bdbc-746cbd411304", "comment": "Malware payload (Amadey)", "value": "3d99e2570bef52a6679c82b03822b60f874d1860", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686234968, "uuid": "79059e85-7cfd-4251-9d81-7e5d24bb9141", "comment": "Malware payload (Amadey)", "value": "463c068e88088182cfbc5f4a1da7f330475cddc00de50b8f348d3907bee55926055f3050d004463c7be4ea66e7c1b2be", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686234968, "uuid": "859ff4cc-a165-49d2-a509-67bae59cb77f", "value": "T19BF4230B37E88073DCB657F048F616531739BC6299B8963B578A2D5A4D73A81A130B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686234968, "uuid": "84e5f2ea-efdb-44d0-9602-a04f356f94ca", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686234968, "uuid": "c0436459-4867-40fc-bd29-ab6fcca1b338", "value": "12288:tMrDy905VLSJhCntGQ/xZxtHCjf/TkjpwUv9jrPqgv2amFks9yo9P92xsJ8D7XLp:6yeVfntGmtHYQlwG9X9vtMkAPMsI7F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686234968, "uuid": "8f41505c-49b2-44fd-9a09-07ddbcd864cb", "value": 790016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686234968, "uuid": "fc4f1171-a792-48e8-8e43-176570724b1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686234968, "uuid": "a994dd4f-d818-4bd0-aa8a-e573b241cb21", "value": "51bdb8551f1e2c94496ed9930a9b61aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a24852cd-062a-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686249067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686249067, "uuid": "4e657afc-69d3-42ef-a929-62e44b2d063c", "comment": "Malware payload", "value": "6860240392c808dabd36baa6685cb004", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686249067, "uuid": "b52a3fa3-8ac1-40f1-8ba4-21d15f2defb7", "comment": "Malware payload", "value": "b9bccbf332c6f942113a67885cedc8e916f1ee5818ce7a5cbe931af88bf43640", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686249067, "uuid": "271103c8-bfc1-4d44-b01a-dfb282b3a586", "comment": "Malware payload", "value": "4dc21b63d9e46a75fe4b2ce79f626515f5bf09a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686249067, "uuid": "af9b985f-e91b-4bf7-aba6-cc3a56c463ee", "comment": "Malware payload", "value": "d9030ce19abbaf066979342c57b69c5541838d37b702909c5cf18074516d5463c85c53a67e3f21cc70b759730e7cae16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686249067, "uuid": "283d76c6-c9d1-4053-9e74-bac74a65c209", "value": "T19554F1A6E6C4C6BAC2B40EFC5C28C1A479ADB9323E7714A7F9DD0F4D593D092690D183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686249067, "uuid": "f72e5db2-264a-402f-b7db-92d6ac91f56b", "value": "078683deeee217bf8224debb163055d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686249067, "uuid": "6dcff500-578e-4769-99e5-78b8fc99c8f6", "value": "6144:ImcD66RRj05JGmrpQsK3RD2u270jupCJsCxCI:BcD663hZ2zkPaCxj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686249067, "uuid": "742657d6-60fd-4ab9-a47e-a98a6f2eadf3", "value": 290304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686249067, "uuid": "62040501-3273-417e-b1d9-b33d055ef753", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686249067, "uuid": "5d7070ad-e29e-40e1-a6f9-6a5652db3d1f", "value": "b9bccbf332c6f942113a67885cedc8e916f1ee5818ce7a5cbe931af88bf43640", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57dcee50-05f5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686226179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226179, "uuid": "2529b54e-10d8-4f08-adeb-66ce04c55428", "comment": "Malware payload (Formbook)", "value": "295d07ed71635f16a105f69333fe48e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226179, "uuid": "61c8574b-d79e-4058-9995-0b4e3eaccabf", "comment": "Malware payload (Formbook)", "value": "baf6e6d6d8347f5151d3c260ca4d72694f5339b558294409cb7c4871616d8188", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226179, "uuid": "9ac3c8e7-ece2-4dbe-b123-d5517715d2db", "comment": "Malware payload (Formbook)", "value": "91fb748228ecad831836a0b2bef5a38057007685", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226179, "uuid": "3f51c159-4264-4b48-92be-f4e258991c60", "comment": "Malware payload (Formbook)", "value": "a218818e20325fabb1acfba49d85e9835a78762b91d9cc86371873ee36a9b9d499e89941e956427e5b3a22c54a78c2d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226179, "uuid": "7d666e58-0003-425f-9d6b-03108c885f72", "value": "T113F4125452BB8B7BC57F1BFE20615A3003F9138E7611E7478E83B0D96F2BB644A4291B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226179, "uuid": "e8c33d31-058c-4659-bf73-20a89552bdaf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226179, "uuid": "04268687-9d75-4ddf-8e52-1143a5bfcc82", "value": "12288:MHkmFx2iqNhujGjUSQFrmpSTLhNed1QbNEOyu9GcJ983KyJY/nhXfzgcK:MEmFxUAmpSvPebQZEhu9dEanlzJK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686226179, "uuid": "a5b47962-ed9c-41d3-8bca-6f786164e66d", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686226179, "uuid": "eb1df0a4-d44e-4e7d-adc8-958df6c8b22f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226179, "uuid": "b7952f5b-a4fa-4477-8478-86d2c9b29ce2", "value": "baf6e6d6d8347f5151d3c260ca4d72694f5339b558294409cb7c4871616d8188", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "534f7970-05c4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686205126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686205126, "uuid": "2fa3dda3-f02a-4dc9-bc88-c37efaf3a716", "comment": "Malware payload (Mirai)", "value": "0f7336663673db78dff0535d247745c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686205126, "uuid": "30450e47-9164-4037-9c6d-d890b3b04b35", "comment": "Malware payload (Mirai)", "value": "bb67c6baee42fb79dfff37f9677ec4c3ed2116232a6b940d563648d6bf35a7f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686205126, "uuid": "1339894d-de91-4c76-9d65-b46512e77153", "comment": "Malware payload (Mirai)", "value": "424c036dc39e931a5a4106de4885be31bcdf9616", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686205126, "uuid": "4de0da37-6638-4058-a687-d78212177ef4", "comment": "Malware payload (Mirai)", "value": "2cdd157d4dba07e88bd7dffabbda5c14b36071d135fceed00b32af284e6a1b7d12cc8b14216ab7441ceb52dccd675157", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686205126, "uuid": "c1d574ed-c917-488b-b10d-0e5b68e7fd44", "value": "T16B534A217A792E17C4E4A07E25B38324B6E5678E32B8C65D7C723F4EFF1066064171B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686205126, "uuid": "ea40265c-eae4-44c6-8476-357fdfa956b0", "value": "1536:IDK6bb9lTEFq1X6JySbe7M/Tbrv0kvGpdYm+A:mKQ27be7M/Tc0sN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686205126, "uuid": "5aede28e-33bf-45a0-a5b7-2a0b0b8c7216", "value": 64320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686205126, "uuid": "4206145d-535a-4988-81e2-a0ae4ae32921", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686205126, "uuid": "d5cfac92-64cf-4cd5-9699-4c855b655495", "value": "0f7336663673db78dff0535d247745c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed7ccfac-05ec-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686222564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686222564, "uuid": "633107de-6f12-41b6-97c2-51086335f9c1", "comment": "Malware payload", "value": "3487763f09d132b5f46d9bfdad6bc41e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686222564, "uuid": "b29e107c-cdfe-4eb8-b97e-b13eb486a127", "comment": "Malware payload", "value": "bc6d7cdbd6027cab971b5bda0f65df8260d4dcd0e3267aef2fcad25dab0e912c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686222564, "uuid": "7605f158-1d27-414c-b241-f39d058e03c4", "comment": "Malware payload", "value": "bef01f69be6bfe71d6b089a65b78aadc17b84277", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686222564, "uuid": "45dd50db-7f08-48d9-b34e-1df8fe06c9e6", "comment": "Malware payload", "value": "1dfba32753f2e00de051eabb36b42a70e39bf602ace710701b68e8926fdc767848acb329f4a4bd67a83c5b2afb3450f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686222564, "uuid": "9d1d859c-9dc7-4481-bd7d-39960f174337", "value": "T102A4128CF9575EF8E50E9A363818783F99939E82BC122787595B80C11C8479B7D9F2C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686222564, "uuid": "b37df58f-51b3-49ef-83a3-0cd714eaa620", "value": "12288:anDd2XYwCvbWvm62d73ebp3Umpv/nd2S/T/rVMoKao:aDduYw0obcOJlrC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686222564, "uuid": "b6d3bf11-5a16-4140-a782-4030cc0f7080", "value": 467456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686222564, "uuid": "f1c234af-6240-4cf8-b377-26b746f7451a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686222564, "uuid": "00ab5212-c56d-4ec6-8b70-058f7d29089a", "value": "bc6d7cdbd6027cab971b5bda0f65df8260d4dcd0e3267aef2fcad25dab0e912c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "010bc8e8-05a8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686192962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192962, "uuid": "a4c6383c-591b-4cb0-ad5e-e3567f12ef22", "comment": "Malware payload (Amadey)", "value": "fe0424bb5f835bb981e7a73ad2b2d725", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192962, "uuid": "3eb50795-af3e-44bd-a28d-4fddd1b80d03", "comment": "Malware payload (Amadey)", "value": "bd4521ee22c426419a3d81ec1ee3872f2b8c466047fbef87572f1b7345a238d0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192962, "uuid": "1acd9a31-5bea-4ecf-95f9-d2b25f0f73a7", "comment": "Malware payload (Amadey)", "value": "62de5b98caf45076648bb51430261e808f0dbcd9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192962, "uuid": "0f4aa85d-2128-4c37-98ca-50d5e181bf41", "comment": "Malware payload (Amadey)", "value": "dfa676884a3424dd84d529f0bc8491dd76d888861622b905c2760975c83b53449f38514726f1272ad860ea61cb058cca", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192962, "uuid": "34bbc63e-3670-415e-a8b9-49b596cf771d", "value": "T142D41202B6D89473E9B4237098FB13871B31BDA19DB8676F7354AD9A0C722D4A53133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192962, "uuid": "7404d109-763b-442d-806f-ceecf36f3b49", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192962, "uuid": "03e46226-0c1a-43da-ba08-7a681d5f4af4", "value": "12288:YMrIy90GZA8cRUeWaqvtrOmZwSfJL29FyYou:gyTKDqhFZwSIVou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686192962, "uuid": "f6024cc0-96cf-4ab0-bc0a-d459a9132ba4", "value": 605696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686192962, "uuid": "a6e70a26-29c5-471f-9b09-242e1b24a6e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192962, "uuid": "f87cdff4-783f-4753-91a1-c263d531e5e4", "value": "fe0424bb5f835bb981e7a73ad2b2d725.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76d79181-0619-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686241693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241693, "uuid": "121c925c-80f2-42c7-bbd5-f1cd151bf72b", "comment": "Malware payload", "value": "054ef16ea11dd61f746c60d7ddad8cf9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241693, "uuid": "2eace058-3582-4be9-bcc3-8473f561d965", "comment": "Malware payload", "value": "bdda59259acb860fde79314444343d65a797a50bbd0708ba26aec89d6aae227a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241693, "uuid": "96646bf9-744f-4909-8b88-531e3ec70230", "comment": "Malware payload", "value": "a288eec3f68d56a7e46aa23ceebecd8f12e699fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241693, "uuid": "9193895d-1970-480a-91a4-6bca5ce7fa38", "comment": "Malware payload", "value": "8203d5a51d297c893f4b426514567549d0b13833cc566d4afaacb41df522d632f30f1439d2c6bce436d6af3a116fb770", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241693, "uuid": "eb1f3ce9-2e39-48c8-b975-983b84fcbf32", "value": "T18E827B95B314C9EEC1D405321C23DAB876203D3E8E285E073BE86B1F3E32756EC16A56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241693, "uuid": "1a9bc920-76c6-4c98-a479-4afc8b703843", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241693, "uuid": "99c3dca5-5600-45e1-899b-3dacac878e07", "value": "384:pLDTs8hsF6qtK8lzQ8+Sych3mYvCPHxVQV:pLXVhaTtDE8VfCPHxA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686241693, "uuid": "07c690ec-4344-48de-8769-c21cc428a5fe", "value": 17819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686241693, "uuid": "3eda6514-a80f-49e2-b8cb-7165317c867b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241693, "uuid": "6568e2d1-ba4a-43ee-8ac0-e98d5ccc74ef", "value": "SecuriteInfo.com.HEUR.26359.3577", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90c5c8d1-05ce-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1686209524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686209524, "uuid": "80ec00e9-1fc1-4fbe-be4b-8f31155a83c0", "comment": "Malware payload (AveMariaRAT)", "value": "1190c6a8211a23925ec5342f1b457192", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686209524, "uuid": "8638ca13-1d41-448b-90e3-949f7e4ca273", "comment": "Malware payload (AveMariaRAT)", "value": "be1d695a2d40d12c961f141f6837bc5b5203989ce206c2d66bb531c21c2dbe7a", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686209524, "uuid": "78535b52-a92a-4b8d-ae7d-92a162a369d4", "comment": "Malware payload (AveMariaRAT)", "value": "3d224b83ec6d59569935987f577df3547f83e4f6", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686209524, "uuid": "8bdb6517-b20c-470b-9fac-c393d02577cc", "comment": "Malware payload (AveMariaRAT)", "value": "9b5307c6efbfb932ca4a5bff525c1e1fd8be49b25715abe5fa549c91f0fde1bce0f8de10b7e51870bc01559fc76819e7", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686209524, "uuid": "7f5ff19f-3640-4aad-b1bc-08d08fad5355", "value": "T1DD045A9D766072EFC867C4729EA85C78FA6074BB831B4613942356EE9E0C897CF150F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686209524, "uuid": "06c382b1-c9a4-4d96-af4d-429d4ec22e18", "value": "3072:SNgBjhLw49ZxCvX3vVjAtryaRWqQM18q1p7hBqN:SmBlnDI/VjAtrZRGMv1p7hBq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686209524, "uuid": "057ae8c9-5ef2-42da-8d27-34baeb725cac", "value": 182784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686209524, "uuid": "13a21a8f-c841-418b-91aa-463206331607", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686209524, "uuid": "d6a5cec3-d33d-4119-a15a-e009ba58dd97", "value": "1190c6a8211a23925ec5342f1b457192", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27c1134f-05e5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (WannaCry)", "timestamp": 1686219226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219226, "uuid": "b4eec0a2-3288-4163-9c21-0788a3befc87", "comment": "Malware payload (WannaCry)", "value": "5c7fb0927db37372da25f270708103a2", "object_relation": "md5", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219226, "uuid": "73b2237b-9572-44f5-ba52-975f8bddc18f", "comment": "Malware payload (WannaCry)", "value": "be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844", "object_relation": "sha256", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219226, "uuid": "9711bf9f-7b3c-4513-a053-036eb37d5a7f", "comment": "Malware payload (WannaCry)", "value": "120ed9279d85cbfa56e5b7779ffa7162074f7a29", "object_relation": "sha1", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219226, "uuid": "a84e41a9-2c3a-497d-ba7a-8f2fb716bc17", "comment": "Malware payload (WannaCry)", "value": "e318bffae79db34f76561004364dd9bd473d8d1e3b82af3368b7ab49924c5f190d2e3cfd739fe927984d749f172c7cae", "object_relation": "sha3-384", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219226, "uuid": "e0e4dd39-a91a-49a9-bc35-116269eabec0", "value": "T1A024015A7A61877FD0B20532746194FB4EFE0DD3F5A89A4FE74D0A501F048884BE3A9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219226, "uuid": "210a0620-719d-4dc1-964a-cedc327284be", "value": "e858a14f217810d78466806d95d7fceb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219226, "uuid": "c982156c-df5f-4dd6-ad87-1cf2c21061d3", "value": "3072:Y059femWRwTs/dbelj0X8/j84pcRXPlU3Upt3or4H84lK8PtpLzLsR/EfcZ:+5RwTs/dSXj84mRXPemxdBlPvLzLeZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686219226, "uuid": "13f6f392-e092-4acf-b1a6-e113d1df9ab0", "value": 229376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686219226, "uuid": "5ca38056-7cd4-466f-99f0-e836642daaf0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219226, "uuid": "f8026df3-7697-45ee-ae44-53920b602f2b", "value": "WannaCry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2631e83b-05bc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686201614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201614, "uuid": "f27e0b0d-2a65-4bc9-9cb9-c443b77e00b0", "comment": "Malware payload (Formbook)", "value": "f773fdea0e32c51ffea025bc50767210", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201614, "uuid": "1f81d3e5-4449-4cfe-b526-96c8a807d7fa", "comment": "Malware payload (Formbook)", "value": "be7759c8997e5beb025ae36862d8701528df5f617c7e5fa56a2fbc7299b90289", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201614, "uuid": "6d95520d-289b-45e4-a4d2-e0071631d043", "comment": "Malware payload (Formbook)", "value": "b2da34d1fe1220d90729226445b5bdbd26648e4f", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201614, "uuid": "9b3a4e5f-b1c9-40a6-80ab-348459e24f4e", "comment": "Malware payload (Formbook)", "value": "44e22588a8b952741fb093fb975111d7cd57671b057d04f1a727e4a7cc2f3ab13556a92c3adf7a708cc7ab2fa62fd974", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686201614, "uuid": "da7a045c-dca7-48c6-9594-e98bce07fdae", "value": "T15BB2D4565B8C4C51F36AE8B7824DE00E09BCF22A31C255E5BD9DE2707B7D14E0B6B1B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686201614, "uuid": "c6812695-27dc-432c-9685-1a799acb2b0a", "value": "384:dWCh4G/cSNntDwgmlux190sIIw8AzuMtataYIxi9j2Lh3Wi7y+lXTWD5+Z10hqi:dWehESU3cX90sI8K7ataFxi9ytHyoXTM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686201614, "uuid": "a335aa64-f610-4243-a365-24b3ac2cd20f", "value": 23611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686201614, "uuid": "bafd1ef8-2e3f-4a7b-95b5-55a084ac094f", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686201614, "uuid": "435e131a-02fc-495b-8d05-93c7d6c42107", "value": "f773fdea0e32c51ffea025bc50767210", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cdb82a3-05af-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Adware.Generic)", "timestamp": 1686196015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686196015, "uuid": "5c9275e0-d9dd-4dfd-ac34-7145373c4640", "comment": "Malware payload (Adware.Generic)", "value": "4b921412e7a61d828cb6b78726747c5e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686196015, "uuid": "b64f434f-5034-413f-9e85-8d0761f052a6", "comment": "Malware payload (Adware.Generic)", "value": "bfe85700c95ee65a50c47769f003c792d9b7cc407359a6d6df795c3bbb3fef8b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686196015, "uuid": "8423f8dd-32be-4d40-a6fb-48b240661ca9", "comment": "Malware payload (Adware.Generic)", "value": "ed7824bee1b817104b5555391b8763abee9636cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686196015, "uuid": "6595bfa5-7337-42e2-9954-833292920592", "comment": "Malware payload (Adware.Generic)", "value": "576f1cfe3292a8529b767b55fc9b6ac86b0bc490985a0cf7bcd799ce12c2147b9fab91d565cbae0014db68b6a9ab8692", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686196015, "uuid": "059166fa-d13c-44af-a9e5-f9bad0e8bf1a", "value": "T1B9F633623B59CC98E2B1C4F8297D4F84F87D89661D5785F8DBE68CE114B8EB8748F006", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686196015, "uuid": "2b6555a4-9619-4e01-82b6-d765cf9a1b51", "value": "f5151e63f951542420f03e2fa50c82d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686196015, "uuid": "27137560-d3d4-4712-af55-e11d374af561", "value": "393216:9S9Q6sx8CfDNhWJ36Yt/MENAzN7pHlY2/E3oXtrP:9S98NBkBt/fYdHl1IU5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686196015, "uuid": "34a1ed9c-d27c-4650-9dd0-1ff263039162", "value": 16251554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686196015, "uuid": "2b59b516-402d-46c6-9d72-460c6fb8f4ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686196015, "uuid": "6d71292a-a6eb-4c10-affd-4d26e77dafdd", "value": "4b921412e7a61d828cb6b78726747c5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dc93c7c-05e5-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686219397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219397, "uuid": "2a830a5e-e093-43b9-a21b-3a157a81b4bd", "comment": "Malware payload", "value": "271e93707156e7d56318251f6f906c1f", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219397, "uuid": "d7253301-85d9-442c-8790-faa1733bda2e", "comment": "Malware payload", "value": "c0681509c5c0f9e4abd2093c0011ec1a6a637910eaa2ccfeeff5dd1445d1c93e", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219397, "uuid": "3acfeec3-0f21-4676-87e2-ded44a1449b6", "comment": "Malware payload", "value": "99a03fa61d42d59ec442c11525fd9159546150fa", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219397, "uuid": "9bbf119d-0200-403a-8a54-813e9c672572", "comment": "Malware payload", "value": "40fd921abcdcf96e51e9a1ce46998ebf83ccd9e6d6e61910ef44f8aac75011aa2a2f503b33d14a6ad74ece10a1be42a1", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219397, "uuid": "28684831-81fc-4a9c-a6ec-677e1e5498a8", "value": "T19A32642298C25430924B987C6C9BA8076F253C43971C31623EFDA3C87F8956573BADED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219397, "uuid": "d2ad333e-125f-44be-9ed1-96ef9e3bb3a7", "value": "192:yAGI2g/IOwWb1jkdsvxtMwv3tMwvhMdCTk6dli3sY8QnGFnl7+7Dx:pP2g/IOwWb1IdsvxtMwv3tMwv9k6fi3v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686219397, "uuid": "543cf6ad-f329-4384-8ee8-68f9874350bf", "value": 11871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686219397, "uuid": "ec72354b-28db-467c-8045-a0ea91940dc8", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219397, "uuid": "b0b830e2-27e6-40dc-ac9d-b05d69a91e47", "value": "discord_token_grabber.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9443260-05d0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1686210424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686210424, "uuid": "121821be-b1df-4cb4-b0b3-dc9ab3a2f9ce", "comment": "Malware payload (RemcosRAT)", "value": "859f5ba01acb6e8183db471ce9dd1ba9", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686210424, "uuid": "a016e4fe-50c6-405e-8f8d-f64cbe36cc17", "comment": "Malware payload (RemcosRAT)", "value": "c1a155ea8051e4e8af694595085b4562aa0c3ff48f89d3cb043f6d4b4e8bb54f", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686210424, "uuid": "d8fc4041-fbd2-4aad-92f8-73633ff62ccf", "comment": "Malware payload (RemcosRAT)", "value": "67ea7a6605c4e52f9f32c21207d050309bdaa2dc", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686210424, "uuid": "6908ef5c-5525-4d38-bb67-b9fe3e4e77df", "comment": "Malware payload (RemcosRAT)", "value": "a8c98c708589112b1a43b3cd63761c53921700cfdc4281e2d4d8b64064cb5b2c39b2d81b6e85d2623a93e2f44d0fd917", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686210424, "uuid": "7f5d0779-a688-4020-a9ba-7b1ffb492e16", "value": "T16DB4F19D364032EFC867D4B2DDA41D69EA60797A871B4103E0271AEEED0D98BDF510F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686210424, "uuid": "62baa4f7-05d1-45a3-a10a-b19c6ee82095", "value": "12288:kiBKXNtqhbdE3Gkk4bUbPraTgZSi4XU7CqVUIJI:Jht4grraU6XP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686210424, "uuid": "8eab6d8f-7d24-4c3f-ab9a-df340f8ada03", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686210424, "uuid": "54bb2d8c-127d-4ac7-9333-d0b87390e00a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686210424, "uuid": "1796b443-ac00-4311-b8eb-aa77079b9cf0", "value": "859f5ba01acb6e8183db471ce9dd1ba9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e12c8d6-0619-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686241705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241705, "uuid": "7cc45ec2-a8d7-4aa7-b7d5-652325479a4f", "comment": "Malware payload", "value": "7d0ccdf350aae894376740b79763677f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241705, "uuid": "0823e548-e163-4ad0-8925-27128712e774", "comment": "Malware payload", "value": "c1a1d3bf4335b5a2ede874eff567118768d19b9cf60491341337d9738c2628a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241705, "uuid": "00d215e3-5f75-44b6-9f89-f34371b8d68f", "comment": "Malware payload", "value": "eae8d3703d51de7c9cd1d0d8706ecf182757bf75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241705, "uuid": "143e137c-5664-42c2-8f49-cc6f43931d80", "comment": "Malware payload", "value": "941cbcf68bf42ab7b6535477aba31032c0c19b3f72eb403042a19951c42bc45d604dc533c0fec8eff6efe68532840366", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241705, "uuid": "dceb5683-4561-4d9c-9b2e-2037567273fc", "value": "T171E372330DB20406F25F43323B21F4B6191B4F25141D8BAE57AA97AEC5612E78EC9FE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241705, "uuid": "fc17ba1c-1348-4f90-9f49-6bad5123c665", "value": "1536:ZBrJvV+WcnZ8Ze7YG3kxanQ9XztFDSwMZZf+eaSOIZ:DJcZW23kxanQ9Xz/UZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686241705, "uuid": "2eb7465d-b097-4779-9294-8d058ccd278b", "value": 143360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686241705, "uuid": "ebff3e7c-7460-4c36-9b3e-488e3fcf00e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241705, "uuid": "3ea14d7a-4da4-47db-ae3b-ce154e9e3944", "value": "SecuriteInfo.com.Heuristic.HEUR.AGEN.1333029.10879.5802", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85b97988-0619-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686241718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241718, "uuid": "c34562a0-5775-4579-a6f8-6ff467730ac8", "comment": "Malware payload", "value": "2b14e1c4580c1f68761cdb17b6b867b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241718, "uuid": "23626e79-622b-4635-9aaa-a5187388a854", "comment": "Malware payload", "value": "c26e5f4ec1a3a96dd79e4f44040d665bd2df2f36f349867ad4accf0d1a907e0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241718, "uuid": "65fbbecb-5616-4ed8-afcc-2589cb9bee1c", "comment": "Malware payload", "value": "9ab5a26d5afc887d8a3450fa45607610e404cc32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241718, "uuid": "8f2291ed-4f9f-4268-96e5-2b4362bae39f", "comment": "Malware payload", "value": "fc5d0a1bad6cc7031c5682ec47bd0bf8d9ca722842851369a3ade5e1f0d5a96f8c7ce4035c239d3b9b4e9366fa9a6369", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241718, "uuid": "23eb0c59-36a6-4ef7-8263-87bcb3814c46", "value": "T136B56C21BE4DC40AC1731636B917C6E82437BF56BD24654726A87E4CFF743833A352AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241718, "uuid": "72ea791e-a67e-46e6-a744-2b398e35b990", "value": "24576:abEp9ckDZq8Nnct8015ILqXe2kQ6Uy0RD1O3I67KxhLv5It7nmhFwPgE:mdRSo9qI64LhmY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686241718, "uuid": "ed6eb129-067d-4ea8-bd15-039d0bd650d6", "value": 2355200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686241718, "uuid": "6e672149-6ea0-43f4-8ec6-b3b096ab78f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241718, "uuid": "3f24b76b-552c-49af-82dd-07ca461c25d3", "value": "SecuriteInfo.com.Trojan-PWS.Win32.Gamec.15511.16779", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "796d56d3-05e3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DarkTortilla)", "timestamp": 1686218504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686218504, "uuid": "a8ad9a25-6574-4646-b173-82294c088b07", "comment": "Malware payload (DarkTortilla)", "value": "06bea8535053721aa3a02d3763e74cd1", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686218504, "uuid": "6bc1453b-3083-42cf-b653-3909280c3ff6", "comment": "Malware payload (DarkTortilla)", "value": "c292360e639b02804a004aa4a73771fab48657061b6be12fbce9fccd233f1dd4", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686218504, "uuid": "502a8825-89f0-4fdb-b5f0-2d1b3c017c2e", "comment": "Malware payload (DarkTortilla)", "value": "579ca976f7f9d92eaca4733af6c4f9052be8904e", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686218504, "uuid": "20159e28-1fb1-4a97-a0e0-9cc9c696e1e0", "comment": "Malware payload (DarkTortilla)", "value": "a4b517cd4da86ae7a122dfde31f5c9cb076de2f383a153d4eeaa6a373c10860ad5c4ea681b06edc91c488e75b2b4faf6", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686218504, "uuid": "8460ebcb-5455-4b04-ac4d-72c2e8eac520", "value": "T1C1A4E1648E28BADDE1FD033980F0080B51F4FA7845C9CE8A9D3B65E50A73B55E7660ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686218504, "uuid": "7019b876-bd1f-4298-af1a-d73e8a765703", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686218504, "uuid": "cf1a7e16-90ad-41ee-b16f-bd869f42bdd0", "value": "6144:Ycep15yXrwl+QAdxWfqjk3IYH8Q2kbV7Sat1+eUJMwSiizJmdC3d5Cdy:FepHyX2+Q6gmk12kka/ZzT9+Ct5CE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686218504, "uuid": "99ffa9f2-d383-48da-b836-5d01378d4fa3", "value": 487176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686218504, "uuid": "970adf54-b60a-40b8-a9c4-98fbb10f0dc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686218504, "uuid": "f54a0a65-a80a-42e9-87c4-a36d43fbdb46", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbcd9110-05e6-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686220012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220012, "uuid": "24e5b622-1a10-4b44-b197-dbcd45d56f02", "comment": "Malware payload", "value": "022aee066b65039dde6dd2bd7d36669a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220012, "uuid": "08aeeb99-2a84-40ea-8270-5e5c3d79f2d2", "comment": "Malware payload", "value": "c2f6c30ed608d3ae1828d6af2aaf97052bc41b409e5b820ffb3f99dccfc0813c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220012, "uuid": "be8aab4c-a93a-4009-8ebc-45c956a18c19", "comment": "Malware payload", "value": "b9505e695b50da3b332042f7b0b9324c67f76c05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220012, "uuid": "3325eaa1-edcc-4dc8-bcb4-d65deec6f42b", "comment": "Malware payload", "value": "48d3dc00812c0e78dffcb75e641b33c8887541e59765ce0bcd49cc769a9b327c9f21a1dfacf7098d054026c02c6de90a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220012, "uuid": "12e0eec5-3a74-4bab-84d9-9ae1b6512d79", "value": "T1D832F920731CC173CA3647B65893A7810376A3165021EFDFACC851EA9DE37158A93BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220012, "uuid": "3878b822-6d01-4241-9cf9-a7fa7050ba9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220012, "uuid": "404cbbd0-5957-487a-bec4-76cb67cfc557", "value": "192:eiTffffnLoLsKLmL1L5B3FlLBnIYGslY43jP4Rj/CFunQ:eiTffffnLoLsKLmL1L5TlL5IYGmn0ROm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686220012, "uuid": "d806098b-12a6-40dd-9db7-f7a0c5ce6622", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686220012, "uuid": "f9a522f3-967a-4d4c-a539-7c0e45c2d539", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220012, "uuid": "8d04a1a2-193f-42db-8907-5bd1a27bdb5e", "value": "c2f6c30ed608d3ae1828d6af2aaf97052bc41b409e5b820ffb3f99dccfc0813c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8d7259d-0620-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686244783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686244783, "uuid": "fb71af68-60eb-4063-9cf1-331b9e845e16", "comment": "Malware payload", "value": "cf5445318cc8fb5dcc080a98092ea918", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686244783, "uuid": "eb639fa8-a26f-44a7-87d3-d12147cfc42d", "comment": "Malware payload", "value": "c31f2aad3e0e00d5fe09571d3a82663025da6715974807b7763bb22d6907f1df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686244783, "uuid": "f6b176c5-a968-4d97-8084-9f43fb92a797", "comment": "Malware payload", "value": "7a6fb3af2404f36810d8fc2dffe41b61350adcd6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686244783, "uuid": "8d056585-4fe4-48ba-9830-013ef9e86326", "comment": "Malware payload", "value": "5c29ef0441b7d02e0a819784ee03e16f0c158dff55c7a72cd8cfa87210b43aba312afbe155a745e71511c71cd6d10020", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686244783, "uuid": "67f532bb-668b-4f22-ba62-8e2a498dbd9a", "value": "T11CF2F26DF1846F718095AF380B48893A41477CFAFF3060BEE4175B9DA961729E878DC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686244783, "uuid": "078caab4-6618-4f35-a76f-a868e048333e", "value": "768:b5GTdy4MrmfXf/aVrLhGVX8StDVzX/3l3WtEPaCR4Pfs+s:cAZRVLktD9vl3sEPaC6Ps", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686244783, "uuid": "053a673e-b9a8-4843-a64d-8910383583b9", "value": 37199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686244783, "uuid": "a4f67434-04a8-413e-a6da-e8bf462f9109", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686244783, "uuid": "74506e88-6ebd-48c2-9ac2-f4046a9411fe", "value": "10720996837.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ce4198e-05c4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686205088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686205088, "uuid": "18aab983-305b-492d-bd9a-966e7b0dc7c4", "comment": "Malware payload (Mirai)", "value": "5bc3902a76a9258fa73e198ac4457289", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686205088, "uuid": "3010d88c-8362-42ce-bd8a-50b27a0dd442", "comment": "Malware payload (Mirai)", "value": "c454f29af81f51f2b048f11bd43ddd8501cb40fa18299722916c223cfe4113cd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686205088, "uuid": "d89a6636-82af-49cc-be60-4fb73c11ae51", "comment": "Malware payload (Mirai)", "value": "a4e07b1e25250dbd67b340a62cd9683d782ea5bf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686205088, "uuid": "1fb97aa3-a1c6-4594-9608-682bedfe8688", "comment": "Malware payload (Mirai)", "value": "5774c22749d288db8efd0ef5e935c0fe1bc6f2bbff9fe39e65e6ba3e7bf023627c7c875a82c457b9233417c5aec53783", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686205088, "uuid": "761775f8-e687-443d-9a2c-f7a205278cc2", "value": "T135338D36C87F6DA8C5444638B82249342F63F50885A7AEFA9BC187655047FFCF6183E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686205088, "uuid": "b9e0888b-7f6d-412d-9261-5c2dd38d7350", "value": "1536:0ndIcnkW5wtdl4ZhTZJNexd+3+4keEtCQ2d42+:0nFnkW5IEreO+4ke0I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686205088, "uuid": "efcb156d-45a2-4e0a-9e5e-c29765bd43b2", "value": 55116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686205088, "uuid": "eee8f443-797d-46be-91e9-bf97ef8c5bbd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686205088, "uuid": "e4579c9e-474d-4739-9e81-fbfbc248076d", "value": "5bc3902a76a9258fa73e198ac4457289", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd6d56df-063f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686258132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686258132, "uuid": "2e20d932-de71-420f-97a4-8f110728ad1b", "comment": "Malware payload (Mirai)", "value": "c06208b1698fb5333f6847075e3fc716", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686258132, "uuid": "fe2db90e-f54e-4bcd-8d02-c8ade2db86df", "comment": "Malware payload (Mirai)", "value": "c4578e27d1801822f188fc1e3d9361e03edf73417cfc64961f7514dac8629005", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686258132, "uuid": "0695ff3f-ce71-45b6-90ab-774cd816c1c3", "comment": "Malware payload (Mirai)", "value": "dbe96ff50e4a68be43ec3ec540e188f0dd830e8b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686258132, "uuid": "9cc24af5-b9bf-4656-994c-d48429417658", "comment": "Malware payload (Mirai)", "value": "ec28729ee2cf3300de4f912bb870b2988f74ed625bc86d436563fa27b8f214cd865e198d4c1fc91080cc1a47b4ece9eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686258132, "uuid": "6c9bb355-7b04-43d0-a26b-49fc3813a0bd", "value": "T15282C03460977074CBF00931F5BECA82671A4BB8E1FC32930A55B7BDCD4610A95B81EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686258132, "uuid": "3bb6010b-13db-4a12-950a-2b9ab599de08", "value": "384:MnfzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUM/qajEwhymdGUop5h5la:2dV0P6+kom0tVAoNvm+tgAs3Uoznla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686258132, "uuid": "8bc5c989-a757-4446-8d65-51fc3c74fecc", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686258132, "uuid": "a24ca81c-2ce0-43e8-97a2-363477b9ac54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686258132, "uuid": "0b66ee2c-13de-4974-9d78-a6343d8791bc", "value": "c06208b1698fb5333f6847075e3fc716", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40ba3e40-05cc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1686208531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686208531, "uuid": "a6ea3b90-285f-46d3-85fc-1a9feefe1e7f", "comment": "Malware payload (RemcosRAT)", "value": "12f1f8b544a44c9e417a7265a4c02a4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686208531, "uuid": "e35ede88-d455-41a9-886a-12123a3e0506", "comment": "Malware payload (RemcosRAT)", "value": "c4a1a8af4c1336e8e69e1914959cbf3bc4bfe5221639a163244d19fd60e8af19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686208531, "uuid": "e6ea342b-b010-4d53-9f17-22667741af7e", "comment": "Malware payload (RemcosRAT)", "value": "20b172d83dcdb9974b8e222f14ea1e48eeccbfbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686208531, "uuid": "b31feaed-db6d-4b8f-9ccc-3640d49b3991", "comment": "Malware payload (RemcosRAT)", "value": "ff33482281848972951acc16e7e7f52d68ad833fae9a809aaa314a6b8a0cfe5b21bc926727c033e4e77dddd294ef4d6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686208531, "uuid": "26a15849-1285-4e24-8dc0-f49d5ca24b92", "value": "T11474125875A5C22BEB6B4F704A66E73A3DB0DF82185051072B31FB2EBD727D0851F285", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686208531, "uuid": "35cf2ec3-fdc9-4441-8789-19e18eade3fc", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686208531, "uuid": "ea6c984a-2064-4824-ad62-3073ae5f778a", "value": "6144:tIw3EwpCED/b1Myi5LQyUXme7HkSv7QFkMaTfKSzRm9C42+krMwUuDP:Aob1MyaQLmesdhgRmIdgyz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686208531, "uuid": "08bdd605-f928-4365-abc7-89fdd64f2b94", "value": 356880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686208531, "uuid": "f4bc5664-a36a-4559-88f7-80a452c743f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686208531, "uuid": "aed96de3-586f-48cc-9e6e-57b50dc9001f", "value": "OFFER REQUEST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f0df721-05c3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686204636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204636, "uuid": "4c779908-54c7-49bb-be40-aa280a9ec0b5", "comment": "Malware payload (Mirai)", "value": "c4380b16dd8db82a3a94902ad9b7b13e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204636, "uuid": "ec5f5cfa-f04e-41b6-a498-8e729544da40", "comment": "Malware payload (Mirai)", "value": "c4dd60a1722e6b8b81a135ee0e7c488fc5017fed90337630e3fad46d60377fe7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204636, "uuid": "2472e88f-2d1b-482e-a0ef-35eb8530159e", "comment": "Malware payload (Mirai)", "value": "cec5bb373fa43c048c317250a98f3a01cc8c77c2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204636, "uuid": "1ece3fb1-37ed-4ac3-bc7e-bb54c9894ff6", "comment": "Malware payload (Mirai)", "value": "ec3ea43a03e51898c1be438b3f35cc5849de1ca9421aa08796c1f44b1e9e9fa40cf21259e58255f01ab2c449cbe4c419", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204636, "uuid": "ddc76508-3308-4d19-8c87-2b82579183fc", "value": "T12D63E40AEF514EBBDC6FDD3706B9074231CC665712A93B3A3534D92CB64A54B0AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204636, "uuid": "a14ad8d7-24a3-4279-8291-aac32d82dfb0", "value": "1536:2tZAbKVSrdMzSUF6RJ32yZVg6VJlpRX81puQn2Pnib:2tZAbJo6RwyTdQn2ab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686204636, "uuid": "5292d2f5-5156-479a-a129-1097f86659ad", "value": 72976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686204636, "uuid": "35d588e9-7905-45fd-85bc-b5e2c3271301", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204636, "uuid": "6cc14c0d-6fc4-4905-ba8a-880bfc564f6e", "value": "c4380b16dd8db82a3a94902ad9b7b13e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cd4c4bf-0619-11ee-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1686241515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241515, "uuid": "6ae1ad83-19db-4dcf-b39a-79f2a94cc0a5", "comment": "Malware payload (njrat)", "value": "08b26b1bd71c6db9358c52230f0a87e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241515, "uuid": "45393d0a-89ce-4638-87a7-1b1cb5af19fd", "comment": "Malware payload (njrat)", "value": "c56f7b994707861555b133c1826ddf02745007d10b457cf50172a170f5d933f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241515, "uuid": "7e98038f-afce-4501-8048-436704ca77d3", "comment": "Malware payload (njrat)", "value": "46b37b3294362c6039316d94096c8bb8d9efec07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241515, "uuid": "b564eeb2-0bf9-4f52-a880-53af563cca77", "comment": "Malware payload (njrat)", "value": "c13f90335eb4f64c524e5643965e46f275b081bc4058ded2916a73bf915aca5c9b21084145f4ba8ad8b179294e02284c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241515, "uuid": "3ce2a4b7-40a1-499f-8834-482b3070e200", "value": "T137B2194E3FA98856C5AC1B74CAB5961003B491470413EE2FCCC564DBAFB3AD92D4CAF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241515, "uuid": "86c45b86-1ddb-420a-9072-74fd6a82c014", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241515, "uuid": "87d86184-c3b2-4a4f-a29f-a33a3476545c", "value": "384:FXc68yCasVKDh3OQyNpsQ1im/VjJs+PyR46vg5J++p57nhmRvR6JZlbw8hqIusZ6:FD873Kt+QesGN/VjZPQRpcnuL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686241515, "uuid": "270d406b-2d2c-4632-89e5-d17ad75249ce", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686241515, "uuid": "c039b960-ffbb-432e-813c-f98eb8b7761a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241515, "uuid": "7dee3c7d-29d5-467f-b4e1-428868e7f242", "value": "08b26b1bd71c6db9358c52230f0a87e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51602664-05a7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686192667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192667, "uuid": "41716e2c-10e8-45e5-af34-0baa0604e786", "comment": "Malware payload (RedLineStealer)", "value": "cc77acea6b5d95d9fd99968a561bcdfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192667, "uuid": "684c3c3d-2a4b-4fce-8344-38de395ce275", "comment": "Malware payload (RedLineStealer)", "value": "c7c1c17481aa68dabbfdf6da25de4263e932986cc1fedc7d7bcace207f639712", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192667, "uuid": "e123e9f1-e927-48c7-bc21-54d90d41c20c", "comment": "Malware payload (RedLineStealer)", "value": "1b46c5a5ff520608801926e8f59b2af25fa701a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192667, "uuid": "9e1cced4-dd83-4a9b-9e00-f983dc595679", "comment": "Malware payload (RedLineStealer)", "value": "d9ed47e96e57e3662ceb84b9119478c24d4866ab0dcc79b533ccb38aea6a4790e255685a5ff2fd181a3bf318e1c75d81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192667, "uuid": "67a0a6fd-2069-49fa-8243-63771deab87e", "value": "T1C9F41256F2D90161DDB10BB00DF622D30A32BCA15E7C536B1B44699E4973AC6BC72B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192667, "uuid": "db224490-86af-484f-aada-b1e950253519", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192667, "uuid": "21e092e5-171a-460c-9d0c-a8b527114db0", "value": "12288:ZMriy90vFDJ2Y1L6gpQ50t9P/shEEKg6BSrdu/c2RmfUhFAoH1Bu6IyOH9wRG:vyGAY1L6giUVMEEwBikcmWc66ID7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686192667, "uuid": "36ec5bdd-748c-47a7-b597-8df73b7d5438", "value": 740864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686192667, "uuid": "91ee0453-73a6-44cd-8de6-ea8f5a64962c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192667, "uuid": "0b4d9c7d-742e-4339-b8f9-2213196c61ed", "value": "cc77acea6b5d95d9fd99968a561bcdfb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f4c8df4-05a6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686192369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192369, "uuid": "227a746d-c249-4e19-a2af-c0258ad86d34", "comment": "Malware payload (Amadey)", "value": "1058f2d7db5719a14d697bf8e524bd8d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192369, "uuid": "ad18aa1b-548d-4cd5-940c-d5721ace2616", "comment": "Malware payload (Amadey)", "value": "c7fc4920432bf209c8df372a027a63ea03b5056acf0aefaa434a18342e24abac", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192369, "uuid": "3e9fa32b-987b-457a-bc19-6f7ecc0b25f4", "comment": "Malware payload (Amadey)", "value": "e698086f633a5e37232b431e6348037b5da52bd4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192369, "uuid": "1eb7899f-fe54-4bef-8d3f-c41306bf7ab1", "comment": "Malware payload (Amadey)", "value": "98c2833b4eda080f99fc40ab9620c36650dd8818e6cf883def89bdbb3af80f406c5839ced211ee5b8e492f0c4f464926", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192369, "uuid": "5e310b16-6276-4324-bd2b-0721ceca54f6", "value": "T189F41207E6D59832C8BA17F018FA07D30736BEA64975539B369DAC0A1C73684A1B137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192369, "uuid": "b6737c91-10f4-41d7-8bd2-115e76da7972", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192369, "uuid": "b67cdc8e-b5fa-415f-ace4-e4f05fec3acd", "value": "12288:yMruy90JB0pCOjgECt/CY7CxsB5hKF9muz7uS5qFHIAfvnxjkjSZ6Ap6ykWXI+he:MyUBcVCt/BexE5hKF9hr5qZIixjuSZ6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686192369, "uuid": "c01a5189-eeef-4793-8e7f-7b3b0c4f8f36", "value": 770048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686192369, "uuid": "f914311a-1fcb-449d-9fb4-ddf901aab404", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192369, "uuid": "1ece59cf-2e65-4e10-aa54-ce67c57f59f6", "value": "1058f2d7db5719a14d697bf8e524bd8d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e787f749-05ff-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686230715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230715, "uuid": "51ff7f33-c8ff-416d-a863-1261ddaf1d08", "comment": "Malware payload (AgentTesla)", "value": "09c693f0fbf78b8bc65a0ad7b78d501c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230715, "uuid": "a4c851bc-bf50-450a-8655-ded0457d0503", "comment": "Malware payload (AgentTesla)", "value": "c80eb3477fe87ce75b724d82194756e62b21860925664ee3782b0a1a7d7b925a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230715, "uuid": "22043b56-43a2-41df-acb3-51740cf72153", "comment": "Malware payload (AgentTesla)", "value": "5608c31627ced37a9c887de860c7e2a400d1b47c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230715, "uuid": "996d2e3e-ed66-472b-8f2b-0fe1419a872b", "comment": "Malware payload (AgentTesla)", "value": "f3afe3d5d62f0e296309f641878ba331a6cf7a3231400b8e81367d1cace2e98011be65bc97fef505edfc56d97fc8c17d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686230715, "uuid": "be4e1cd5-5f32-4f3e-9615-8b27cfc08c68", "value": "T1001590BC4C43E4EBEE78E23A95F02747B7291516765E398D22DA37414D83DC2B2D0A1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686230715, "uuid": "92487b36-5e1b-487f-bdb1-7fa3636259c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686230715, "uuid": "5498e0e6-4d66-415c-b2ea-f843a3eb97f0", "value": "12288:UZ/RRxHZiqYqNC2YxTHX5W7+O3izfCzVcwr+n:UZZHsqleTJ++O3iww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686230715, "uuid": "154b2b0d-c823-4da7-ba81-60868d657d90", "value": 944640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686230715, "uuid": "d6be9513-176b-4ab5-bb24-18395af0bfaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686230715, "uuid": "07fe86ec-5a9e-458d-b2ed-05a6df620784", "value": "div.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2130c15e-0642-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686259158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686259158, "uuid": "7e881ed6-54c1-40c2-812a-569bfeefc1ee", "comment": "Malware payload", "value": "5b252eb0df6b2ec35f1b812d777f7f54", "object_relation": "md5", "Tag": [ { "name": "555756", "colour": "#CED47B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686259158, "uuid": "6d695e7b-4c3f-499e-90be-7c39396fc773", "comment": "Malware payload", "value": "c80fefaee5a61a93a89c869f69cd4ad540442e4c6b7f801473eeae54f72e3c7a", "object_relation": "sha256", "Tag": [ { "name": "555756", "colour": "#CED47B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686259158, "uuid": "9c70cda2-9cae-4527-be01-e78522f60131", "comment": "Malware payload", "value": "678f4d0272e368319e84bc7b504eef63806daecb", "object_relation": "sha1", "Tag": [ { "name": "555756", "colour": "#CED47B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686259158, "uuid": "d15a4eb3-e82e-4b21-bb04-3dd91a61ea70", "comment": "Malware payload", "value": "39b4beba88d8f1df8527c797a1d514cdbdebcf8b4eb7db94adf2132c93ad083438fefeb00e4ecede7ff832202f55c90a", "object_relation": "sha3-384", "Tag": [ { "name": "555756", "colour": "#CED47B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686259158, "uuid": "cc2a68b9-d1a7-44d7-b890-b11993f653a5", "value": "T11A55E05660A60F84C85822B9D5EF1F93278CBF4A1916D39F5325F26F7EB36F88D24042", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686259158, "uuid": "72c45d7d-70d7-49d2-a759-af9271a033b3", "value": "12288:k54Q48zoL5sB1IoVJDegIscKHS5BLOuVVJEtPRHZAsvTWIW+8VZhYC63/Ir:LQBoL5sB1FVJD5CggyuTKzH0/iIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686259158, "uuid": "6a2d3dee-97d7-4c80-8be2-f67e9dc37059", "value": 1344793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686259158, "uuid": "354b5055-29ce-4869-b937-bf609c7b6c34", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686259158, "uuid": "315acc90-5c82-47b8-bdb9-859860b26a24", "value": "1358.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "630d6832-05c9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686207300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207300, "uuid": "bf8b3b8e-28fd-4af1-a3e3-3d40ce538c65", "comment": "Malware payload (Mirai)", "value": "f8a34648cfe9630d4aa8076934248c80", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207300, "uuid": "ada99927-26f6-41eb-aa42-2e4d08ec4c36", "comment": "Malware payload (Mirai)", "value": "c8c43cd6768465d118446030f578e1aae86047d1d1476db724af8a4a976af5b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207300, "uuid": "ac90cd71-7855-4981-ab2f-1bf76be52541", "comment": "Malware payload (Mirai)", "value": "e0894a6799b1b10b27040a5347cf3ef32f2edaba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207300, "uuid": "a1b5baff-6979-4fc7-b733-1e5c3f9b60c0", "comment": "Malware payload (Mirai)", "value": "d3805f64315262037a40a81f11653c00032a2eb2b693d34aeea55a00d874847353cde1a784e005e14ae6d550be3de6fd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207300, "uuid": "d20e9fa2-bf25-4a7e-9a59-26ff6536269e", "value": "T19A632995BC819A13C5D422BBFB5E418C332663B8D2DE3207DD216F61778B81F0EA7A51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207300, "uuid": "f9bed2bd-e6a9-471b-9132-63ac0b49dd8c", "value": "1536:mYoqpICNF6GA1N+6eKuPPt57Ug5i0kHkNJ/YnjfVwV:mYxpu1xluXb7AHkNOjfs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686207300, "uuid": "f3a70f8c-efd5-41ae-9e75-855a513e3473", "value": 70904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686207300, "uuid": "255be673-fc7f-4692-8546-fc626e2299cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207300, "uuid": "cdf74b0a-3164-47c8-8f7f-2208ad21457c", "value": "f8a34648cfe9630d4aa8076934248c80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75e65f87-05e5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686219357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219357, "uuid": "55abfa9f-92e8-4dab-bbab-bad30e3e4762", "comment": "Malware payload (AgentTesla)", "value": "152e3b313207ea19b8428a4f7e2fb3b5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219357, "uuid": "a1a74388-06b0-4e17-8d0d-d7a6b411875b", "comment": "Malware payload (AgentTesla)", "value": "c8f04635049883e3151531fd25e7e0d3f50b336c5beed67923844d9de861cf79", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219357, "uuid": "588d573f-970c-42f1-b88f-f27e90726a26", "comment": "Malware payload (AgentTesla)", "value": "323aab87798142d5a2fbf06affaf935cbb95cad5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219357, "uuid": "80bc6be8-2847-4e6f-adf9-afa825129fa5", "comment": "Malware payload (AgentTesla)", "value": "1c1002d2783b3e5a54f55f9e90b56ff46f142ac9b260b1ae07cad3d66682eac392120c34fbbebd8121606f73947258a4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219357, "uuid": "44584240-c0a7-406e-8bf3-205c0541ba6c", "value": "T162E4CF2336D5BE0BD07A027581E0C2B077B69F847661E6B74EC8BD5BB1BB26D1273112", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219357, "uuid": "549ffcc3-8b5d-45f9-96a2-73507bf13fc7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219357, "uuid": "95e4c37a-f12e-427d-aac5-be61a2c43ae8", "value": "12288:LV9gxNbAdywa2ppVoDVr0JgqRliS0OQwwrHjGu:LDsgMDdmgCiTOazjN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686219357, "uuid": "53560d83-aed9-41d6-9b97-f3ae8602ebbf", "value": 687104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686219357, "uuid": "1f0b2e6a-99d7-477f-b038-e212ea122753", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219357, "uuid": "8aa805be-fb50-4981-809d-3871cacc8367", "value": "c8f04635049883e3151531fd25e7e0d3f50b336c5beed67923844d9de861cf79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d99626f9-05cf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686210076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686210076, "uuid": "323d00c7-35a9-4339-a255-fe1cb88a14ed", "comment": "Malware payload (Mirai)", "value": "c7ace837be0290e31d9be8745d4adc2a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686210076, "uuid": "44c86f5c-a7ef-4d20-a2a4-fdccf0026ee3", "comment": "Malware payload (Mirai)", "value": "c993fe1c033fb70957a4d64b049f1d1d52d4f6176ad0785fef3fca74c266651f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686210076, "uuid": "90ec2747-a851-414b-a629-de709df483a8", "comment": "Malware payload (Mirai)", "value": "a955c3874d23269c937894fda0269472053d7c1c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686210076, "uuid": "aca8f5a9-3a86-4c1e-9400-a4f834d15a11", "comment": "Malware payload (Mirai)", "value": "a4d1a29b5435be4623e34e61614aa9b48497c0027903009a4150d61e2ed24738c99b5613d25f5d53a25a22d0e57a2a7e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686210076, "uuid": "f67d10c4-59cd-43f7-9ec8-f6157f3e1f89", "value": "T11BE2F2613E2660A2C7F50D34E9F94891DF05ED58EA1650483E3053E48EC79E67EF0EAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686210076, "uuid": "4622beb5-66e8-40e1-87e9-70d1fd9baf78", "value": "768:poXXtUA1V2cdRhBkKA6WbhYMRHm/gcA3Ubu:pkdJz8bhLNZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686210076, "uuid": "d1bb925c-480a-459a-93a6-9a5a089ef3d9", "value": 32588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686210076, "uuid": "6352d421-a02b-4a78-ab27-253455ac935c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686210076, "uuid": "2a3ca46a-c4dd-48ad-9eb6-78f29560142e", "value": "c7ace837be0290e31d9be8745d4adc2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "240344d0-062e-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686250573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686250573, "uuid": "011f8cf4-7c4d-415f-aa03-dab672ccae16", "comment": "Malware payload", "value": "604bbfa9fee72a68777e874f852dbfa8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686250573, "uuid": "f15ce46c-9435-49a3-a750-e1605fd8e9aa", "comment": "Malware payload", "value": "cad29fb4bd5990a83d64949b2ae6224b58951a6e54cc2805834b964773573aef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686250573, "uuid": "58dc396c-b447-4773-8b33-15ae9dd1f9da", "comment": "Malware payload", "value": "016e47f8e8884b15eb6a53ff0aaa341e7d5c9c8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686250573, "uuid": "e48a6543-d214-42e8-acee-434f96696399", "comment": "Malware payload", "value": "d043347a9b26fbf3d1f89e205e1ecc7dc748c7fb5a4d34d5139afe0c1527be62c9d282433d0a3cba4af71a897c3d1a15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686250573, "uuid": "06bca224-f12c-4c9d-9647-83eba3014f99", "value": "T1E104E5F479A4C473F380B0F454B8A7BF987D5D210A61811256BA79CC9E7AB33DD0922E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686250573, "uuid": "00982203-ec6d-4c5b-838d-6da925004a39", "value": "6d51ff186ff9fc1e4fbe4ad5e309dff8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686250573, "uuid": "f413c873-f36a-4d37-834c-81c0373c450e", "value": "3072:0OyP/S+kYbibg73HkgmOQKq0CbPQLxA/y3/jansb4FbyWH:3yyImbg73kgm730CDk+y3/ja04FeWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686250573, "uuid": "a75072b5-fcef-4ef7-9c99-285ff1e4165c", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686250573, "uuid": "a85a7135-b727-4ec6-8b0c-424383b5116b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686250573, "uuid": "8a801913-b606-4a83-b982-4f74fa54c50a", "value": "cad29fb4bd5990a83d64949b2ae6224b58951a6e54cc2805834b964773573aef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63d1e070-05c3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686204724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204724, "uuid": "0b56f27b-2207-4738-b970-ab2121d467c3", "comment": "Malware payload (Mirai)", "value": "071e4bd3ddb32f58af2174d3261e8ff9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204724, "uuid": "92682223-e89a-4724-897f-dd5133fc0929", "comment": "Malware payload (Mirai)", "value": "cb04191cef83698b27d4fd524040c321479465cb609790882c3fc19dc676556e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204724, "uuid": "f1205c26-a6d8-459f-9a87-afe06a847b78", "comment": "Malware payload (Mirai)", "value": "667e775798c0e9621b87493d629b31794b105c65", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204724, "uuid": "0783ac6e-1c31-4b69-ab30-52f46a17ad8d", "comment": "Malware payload (Mirai)", "value": "918c5992f33a506cd2fe6c89a22c10b23e60ee2149cb5e9589a514422c205eb6b811ab35734ad40b1b8ec2800897232a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204724, "uuid": "d36f9765-cc98-4c31-aaac-6f4716dfcb71", "value": "T1CD533A56F9819B11D5D1127AFE1E128E7313077CE3EE73229E24AB24778796B0E3B805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204724, "uuid": "7270125c-b190-406a-8876-d65a25112ac7", "value": "1536:MHnUTYiZnvx+adikJawDJMcWIXi8Uncc/j7Jy5yYHiY:FT0+ikJaw9Uncc/jNykNY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686204724, "uuid": "67ac4afc-5e49-42cb-aebe-93cea46aee4e", "value": 64304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686204724, "uuid": "2d731512-b061-44b3-95ca-372c4c6da0e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204724, "uuid": "70ee1d6c-0f65-4d78-b25d-a91d2ef1947a", "value": "071e4bd3ddb32f58af2174d3261e8ff9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd76fae9-05a6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686192419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192419, "uuid": "3fe18553-f1a2-4500-9390-3daa944a8e2f", "comment": "Malware payload (Amadey)", "value": "9247d98ae9e281670f16112be20c357a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192419, "uuid": "d8b0b9b8-5b4b-46af-93c3-5aea42506a6b", "comment": "Malware payload (Amadey)", "value": "cbebc31e36f53b268083b9c25c57209e71b4ce15845b89752457f0ee1ade9ecd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192419, "uuid": "b3258222-942e-42bd-aeea-bedb935f1aee", "comment": "Malware payload (Amadey)", "value": "67c22936b0a25b6b70219fcf4fe803aa4bdd5c1b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192419, "uuid": "b2d674e0-c8a0-40ee-8468-d876bd2f0f5a", "comment": "Malware payload (Amadey)", "value": "af1b69477367e16c30286e90a39dfab3ede9d082863732d591423799209cf2375d482373549af80f3d29247efaaf1a07", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192419, "uuid": "d3484525-7077-4f48-aadb-190843fe6546", "value": "T1A424F7257D12C032D56061B619F5BFF2C59C6828ABB049DB7B800F77DA122F73A61E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192419, "uuid": "8287098c-90ec-4694-b4bf-fb2a72664397", "value": "f8cc61ade86cb7277d0ab974de6323cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192419, "uuid": "62465538-0a14-4b7b-ae02-759d0552715b", "value": "3072:H/DmgskHbfHN+Pst60p0zuNmnKG7peNMQbuZAIqbey3lfbi:fDmfAfHN+wiuInRexuZAIij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686192419, "uuid": "eca050db-28ce-4ee6-946c-295a687990c8", "value": 211210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686192419, "uuid": "d183fabe-c160-497f-86cf-c8503222d214", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192419, "uuid": "7fce5307-89fd-4511-b609-1106b0bcaa22", "value": "9247d98ae9e281670f16112be20c357a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78c2108e-05d3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686211631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686211631, "uuid": "d07d3001-92ab-4f3e-a842-9a3be04d1d06", "comment": "Malware payload (AgentTesla)", "value": "0a7d5946228024deec40e2c4a25c7b26", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686211631, "uuid": "19ac8606-d330-4382-a2d6-3fe8b0302ed7", "comment": "Malware payload (AgentTesla)", "value": "cc1551a752602b74e927fca91950c8171a23611ae9bbdf3fd7746d0776a0aa89", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686211631, "uuid": "774c1633-2299-4a07-93b5-897788c513d5", "comment": "Malware payload (AgentTesla)", "value": "b71d9a75ae8886802d2ae7bdb30474c8acdeb6b8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686211631, "uuid": "39fe110a-2231-47d3-8554-ffadaccf1fb1", "comment": "Malware payload (AgentTesla)", "value": "cf6c6f85b7dbec06ea5206d01fef041e5c9fad86880a880bd9a9911ab7a788a74fd1bf907f02b4d36ae43227580755a6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686211631, "uuid": "09bc9431-5a24-4bc1-9a53-620b8feef7bc", "value": "T11AD4231F6C8AE5F2E4C4812F1FE10C19D726CA4BD4226CA07BFC9355645EBB52E1EC16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686211631, "uuid": "0f617169-39c3-402e-9ecb-fc6d4fb51648", "value": "12288:wZcClf41HP/DZCeO54+xXFGtCNcIgEbPULRMRxRo8xmNNxq3pjgApZfEPXl3UDQt:qGHLjgXFbcOb8OOO3pjpbol3UDY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686211631, "uuid": "7d980d1b-4b68-4748-9129-394f5f37701d", "value": 634792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686211631, "uuid": "afb8f606-112a-4c65-9f1f-f221040990e0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686211631, "uuid": "4ad26772-e346-49ac-b45a-cc2a8c9d6e98", "value": "PAYMENT SLIP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a9a1c8e-0619-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686241726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241726, "uuid": "bea17219-9d9b-46d2-a74b-4aea52a4f424", "comment": "Malware payload", "value": "c01de59ef225fb7c730e14db4988271f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241726, "uuid": "5f565790-c0ae-457d-8de7-82a1b156dd2d", "comment": "Malware payload", "value": "cc7a593c4d313575d05863ee9f0e6dee43990013e1fe8f3babdbf8d6005dd510", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241726, "uuid": "63fc7339-8379-43d3-acd0-cf78bbe27455", "comment": "Malware payload", "value": "7b4f9f7dddc955dc7c71f4758f979f8cfd7355a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241726, "uuid": "eb2deafb-035c-4a5b-a865-95da1d531b61", "comment": "Malware payload", "value": "3ee6c3eafeb627b19e7f2dea600e88e724f14d494df465c4ab93ff0f48706c17620a972a153778ea464f05c4b49f3dfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241726, "uuid": "04a5d294-a026-4bb7-9bb3-934227200ce5", "value": "T13C342366C298C74CE58F4BB20FC97E5FB2A5FAC59400CEC5276D621D26F835DE4A0278", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241726, "uuid": "fa303841-c3ea-4726-a132-5ee37c19877c", "value": "2fd7d94f6efb8427ad1eaf4cd5663833", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241726, "uuid": "55b082cc-8bfb-48f6-a4c5-e2554aa0ff5f", "value": "6144:k8TcJ0GYjJ26IkoVg6HQBJ4lqbRK8TpQzkEZ7nyeLFlnO6moSa:k8TcJDYj0Vg6HQBJVRKFzj7ndLFCoSa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686241726, "uuid": "854dd438-6890-4e4a-8280-7d052ccf5513", "value": 246784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686241726, "uuid": "ed13d85d-62ff-4df8-b8a4-3cb0f6c61ee8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241726, "uuid": "e25734bf-bb2d-40f5-bec3-6ad784006d28", "value": "SecuriteInfo.com.Trojan.Heur.Zbot.6.13796.5287", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5d893f3-05e6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686219867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219867, "uuid": "b1f0ad9b-6b12-49b3-8988-0ec81da56799", "comment": "Malware payload (Formbook)", "value": "c663e216472972bc12f701dd6eb04f71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219867, "uuid": "68940626-592a-4047-b9a6-a9f566d0dcd1", "comment": "Malware payload (Formbook)", "value": "cce0243baf6140b9d0bc6360f85b7d2eb7d769d7d6dd25a5991ab9cc12465b58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219867, "uuid": "2a8426ca-ee37-40c5-b307-db1ad2376270", "comment": "Malware payload (Formbook)", "value": "28b1888c11416feeaac5d72bb7cdf2d21321c037", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219867, "uuid": "c68f5967-cd62-46bd-9112-665dba53b5e2", "comment": "Malware payload (Formbook)", "value": "c59884d6aba16892583dc7b8fb873935a0d57681d827cc583116a64f9eb8ac929398a32cfa76d4cb82dd65a9c1ee88a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219867, "uuid": "3bc7f2fc-11da-42b3-a5ef-408631b64f5d", "value": "T170E4F03026DAC71AD06B4375C5E0C2F0A376EE95B862C7834EDDFC5FB29E6A12311252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219867, "uuid": "21f9c277-332f-4adb-923c-c342be8bcc94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219867, "uuid": "c2b27de3-d5d5-492f-aa49-f0fd7e042906", "value": "12288:iulgIqF2ZCf1UdjtQjhWIDtW9XVlXnw7L8VcguIjlAmk5ofob9Ub+osqmizs:ikDQgKj07v27gu5ZoiCb+1qm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686219867, "uuid": "343d2e71-ae09-4c54-9d36-394a5ba4b65d", "value": 687616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686219867, "uuid": "922d23a8-0556-448a-a0a7-a46f04ee6f88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219867, "uuid": "81d72f6b-0587-4c10-b196-90b4b2e11df7", "value": "cce0243baf6140b9d0bc6360f85b7d2eb7d769d7d6dd25a5991ab9cc12465b58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "083e020c-060c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686235924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686235924, "uuid": "36a6ab7e-082e-4344-98ff-9e5c4ae2ea03", "comment": "Malware payload (Mirai)", "value": "58befec72fe0bd5d827786346563b03f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686235924, "uuid": "ec77a59b-414f-402b-8ee8-a68a2413f2b3", "comment": "Malware payload (Mirai)", "value": "cd07e8a1aad91e06d2d82e13459f3e60b3787cd467804dbb015d841bea50b693", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686235924, "uuid": "38439992-b692-4fa9-8ca0-ae3ce1fefbf3", "comment": "Malware payload (Mirai)", "value": "d0224e8f237ea53456720c21c84c1b2fa4ba7476", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686235924, "uuid": "74979c61-a042-4a06-86e0-c65810bbe636", "comment": "Malware payload (Mirai)", "value": "c9530e87e22275505ac2985292b3641b8cec3c780ad8f6a5c8a3e515d79f1f488eccd43e15c8a6529c4cdef851deae32", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686235924, "uuid": "bbda895b-0a5d-477e-8d6f-4367c3f2a7e4", "value": "T17AF2E0305261ECC5C928AC34198FB95A8519E8598F8849B67BD83CFAC855B387F1E0A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686235924, "uuid": "3cb71d50-4a0b-47f5-90b9-23e7fcc7b614", "value": "768:NEXxttkFjpGM7acyeXuaNmB1x6cXkO1/7zP2pI0fknbcuyD7Uiyqq:Nxpf7JyeLmlNV1Tz3Pnouy8Zqq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686235924, "uuid": "c3b04189-05fc-43f9-ad8b-70a679a71902", "value": 34516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686235924, "uuid": "2eceee78-80ba-41e4-821d-183721041eee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686235924, "uuid": "503e0a67-c8c4-4d57-bfd7-d441f7c350e4", "value": "db0fa4b8db0333367e9bda3ab68b8042.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44e46036-060f-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686237314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686237314, "uuid": "efd7c5ca-5539-4881-999b-97382854836a", "comment": "Malware payload", "value": "d291971470263d05fd0e50edced31031", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686237314, "uuid": "3563fe13-404c-4e68-b0e1-5d0483e1d94b", "comment": "Malware payload", "value": "ce1c75279c8274841c5e0bab0e1d664c1749373917df91616a0ed723428aea77", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686237314, "uuid": "6da67732-fa5a-4519-9dc2-4f918f328d19", "comment": "Malware payload", "value": "6bf76a332e9f40796036b74790424929c1c7920c", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686237314, "uuid": "0159d497-9689-452e-b0bb-446943a5a87a", "comment": "Malware payload", "value": "cea9b7880695cf2c02171037bb62938cb239a3fd20198adc7fa30cfa8d2e7e232db36b886264cd9ca216dd0248c59f90", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686237314, "uuid": "240831d7-2b3e-4a4a-93c6-7fa87ed960f8", "value": "T16C23F1612BA9D88AFE00875A7B2370C6B51FF5075FC91C67A8F7918F7211AD93923E10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686237314, "uuid": "12e6b69c-c2ed-45e5-8234-53622a8cfdba", "value": "768:crxLHCUu3c4AtyesUHkraA5lJVK+lFZLpzuIHnc1J3QSWM2UoOzyHzyVJ9no7/TY:c9zCUuM4mnHkraA7ZhLzHy5SM2azy+vD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686237314, "uuid": "94afd39c-1299-44a9-ad50-c727cdab230c", "value": 46200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686237314, "uuid": "b0e691d3-6749-49fc-9d0f-510dd47deec3", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686237314, "uuid": "b9ae2c1b-32cc-4863-b2a2-4c258bc10ae4", "value": "evil.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c5febad-0607-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686233944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686233944, "uuid": "0782c81b-ff00-4db8-8698-9044e67bcd1a", "comment": "Malware payload (AgentTesla)", "value": "c8276b980d364eb06310790c45756831", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686233944, "uuid": "7efcf558-0802-4757-a6eb-cc43fe91ec64", "comment": "Malware payload (AgentTesla)", "value": "cec5cc9dfa8e64cd0bacc6aa6f7767729dec65d6a8d53184b887dc89a6a76884", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686233944, "uuid": "e8687357-7816-4f60-ac25-3ab48be7f6f1", "comment": "Malware payload (AgentTesla)", "value": "351906d842e5f110b97fab216095b5474962e306", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686233944, "uuid": "3377f09e-707a-4ee0-9aa1-01f49c2d7982", "comment": "Malware payload (AgentTesla)", "value": "530c77c4085b9752d76efe6dcb06905678f3c9435702323df246d36ff6a76e95746f93a5839d4fe62d0e9ac6a50d34c8", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686233944, "uuid": "cbf916d3-321a-44a8-96d4-6aa19d8f113d", "value": "T1D405D05433BB5F25C83A6BFA0840597087F4AA5A383FD38A5ED3A4CA5D60F114E81F97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686233944, "uuid": "82ed4904-38dd-46ca-bb80-9017f5b02b7b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686233944, "uuid": "f7a092b8-1885-4758-b65c-12d09795cca9", "value": "12288:LHrkBF0haDnLMzIL2q+RTdOL8OOQ7BJaBdRRzxIPUmEsVXD7QU4xTknvPKmkBX/S:LABFKOyqGUL8mPcNxIPUC7uxTk336Xa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686233944, "uuid": "fd82b9b5-8bc7-4392-8fff-c7ac81af43f5", "value": 847360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686233944, "uuid": "aee459ba-f287-416f-95ff-3e8f616f5e5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686233944, "uuid": "22756de2-939c-4b8d-8ca7-64302a6c02aa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c2abf31-05cc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (NetSupport)", "timestamp": 1686208523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686208523, "uuid": "632767f0-5548-41b9-bf3a-97ceb7adf55a", "comment": "Malware payload (NetSupport)", "value": "25e2ff9c9ce6424e9a0972bfdca5a912", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686208523, "uuid": "3d503c0a-dcf3-4442-a957-55a1beba6166", "comment": "Malware payload (NetSupport)", "value": "cecc630c0fef9b4f1468c6a7b968733602aa5df667f894011559d691441b881a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686208523, "uuid": "22c50948-0145-4a57-85a9-ff7d975787c2", "comment": "Malware payload (NetSupport)", "value": "47632a09766f36e7065048d4ace05ea8d1d31b74", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686208523, "uuid": "ddded46f-8c50-4ff2-95ef-9c3e03f92441", "comment": "Malware payload (NetSupport)", "value": "5add97f92224c3df7c3dfd4495c0832cb4513f45a821e4a583899994499bd62c5ef7a4491ab94e15739e07e44e076459", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686208523, "uuid": "8944fb08-0b4c-41ee-8f00-cebd32b5153e", "value": "T11233D19CA9E370D04513F17F436FAC04A1B618438C08FD07B98D5A64EF9E12DDAB56EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686208523, "uuid": "0111d7a8-b78a-4c64-8489-0ad7e0fc8d61", "value": "768:RfUYlS5Tp94WsZWgU1ho9WF5hOBK4I0SS4nlDiOq:9r8T89k1+chOxaiF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686208523, "uuid": "71ec1e46-2af6-4c21-bf79-c82b218f0de1", "value": 50244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686208523, "uuid": "ad0ccdd0-cf1b-48bb-9b5f-eb502e9b7329", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686208523, "uuid": "b49c892b-abbc-4064-b9fb-9c63eea7aea4", "value": "TRX326326.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "476fa464-0638-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686254928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686254928, "uuid": "fd739b19-414e-4a1c-9891-11755e59a3cd", "comment": "Malware payload", "value": "fe68c6db610d15931ad740d93cb58f7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686254928, "uuid": "a15d6c4b-a45b-4fe4-a31e-64c850d7e3f9", "comment": "Malware payload", "value": "ceede3f9fd6591b7ddebd806034806085ad914dbea25723a5e08b11de5589879", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686254928, "uuid": "80a7d0fc-4d46-4ca6-ab6a-f73a110ddc04", "comment": "Malware payload", "value": "f43d3445b8fb31461870265acc7e943da5d7a481", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686254928, "uuid": "8d13b88a-d846-440b-8207-56ecd7e43ac0", "comment": "Malware payload", "value": "450b833b26f00cbe7b8151295ba1b5812e1f8aa5a03af562110e9af7264586fc5b4b3726fd2dcef42f5f65ffdade7313", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686254928, "uuid": "d0abe62c-1dbc-408a-882c-97e5a212d6c3", "value": "T1FA15231267F59131DDB7277098FA13531F39BCE198688B1B3362DE9E1872681B932327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686254928, "uuid": "a8a4ebf5-249a-4f17-81b1-cf6c5757ca29", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686254928, "uuid": "c36130c3-c784-43d6-90a8-20b656243f0e", "value": "24576:vy1elPne8Arqw4hfW2FB9yPPEUKBT5A7OXZYSDOvhyP:61CeJr8fWuW8BT5Aapnt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686254928, "uuid": "3d35853f-f51b-4b47-b166-6a28fb28e288", "value": 875008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686254928, "uuid": "d7df61d1-35fa-4196-819d-8b9c7db7cbeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686254928, "uuid": "799d42b6-641c-44f6-ae46-6257dc6f7198", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a73deda9-05d0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686210421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686210421, "uuid": "36f280e1-1f6f-49ef-bdd8-45799bc9ea47", "comment": "Malware payload (Mirai)", "value": "3c82ec739c727b113d5d9af8a581da93", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686210421, "uuid": "8a16a821-7b9b-48e2-86a0-db8107ac9166", "comment": "Malware payload (Mirai)", "value": "cefaab1e545447af9c81ea9b99f72b367a999dde32873cb577129ed6acda6006", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686210421, "uuid": "fbf35db7-53b9-4440-99c9-18ef9c1bc162", "comment": "Malware payload (Mirai)", "value": "e403601c1bb3a53605a3a4e097a1ad981efa731f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686210421, "uuid": "c515f3db-d8c0-446e-b6ff-066ee77eb804", "comment": "Malware payload (Mirai)", "value": "580df6c3179d34b416ba539fa07f8d1519c47826fb478d300f68ea6cb41e379a8b98deab7ffc5003b4bf7d7182ba3ebe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686210421, "uuid": "c499abcd-bc62-4b73-ae95-b06e17d9627b", "value": "T1EA21EF6657E26D17CCA0067BDD9B5350A312EF8880DEF913F61212650C2F3144F2A69A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686210421, "uuid": "f719f550-a81e-4f8c-9c18-d7ee3b2e7e29", "value": "24:JdJ/iRVCO8DTuJeVgc/llFSw0/cvMnqFabUHv2IIeVrNb4r:JdJECO8DaYVZXFSwR/2IprN2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686210421, "uuid": "16afd025-e8b8-4b60-8f5b-665d19f71652", "value": 1236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686210421, "uuid": "e894ad8d-b16b-4ca1-8e49-b1a2463f31fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686210421, "uuid": "2083e2b4-f5e0-4f8e-b561-538509de4e63", "value": "3c82ec739c727b113d5d9af8a581da93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6cf5aba-05bc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686201884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201884, "uuid": "ee32b057-8a5e-4b8c-8182-ef7b82966ae7", "comment": "Malware payload (Mirai)", "value": "3e2fac2c4ed081043f859357b5afde7d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201884, "uuid": "5859003d-a875-407d-86c3-190a718a3e94", "comment": "Malware payload (Mirai)", "value": "cf2f9096c893484c39ac11f08d46f7147edf971f4eb724d01e67bfa7100cbb0f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201884, "uuid": "6e6b557e-8d9d-487a-9aa7-7df8ba743a97", "comment": "Malware payload (Mirai)", "value": "3c75295929aa5ee5758ee9fec10c97203137d911", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201884, "uuid": "36d6ebfc-2684-44a7-86e3-054396b02c39", "comment": "Malware payload (Mirai)", "value": "7832193d4189733f5e774920a1d99521c99b3bf128186f4b9c6154e395a8e87aae26f04382d9c7ef5d702ebea8cbd61d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686201884, "uuid": "a6b2d604-8fd6-4645-bda7-79785786557f", "value": "T1C2734B42F8C1A612C5C1167BFA0E128D372653ACD2EF7213DE259F623BE755A0E7B412", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686201884, "uuid": "fac39a5b-1799-4e5e-8709-f46ecb10a553", "value": "1536:6ib708fC+zP5uaTqZfYvtbdVVgILMFtxZPr2GcIWdTvoyB:ft3duau5Yv1byyMFtxZD2GcIIoy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686201884, "uuid": "8f007eeb-f9b3-4225-bc68-2da6316a4cef", "value": 74964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686201884, "uuid": "e5ce6697-fb6c-4df9-932c-21db7e2f54b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686201884, "uuid": "078ffd29-7e7a-4222-9efe-19c0cb74a4d2", "value": "3e2fac2c4ed081043f859357b5afde7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06105858-0627-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686247517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686247517, "uuid": "5c5b562b-9cab-4d96-b2cf-cb4509ee15a8", "comment": "Malware payload", "value": "23f26bcf005118289b56d5880759379a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686247517, "uuid": "1f9ff82a-6498-4968-be5d-4baf4442b08c", "comment": "Malware payload", "value": "cf67a8aac84b52c4bbe6286789a6c6dfb04caf39fc39a129a8a5c93a7134beb4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686247517, "uuid": "4d20dd3c-0176-4a29-9f59-ca6acd025c31", "comment": "Malware payload", "value": "835012bd23413f8370e24266331896a059e048a7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686247517, "uuid": "d507b66d-7654-4332-ad68-7707a9b7d7a7", "comment": "Malware payload", "value": "c3143870ca49f0faab610c09b0770e187d9668cb097d4fa6ba1de80199d5cde58dfc6c7151d2812bf69147a737eb62f2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686247517, "uuid": "031dea4c-e269-4098-8da9-f2a3daa62a47", "value": "T149A58EC0FAD744FAE46728B1B09AB7AFAB3112050138CD76DFA58E09E977B401DDB245", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686247517, "uuid": "f520be07-c5f4-4f56-9979-fd4f87a292e9", "value": "24576:v7AkdHt+UnNtqbVotX4Dw/9JGCZdBK/+NYou+Frn/yd4L:vZ8RDwlJGoYITL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686247517, "uuid": "b0adb4f2-6736-41ba-a866-273a2da14f93", "value": 2109440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686247517, "uuid": "6fb51b37-7031-474b-9ef0-fce5b4be25f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686247517, "uuid": "e4766eed-98b1-45d7-b037-77f89f2f1599", "value": "cf67a8aac84b52c4bbe6286789a6c6dfb04caf39fc39a129a8a5c93a7134beb4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83eedfba-05e5-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686219381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219381, "uuid": "9feb94f3-27c5-436d-9908-3fedd0bab04c", "comment": "Malware payload", "value": "2d2d3e0e190588e4ae940b6758c4f175", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219381, "uuid": "15cc24f5-ba26-407a-b96a-5e537b185763", "comment": "Malware payload", "value": "cf9f7cb2f56e03bc88ca4ebbabd35ce3c23adc5c375538e3da5f396cc7542620", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219381, "uuid": "8b8d32eb-22a9-4ded-bef4-5cc46d97bee6", "comment": "Malware payload", "value": "edf17421429149055fb2395acf6b42866371ffce", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219381, "uuid": "7cf8a609-564f-40ec-913c-41dd3e4943a8", "comment": "Malware payload", "value": "6ec59c6db0a55166033d1d595a6f55d7ba3eaa4b6cf7e4ea7ddfb5215ec978006affa32c44edf181d197f036c0e28ee3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219381, "uuid": "65594d3f-ea21-4d5f-99d6-c6843c3098c7", "value": "T1889423E092E60C30E4E1D63D548502989387FB689A9C7FD4CE2BE9340967BBD1FB855C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219381, "uuid": "5094ba1b-e3d9-4d35-b381-0f132d1bc0c1", "value": "12288:t6NUIj/sEvLgKMPGRrAXzDgL0HzBul7r6bPWu:o2IjVLgKMPI8XHgQHkl/6Wu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686219381, "uuid": "01116e38-74f7-463a-b215-481d8d698910", "value": 439824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686219381, "uuid": "4ed72174-d7f1-4a9f-a71b-b6fd6869eafe", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219381, "uuid": "fcff697c-ea8f-461d-bf3f-ac4bf6c7987e", "value": "PySilon-malware-Python.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e529c99-0606-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686233384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686233384, "uuid": "7dd70031-67c6-42d1-bb85-b673448cd1a5", "comment": "Malware payload", "value": "20f22500fef707ab8739f4700ebb9552", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686233384, "uuid": "bbf7050c-feae-41f5-ac68-4af5b4032be3", "comment": "Malware payload", "value": "cfc81da95bbd4269cd7c1c525e67861f93e0e7e513b73b741816703dfbc6cce5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686233384, "uuid": "242d1381-0aaa-4561-9fd6-fd32f47d251d", "comment": "Malware payload", "value": "0f434e28ddea19e944a5953c9b3c9a1cab35a919", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686233384, "uuid": "b9627720-62d7-4dd2-bf9d-beeb08bd4ac8", "comment": "Malware payload", "value": "1d3b7a039fcd541351aeed35c25fc7b1b247581b90fb3ad743ac48569f0f6a24e6db39bfb3901d2365b0364e75229736", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686233384, "uuid": "368ab7bb-a329-43df-a048-d3c0de8c4ba2", "value": "T11043E441ABF84214F7BF6F30BDB206054A36BD5B5C31D75D3588915E0BB1B808AA2BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686233384, "uuid": "b4ca98cf-f7a3-45cb-a178-c339214692ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686233384, "uuid": "675f3802-8461-4a96-9a09-277acab57274", "value": "768:Od/WJvqpXjmlFJHsWxO9PCuC2ZWxvS57KjazWFP8yI/zd3cEkRufwVc6KCyaCXPo:+6FFsWxO9ff9DyYzhcn4wVclCyBXPxi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686233384, "uuid": "8012c71a-1c49-49e6-944a-2217d2ca76ea", "value": 56154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686233384, "uuid": "62f6621a-5e14-439c-99ae-231c96616b10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686233384, "uuid": "638ab3fd-3da5-43a4-a792-af350b67689b", "value": "helper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4086c7ca-0600-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686230864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230864, "uuid": "03518308-bbeb-4380-bf0e-78f2a3d2f88c", "comment": "Malware payload (AgentTesla)", "value": "6a5ff8d244ae4a460ce972906a3fffd8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230864, "uuid": "10d165c3-1306-4fab-b2e5-7ff05b23efd4", "comment": "Malware payload (AgentTesla)", "value": "d03a9517cf81eca522f483a8229379002aab4f1067ccf491f7d6cfac62e223f7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230864, "uuid": "6d6f76f9-349c-4c24-9f86-da5227746286", "comment": "Malware payload (AgentTesla)", "value": "6009dd270803e231d787e3dc1f3eb55a698f7fed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230864, "uuid": "08115419-c2c1-48f8-9ef9-4ceb72a188cd", "comment": "Malware payload (AgentTesla)", "value": "8711aff781430105e74bc4b03384d7eee81057c609ec2ec794981fcc5777f5d1b92bb5781f40470eb5fe4ff4a944a77f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686230864, "uuid": "58d14d18-52de-4b10-b3b6-44787acfad7b", "value": "T12144E159AE955B1AED9A077B40E2A413AFB0F163E133E70E75C82C777A1F3C61205887", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686230864, "uuid": "8654fcfd-b717-455b-82f9-19b5ebdbeb9c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686230864, "uuid": "b3ea5f0d-0041-4c58-9967-bb5d85cee4f1", "value": "6144:lUZ7XXb7v6fsQrGsUO+ZxdQYXBmfwrhGGGGGGGGHGGGGGGGGGGGGGGGGGGGGGGGG:lyGsQX+Zxjty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686230864, "uuid": "0411640a-e919-4ce0-a991-9b98e401bdec", "value": 257536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686230864, "uuid": "0bf2e9e4-ab75-42f4-8667-ea38e0dc5c3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686230864, "uuid": "f154a7f9-ea54-4397-b4af-9dece498e8d3", "value": "Quote SZC 10219 R.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cb6deae-05d6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686212980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686212980, "uuid": "8d20a75d-4ec7-44ea-8898-b1f8d14ee890", "comment": "Malware payload (Mirai)", "value": "6b4140c33e3af702ecb0f340313df7cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686212980, "uuid": "c38da5ba-4bfd-40eb-9723-d9fbd7102e84", "comment": "Malware payload (Mirai)", "value": "d065400cfbd85045b812283c91cb1c56f350b2a5cf3e3daacc8ea8e02b2d968d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686212980, "uuid": "bca14508-9ee1-4f94-89a5-34098d2092ce", "comment": "Malware payload (Mirai)", "value": "fe51dbba9213149f3110bca4eb0af3550bdd172e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686212980, "uuid": "5cc9a038-71bb-44ad-ac99-502ff4d3bf49", "comment": "Malware payload (Mirai)", "value": "4309b9f5ae8f878e9e9dc2b970ef45aebeb984cae380e9212e880a466fd0c606dee7a54b59b4e5c3bbef63323fa0e2f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686212980, "uuid": "3a773c2f-da27-461a-aa29-b79d9a359618", "value": "T1EC92D15EEA99D7E1CB3AA17B404D47E8017E94C9E3EDA735F7B00173E2042719480BAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686212980, "uuid": "375553f3-a4dd-4084-9062-d9703eb9a10b", "value": "384:JSlatQ9KrE8dIJR5dyTd/pPyIs3qZUnY8dFbeFswVSO3jy0swJaiDllu:Jma8KrEYIJR5owqCnY8TeFT935swJai+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686212980, "uuid": "ef595230-60ca-4bbf-8c39-c0d274602738", "value": 20032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686212980, "uuid": "e362a1ba-e210-4ee9-a50d-1a246da9758a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686212980, "uuid": "0a5342c7-4350-40ab-add2-cc3b846bf6d0", "value": "SecuriteInfo.com.Linux.Siggen.9999.24373.23404", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "039275a7-05f7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686226897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226897, "uuid": "d7e3b048-136e-4805-9dc9-e093585519fe", "comment": "Malware payload (Formbook)", "value": "eb53e0d434bb1c83ebcad9e65bdaae66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226897, "uuid": "7df7458a-2eae-4a4e-a379-5922cf0518a3", "comment": "Malware payload (Formbook)", "value": "d0cf6bd04be1d0bf4c00fdc98b607f414a0137b7c92fb60249adc47b0e5868c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226897, "uuid": "d097e410-8c79-4e89-83a1-de6f05dfb190", "comment": "Malware payload (Formbook)", "value": "5c8115274350b87c7ab8b5bcc9c298249cecda22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226897, "uuid": "8ba0a4be-33fc-4753-b082-93ed444e413f", "comment": "Malware payload (Formbook)", "value": "08308da72c5987447780a595f96b6fe3e962905d9b6c403b9d8d9fe6b62b7d7f9e97154ba271cb539b3a24b249fc86e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226897, "uuid": "59d6521d-3ee5-4fe4-a3e6-4809b4e5fd3f", "value": "T19E451202BEC159B3D1A719325A75A721BA3DB9201F75CFDFA3D00A2DEA215C0D7317A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226897, "uuid": "ffc2c1fd-bfdc-4660-ada3-20a8f2855be7", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226897, "uuid": "134da73b-1a86-4c1a-a995-33f26ad2153b", "value": "24576:NTbBv5rUanelTs9etyjB7DXaCUci4sSXepEgzXPfRXI9gJzB:HBjIkMyjBCCUcihSQVzffRXYgJzB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686226897, "uuid": "28a5ad01-467c-49e5-8f02-ab046fc76cd1", "value": 1243107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686226897, "uuid": "314b4100-26e7-4ddb-b4cc-3ad457bb1e5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226897, "uuid": "4be4cdb4-a12d-4b0b-8058-c3a145baba4d", "value": "d0cf6bd04be1d0bf4c00fdc98b607f414a0137b7c92fb60249adc47b0e5868c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dea4807-05eb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686221867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686221867, "uuid": "3ad7ed91-0760-4f31-9a25-de8878bc84c3", "comment": "Malware payload (GuLoader)", "value": "550c5d8e210eb5be36caa4a3610d3214", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686221867, "uuid": "97e82f7a-b71a-433c-b45c-c2deea8e4bc0", "comment": "Malware payload (GuLoader)", "value": "d0f5e5711e53f7f7cafbfedf8b7614341a9685043411bdfd2b0d1f1aebb1ac3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686221867, "uuid": "b79d9873-705d-4520-b5c2-fb3b2ba87ed4", "comment": "Malware payload (GuLoader)", "value": "7d0ebc9329840c3afd51dfc2e6181cd767913482", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686221867, "uuid": "e0fdb236-2e2f-4d6e-a787-ad7a35dc3a27", "comment": "Malware payload (GuLoader)", "value": "be4a53c9b1bb9426b7097813c289ed629b6da14c34c0c7f6cb842e5276c3a50cdee8aae9540d4277af4f44360191845a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686221867, "uuid": "5890624a-d4ec-4157-a4de-085cea8c1cc7", "value": "T1D5D4D0023F2CA59DD5F8C6B637539BF50FA8AD2AC4F166CAB3C5730C69745920E9E402", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686221867, "uuid": "7bbe67a1-04ce-4c1f-ac64-2b968e7e28bd", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686221867, "uuid": "58e05bbd-6c8d-4d0b-aa33-39b55f4e87f3", "value": "12288:04+L3gMNEauRir739UZPM4GGbL8+tBllIgZwFeRD5LUiEE7GT:a80EauRir7NUZPM4G+ttId0RqfFT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686221867, "uuid": "a1edc57f-d02c-4af8-8892-cff6620b9236", "value": 624634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686221867, "uuid": "be608e30-f937-4341-8aff-27f9014e0b1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686221867, "uuid": "b8d77752-0de0-4222-b66f-6dd4255f0dc7", "value": "d0f5e5711e53f7f7cafbfedf8b7614341a9685043411bdfd2b0d1f1aebb1ac3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e45a737-05f5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686226297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226297, "uuid": "5085820b-e1ba-46e1-a953-5bac3269389b", "comment": "Malware payload (Loki)", "value": "d3e2fcbc5f69342f44f954ad893df07b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226297, "uuid": "7563d7b9-5f64-4e44-a674-3c485e7b791c", "comment": "Malware payload (Loki)", "value": "d1f011508f3fcc568d618796652b5aed02d86c0a0f9c5007385cc50fce7dd532", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226297, "uuid": "8c131a00-7873-4374-a597-a73d66ddea2d", "comment": "Malware payload (Loki)", "value": "aa2304965a264e02d3c30c2510fd3a5dfc225a3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226297, "uuid": "695dc048-eb4a-4456-896f-1a6af807c4d1", "comment": "Malware payload (Loki)", "value": "f73e24d355012fd180ac75d0d321c341052a61a7631a0cc518423ba40dc7839ed21ed70c9e4a8f993460f674d8a62426", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226297, "uuid": "28935394-4187-48e6-b211-7bca44f86d74", "value": "T191D41254A6A64727C23F13FE80B05EB513FA5A8B7712E7160D83B0EDAB57B058D11E0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226297, "uuid": "b35ed0b4-8e96-4a4e-aba4-ae22ad5b32fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226297, "uuid": "0d323054-8e54-4b7d-b4b0-f9078c5abd56", "value": "12288:g2HkmFx2iqNhujGjUTkc4jE3Q66kLjNud0cWFJhoTU5mmPgA1GqV:lEmFxUmEjE3lluduJ+TUomPrb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686226297, "uuid": "e08bad60-0a79-416e-bd41-1c556a86a2b7", "value": 654848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686226297, "uuid": "7d0258c5-6fe2-46d8-aee0-04b500efe56d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226297, "uuid": "dd30b291-3b4a-4f3b-8452-f5799a2b470c", "value": "d1f011508f3fcc568d618796652b5aed02d86c0a0f9c5007385cc50fce7dd532", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4a73a24-05a6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686192378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192378, "uuid": "c0858338-39e4-452d-9cfc-fb2b6c1b8d18", "comment": "Malware payload (RedLineStealer)", "value": "7136a0ad61b7c8c832411988269dfb44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192378, "uuid": "55461863-e81c-411e-81ff-6043b37eb1b1", "comment": "Malware payload (RedLineStealer)", "value": "d2c455b4c65a871394f2119d6b2a0f94db1bd2e3321f729c68b30432f3e05518", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192378, "uuid": "fc58d128-164d-4c7c-b349-744eb0f2d523", "comment": "Malware payload (RedLineStealer)", "value": "7396c3357416d6948c02b81e6d9c8be303f9c2c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192378, "uuid": "bf85ddd6-cf6a-4aa5-b433-503cf57b0299", "comment": "Malware payload (RedLineStealer)", "value": "d6fb4408d3b9a71aa5883e0ee6a372d662740d19d13294f1fe2c9e8364777e9b4c271756687443f1316d52c6b32d233a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192378, "uuid": "a0e6fc9f-c07b-412d-a9e4-fc6c12abe606", "value": "T183D41226E3E94072D4752B7068F903930B38FD964C79C35B63A6985F1DB26D8A43633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192378, "uuid": "feccbc64-d450-4f8c-9059-8eaa84931c1c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192378, "uuid": "259472ee-26b3-4f86-b957-bb8402de8df3", "value": "12288:6MrVy90Ffm7GzOkIyPllBYW4sNef1hRbFUglpoSPu:nyK9HIg2skhfUgUS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686192378, "uuid": "629f71fe-ae72-4b4b-947d-15621e5e5211", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686192378, "uuid": "fe93343d-87c0-4de8-a645-448ea66dce3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192378, "uuid": "ac49e280-07f9-4e37-b6d6-4c4519b404c6", "value": "7136a0ad61b7c8c832411988269dfb44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc262a56-05bc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686201866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201866, "uuid": "b53042c8-c295-40ef-b6a3-0025e4d9c60c", "comment": "Malware payload (Mirai)", "value": "19a4743c036fc311db0a43d51c9f342c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201866, "uuid": "b92bfedd-b556-4500-9232-726a624634c4", "comment": "Malware payload (Mirai)", "value": "d3152c34c95bb3e2446768cb947481e57a18541e8fc0756b44751776525e3c49", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201866, "uuid": "22e00304-0a35-4c80-b44e-ad24369e2146", "comment": "Malware payload (Mirai)", "value": "119681e784c954aaf4744a33638fce9a1e1f90f6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201866, "uuid": "53dcaf7b-f5c7-41c1-a0e3-9b3e4deed14f", "comment": "Malware payload (Mirai)", "value": "3d13f42d6b35f6d2e5100c859734defa73f04901dd21724ed03de44dbda64aaeac945d9e372a42e8be2a5f49cad979d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686201866, "uuid": "8fc93989-60d6-416f-8187-5e2ca861731f", "value": "T15C542A46F6D8A72BC3D223BAFA7A0B6F33398648A79672155D3016743FC27587B36014", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686201866, "uuid": "cabbbfd8-0ef8-4525-87b2-208f4f7d0a01", "value": "6144:FwT44Qfhgar17l0GqLp+Nl92LkhmJ9sVuj:FwDkhgahept62", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686201866, "uuid": "d5258870-042c-47ff-b126-8cd77460e49b", "value": 281709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686201866, "uuid": "30f39100-d1b1-41e5-95d3-172fe8f2abdb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686201866, "uuid": "829a5098-092a-4633-ae56-8413bc379853", "value": "19a4743c036fc311db0a43d51c9f342c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdaf4922-0639-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686255582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686255582, "uuid": "e599c3eb-10a3-42cb-8bd1-a3deb924ea45", "comment": "Malware payload", "value": "e80944ad1b3d3757b5f097275ff7aa71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686255582, "uuid": "7c407174-99e1-4f33-ac73-63f3e1405ba8", "comment": "Malware payload", "value": "d322cd714f9a91593e01dfe061b4b6983cf70c4b9e2321dcd45a55ffa79303c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686255582, "uuid": "bb733871-2e6c-48bb-89d8-4494749f00f4", "comment": "Malware payload", "value": "6271aaebc264ba1c6e42c9a7d109270eaeac52ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686255582, "uuid": "1bfea669-a933-4d31-852b-e58736c9716a", "comment": "Malware payload", "value": "522dcdb5614c8a80ba204698e07c8116927725c6e62c8e36913b01badfbb6690f4b0ac4b4c9b90b6e1b2784fd8756877", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686255582, "uuid": "f90f02f4-22f4-4512-b855-351ccaf22ed5", "value": "T190359CC0798C8432F4E3113549E8CAEE593AB56103E5D4EB67E80A6E4F2D7F1BA34D19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686255582, "uuid": "dbf00e6e-6072-4d5b-a29c-393f79f89d9c", "value": "777ff9aa918fc66348e3ac8827ba1b21", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686255582, "uuid": "637b910c-37b9-493d-aef6-c2f64d5b56fd", "value": "6144:iwZTqmvKC3kd49fAzyym05F7vfbAOsolBoQBV3Kf6Ww5LNZfT3wPY6kuYw:iWqmSOky9fAzTOu46WwL1whpYw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686255582, "uuid": "d0fced69-5406-4974-a4e3-0befbd233965", "value": 1082672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686255582, "uuid": "fbe4288d-e80a-4554-9b4e-c6bfda8dd294", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686255582, "uuid": "d3335d3b-e37d-49a0-9a8e-04937f2bc79e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17e1e4db-05b1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686196866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686196866, "uuid": "d81055e6-75d7-47b8-80ff-9b5607cfa5b0", "comment": "Malware payload (RedLineStealer)", "value": "1a66a5aa38be5420f45cc4afad824bb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686196866, "uuid": "42ceafe5-2bab-440c-897e-2801ce48d4ce", "comment": "Malware payload (RedLineStealer)", "value": "d38c6166bbd863e1c2edade1fe36d1573ae0d7b4c057162b7db6050b73135719", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686196866, "uuid": "5ece5962-7048-48f6-b043-e662cbcc1902", "comment": "Malware payload (RedLineStealer)", "value": "5cacaac8e6aa28cd86edf12e5712e8cc3052adb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686196866, "uuid": "7b0878cd-ed80-4b5e-91d5-510257b45e39", "comment": "Malware payload (RedLineStealer)", "value": "7406b05083e6b969e57b7710ebf36ea79aadf5659f6de58d0fba10b0bccbde4995ad3af1565cfd0cb64ede9bb5546e20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686196866, "uuid": "7cd1f63e-32ae-4fcd-825d-de56b4041be9", "value": "T1A4D41213A7D84072DCB537B019F712870B3A7DA1593C977637CA6D8E1972680A8363BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686196866, "uuid": "c11fba3d-a418-4b30-8c11-a45db2ad5a4f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686196866, "uuid": "0260aff6-eb2f-434e-ae6a-36cb6643bec1", "value": "12288:aMrNy90/QgLaQk6W35rKNB4K8TqrU8ZDgqgMG2iG1Cb5rIj7bN1Gi:nymQgLnWprKArqrhCqg6iGdvNv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686196866, "uuid": "0535c0b7-51ff-46f1-86b8-7844913c7c61", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686196866, "uuid": "44d24576-4c31-40ab-aff9-aca20edb36e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686196866, "uuid": "e3064a8f-2787-4929-b67d-ab400e8cd61c", "value": "1a66a5aa38be5420f45cc4afad824bb2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e7602a4-0600-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686230861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230861, "uuid": "08a5e7bb-bfe5-4027-a90d-4f6dd37811b4", "comment": "Malware payload (AgentTesla)", "value": "4a77c707740eaa443b5849758c11385d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230861, "uuid": "3ce0046a-7d5c-4cb3-a508-8c48c475c3b3", "comment": "Malware payload (AgentTesla)", "value": "d3b064dd11c1c634020c0c155bf9e33c1f0ad2fd8fc85eb1ffd44e05cfd4c291", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230861, "uuid": "68d08a30-12e9-4b19-8983-0890a6bc6c35", "comment": "Malware payload (AgentTesla)", "value": "d2b7bdbd19fbc3cc8b4e8fc4a34efbfc0187bc69", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230861, "uuid": "2c14f38e-e736-4956-96a7-623dc5355ce0", "comment": "Malware payload (AgentTesla)", "value": "5076d84f5482b4a311190c59d6cf46d3ed4bffa6c6c800a834a366f3382b8bf1687ac7285df68a75a7e59c2c7f520488", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686230861, "uuid": "e483b8fc-75e7-451d-b289-115ca56a8700", "value": "T1DFF4124836FB591FD2AF7FBD18200130CAF86D8A7123E35E4EA7795ECC95B0409916A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686230861, "uuid": "366c6856-d31b-4b19-8c4c-fcd9d8865979", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686230861, "uuid": "d9930848-bf45-4780-b927-77f4ad9e9241", "value": "12288:suwas/16/YHmM9mARLAV+/3aI+sjbJj/R/A9UYX4Ef17FH+ajZBnxqh9SVrEsfO:s6s6cV9mA9ImKI+I1jZ/WUYo0x+ajZln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686230861, "uuid": "24312f6e-7341-423a-9636-303ee9246cb4", "value": 761344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686230861, "uuid": "0a532f4f-afd9-4c1d-8cc4-50cd8df182a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686230861, "uuid": "bafb210e-daa0-4a96-93cc-1921ffabec8e", "value": "PO ME-625923.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7da9062-063f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686258123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686258123, "uuid": "6f4a2362-a923-4624-ac6e-c05aebb2a1ef", "comment": "Malware payload (Mirai)", "value": "5a35cb963109cc102d58ba0cf3121e69", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686258123, "uuid": "611df316-0e0c-48b3-a21b-c6357b966fb1", "comment": "Malware payload (Mirai)", "value": "d45aae34a26cb8821347d06e669c3e937be32e2fd5ad159931c54ea47a012941", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686258123, "uuid": "6b6999e6-739c-4790-bdbb-abee40db219a", "comment": "Malware payload (Mirai)", "value": "75d2bad95e0b83c9030ec37c3d32ad1d8a0b4b53", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686258123, "uuid": "51dba9e2-c4e7-4925-91d0-dba29eb4bbc0", "comment": "Malware payload (Mirai)", "value": "6e3d386efe669fdc14d2de5c7ab8a891f8f956fc3cd50b24cdfa3ed634c76918f5815132590ad93afb6798f68d257b4c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686258123, "uuid": "c117afc1-4d77-4532-8006-cda6dc2a5fbf", "value": "T162B39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657969791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686258123, "uuid": "a35d4c0a-52be-4b96-b9c1-fe1643378974", "value": "1536:fu27gBY9FSSpj3z5Qxw6YaWWgg1o/LWy:m9sSyzz36YaWWgg1oq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686258123, "uuid": "f45c5987-f366-40b3-b5ae-98f8fcf2763d", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686258123, "uuid": "9f026310-6b8e-41de-8571-ded1532bbddf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686258123, "uuid": "ad8f1c81-31fa-4463-a113-d07b2c5a0260", "value": "5a35cb963109cc102d58ba0cf3121e69", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "590680e1-05c3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686204706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204706, "uuid": "82b619ae-d47e-4c9e-a07f-2e7ef8a37a90", "comment": "Malware payload (Mirai)", "value": "85567c2fe887e726215fdb93966310f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204706, "uuid": "6d0e2503-5e8d-4bba-8a42-bafdd19a94e9", "comment": "Malware payload (Mirai)", "value": "d48188e74f31b712c16c24b0172e3c5416f93ee35c769e6e55060810b80c2857", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204706, "uuid": "779b3a7d-fd84-4555-ae88-cd2c9286a4c7", "comment": "Malware payload (Mirai)", "value": "e72c46117b697b639db21ef1af542623caa2a513", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204706, "uuid": "4130ec3d-8aeb-4ad2-afc3-6502fcceac79", "comment": "Malware payload (Mirai)", "value": "aa7a42fbfaa9d57adb4736803a27805bb8cc116b30a64236c897270c40491cdf8428f463f4b0595f4c193f873a1d27e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204706, "uuid": "3ad8d896-6251-401c-9238-c73589a839ee", "value": "T142534B02B31C0E07D0A31AB0253F5BD197BEEAD022E4F684751F979996B6E361582FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204706, "uuid": "64bcf3a8-dfba-4cf7-a2d0-ad645a31d1eb", "value": "768:ik10AjVofkkcRGiRnkmXbvm2lK0GJkDJSZEMn+/p9+yzgviFRsNYraFV+tDqwW0X:MGJCem22QJAdq+yUKFRsNa++xjW08q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686204706, "uuid": "20070585-c1ef-4405-aa23-c7d241579111", "value": 63012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686204706, "uuid": "bc4e586c-2bcb-4129-b80f-624d018d1f37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204706, "uuid": "217c7ec1-3486-432c-86df-71e476e14f89", "value": "85567c2fe887e726215fdb93966310f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b9d1f2f-05f3-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686225380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225380, "uuid": "f3ceb3af-1d0f-4246-876b-bc71088b1eaf", "comment": "Malware payload", "value": "bdf5dea5493048f18b144fa35a24c026", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225380, "uuid": "4a4f55fa-273c-495c-89a5-1b1e27ce6fad", "comment": "Malware payload", "value": "d4a0bf1a01c771d808753bc0ddfd441d08787601ffc8922986a9ef3e30fe1897", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225380, "uuid": "af5f82a1-7249-4990-9cc6-dff6f0f1c44e", "comment": "Malware payload", "value": "65bdcfb1020445ef360deaa873a0f51d75e270cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225380, "uuid": "8727e938-7677-43a7-b708-947acacb74a0", "comment": "Malware payload", "value": "c217b710036bc0fdbcb7257cb13c33b627e5029556a9fca30dcbacbbb3b2124a54601eef1f4fc9d0e5fc5ec5e0b0e62f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686225380, "uuid": "06085ca8-08f6-4eb6-832d-6777ab458873", "value": "T1A0D43F7D0EF547DA826BC664DFD8DD27FB24941BEDC8AA6808C20753724294FB0861BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686225380, "uuid": "fef95473-5e37-45b4-ac46-828b8caaf4c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686225380, "uuid": "c07df928-3dca-498a-8417-3b1a710be5d7", "value": "12288:Hj4q7uc3Im3jZdtPgxSZqZAtbcXyAEXwH:D4M4AjZdZBZKAZA6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686225380, "uuid": "64e1906b-c3d7-41b1-8510-18b1a81eccb6", "value": 624128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686225380, "uuid": "65f35ac8-2223-42c0-8682-00cfbe1975d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686225380, "uuid": "db9baab0-527e-42e7-aadf-1ff35131ca67", "value": "d4a0bf1a01c771d808753bc0ddfd441d08787601ffc8922986a9ef3e30fe1897", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aea390d-05ff-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686230506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230506, "uuid": "5ebbae02-e75f-4a18-86cc-cc71597492d6", "comment": "Malware payload (Formbook)", "value": "ae2f78ed3b32a4e7f969ce267778ac66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230506, "uuid": "4e32c39d-ce34-4705-a47f-ec74aaa97ee3", "comment": "Malware payload (Formbook)", "value": "d5e9981b7fdef80983edcdda6b3e09870fe991720db4684986ceecb01d24506c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230506, "uuid": "79a6c194-55ac-4267-af38-5dee7b3e0af6", "comment": "Malware payload (Formbook)", "value": "3b7c6425c65933d6b5dac6187e16a0597f3ea5aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230506, "uuid": "9261aa50-4d26-49d7-a7ab-5ad5a8e435e2", "comment": "Malware payload (Formbook)", "value": "eb6b403a6c0786b0cdd60d08c76e6484943e237436d1d69976a38fe9e141f2ac5bf105b9e521d1152bc1db4bb103adaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686230506, "uuid": "013ef3f8-3511-4794-8083-e9acd1acc26d", "value": "T1FEF4015D77F6050FD66B7FBD1C101170C6F86E8A7523C3AA1E8B798E9C92B440AC1A93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686230506, "uuid": "99b1674d-05e3-459d-99b9-60bd6d97115b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686230506, "uuid": "5e274a69-e86c-4c3e-b699-7f5e595ae0ba", "value": "12288:0uJas/16/YHmM9mARLAV+/3M73epjTDrFljb3m0z9SFOuDsDtnQkCEgYDjz:0Bs6cV9mA9Im873epjyOxDtQXEnDf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686230506, "uuid": "1b4346e0-5ac2-49da-b3e8-a2947b00c488", "value": 784384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686230506, "uuid": "af492deb-e9e9-43e6-8be8-0ccb20644e84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686230506, "uuid": "c71d5b6f-990e-4c80-82d8-1f46eaeb9bfb", "value": "THREE quotations.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "915a502f-05e4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686218974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686218974, "uuid": "5a93738e-8c5e-42e2-96df-fae712ea4fd5", "comment": "Malware payload (AgentTesla)", "value": "aaf5677e16cda52a2b19e6bdf4c69600", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686218974, "uuid": "3e98b9e4-f01f-478d-815a-acb75e07ba19", "comment": "Malware payload (AgentTesla)", "value": "d65f2f9e7f0d7a2151b4dcc7ef0eaa3107006a11db439e846f8bc2e6c50c6f54", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686218974, "uuid": "e1fe6c94-a4d7-486b-b1bd-3f7eef1cae38", "comment": "Malware payload (AgentTesla)", "value": "0c1cba81a6962cf6ef7d1d2034a26705afca1364", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686218974, "uuid": "c1b46fd3-914c-439d-a433-f3ad2c5fd0c2", "comment": "Malware payload (AgentTesla)", "value": "a61f64176c90ff54e900442a48a6bd267326b172d8e43eeea5ed09805b1ed0916620889a17bb4eed8967858692855776", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686218974, "uuid": "3bb000ee-22e2-44f3-bb8b-d7f34163c826", "value": "T1DB15C53D0AA58AEEC4BBD364A7CC599BFA73E817F15C9B6C4486035272436CE60C21DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686218974, "uuid": "39d630b0-3d54-4023-a8d3-ede7296aa1ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686218974, "uuid": "4b995561-0113-45bf-b6d6-fd0888e22226", "value": "12288:PsRbmbmmkZ9FjgbEpBY1932Wt9y74/uySIlqJTW3YXFZPkLfsqv5y:0Rm09xME473pO7YeI6EoZPkIqv5y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686218974, "uuid": "bc7e8eda-8e3b-437c-b73a-efabbe477480", "value": 959488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686218974, "uuid": "823a5514-1e16-4243-bba7-2cbf425fb5b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686218974, "uuid": "21be19d8-f9e7-4687-ba22-03bc4d644ef2", "value": "d65f2f9e7f0d7a2151b4dcc7ef0eaa3107006a11db439e846f8bc2e6c50c6f54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abd4a374-063f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686258103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686258103, "uuid": "68b2b20d-50e0-435b-8001-064bf4409c2a", "comment": "Malware payload (Mirai)", "value": "363dd1239198a5c7cd3ae5e0254c3841", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686258103, "uuid": "bba8ebac-4ec6-4ec2-b1f2-a54f1d5e463b", "comment": "Malware payload (Mirai)", "value": "d77bc8a29adf745314f9cc3163e938351ee9370a80e5c28d71a87d7e6c9e7cd8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686258103, "uuid": "011aed3b-c435-4030-bf35-08ab07610de3", "comment": "Malware payload (Mirai)", "value": "25e551b6ef5b745b36577ce0f720a4cc8f6c0976", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686258103, "uuid": "c7d60efe-37b6-4813-8b38-7d6e4fe12b70", "comment": "Malware payload (Mirai)", "value": "ce1f9d83be7ea249125ab9edd5f0ac62ec162c006c0311e6118b51a4e628250ddb359349cdad793892cdbae345267272", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686258103, "uuid": "13b27d95-812a-47ac-b436-c098d393e5e6", "value": "T145330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2757BBFDA36C721A45E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686258103, "uuid": "dd13e751-9b3f-4dae-8d63-1fac6bbb983b", "value": "768:gduPBFnHooqR8qOCKq2GH4Fje+TK806MMUVjzMfQXOtHud2oGh:r/hqaJ6cjeqK806MHdMfQXoHuCh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686258103, "uuid": "cdafb2da-46e0-44bd-8930-dd02634782f6", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686258103, "uuid": "a67fa00c-3d26-4083-8c4f-ad054418733e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686258103, "uuid": "7f5b4ab3-bbf0-4ab7-9f15-66fc3d4968f6", "value": "363dd1239198a5c7cd3ae5e0254c3841", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b53ceb1-0619-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686241727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241727, "uuid": "2d2bd579-5468-4b84-87cf-141170fcc129", "comment": "Malware payload", "value": "2149070a39b56ba090ef5d7d70643e48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241727, "uuid": "0e57c944-ec83-40a9-98b7-6ab687bddaf1", "comment": "Malware payload", "value": "d7dd0d6e341d92f91bf7ffa7849a0cb308d7c5f70a3b47970ec6060e8740c625", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241727, "uuid": "b92243f1-a082-495f-bc7a-dffb871b34b9", "comment": "Malware payload", "value": "eed5005eaa54dcd1793e43163c0b6e6da0a647c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241727, "uuid": "dc7876ab-72c0-42ba-828a-55ca3d3d02a7", "comment": "Malware payload", "value": "751e68b5ace49ce4821bdc8af049e74f40964cafa23981ec3b34e774768dfeb2bfe799ccc8d060419805c80e80919d26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241727, "uuid": "ff88f87a-e243-40c2-a510-580d3277d778", "value": "T1824523648DC2C8D2D27B4FFC54F2CA9517CDBD766B94236B02C6396BBD39084C98E291", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241727, "uuid": "0b2f1869-1b6a-4150-a3e5-a22a2e81dfa7", "value": "6026351fe952ba5edbb3e844a7e4aa36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241727, "uuid": "08c3215d-1ba9-47bb-9861-9cacb76014e9", "value": "24576:A571w4XBPIv6VYrrGLrAXDM9YAlWNul2gmH8h3RyG7uCC2:AhRIA06LMXDgWNul3ByG7VC2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686241727, "uuid": "ddc82a0e-264b-4835-af88-af3350859a2c", "value": 1195008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686241727, "uuid": "f38c2810-dcb9-4fa9-a23c-5392abd4374c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241727, "uuid": "dbd0e8d3-3ad2-44c2-842b-b984131208ed", "value": "SecuriteInfo.com.BScope.Trojan.Zpevdo.12231.13198", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "182884f8-05e5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686219200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219200, "uuid": "74812f08-97f5-487f-9fce-4d139fe32616", "comment": "Malware payload (GuLoader)", "value": "fefe05f4ddab09fbc49beb3c06883236", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219200, "uuid": "269ffe00-b0ec-478e-830d-256c82abd773", "comment": "Malware payload (GuLoader)", "value": "d8b3d99bf35250811529cc870b84d55b8a45ec384d8c136eb6d0692b629d4686", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219200, "uuid": "6fa96ed7-57b8-42e8-80fc-26567b5b429c", "comment": "Malware payload (GuLoader)", "value": "8977219268d54712ea84869b44c599dc380fed1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219200, "uuid": "8b30de83-8d82-4e75-8617-a8d775820c29", "comment": "Malware payload (GuLoader)", "value": "121750671cb9bd73dea79b871c65366c22594956502e4a0e47c05a8a16f8f23461101cf3de9dfafc6396a92e498e6d7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219200, "uuid": "919669c2-6678-4562-a9d3-180aefde30ae", "value": "T1475401A53BB0E407CAA55131BEE2CA7A2F60DD842C65121713E87F073D7F7A78849768", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219200, "uuid": "bac90220-cc53-4728-80a7-a08139d72d2c", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219200, "uuid": "0c508939-d5c7-406f-9b93-3661dc8e0912", "value": "6144:Xwq3NpJC6GftmDlIEP+ktDpkTV5lYnXdp65LQP:Xzk62glIE2ktVkCnXdpSY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686219200, "uuid": "c7dea261-c462-41df-9fbe-b93953c0e9f1", "value": 294712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686219200, "uuid": "6f506f2b-f9f6-41fd-890c-085fe61adbbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219200, "uuid": "069b24e2-4531-4e60-922f-8ae90642ba11", "value": "d8b3d99bf35250811529cc870b84d55b8a45ec384d8c136eb6d0692b629d4686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83bc7ef0-0619-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686241714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241714, "uuid": "97176f13-1d55-4fdf-bcee-4049e2ed38b7", "comment": "Malware payload", "value": "5bac83e02134c105f3d214e9eb466721", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241714, "uuid": "4c41e8f5-7ae7-46f5-a5f8-932971f1ce6f", "comment": "Malware payload", "value": "d916962897716f0bf2305ac5079465b04bbb4028f6f4d876f8b379ff4b5c8f79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241714, "uuid": "f13044dc-649f-439c-8a24-4181fdc0322a", "comment": "Malware payload", "value": "5931fb7efdb6c3b860af4adfb7ee20f6a9f39f0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241714, "uuid": "db7cfc13-d71d-47fc-9626-642848a51518", "comment": "Malware payload", "value": "e454b8b90e826cb1ac86581e905c6c8263bfc9292dc558aa43643b8fcd8ce3f845068ddfa56cee07aa0b9226a8917c8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241714, "uuid": "6b6bad24-27fb-4831-ad40-256d62dd825e", "value": "T11903280F3470DAC3E5D9E37911060B90B9AB9E44B234AFB1EC22DC6ED6385E94E0456F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241714, "uuid": "d8aec517-07cc-4ac0-b02a-0a39cc4400fe", "value": "768:ke8ofHMKwIdelOTdK/9IZcrtJh31dxbE:SId+Oh6ZJh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686241714, "uuid": "b7165e6f-d9dc-4614-a8b3-a001aaf54243", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686241714, "uuid": "f8cc6425-e1da-4cd6-afaf-16e2924e905e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241714, "uuid": "30d9271e-1778-4fb1-aa1a-902ccbd7ac76", "value": "SecuriteInfo.com.Win32.Malware-gen.30336.12647", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d948a9f7-05e3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686218665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686218665, "uuid": "2d80c3dd-9826-4203-ac01-23e15f27173c", "comment": "Malware payload (AgentTesla)", "value": "e3a4753126706bc808dabf688b1bce71", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686218665, "uuid": "ff318a15-60a5-4b07-8ed5-1c0adb10b0d9", "comment": "Malware payload (AgentTesla)", "value": "d9306a1c01d5697b35534bd8156c06c6a18bc9b9f582a53de124534f35d0fa74", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686218665, "uuid": "2ca002d9-588b-45e2-bbe6-0c7a45f3349b", "comment": "Malware payload (AgentTesla)", "value": "75e3d8834e2bf83e72147182b457cc4f42f41198", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686218665, "uuid": "0a03702e-2745-478b-8628-c347caa280fe", "comment": "Malware payload (AgentTesla)", "value": "f885215f9308c097e6981bdeaaa87914c688daf0feb4b612e1e0f33f0c809f0752d313531003409e95c66fcf0e4e5685", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686218665, "uuid": "26f7e4b6-fb83-415d-bebc-a329cdbaa98a", "value": "T1F715CF60EAE8C6DDD8350BF09193D4B407262D28E4E9EA560EDB3CDF31B6A44316753B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686218665, "uuid": "087458d7-bada-4f99-9579-c94fa61777dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686218665, "uuid": "5ca23384-cfe1-4dcc-8835-8e4c99d4027d", "value": "12288:k2iNfUFotEvZ41qUQe3g86Csi9cCtpOnxcc2lt/zbpt0FO8:k1Bs0qZ4x6Csi9cCUcc2l9zbGO8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686218665, "uuid": "a6a13a92-0b85-436f-b6de-f65e602d0da6", "value": 911360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686218665, "uuid": "7b0f4a99-1a81-442c-9078-6063498b99d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686218665, "uuid": "8a012605-d198-4e92-bf53-2cfb9b2f31d6", "value": "d9306a1c01d5697b35534bd8156c06c6a18bc9b9f582a53de124534f35d0fa74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "440f57d5-05bc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686201664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201664, "uuid": "2873fd6d-d0e8-4d86-8595-bc4413c08975", "comment": "Malware payload (RedLineStealer)", "value": "9ca3cf16dfb5441d085a0a1ec8e8ba48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201664, "uuid": "0b6476a2-fe63-4c1b-befc-386632d1ddb9", "comment": "Malware payload (RedLineStealer)", "value": "d9be7b6bce361b4479438e5842c8bd4462dc2937caefdfdfdfb05b5f98d78d14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201664, "uuid": "9972868a-1433-4848-b1f5-158042060258", "comment": "Malware payload (RedLineStealer)", "value": "a31ae1bade65e3bd02b0d14088e7340fb96ec06b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201664, "uuid": "8423dce6-f33d-419b-8d25-4e01989f1a7c", "comment": "Malware payload (RedLineStealer)", "value": "0a9b850b75094e04f14a65f2a5fb82051414021f3387339ad3d084a80af84860b21b107dc42bf1c58829114e5e5c9205", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686201664, "uuid": "f9b276d4-d847-41e8-be6c-47f8d8808c00", "value": "T15CF41227FBE18433E8F053706CF627430F357EA45E7882626B0559A90D33A9994763B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686201664, "uuid": "102a442f-eb29-4241-8137-1fa282af2091", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686201664, "uuid": "0adebe0d-bd4a-4a70-9e37-d2f246acf39a", "value": "12288:GMrUy90DhVWtvKMtfMVIWs30gCez4+5SvvOG50IDAzBJzgGg3DUqoU6Y6vBCdFN0:iyhBFkVIWsEzwSvvOhIDA1JzgCqoU4v5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686201664, "uuid": "c39a7d41-d8bd-4882-af3d-9159e9524caa", "value": 770560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686201664, "uuid": "6ee275e9-1eb9-481d-b2dc-7c1f69625ea6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686201664, "uuid": "4e03e648-eec5-44cd-9652-94b2a9d126ca", "value": "9ca3cf16dfb5441d085a0a1ec8e8ba48.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16c1891c-05b1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686196864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686196864, "uuid": "22679aa5-bf08-4719-beb6-33fba8e9d43a", "comment": "Malware payload (RedLineStealer)", "value": "d66ee5c5174da6e011b0374179d09a81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686196864, "uuid": "7926312b-1663-4e92-8f06-7bc4a596e75f", "comment": "Malware payload (RedLineStealer)", "value": "d9c3d987d5cdc3dc964080516de392e870fcaeff898c60c28d2799e17c61464b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686196864, "uuid": "51bc1336-9c90-448f-a46d-eaf96fb71779", "comment": "Malware payload (RedLineStealer)", "value": "b77fc70a2bbc9862d3354f0991d64ffa96b6f1e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686196864, "uuid": "3203fc2c-5ef3-44bc-b9b4-46df5ab84953", "comment": "Malware payload (RedLineStealer)", "value": "2dd50827ff78e552ad8005bad32c48d30f34abb5e5c11cc5a966d129bd504f8e2bdc1801b35201157cd105b9b26d8807", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686196864, "uuid": "e4bb8f4f-097c-421c-af6f-4857ed37670e", "value": "T154152353BAD45471EEB52FB049F743C31A367DB28878532B268A685B0C73290B97173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686196864, "uuid": "22f4f420-f42f-48e5-87ee-581405aa24b4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686196864, "uuid": "1b468f13-5427-4574-a513-b0897e8055f1", "value": "12288:6Mrsy90+TOPh7ssu/qrYPqrDcsvDuNK145xv1/J/OfTmw91CijR4a9VYWn6v2aeJ:yygaJqrYy1DWK1s1MT50WR4cC464J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686196864, "uuid": "484c457c-8bfc-47c5-9343-2f1a72dd9887", "value": 884736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686196864, "uuid": "1fb0bb33-a8b0-44d5-b9c4-1844792807d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686196864, "uuid": "28c0b70f-6c8a-4179-a8e9-c35b8ce7614a", "value": "d66ee5c5174da6e011b0374179d09a81.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5dcb6c0-0591-11ee-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1686183360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686183360, "uuid": "8dffad6c-ca7c-4a8a-8d73-1d97ebf2050e", "comment": "Malware payload (njrat)", "value": "0d8b76317dbfa4482bc07bc247df8f25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686183360, "uuid": "adeac999-bb39-427e-8833-b4671c18e912", "comment": "Malware payload (njrat)", "value": "da83ebf186d48f78f9aa8fd6c67d50141c20a104696697373badd324555b4c96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686183360, "uuid": "e38593ed-a0f1-44cb-85e1-b7aefdef4a20", "comment": "Malware payload (njrat)", "value": "236b3b64330227d5d34bda71703945747ecacf06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686183360, "uuid": "c3b20732-12b5-4ddc-b23a-27cf65bdc251", "comment": "Malware payload (njrat)", "value": "d73875b517671a3e49c09bb37d885ef8c4a12b9f02cf554eab2068d1d436921ba7b95aa13a04d853d0337e95746a47dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686183360, "uuid": "74b84e2e-f3d0-4191-9e38-1e7dd9eac8f7", "value": "T1E7E22BADFBE64465D1BD0AB50571950003B4D103E523F77E8ECA28E62B2B3D84B84DF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686183360, "uuid": "a3d2b04a-2cae-44b7-9b71-a9b4fc3f5240", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686183360, "uuid": "6aa087e2-c421-4aba-900f-a95841b17eeb", "value": "768:8rzgfV5VXPKzxF+dtYjK/L+rvAJQmIDUu0tiJsj:/fqci4QVknj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686183360, "uuid": "d98d5e14-22fc-42d0-9b27-fd444eee0a66", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686183360, "uuid": "a0cb574b-9fae-4658-876f-28242ca189ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686183360, "uuid": "546a791b-7ed2-42bc-96f3-12940d3970cd", "value": "0d8b76317dbfa4482bc07bc247df8f25.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e472a9f-05fa-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686228230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686228230, "uuid": "da156bfe-3b5a-42ff-bee0-a145f20b541a", "comment": "Malware payload (AgentTesla)", "value": "b038b4d1fbbab60fc94b46d6e244932c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686228230, "uuid": "e59cd12b-284b-422e-82e6-cd875bab25e5", "comment": "Malware payload (AgentTesla)", "value": "dab636a81ff0ed263531e7984977366336b9f194c170406c8b145db5711c9d8e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686228230, "uuid": "cd4e6be0-33b7-4b18-8808-121dd62a744e", "comment": "Malware payload (AgentTesla)", "value": "cecbc91cddb4451de243f5a07cea733c994ceec4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686228230, "uuid": "eb8d371c-8935-4b02-b450-77548f3cfcb0", "comment": "Malware payload (AgentTesla)", "value": "4f270dd366fee43b7149e6f8c1ec70da0601c0c545e360c99be56f0999461407cc3de56c7388d39630d80d90bdbff232", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686228230, "uuid": "daed4517-e76f-41a4-a0f8-d6cde49c1cca", "value": "T19C05F144B6BA4F1BC1BA47F1850463341BBE9A9DBC72E30A4EDBF9D72461F054681B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686228230, "uuid": "53ea2131-1568-492b-98f0-4fa5764af9d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686228230, "uuid": "5ca36e94-6f37-4d55-b863-1a7ed3362c7b", "value": "12288:s/2B0xTGlxNqvNu2hZ+nUEsn9tyNSJCbqixpDvYp11z3NBWXKxVx4ra4yjSqTvFC:s/LaVUH999ggCbqijsRz3yrdyWW/s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686228230, "uuid": "33dcf6d2-86fe-4d37-a78f-663a3662d782", "value": 811008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686228230, "uuid": "fe5697bd-41fa-4541-a916-71c92f119403", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686228230, "uuid": "f05a59a1-53a7-4f89-86a8-9e79092172ea", "value": "dab636a81ff0ed263531e7984977366336b9f194c170406c8b145db5711c9d8e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f1f419b-05e7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686220071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220071, "uuid": "5d5ec5e0-fbdb-4173-ba60-d7cc3764b228", "comment": "Malware payload (Mirai)", "value": "3546b37210440e9e95b2bf4b6b750e4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220071, "uuid": "005ad3b0-1221-4d34-a043-ad25b7587bb1", "comment": "Malware payload (Mirai)", "value": "db67af8a262e4ea9388ab623faa019645a00e28078b96e673d4237ae6a20448c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220071, "uuid": "4e5752a2-420d-45a7-8f85-27efce146be9", "comment": "Malware payload (Mirai)", "value": "e8143021bb35a88ccb84d3f3e6ad311f06301d9c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220071, "uuid": "ebc1c6b6-82bb-4842-95b9-48592c5d6985", "comment": "Malware payload (Mirai)", "value": "190c29ed52f1eef1101931921604d48fb1d1330f48b72f90367ba5ef44b048b28d5425ca85f0c6e10f95ab5812b90ff4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220071, "uuid": "a598bec6-46ea-4c11-9b29-1e88b85f7130", "value": "T11E23F1B127599097E7C324BB17B0A760AF704BDA31015E2AFB00EAF7C601953BD575C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220071, "uuid": "4c392e8d-a716-4261-990f-05130d2e726f", "value": "768:SpeVL+HtLbST7Z6OOhND9zB5bzxm6ZUyd31QooVhqtWf/ePjMJynK7VJgGlzDpUT:S3HtKHEOmzpmHW1Qo2NJ/PVqYX0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686220071, "uuid": "f148628c-8bb0-47fb-b28b-fedc5810f4fe", "value": 46160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686220071, "uuid": "b76612fc-72af-4f8e-9f0b-afa36a88b5e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220071, "uuid": "8a093537-faa3-4ff1-9d6b-02d08fe6cebb", "value": "SecuriteInfo.com.Linux.Siggen.9999.122.16825", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "518d069d-05c3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686204694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204694, "uuid": "f678914c-ac55-4dd8-9227-822ac403fc16", "comment": "Malware payload (Mirai)", "value": "a32a8738c06cfc9e7e48cdd43e366835", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204694, "uuid": "ce3ddd8d-4454-4c20-b66a-55f337a28189", "comment": "Malware payload (Mirai)", "value": "db8f21c4d550b3a0a1baa5996d0e7abc89448a15218b77a422b33cbb43f0423a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204694, "uuid": "fc218f42-c034-41f5-b8a3-50bd9fe6b45d", "comment": "Malware payload (Mirai)", "value": "2082e631507457de00ffb6d0d2fadbce76b21c47", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204694, "uuid": "3a9b3750-3e76-47b9-8e8f-e6e8d493b328", "comment": "Malware payload (Mirai)", "value": "c8431d1dbe8ab288d6efddf43989d3da6da654e49939f38e65ac5db3499f31afa5c58cbbe2ed63b9cafe7c7c7e8c7c69", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204694, "uuid": "5c3effa2-a133-4d1f-802f-2229fcdc4390", "value": "T1CF533932BA720C2BC4D5A57A71F34725F2F6439624BC8A1A7D710E8CAF64B5032477A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204694, "uuid": "58548637-d7d8-400c-a1fd-c8901cda0877", "value": "768:ijT5CiunwOtMEx0O+lt5V3w/GuBmhhlwN/DkKIt7c8v47I5:ijT4iun7tHQlt5pfzlwhD+ttv47m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686204694, "uuid": "53a7218c-9ad5-4e6d-907d-168fb98e378a", "value": 61936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686204694, "uuid": "3624a21f-09c1-418a-9981-46fea00b8e3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204694, "uuid": "3b4e73c3-20c1-4df1-be87-15dfeb5f1eca", "value": "a32a8738c06cfc9e7e48cdd43e366835", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e412e4a5-05a3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686191195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686191195, "uuid": "468261b1-3a0d-4293-b50d-cd7bc9d2f62b", "comment": "Malware payload (RedLineStealer)", "value": "ca2de92b7bb408bc9b19d81c263321d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686191195, "uuid": "d604c340-591b-4d77-8a5f-3249d29cbfdd", "comment": "Malware payload (RedLineStealer)", "value": "dbae05bbf3a5211cb42dc7c1f97686f871f8969daa01d74569a7dd2d104a7f3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686191195, "uuid": "c9a77d52-8620-409d-b669-970b89abede8", "comment": "Malware payload (RedLineStealer)", "value": "2434123faff70e5957312a1915a24d4bb714ef38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686191195, "uuid": "4c293c94-3dce-4acf-8ba3-4ccac9dde483", "comment": "Malware payload (RedLineStealer)", "value": "85f4c34c96045fc49687acf8c0efe570326aadbd5a6c08ec486ceecde4acb2aae98b77d1fa8b6f3bbdde82a3ea5f5bec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686191195, "uuid": "82a07714-00f7-4693-8333-a3bd46a068f4", "value": "T1FA54480237C78CBDF8AA073D60D48F3DC877ED60165464FA37A89A618ED0213959B5BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686191195, "uuid": "804a0883-32da-48b8-a710-8735fcd8f7db", "value": "f264906d4975bf1277da66f2124faba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686191195, "uuid": "b5485c42-ce31-45b3-b6c1-7f91df122bb8", "value": "6144:MQvoWvJfCW1wvTygXUNVS4MGh1aBFrvz1xcxcWhvrt:MUMfyR1aBFrvz1xcxdvrt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686191195, "uuid": "ffb7a59e-9144-4d37-b386-3587b05438ce", "value": 288902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686191195, "uuid": "dfe56669-9635-47a0-bb45-16c4545f744a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686191195, "uuid": "6a30695d-3525-40f1-acd1-f95fe6c9e184", "value": "SecuriteInfo.com.Variant.Tedy.379608.8630.2141", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd60b1a6-05d7-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686213572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686213572, "uuid": "0af79af1-be04-41d5-90e3-f6c50c8a4af0", "comment": "Malware payload", "value": "c694e307f0c76e4f0a5c0a24fcfc2eb7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686213572, "uuid": "ffac8ce2-a294-4efb-a395-2b6d4b37c24e", "comment": "Malware payload", "value": "dbfd6759e9b2c0382a3b7f6356cc446e73cff7e0f9ac45d0f786595543b2a772", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686213572, "uuid": "c797b4fe-4178-4a3a-9f4d-c1f31376d188", "comment": "Malware payload", "value": "899b1398e3b7526795dc8e34457de501f242e265", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686213572, "uuid": "2b997463-2c0a-4438-8d36-40d5300b3109", "comment": "Malware payload", "value": "83e30b0ebb7c453430d37b79106f901990971715c53123a0520eda1db90f80019e3898619a5f8cefd526c6c2da74a3c7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686213572, "uuid": "010bfff1-b522-4212-b771-1edb7cd8805f", "value": "T1FB03AD9C29E760504623F47D572F9804E1B60C57888CFE0BBD5CB650EF9A02CEAB59ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686213572, "uuid": "08cc7f36-c543-496a-be6b-51e3ab9aff7c", "value": "384:E6qATHgyTwHfIpKrYGajAo13XqycAssDJ6GEUjw4nF/qCT5u95m6Sy:NjggpKadqjApDIUjJSCT58xSy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686213572, "uuid": "8dbc828b-5248-4dcb-b6ab-c745ba78ae56", "value": 40325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686213572, "uuid": "64d106f8-0d88-47ff-9b71-731d3e2a6818", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686213572, "uuid": "95adc2b8-4578-4d0e-bd76-4b76b0ca738d", "value": "weeklyi43804380.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48500a21-05b3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686197806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686197806, "uuid": "4419901a-5175-47d7-8feb-2d912cb94ef2", "comment": "Malware payload (Amadey)", "value": "778357b87cda8e9f52552d1332ee19a2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686197806, "uuid": "1ad428f7-c656-46e1-bbaf-4fac1736a1e8", "comment": "Malware payload (Amadey)", "value": "dcda87129c5d1687d208553663943bde1fb19ca3942fccf99da672d4f6cb3fea", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686197806, "uuid": "a892b162-122d-4ec2-b56d-e1e4b6a2cd9f", "comment": "Malware payload (Amadey)", "value": "4dd74a9f3d34fb678e91e1017620602d36d99b23", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686197806, "uuid": "bef9adf7-63b1-45f2-9ffe-314be51e2015", "comment": "Malware payload (Amadey)", "value": "53a9a7bdf084789924477916c7cc6558238c64baf9b2bfeaeb57d8b325ddc85b9f449c37e3fe14bf67b9e0360403cd6e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686197806, "uuid": "952f14ff-c848-45b0-be31-e88e630d122c", "value": "T1A424F7257D12C032D56061B619F5BFF2C59C6828ABB049DB7B800F77DA122F73A61E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686197806, "uuid": "e34bfc85-1d0c-430b-8471-3ec52299353b", "value": "f8cc61ade86cb7277d0ab974de6323cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686197806, "uuid": "879c8719-b926-4435-b855-a0a40db1f583", "value": "3072:H/DmgskHbfHN+Pst60p0zuNmnKG7peNMQbuZAIqbey3lfbi:fDmfAfHN+wiuInRexuZAIij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686197806, "uuid": "c09edd41-d90d-4c86-88cd-92145520e6cf", "value": 212604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686197806, "uuid": "792f7305-fb12-47fa-a784-5eba74b0458c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686197806, "uuid": "21a19a26-4681-45f5-97e1-71344301c864", "value": "778357b87cda8e9f52552d1332ee19a2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dca7f844-05a5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686192042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192042, "uuid": "52bbe592-075b-4144-8cf4-85707bd68965", "comment": "Malware payload (RedLineStealer)", "value": "1a5360bfba26025b28a0192aa9906a97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192042, "uuid": "93b76ee1-b0f5-4751-8946-d1ee773ee343", "comment": "Malware payload (RedLineStealer)", "value": "dd8af0430b05221fcd59751c821f12cc06be03f25f8ea960c947a78a2d4fde0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192042, "uuid": "60169553-3d8a-4113-9d77-05aad0c010cc", "comment": "Malware payload (RedLineStealer)", "value": "e0073786c05cbaa88311511bc180fdab45acabf3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192042, "uuid": "1cee8380-920b-40e2-a1bf-d5c8264cf23e", "comment": "Malware payload (RedLineStealer)", "value": "b0af069f60b7aaed67abc7d0605fcb3af1d5987c71c65939153bdcf9734a11cd4e9d485ecef01c9774d44556614ffe44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192042, "uuid": "6e22e676-2edb-4641-87b9-445545ae4e8f", "value": "T1B4F41252A7F8C633E8792F705CF6015306367CE29978936B239268BF19732D4693532B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192042, "uuid": "c0093a27-4fac-481e-bea2-b097ebcab86e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192042, "uuid": "d2a1c296-bdc2-4bf8-af50-599af72fb557", "value": "12288:8MrRy90gF3mHV//cDaF6Xz0bSSdMBFPylJqqJhpgMmr1WqZrrD:dy9BmHV//cDaFX2S2B+J3Jvbmr1WqVrD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686192042, "uuid": "5c921497-4a01-4062-8cdf-5caa743cad5c", "value": 739840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686192042, "uuid": "32b68d7b-e83e-4518-850f-b8d3cbe9826b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192042, "uuid": "76f56830-f935-4068-8f46-c17dfc1ed4c0", "value": "1a5360bfba26025b28a0192aa9906a97.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4d3aa78-05cf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686210095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686210095, "uuid": "15af1003-e1d2-474c-aa1a-87eb2d38ca89", "comment": "Malware payload (Mirai)", "value": "adbf0cddd85fcf1290018ed8ff836e4a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686210095, "uuid": "086e1444-9ee4-4bbb-b0d2-d5b029f52e75", "comment": "Malware payload (Mirai)", "value": "de09b389fddfffeb244a438066584c58d7d5a3f03aacba8e71e1eecadad97da7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686210095, "uuid": "f1ec8d3f-779e-403a-876f-c1224484c3a8", "comment": "Malware payload (Mirai)", "value": "369cc5c17c469cee75d5e70383493183b869a690", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686210095, "uuid": "b76027ac-b29f-4662-a266-3050dcc9a2ec", "comment": "Malware payload (Mirai)", "value": "a439c03465f1e8cf3a24e8b78f5818f07e953d3215219eabdf7e25aeaa3d0d9897506166c1b9ffd8e5057f3e8a5579f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686210095, "uuid": "cc1f6268-0272-4293-9f3c-c79dd2282460", "value": "T1D823026181CEF5B09940A6B7D76BDB42F7A27ABCD0463E6B3B0583275F8784242FC491", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686210095, "uuid": "20e7078d-8bbb-43f7-a6c7-463e6c8d5ca5", "value": "768:MRl7zzlRRSJLu8TKxkFj6pMWHLfe2zY121ZahBs2SLFnsoHaOinYK1QEWSoORKz3:AFzJRRSxTMkZkLG2zlZcBtOsoH4nYKxy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686210095, "uuid": "1ce9deb7-9547-4256-bced-47a3b581099e", "value": 48732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686210095, "uuid": "2a120f11-dede-4b46-8b69-debc8bb39078", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686210095, "uuid": "a9ff95b3-db02-4b2b-ac52-d4b12a278649", "value": "adbf0cddd85fcf1290018ed8ff836e4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1145193-05ed-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686222919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686222919, "uuid": "a23ab9f5-ddfa-43e2-a7fa-42458003e889", "comment": "Malware payload (AgentTesla)", "value": "6b0fc4637d18724db567dbd711329b6d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686222919, "uuid": "a0dffeb6-5553-4185-b405-680099a4640b", "comment": "Malware payload (AgentTesla)", "value": "de69511f960e783c013dcd20621c0d78379876b985a0e56e77e85110909b57b7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686222919, "uuid": "305b043b-b497-4a6a-baf2-930781e978e4", "comment": "Malware payload (AgentTesla)", "value": "dfd370773c099ec52c19b58cf035a1e311cd4e20", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686222919, "uuid": "ed847f68-3c0b-45fe-a645-5f7708046154", "comment": "Malware payload (AgentTesla)", "value": "d1b704db67c7762e60774473f5594998a66f538c81b00eacf81cbe7f1d32a47fdc40875dce6de1b620d6d1608b92ee79", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686222919, "uuid": "279544b6-e1b7-4ebf-af8e-2dd7f71f07c6", "value": "T121E4F1430BC9AA95F83E40779AF43D91DFF6AC5D00F18B284DA6B5B08DF12D60E425B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686222919, "uuid": "ecdff3c2-96de-489b-b8f4-68684c04ab15", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686222919, "uuid": "1c8db6b0-67be-4f28-83ee-132e55061ac1", "value": "12288:GrjM5uxjcrWsUPEfIifqe8ES2FRyLvBFG5Py/tzvErrnoFYBt:Gr0w2IPEIb8pNy/mrnMK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686222919, "uuid": "53f98a9a-a406-4ee3-826c-0d2d47e9a8c0", "value": 687104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686222919, "uuid": "2cf93cb4-0411-4309-9f8b-0e7058b7370a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686222919, "uuid": "c15641f6-49a7-407e-a024-99f0390ac26b", "value": "de69511f960e783c013dcd20621c0d78379876b985a0e56e77e85110909b57b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0a2d1eb-05f2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686225013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225013, "uuid": "d2405c73-2324-46a3-815e-bdae0c6ce117", "comment": "Malware payload (AgentTesla)", "value": "77fc7e4ec8f5588dcb045ac7acb4ffe4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225013, "uuid": "e7e22cbb-ed94-4b2a-9dbd-0b2b70234e03", "comment": "Malware payload (AgentTesla)", "value": "dfe1d62ed1673dd1cabf1a8b9e5214e5bbd356fc8c393102e3909c8e4dc4e718", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225013, "uuid": "4dd6d9a4-1e80-4fdb-a2a4-1debbf182f66", "comment": "Malware payload (AgentTesla)", "value": "53add6c63e6fdac8bb96d86eeeea394f0431676e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686225013, "uuid": "44c68e29-b85a-4a84-918d-a82252aed98a", "comment": "Malware payload (AgentTesla)", "value": "524901e724dffa1b28d4086705fee897d7a6d7378c78357e066355259438ca4421d063409f2b408caf3c11d8c7fff0f6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686225013, "uuid": "208b2842-5d36-4029-8f5a-7e2e66f9024e", "value": "T1E6E4010573A98B47F0B93BF226419AB057F6BC1B70BAE20A0CC677DF5466F118961B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686225013, "uuid": "3d5d4fd1-72cb-4de7-b8b9-ac30b96c5671", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686225013, "uuid": "0f552e57-c223-49e3-b694-bc369b6d0103", "value": "12288:8Kr7z5GoJiGaq5aubxz9SS1e9/KobnZ4zGQUEndt7PAi2ci:X5GoR5a+tEcexzZDQUEnPAiQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686225013, "uuid": "37b332fc-def4-464f-8b29-17f3b8de85f2", "value": 685568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686225013, "uuid": "e557f1dc-5102-4e2c-ad8d-7144ef1b775d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686225013, "uuid": "3d4ee098-b0ba-467d-b369-5ec8a0f0a9fe", "value": "dfe1d62ed1673dd1cabf1a8b9e5214e5bbd356fc8c393102e3909c8e4dc4e718", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a14c4b1-0619-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686241698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241698, "uuid": "87629e4b-d47b-4556-a711-62044075fd4f", "comment": "Malware payload", "value": "b013f5b8ccbca96287379939632451bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241698, "uuid": "d8c61595-924c-4bc1-915e-626c7a637eab", "comment": "Malware payload", "value": "dff7117c3fbddbfff87e662b170817516609a38cadf29fcc3d0a793918f6d3a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241698, "uuid": "906e7095-bf24-4304-aef1-a6be6a2cc3b4", "comment": "Malware payload", "value": "2591d97270476a6d5bd3898793e31a8846d5d119", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241698, "uuid": "c6dc6341-cf62-49ef-9fbb-cf4744e42ecc", "comment": "Malware payload", "value": "c85782b350dd2bc0e5f7a6a207c85889b0675affdaccb4e53744d65318ebb56342ededc25e781451fde05c2c8399ee98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241698, "uuid": "2060c8ce-9667-447d-8665-2b8653db7176", "value": "T1C9222A1329C5C4B7CACCC672DAEA1B41DFBA3E653710C217237D306E8278262E51478D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241698, "uuid": "7aeff185-9bb4-4165-bf6b-a0ea8c3af5f3", "value": "192:CqRA6O+6lcVJHibUgCV4Fz8uxhZ09ofx9R2OkcFpu:CP6OVlEJCbUPSDGGp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686241698, "uuid": "9fb40534-02a3-491a-bd1a-7e9c1e003d69", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686241698, "uuid": "4c22362c-7e8f-4f45-bbad-6476cce6cc58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241698, "uuid": "f4f01c0a-fdf8-4b7b-9759-e02576a8e2f5", "value": "SecuriteInfo.com.W32.A-62389890.Eldorado.29821.10689", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "875ffcb4-05bd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686202207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686202207, "uuid": "1fe29adb-2ea9-4657-a9f6-f3c4debc931d", "comment": "Malware payload (Mirai)", "value": "f24fef97c31638cae65e1c213102c60b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686202207, "uuid": "93f5d266-30f8-4546-ae7a-004788d5e0ba", "comment": "Malware payload (Mirai)", "value": "e042b86ee6d5327b1c03efcf0e92cb2549e4817768c285f21347761dd5e032c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686202207, "uuid": "ee58ee5e-1317-497a-b262-5556d0836434", "comment": "Malware payload (Mirai)", "value": "b6e4307e24239b7bc12db2a99b517874788c5220", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686202207, "uuid": "c3825aa0-ac56-4d73-b41d-d9e6a30d5d83", "comment": "Malware payload (Mirai)", "value": "9e503a57a86bc295ea1cbc7f52d2ee8ddf8c25353e7cecba517513eb3c9733d8f0936ffe2d687d82d094ece606e4a002", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686202207, "uuid": "5f3002ab-ecbc-4a7c-96f1-7b2dd060a847", "value": "T1BD83075AF9816B11D4D926BEFE0E1189335357BCE3EE71129E204F2037CAA6B0F76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686202207, "uuid": "eb3cad7b-7646-4437-8da1-620510835301", "value": "1536:XUn7/fgAKGKVKZKMK/KiiDUdosGj49+yaxZCjnMSodl9uib+Xf8BY79dGaJ:wjKGKVKZKMK/KiiD3sGj2+yaxZCjnaLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686202207, "uuid": "7c7e5dbd-ad0c-4674-8bbb-e4b5b4d21b3e", "value": 87568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686202207, "uuid": "a4cf722f-7089-44c9-a17f-527808d8ad6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686202207, "uuid": "913e0fd3-361e-4951-a94a-588d1ece9f16", "value": "f24fef97c31638cae65e1c213102c60b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "722c7c50-05b7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686199594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686199594, "uuid": "7f891580-a62d-4c3c-a657-1aa4b13910d3", "comment": "Malware payload (GuLoader)", "value": "930ee6aa6ef31ed1b129d72cabf61487", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686199594, "uuid": "b53fbf46-e1a1-47a7-b810-8246b435149c", "comment": "Malware payload (GuLoader)", "value": "e04bb348676422be5b66ca3f82cb7b093ee08b0eab2230bb03e145565c9e4bb3", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686199594, "uuid": "d0b75f47-a5a0-4542-980a-938dc006119e", "comment": "Malware payload (GuLoader)", "value": "d9de472f318689ad2182d31ada269688e790324c", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686199594, "uuid": "7b89bd7d-9bb3-4675-b817-7aa41f08725f", "comment": "Malware payload (GuLoader)", "value": "0ba13cb9be54eb51cccdd3163b2478877f33faecc8fc0cc0c5310329835adc458c3f8fda4ef5a07e73440873fbac4d7a", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686199594, "uuid": "131c8e51-07c9-4334-939c-b2295d02a0dc", "value": "T1D4C234565B8C4C61F26AE8BB475EA00E49BCF23630D215C4BD9DE2743B7D50E0B6B1B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686199594, "uuid": "9dd72245-93e3-4aa3-b561-8edff7c3e55f", "value": "768:N8yqfpiJnirFonfRbTtMktCtU25eRpNQ3GKe81jEPPsU4Oonbvfs6qk0:NXhpbTtptN25UqGt86PPL4Xbvfy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686199594, "uuid": "b8480e28-84b5-46c7-a8cf-e748f2a8d8f7", "value": 26442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686199594, "uuid": "ba2d08ae-58e2-4877-a220-1ca2d1bdf4f0", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686199594, "uuid": "adb4d3a6-4568-47ab-a84e-25909999eba0", "value": "930ee6aa6ef31ed1b129d72cabf61487", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1bdfed9-0593-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686184266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686184266, "uuid": "0c6e4edf-387e-41bd-a1da-938dca9b5022", "comment": "Malware payload (Amadey)", "value": "eebc54a460b2ee7c9414eb9127be766c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686184266, "uuid": "9f624c36-94f2-4746-bdfc-f7a67aa64f26", "comment": "Malware payload (Amadey)", "value": "e0dcd54b42d6761cb3db42797585ed2f24d3119b328724d31e694c52c1398ae6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686184266, "uuid": "3fe300f4-4cf2-47b8-8afa-632111a6f85f", "comment": "Malware payload (Amadey)", "value": "e9640a8a065bd280fe6c8d8fcbf4802c39ccd6d6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686184266, "uuid": "20993126-ad6f-43df-a468-45571ae966b7", "comment": "Malware payload (Amadey)", "value": "08412181f0f209d43304d48a6ac29d6d4a817f812de069f60d7ad01f6942c4f2603d768ac4709439c681bbb2a5043bed", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686184266, "uuid": "e5e81cbc-b677-40dc-8f11-46f6d4c5f502", "value": "T1E6F41213BBEC8122CCB52B3059F61293063AFDA12A75877F2B45290F0D63B85697573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686184266, "uuid": "a0722d5d-fb2a-4449-a67b-50351182e86d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686184266, "uuid": "7e368c49-967b-4186-bbab-37feb21db84e", "value": "12288:4Mrvy90+mALyrai5gv5+GjGewxJ5HCjAoa03hBQoDIoeJzSqW8ehV0iDm75wrJ6v:3yHnOgvDlwX54AoaWhBnIoedStvpm75Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686184266, "uuid": "acda8643-9d05-4e77-9a10-00d9e96821ef", "value": 770560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686184266, "uuid": "833860aa-0b25-4397-87dd-66e01719fa9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686184266, "uuid": "706a0c5a-a6ec-4492-b1b6-ecdbd81decca", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52094bc4-05e8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686220586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220586, "uuid": "37daf2be-e2f6-4841-a7cf-f4b30896e9b3", "comment": "Malware payload (Formbook)", "value": "fb7902856893edb7c16093005386040e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220586, "uuid": "79b249cb-2e34-4e9e-8128-b28817b5889b", "comment": "Malware payload (Formbook)", "value": "e29e5c28aa859a55debb7c2d806e408e6602cbb0806f0a9042c41ea8efb5074c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220586, "uuid": "25096b5f-830a-4ac2-b6d4-4f4b0e1d493b", "comment": "Malware payload (Formbook)", "value": "703d9d2a8f62c50c59b956e3c4d95f5509f94e8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220586, "uuid": "4a155ec4-948c-442a-a65e-c4c3691a192b", "comment": "Malware payload (Formbook)", "value": "db3b4a5951e80bb21860c93e20835317579b5883262800c0391e3c94bad3da7142fd08de91ce5f5d8251323f30c0cb77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220586, "uuid": "c510771b-6ec1-4777-a4c4-7c5d1f9869a8", "value": "T1CD05CFA152C5821AD55B0F3892B0CEB003BB9F99BD69F2879EC9FC1B737B2D51221107", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220586, "uuid": "9534d932-0956-4ebf-ac31-9c0c26149207", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220586, "uuid": "5062c31f-e1b7-4647-a4fb-4ee2c2698895", "value": "12288:sGgkfvRNhXQ3yNxsAmWo96+jNpbLaJMQt39axcVViXGkIzo0:sG9XhXQIsAYvXaJRtViXGkIz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686220586, "uuid": "2315e85e-4089-4397-8868-287f8d0261e9", "value": 817664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686220586, "uuid": "fee6b091-dadd-4131-9d58-6abde28e7fcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220586, "uuid": "bcc7d585-5b7b-4a36-b8c9-772caed37ed3", "value": "e29e5c28aa859a55debb7c2d806e408e6602cbb0806f0a9042c41ea8efb5074c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76ec3875-05c9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686207333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207333, "uuid": "a37aa215-f10f-441e-87be-5f63e53c1777", "comment": "Malware payload (Mirai)", "value": "6d001549532070083b7eafb2a548a06f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207333, "uuid": "574eac02-e767-4c35-ae85-f720a40b4a27", "comment": "Malware payload (Mirai)", "value": "e2b82c7c6d3c4578ec80e5fe5398cf4f3b34508a98b2985e27a0071de676e2ae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207333, "uuid": "c34a4609-0e7b-47d3-909b-03ba7fef6864", "comment": "Malware payload (Mirai)", "value": "042406562a20de679dcd9be43327c4fdf80e26b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207333, "uuid": "c5f443b9-cd28-47d0-86b6-c47a1b9a5e0f", "comment": "Malware payload (Mirai)", "value": "776f9b110699459a0abf9e13d44116923761f6116f98ccc98b0181abec59a2633ad736a0f1bc5a65dce14b86e19aebae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207333, "uuid": "6c008669-8fd1-49bc-b310-9d242902d37a", "value": "T188831A56F8819B12C5D0127AFD1E018D73531FB8E3DB3202DE199F317BEAA5A0EAB541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207333, "uuid": "e793656f-4f93-4b0e-aa9a-2ab9cd6c022e", "value": "1536:x+npfWjE8RSGbOAkshZQPA64U54dU03JrSXcEk6bDUVv4VOXxOW7HYIjPn3RQHr:cfkUlAkshZQPA64U54dp52X9GVv4n+Hm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686207333, "uuid": "03c13767-9c41-4e19-8a0b-da56beee551e", "value": 82852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686207333, "uuid": "77428982-f08d-44ea-b4af-fa807b2b4da9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207333, "uuid": "fa80a5ef-dc60-4999-871b-5adf0b525555", "value": "6d001549532070083b7eafb2a548a06f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1cbc821-05a6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686192373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192373, "uuid": "c99e0820-bc8a-4217-8684-a3daf685869d", "comment": "Malware payload (Amadey)", "value": "7d2e423a957d89eeffaaa4c4d56401d0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192373, "uuid": "7a30b414-aee3-4205-a135-168b8622dbf0", "comment": "Malware payload (Amadey)", "value": "e2e7be5a1fa9c7c57e26e168cb7060a4188bafe19af2927ae756972ff2e5c4f2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192373, "uuid": "281d111b-a71a-412f-8b8a-ea44da14d869", "comment": "Malware payload (Amadey)", "value": "67497351658f0aa214a0b84edbd49743c33051d7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192373, "uuid": "be291c7e-1f83-4f4c-9f73-f3556c1ad4ca", "comment": "Malware payload (Amadey)", "value": "1d3b76e8677454ee215a06fb445eae6f4d788b9b0aa253eb25f08f5e240b3d9ae4d39ca0e6ba6d892c0483356fca946d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192373, "uuid": "bfb4ad74-24b8-4eb1-88fd-62ff4614f393", "value": "T1FE152383F6E8A136D6F9233129F316831B3AFCE0C9B8426B33546C492CB2451657673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192373, "uuid": "5e46e7ac-b1da-4a8a-b795-3d0f4fc50b1e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192373, "uuid": "c13a3007-ea7f-43c3-8f5a-83df5343746d", "value": "24576:ty2JDrk08oj/mKTFB1WvLZ4IoMfr4gv4DEExHtG1xlY9YO01+gtlF:I2J008E/3J36Lqor4gAD3wDlY9D0Ugt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686192373, "uuid": "bb826187-7941-4186-bffc-b3ff0833de6e", "value": 883200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686192373, "uuid": "18608b0b-4387-4e53-903b-f23322159af2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192373, "uuid": "237a53ae-bdd0-4af3-a7ab-9be508bf6cbc", "value": "7d2e423a957d89eeffaaa4c4d56401d0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3654911-05a3-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686191194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686191194, "uuid": "9119c2df-982b-4816-bdce-5d603045b35f", "comment": "Malware payload", "value": "e42491df94a5e495e88d248381daf78b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686191194, "uuid": "d8eb4b28-5534-43cc-beb2-e5f795bfa065", "comment": "Malware payload", "value": "e363f52ff771a575a98e3fb0b711c9f54978ebfc9b3a119939a57ca545e67356", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686191194, "uuid": "6181a61b-1e9d-4bc2-a3a4-96673a2db489", "comment": "Malware payload", "value": "34897189205392bc5b827c8cfd684828c759416e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686191194, "uuid": "695837cf-b13b-4904-b58d-8204e2fba9cf", "comment": "Malware payload", "value": "e0ffd94d56a8c3bd00c8d948f39ae9d1acbe95ee757c4d65e3dd949ab85e8ed9066ce647efcd6a409d1af391a7e03fd8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686191194, "uuid": "78b1ceaa-2bbd-492d-b981-3480864e9557", "value": "T193C39E01B5D1C071FD760B3518B0DA729E7DFA701E208EBB23585A7A0F613C19A65ABF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686191194, "uuid": "b4638583-9327-49fa-89ce-c17743d659d8", "value": "f264906d4975bf1277da66f2124faba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686191194, "uuid": "d0246478-09d9-4a65-b32e-4c51cc0ab7b3", "value": "3072:B9QLdsON8xxwaTq29LvVEjLfWvb8oyhuWVFrag1shbsrtvx:XQLvN8VTxEkWVFmZhgrt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686191194, "uuid": "4dc0d9c5-f420-45ff-ac9e-f5f76365aa53", "value": 124034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686191194, "uuid": "7bf4c5e7-8670-4dcb-90d0-3bb9296fedad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686191194, "uuid": "00df8e29-bc54-4f92-93fa-90f7638b9d52", "value": "SecuriteInfo.com.Variant.Tedy.379608.16454.1182", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71d0877f-0619-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686241684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241684, "uuid": "642753a8-b2f1-4887-8faf-e77b3e64d5b5", "comment": "Malware payload", "value": "301375233c096c22c6002644f9d77233", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241684, "uuid": "071021bf-b1be-4509-a51c-108972541437", "comment": "Malware payload", "value": "e394e7da62d1b272f3bec28cc075485cef04cda0d18c834d7133fbe3cacbb909", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241684, "uuid": "75986b41-4fee-4477-b1da-9affca4cbd60", "comment": "Malware payload", "value": "fc98b2cb81fcaacdc7be9eddae71afc530899681", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241684, "uuid": "b7eb9817-10ea-455b-8abb-2ce0208fe39a", "comment": "Malware payload", "value": "0782a8cb0c19d1045d4a6b82b24073806e5b97a63e5dd9e31e61150be171cc71f31f10b63d8ef7998d28891133929fb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241684, "uuid": "191c7402-5d8b-47d9-9e63-62179efca2c7", "value": "T1551523CEEB4509B2F20072711FDBF7074A05A4C6146A2E5F5825E52ECF37AA01EA47F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241684, "uuid": "01bfe029-380d-4485-bd9d-749925a44b88", "value": "bfcb746239efa7e6aa5dfcb91447d6d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241684, "uuid": "bc8b1137-c4f0-4e61-b0a1-17ddb970c8cb", "value": "24576:DCeoB9eZIAejF9a8kh5YEJSkHbmfcOzVk8u5ap:+e8eSNqbekH8c8c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686241684, "uuid": "6c57ff64-4177-4b61-b53a-f86102b9a88a", "value": 887296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686241684, "uuid": "1d0be1f8-d4cc-4ef5-9b43-3a641abd2f52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241684, "uuid": "0dc368d4-bfbf-45f1-9b81-fcd300672959", "value": "SecuriteInfo.com.Trojan-PWS.Win32.Gamec.15149.13956", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1b5c294-0636-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1686254301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686254301, "uuid": "dbe220d4-464b-448c-b0ad-3e0a544224c9", "comment": "Malware payload (Fabookie)", "value": "2c26275cb9949a363f46a0458c9a2883", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686254301, "uuid": "c13c70a6-8d0c-4ddf-982b-f1f589a6e11f", "comment": "Malware payload (Fabookie)", "value": "e3d9fe1d6d23c0641c40e3b3eeda4b08f47f6b93e4afad127436fbaf61a7df4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686254301, "uuid": "9123429e-db18-4d26-bc66-ffe6b2b3f719", "comment": "Malware payload (Fabookie)", "value": "35e7f9a5083cf81116a9fe56d0efbaf7f02ac7b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686254301, "uuid": "5627172c-ffe2-447f-9928-a4a9488d1bd4", "comment": "Malware payload (Fabookie)", "value": "ac1b0a5dcd1decf1c6032c1e44bfc04ee2263bf09f15675e07b9d4613c6bfd7f3d28935dec712743d1ed7d600ca4f4c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686254301, "uuid": "9edc74c6-635e-48ae-858e-06c4a1b676ba", "value": "T1B2547C10E26942FDC4BBC179C6838A7BEA7038059B2C97DBD740867A6F16FF19536309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686254301, "uuid": "6f86036f-20b0-4f18-8fd2-8bc8daffffd7", "value": "bb7dd18842cdfea2ece211a612d2b38b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686254301, "uuid": "f980b6fa-f80f-450c-81cb-5b699ca982f2", "value": "6144:97u5oUxzFzLrZjQ11tUeJpj/4EK8iangu2+UvQ/KpmOq:972XxzFzLtjQ1L/4V7KMvQ/Kp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686254301, "uuid": "16e93bcf-3dc8-453e-89a9-2d203beb53e7", "value": 294400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686254301, "uuid": "eac1d3df-a7ae-4f2d-82a0-9ba6b71ff4c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686254301, "uuid": "092bf32a-21a4-47c2-a993-f606c67803c3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4364c00b-05c4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686205099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686205099, "uuid": "24708da0-7cf4-4ea5-b5b4-9535e56899a2", "comment": "Malware payload (Mirai)", "value": "6c6372149ad6b354c97cd5b65eb5c4a3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686205099, "uuid": "6bd7e3b0-172e-42ff-8247-81948f510465", "comment": "Malware payload (Mirai)", "value": "e3dbc38b0754a16ce3d0bbac5f21fa183ef9e291b3d02268791e7bc5082f3aa7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686205099, "uuid": "e115590c-fa37-4a5c-afde-c9b6d170a930", "comment": "Malware payload (Mirai)", "value": "00c948fb67e1fd08dd667fe6c05c59a4c7407579", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686205099, "uuid": "9ece39ff-e0eb-4a15-8318-981794e8aaa8", "comment": "Malware payload (Mirai)", "value": "fff2377c169165e4365ae2573f2af08dc13230ec6f5e081e624b757bcf303efdb6f657a786c480a8b7064c8bd2fb5323", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686205099, "uuid": "f278ea05-f6f1-4f51-ba0a-837d0b77312a", "value": "T18F730946B8818A16C5D413FBFD2E018D332267F8E2DF7212DD115F647BCA92B0E67A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686205099, "uuid": "6a01ae7e-8e02-4d42-a1b5-3d674769148e", "value": "1536:CNniNkfWjpqh8QzWIcZMoVbmk3iBPdZvN2S5i4YMTzGIIiYNfI/bRd42+:LkfWchhzWITkjitoAi4oNfI/bL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686205099, "uuid": "633d8a2f-2870-4be0-865a-c7b5c0653dbf", "value": 75056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686205099, "uuid": "bcf7847a-eceb-4603-a5bc-511a76d1b3c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686205099, "uuid": "16c64040-94cd-4a25-950d-b269ce658412", "value": "6c6372149ad6b354c97cd5b65eb5c4a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41cbb8a0-05e8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686220558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220558, "uuid": "f6609235-2ff6-4a46-88a3-867812b1be25", "comment": "Malware payload (Amadey)", "value": "02e044f33dcb6f529b9a2cab9399a005", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220558, "uuid": "506549c9-1895-407b-8586-91b31437b664", "comment": "Malware payload (Amadey)", "value": "e447ae1f8224e2b964c69128ec258560a374151a8ee932670feb7a2670163682", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220558, "uuid": "5f684fa5-b62d-4158-b4b6-2e5189b6b33e", "comment": "Malware payload (Amadey)", "value": "26160bacfe6b9bae3dbe09f1bd49e351ac421589", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220558, "uuid": "8c1d9c42-4607-4c50-9fac-19b5031d4b45", "comment": "Malware payload (Amadey)", "value": "5c2504553e7bac9e0c77a1943edd2db4d9b57a50c56fcd1d4174600d3a6410b354ca6a8fd35c479c4c064b0d399ebea7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220558, "uuid": "6967423c-29a4-422f-8854-90f69c61ca98", "value": "T1FAF41222ABE94027D9F52BB018FB06C70736B9E1CDB487622796999E5C737C4643073B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220558, "uuid": "f0fcbad4-bc92-41ea-a46a-ecd4f515f16c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220558, "uuid": "bc774e95-49d2-415c-a79e-6dea3acf142e", "value": "24576:sy7vAUKqx3rIKX0OMHZp6oqAgM34iaqR:b0UKqrX0D5p6oqo9a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686220558, "uuid": "304e77ed-f7c3-4536-b6f4-51601681b477", "value": 791040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686220558, "uuid": "e44a7158-c6bd-425e-9176-bb61488067cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220558, "uuid": "9231638f-6039-4e6d-a5f7-f1bcef45086e", "value": "02e044f33dcb6f529b9a2cab9399a005.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9331a1a-05eb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686222074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686222074, "uuid": "f3783c50-3e0f-4a89-98cc-ad4d76d0deb5", "comment": "Malware payload (GuLoader)", "value": "061ca824606e81a9018f865896cb28bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686222074, "uuid": "a77e3e9b-b53b-42b3-b024-4bd252ed99f4", "comment": "Malware payload (GuLoader)", "value": "e44cb4f3f02f2f33835fdd28a8893ab0c4db2ae1c7496bf35dd7fe7859f9df11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686222074, "uuid": "6699e896-29e5-43c3-93e3-891f0a197e7d", "comment": "Malware payload (GuLoader)", "value": "16a7da3f6dbf3e94f3d640d87569514c5b145ca9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686222074, "uuid": "843ae102-c071-4790-88eb-bd90bcffc719", "comment": "Malware payload (GuLoader)", "value": "7dde44181549192a8ef511bf7550d827d0c47625ff3ee86a03444d3aef41d63b855187a25897f8b9233eee6c07b82c2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686222074, "uuid": "366c26e3-bb24-4c82-8068-7123930ba9cc", "value": "T1CC64D0C3B68091FBED610CB4BF1E80EB1A92BDA9D4D01F4BA774773A18E1531620B596", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686222074, "uuid": "e47deaad-9cdf-4f37-9c99-30a09ac9a07a", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686222074, "uuid": "3bf5b880-fdca-4298-aaff-09ff829ba620", "value": "6144:fQ606x5wOyFNKvLOsI5H8TQ87VmepAWAFYyzk7Jf:/wDSvysI58Q87CVBOJf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686222074, "uuid": "268b4054-3c38-4517-8c0e-77fb320381bc", "value": 328685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686222074, "uuid": "98cbc86b-b514-4d54-a4b8-5cf04742003e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686222074, "uuid": "77aeb294-a294-4d09-862a-1482247a9022", "value": "e44cb4f3f02f2f33835fdd28a8893ab0c4db2ae1c7496bf35dd7fe7859f9df11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "842e6c27-05c9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686207355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207355, "uuid": "e23a3d9b-a283-4f6c-b00f-7ee495e64f79", "comment": "Malware payload (Mirai)", "value": "052e9d5febea6162363c3a6c35c65146", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207355, "uuid": "978a37a7-e586-4900-b095-cda1d332d74e", "comment": "Malware payload (Mirai)", "value": "e6630f53d27dde65479771aa6a444161d85c7871349b5f0cabdefa5191872891", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207355, "uuid": "7faaf3b9-99e0-4e1a-8787-d45d4e569ec6", "comment": "Malware payload (Mirai)", "value": "51238f8fc747a3a03067a20efb99a54befd854dc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207355, "uuid": "35462962-6282-4555-ac0c-236145ef564b", "comment": "Malware payload (Mirai)", "value": "64cc0af8e663bb951a4f3a687ee3360e0c28056a809ed3f1502154457532bd2182f744b7f5e6722d7f2d09eeb7017daa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207355, "uuid": "99896987-7480-45f8-b5af-cb99ee0b84d2", "value": "T16D533A01F719084BD1F35EB03B3B2BE583A69E8221B46249795FBB89D571D33448AECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207355, "uuid": "06f62263-ec98-461b-ad64-bd722959f547", "value": "1536:B2wYJHBoTrtjYiu1zOoLuITQNTJqjnXj6f7qwby4FQazTQoYFHQPrf:4w6HQtjtu1ioaIMNdqrXjeDf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686207355, "uuid": "c1aa7bc4-f11f-4820-88d7-9c2346699fbf", "value": 66332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686207355, "uuid": "116dddd1-927c-450f-b750-097312b4cb14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207355, "uuid": "04ca22d3-692d-4533-b115-070bffa34833", "value": "052e9d5febea6162363c3a6c35c65146", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6766a3ed-05c1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686203871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686203871, "uuid": "3731b402-52cd-4d86-8cc4-91d7895d8a1d", "comment": "Malware payload (Mirai)", "value": "149b52800cae635e40915f7cbb439b19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686203871, "uuid": "c0453f35-78d4-46ac-835f-4c22e69efbde", "comment": "Malware payload (Mirai)", "value": "e67f1e64f54fc4f450039905092ad6806f61cc7fc2bd99161370f54a6bfa45d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686203871, "uuid": "909d20b6-ede6-42c0-8e29-2d66c5e64496", "comment": "Malware payload (Mirai)", "value": "cf57a3b6fbc30a7adbe00fcc14bf2c1ea282c60b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686203871, "uuid": "03f47838-301b-4a4c-b6a1-28914b96805b", "comment": "Malware payload (Mirai)", "value": "6e4cf486b6ad92fca4795d04e475171cbb8415c228817f57c2b327761f23f1a9a2dac30c7fe8b20ac3dc4f33ca422265", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686203871, "uuid": "83e8cdcb-e9e3-406d-b280-657038cbe048", "value": "T140434B12E65181FDD44AC2758AAFD172E635B96C12346A1F3BD0BFA51E33E31372A384", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686203871, "uuid": "c7926fac-33d8-43e2-82f6-3fadb6f5947f", "value": "1536:CkEHOJ/CZGgXIUwfQYmNJwqzqwVwtuHr:CkHpIY/qz5tL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686203871, "uuid": "bec5c801-b7cd-41e0-87e2-c90dfc61ee85", "value": 58544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686203871, "uuid": "08dd2529-1a02-4102-acd7-3a2efed94a23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686203871, "uuid": "719085ec-dd98-4435-b28b-b283a36de6ab", "value": "bot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78db6ed7-0619-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686241696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241696, "uuid": "5c7c494d-6a85-4bf0-8b6c-b49dc482c24b", "comment": "Malware payload", "value": "6ebf845f486dffb75ae3967e2fe537b1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241696, "uuid": "96e3f9bc-ac0a-4aa0-90e0-351ab7bc6c50", "comment": "Malware payload", "value": "e720d874a93d98bcc04fd2a806255360195a04286294fe63341bb765ea986d38", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241696, "uuid": "678f38fe-19d1-457a-8643-f64d1f05336f", "comment": "Malware payload", "value": "caf686301faf3d0a392685a391464a8ae5c7e291", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241696, "uuid": "327095dd-3432-4792-9ecc-8c39b1cf5781", "comment": "Malware payload", "value": "86a744ab116db9f6ea2d26cbb91da312fb1fda989b0b0991a68deaac7edf8f7965dc3641e7992a6ec3b8291f9597ee33", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241696, "uuid": "d9ff2573-a980-4955-965c-a5fdb39e105c", "value": "T1F4F17E8B675C2635C22900BB139F5118680CB3526BDB279C76ACE5ABBE9368D4463E1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241696, "uuid": "b33b5bc6-d873-47b1-96a8-60c69b3ce7e6", "value": "47d22ff99d0e9f4348033704e4bcac9a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241696, "uuid": "fd37f412-861e-49b7-b9be-b27573a8ec8e", "value": "96:eigNh6ul6NXpXlDa7NDNbKZemVq2a3LxI8uIad1rc0rgyJFC7tCEy6:8kXdlDapDNbGev3LxIB31d5Jx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686241696, "uuid": "0beae7b1-0c40-4f14-a450-185860d322b4", "value": 7680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686241696, "uuid": "703d0798-6981-4fda-ab0b-6feb24164b94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241696, "uuid": "faf305e0-cefe-44cb-8281-6ee468bc1457", "value": "SecuriteInfo.com.BScope.Trojan.Bitrep.24331.23250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74672d93-0620-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686244695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686244695, "uuid": "709f223f-9d70-4fc7-9540-af07725e99c3", "comment": "Malware payload", "value": "96a3db694f27a242ddc1e9c042ce8dae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "RedAlert", "colour": "#1916F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686244695, "uuid": "1829f971-e5e2-4645-a06d-19bcd8305349", "comment": "Malware payload", "value": "e7ac9fe843e052ad2a2e26269487424cd0c693696b89be63b443ba3e0cd3b9cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "RedAlert", "colour": "#1916F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686244695, "uuid": "69490f2b-2234-4f29-abe3-97f6d1c96616", "comment": "Malware payload", "value": "d6a10e3f8070ecd6887532bdd6f2d9c7d48a70cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "RedAlert", "colour": "#1916F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686244695, "uuid": "cba33bb7-6354-4536-a469-87b36887c8b5", "comment": "Malware payload", "value": "e10b9a27aea8f75bf949da7e8c97b4044fd1c31696e66b4998548c79dab2e4401b5857639228aecc2aaff3caaa6ec3eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "RedAlert", "colour": "#1916F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686244695, "uuid": "659744ce-5a97-4408-919b-6182a5865cc0", "value": "T17AE312B791C2F1FE9D858C29B0AE80DE219A11F93E708C5D0625B42779C72EA7D13237", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686244695, "uuid": "814db2d3-b221-4f1d-862a-ae5e6eeeec4a", "value": "3072:lz5hglhsUecItXi2/P6hJplf7cEMJc5S6to:lz5ilPXyoofc52", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686244695, "uuid": "8579c506-cb6e-4925-8aaa-4cbdb71bf49a", "value": 145588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686244695, "uuid": "9a43860d-6107-4e16-ac64-e2d0619b8f06", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686244695, "uuid": "abbe9374-3951-4ae7-9845-ed9a6d292aca", "value": "10697796873.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc3c162b-05a6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686192417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192417, "uuid": "1d5e7cee-dd98-4a43-9e62-3f6d43906424", "comment": "Malware payload (Amadey)", "value": "656653df36f6fb62a35ea86d7d98609b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192417, "uuid": "df92ec1d-abf9-40e6-b47e-4158055b1e29", "comment": "Malware payload (Amadey)", "value": "e82b950235f0725567d870690cc963bfc0897f0371d267f07eabddc166f126b6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192417, "uuid": "e22757a6-9155-4755-bb3e-d0f40213404b", "comment": "Malware payload (Amadey)", "value": "1084e5ed279345e05106c1494f243c82e675be49", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192417, "uuid": "a7c5e374-749f-45dc-acc3-4dccddcdd474", "comment": "Malware payload (Amadey)", "value": "2622dd500d4fe45f5978cbe284dec71e529bd9515b87114345cbbfaafccbc9985934ee2bb06cdefe8c87494aecba7e5c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192417, "uuid": "88706e99-7618-4c91-8ccc-f7e8ce384ba2", "value": "T1A424F7257D12C032D56061B619F5BFF2C59C6828ABB049DB7B800F77DA122F73A61E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192417, "uuid": "d64d3119-0b7d-400e-8ea3-64dfcd7494c4", "value": "f8cc61ade86cb7277d0ab974de6323cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192417, "uuid": "33c648d1-b426-49e6-a30f-f53f5f05c7bf", "value": "3072:H/DmgskHbfHN+Pst60p0zuNmnKG7peNMQbuZAIqbey3lfbi:fDmfAfHN+wiuInRexuZAIij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686192417, "uuid": "b1b3e369-1031-480b-8651-2c8df414118e", "value": 211705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686192417, "uuid": "5dfab048-b4d1-40bb-aebd-efb421011c66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192417, "uuid": "5ddea2ca-3c82-461d-ac4c-32daee1139dc", "value": "656653df36f6fb62a35ea86d7d98609b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f118b90-05be-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686202569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686202569, "uuid": "7e9b5d95-a483-4dfb-9232-1cdbe3173118", "comment": "Malware payload (Amadey)", "value": "a88d2d74d7359c8b74e1f85fa6fd4fbb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686202569, "uuid": "bacd3045-e9b2-4fac-9835-8aec92be1ef2", "comment": "Malware payload (Amadey)", "value": "e9683adbe84e0d06cecb825dcca4b009f32cf53c492fe8e86e462e07557d7769", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686202569, "uuid": "c8dde9c3-ab68-4fbb-a3f8-9d4b0825f81e", "comment": "Malware payload (Amadey)", "value": "a3634e2433df75c3adac9732e4a10b2290c799e5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686202569, "uuid": "8bbae6f4-6ff7-4816-a467-6f7f3e6fc2d1", "comment": "Malware payload (Amadey)", "value": "ad9bad637db2f1231ce483bcd8a61e4cafe9f14d455a7be5864c46b522746d2ec6aff38b1a818038b37667ca48d761ca", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686202569, "uuid": "a9069449-e199-4457-8a37-faf0eb21d160", "value": "T12054F71393E17D54E52D4BB38F2EC6E8760DFA508E797B692219BE2F16B10B2C163710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686202569, "uuid": "c72d32bb-27d6-4b8d-a901-30c7ecd7d2af", "value": "af40ca862bb560756a6239b041d2950a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686202569, "uuid": "7f6cb430-385a-445b-93dd-289111294650", "value": "3072:fgINZZtBp7mY1kh5RIlU1Rjlwnamy8UpkDrCLHcsDA/gB6Fh80sE7HmJt:tNZRp7mY10a6RWA8UuiTcxNFHmJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686202569, "uuid": "c727bc8c-0248-4d11-8535-090312a6b55c", "value": 292352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686202569, "uuid": "177c26a8-d58d-4b8a-8e76-f596fad72269", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686202569, "uuid": "17458cae-c761-4629-b41d-30d0e1e0baa0", "value": "a88d2d74d7359c8b74e1f85fa6fd4fbb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8e77a42-05d4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686212168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686212168, "uuid": "cb780ecc-8f8b-4fd9-93ac-a9696de5cd1e", "comment": "Malware payload (Amadey)", "value": "07ce702605e66a425128639679c5f2de", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686212168, "uuid": "ee60f3cb-92c7-435c-b020-96ad7aa6070c", "comment": "Malware payload (Amadey)", "value": "e98586f90d7a407fb452f3d96bb9902403d66f28ba39e268e405af22fcb080c2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686212168, "uuid": "482765a5-a5d6-4f4a-8230-495e4484ca34", "comment": "Malware payload (Amadey)", "value": "b9e2e16959d61aa5bf04fd84ff1988a8afde83eb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686212168, "uuid": "102f3c69-31c9-4a3f-9089-6b35cc251e69", "comment": "Malware payload (Amadey)", "value": "4b79d70de70b602bc41b0d5b04cbe5f6dbe581ef3937e6d9a87ab6632e59fab6d28d4000a65bf7efd2fcb8771ca1e14b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686212168, "uuid": "7521c5d2-739f-4635-beca-b8dbe6de14b4", "value": "T1A354F81393A17C54E93D4BB38F2EC6E8760DF6518E797B6A2219BE2F16B1072C163710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686212168, "uuid": "32d5ecbd-606a-4122-b87b-cbd47f646342", "value": "af40ca862bb560756a6239b041d2950a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686212168, "uuid": "e84fd5a2-51f4-4842-a19d-345898095c25", "value": "3072:hyINx8BOk3kBhG2sWRIlEsNgK2RUfXFlF5qOgEb4c+JE0/Ik0sQr7HmJl:VNxtk3kBhGHpEsN2RUfbqO94ciIZ3mJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686212168, "uuid": "eb5a3520-2e38-448b-aab5-24aba11b462f", "value": 290816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686212168, "uuid": "999d1f9f-fe64-439c-9f39-ce45d862d05c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686212168, "uuid": "2608ae93-0441-4177-8eb6-528f88d0dc09", "value": "07ce702605e66a425128639679c5f2de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "802c019c-05bd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686202195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686202195, "uuid": "43c8f5cc-9890-428e-bb01-614ffc9716b9", "comment": "Malware payload (Formbook)", "value": "ce692ee68ccc4b7fb7381f0eabfa6891", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686202195, "uuid": "b741b558-fb3a-419c-9dab-e9e89eed5ee3", "comment": "Malware payload (Formbook)", "value": "e9cf4a2fe44de91205a9147d0108c53b58f964e3c57011e0413cfb4fcb39573d", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686202195, "uuid": "fb2acfc3-5bde-4104-9772-54aade426dca", "comment": "Malware payload (Formbook)", "value": "ea62365271dcf5faf66958cf2505faa8e5b8e772", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686202195, "uuid": "b6e2eddb-8f95-42ad-8291-1730967ccadf", "comment": "Malware payload (Formbook)", "value": "153620b5c5aa1f75984f99eb439cc550a1711c40c819f6e77e0719d85fad07f1d47a8612d146e148b977ed7af18f3e08", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686202195, "uuid": "d4cd8662-8450-48a0-a69e-3d0da18f0b3d", "value": "T1BCB2C36A5B8C4C61F259E8BB865DA00E48FCF23630C215D4BD9DE3743B3D54E0B6A1B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686202195, "uuid": "a7775c23-6a32-499e-92cc-2e9574ed22f0", "value": "384:YyfD8xByw8HWrxLh5U+BylAqpiW+OTATD8oukKYmLuOBjXDc3S1LpE5MD/m6gx3h:JfD8xQr2FLh2qyuqpr+OTATD8osYmLup", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686202195, "uuid": "330a7521-f2d3-4b87-88df-4417725dde2a", "value": 24061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686202195, "uuid": "d694f980-b782-454a-995e-13697ddf11ff", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686202195, "uuid": "e9bb04ab-4bfc-4334-ae63-bdcdfc9d94ca", "value": "ce692ee68ccc4b7fb7381f0eabfa6891", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55d2997a-05a7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1686192675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192675, "uuid": "5c95cf83-5ac7-45a1-8d1f-f3c48e20587d", "comment": "Malware payload (Fabookie)", "value": "f49aa3f4cc246fdf8d11363caecc1591", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192675, "uuid": "47959a7b-7c7f-4b9d-8007-26fbcf7e6fe4", "comment": "Malware payload (Fabookie)", "value": "ea641f05f32a47d5d71bc779780448676cf471793214aafba66bcc9da0a141a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192675, "uuid": "b12bec88-0324-4fcd-ba2f-4debc781360d", "comment": "Malware payload (Fabookie)", "value": "685e1e0cc4ad59ea582844d2f8746900dc5c0dbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192675, "uuid": "9c18d09e-9677-4f94-a353-e52a44ec2fe2", "comment": "Malware payload (Fabookie)", "value": "ed6aeec1a2e7519dff1a3b6baf59a1a1058fe46eb0d0d01b87fc141a876d31d2fb5b3ac77f0c9173d31b19f9b2d7c38e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192675, "uuid": "088283d8-66e9-407a-9c82-fdd2b664d8a9", "value": "T1BC346C3262F078A5E5F74A318E2EC2F4761EB6618F7DE75A321ADE1F08721A1D523311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192675, "uuid": "4f882b00-d46f-46c9-a30d-ac8d1f9c78ed", "value": "ed6a070bf0eed3feda93e1f7e2ff5c98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192675, "uuid": "fca5d258-1771-49ca-a8fc-96f3d001906c", "value": "3072:94rr40JAoRl8vgvNJeEVji7lyRsSBKBD52D3a4p1:Is0JHeQNJe4i7IRsSMuD3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686192675, "uuid": "8abc0e8b-38a4-4570-b66c-7ed1a26f8e86", "value": 251392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686192675, "uuid": "cc26b533-e03f-48e8-bec5-bd15a4adb9f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192675, "uuid": "49486396-f50c-46ff-b66d-a883e6a49835", "value": "f49aa3f4cc246fdf8d11363caecc1591.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77712189-0619-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686241694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241694, "uuid": "ae5b816b-9e29-486c-906a-0fdd56cc2a6b", "comment": "Malware payload", "value": "98f162a57f460d08bb019709390c1f75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241694, "uuid": "904d7183-5b0e-4642-a507-dff9e3086753", "comment": "Malware payload", "value": "ea6e1149ee9913745c301e7b7cb914e51e131743d5d1262e226a8a55afba5ca8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241694, "uuid": "61b55a05-a3df-44eb-b2bc-260a960615b1", "comment": "Malware payload", "value": "f536bc90171cee56afdbdcc979a4efecebe47e41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241694, "uuid": "b06d9ede-5d35-4e8c-966a-2a56ed03d83c", "comment": "Malware payload", "value": "8af0a16df35f63067c5b97876901c5a1cd32e13fea33af825238670947e9b3985e5a8b4040040d41eb3f774d3e6b4b6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241694, "uuid": "d1201592-c5a3-48ff-a17f-494948052d16", "value": "T12EE2CFC049698A3AE10A31BEC41B0909D6FDCC493349CB4DB8F0F41E8A75A976FB4637", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241694, "uuid": "1c2cf2f3-f80b-4953-baaa-60fd1770f2c8", "value": "ea23a5a4586894d7ffdc8f4872c48e51", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241694, "uuid": "d34aa121-f5f9-44de-9409-e13894fd9be5", "value": "768:hgTBeG0dtKj8561qHZ+h07oyVs3Lp4ESZKagvqlkw:hSBeG0dtKj85aEZrop3Lf6Kas6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686241694, "uuid": "dbc2bb45-8ab0-46fc-b85c-3a0d1c145192", "value": 31744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686241694, "uuid": "f06a3fb4-461c-4e8c-accb-4bcd6c9008e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241694, "uuid": "0ef7e8dd-5b4d-44b0-9127-55ccf9211ec0", "value": "SecuriteInfo.com.Virus.Win32.VB.9748.347", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a872ca1-05f7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686227096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227096, "uuid": "a1c7f5b4-cdcf-4f5e-91f5-ef80c2378030", "comment": "Malware payload (Formbook)", "value": "8b0450ce287e3ce0dcb135765ff62159", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227096, "uuid": "150a7e7e-edae-4b9f-a61e-3f264a830cd8", "comment": "Malware payload (Formbook)", "value": "ea94d610bc585bff2eee7d9cf22efc6e6d9c45e01cf5fa63ccab509593b65408", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227096, "uuid": "2222fcc4-9655-4758-a9cc-3cd39d658c99", "comment": "Malware payload (Formbook)", "value": "36c866b898999360485b25d713fea933dde9d304", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227096, "uuid": "aeec3f3c-0f23-4025-865d-74477c71a06a", "comment": "Malware payload (Formbook)", "value": "bd70f7c2b7142ffac96f68ed08bec6b72c74c87a25fd74d5f1ba63a9235d00a67dadde22c6c3cff7930e1385d70d964d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227096, "uuid": "cf0f743c-90a3-4b7f-ac69-23c211e281d5", "value": "T181F4F055B5BB4B1BD5BA53F4850073300BBE6AAAB872E31B4ED7F4D62521F014AC0B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227096, "uuid": "a9a2c9e1-ffa0-4989-bd52-4b998b671e8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227096, "uuid": "c7d95b1a-473a-4a21-a372-e85ce95dcbce", "value": "12288:QO2B0xTGlxNqvNu2hZ+nUEsn9dgMbDt7l2WKehVqajjxKatKWXigRhXnRgrRXfl:QOLaVUH999dHVwIVD/KWSgRlR49", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686227096, "uuid": "e220bb11-42f1-48f0-bd51-0de0ac4de7ab", "value": 794624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686227096, "uuid": "1ab03462-c81a-4a6e-acbe-b642c2764347", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227096, "uuid": "07045d0f-72b3-4684-9280-9e5e64049f2b", "value": "ea94d610bc585bff2eee7d9cf22efc6e6d9c45e01cf5fa63ccab509593b65408", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "681691a5-05c9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686207308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207308, "uuid": "c0e8be7f-22c6-4968-a8db-2af8884c4449", "comment": "Malware payload (Mirai)", "value": "a0e5f42e50207f8193f0ef9d4131959f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207308, "uuid": "c50097bb-abbe-4aba-9cff-8ae6eb1a5ab1", "comment": "Malware payload (Mirai)", "value": "ea96e78254cbe354af3766d55af38ce81be037de5b7843529649b559f4884e7e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207308, "uuid": "6d4016c6-1851-4b11-9c75-f905c45f9857", "comment": "Malware payload (Mirai)", "value": "b2a13da836dcbf02b31060315b6ef00d089cb2a0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207308, "uuid": "e6dcdd9e-1262-40cf-acd7-34eeed072d8d", "comment": "Malware payload (Mirai)", "value": "a7c9ecdb569b7a273fac3ef40ec66a02a9fec314441a4036b49698abbbbaa891d50ad75783cee2696a0842a4457c3dd0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207308, "uuid": "77a41feb-31db-4975-a384-89404065675c", "value": "T164633B02B31C0987D5635EF0293F27E183BEE99121F4B689690FEB469275E325186FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207308, "uuid": "d16cedc3-0007-4087-b698-a755de7dd2f0", "value": "768:a5z6nWpERDRQ8zIY4YsD+mgV9R6gB00N8uL1CW49YjL1fOO9hQS3wSEzMdFk/tdx:yunXN+bYsvgN6pe8ucY/1nA+w5D/Xai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686207308, "uuid": "f3b38563-af37-45a4-8a06-982d9da598bb", "value": 67620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686207308, "uuid": "77b59541-7232-458b-a6d8-2840a53ecfb2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207308, "uuid": "a974df57-b049-41cc-88c5-69d03b5bbe36", "value": "a0e5f42e50207f8193f0ef9d4131959f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8af73293-05e6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686219822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219822, "uuid": "b2168eaa-dd03-49e1-973d-8661d0b7669f", "comment": "Malware payload (AgentTesla)", "value": "d8f1e4048b538254ec528d8ab94dc1e7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219822, "uuid": "c99181a9-040c-4175-86bd-67ee5f9785f4", "comment": "Malware payload (AgentTesla)", "value": "ead1c91568b30168ec9a7685aa357b541c7da50ed5fcfd3d799c1a052d9e1f6f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219822, "uuid": "03207384-84db-430f-82dc-14b4b993220e", "comment": "Malware payload (AgentTesla)", "value": "55c2f17a13f9aebd8c868e4ebd4137843737f9a7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219822, "uuid": "ab73d490-05cf-4872-bafd-ea5e473786ce", "comment": "Malware payload (AgentTesla)", "value": "954475217514fe920fbac2fc976db14625b599cb94bc61d2d4e4a505f43d2cbfa83c956ad7ece922dfd918a772711494", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219822, "uuid": "eee6bccc-8876-475f-ba9d-83053f20571f", "value": "T1ACE4F17026D58B0AD02B037885D1C3F067769D85B8B6CA874FDEFC5F728F2A66321256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219822, "uuid": "68a089de-3b55-444c-8f1b-a685ecdf2f4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219822, "uuid": "8489ca21-5b0d-4b29-91dd-beeae77cfcfd", "value": "12288:kqgCeE2IMPA5m6gVna6I7NzoVCopjXBvmhbndGZCle88a:kqIEeGgVnalNytpjXBvmhbnUEl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686219822, "uuid": "b6caf740-238f-46b9-bb40-6b82584435d8", "value": 717312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686219822, "uuid": "ec87ea1f-239f-46f1-bfda-bf1219ad5c82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219822, "uuid": "2e0f0996-c244-44e1-bf1e-ef7d91ed5d42", "value": "ead1c91568b30168ec9a7685aa357b541c7da50ed5fcfd3d799c1a052d9e1f6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e220b343-05cf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686210090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686210090, "uuid": "26922c4d-13df-48dc-b354-c4f564b538bf", "comment": "Malware payload (Mirai)", "value": "47265241f41c486bfce4567db46ee4c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686210090, "uuid": "2b1b28e6-2d8d-4544-b2f3-7c542b190518", "comment": "Malware payload (Mirai)", "value": "eaddeaa31b0f97307cb7638967b2d74aed383c5c19bad3fea311251f9b9fa6f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686210090, "uuid": "995d62bb-7ee6-452f-80c9-44a1d159be9f", "comment": "Malware payload (Mirai)", "value": "d280738b9a4b3d2ca6b7d93fa0621dcaf02b6738", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686210090, "uuid": "8e0871d0-9519-4bd0-a282-e38b3a1f6bd2", "comment": "Malware payload (Mirai)", "value": "07aa391f39a52e296abefd2d812dd68f56a0cb01edaa6da0554286f45dfb02949d924a7adcc59db8668b24a58ef7be55", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686210090, "uuid": "c95e4ed9-4f3d-42b7-9220-dfe88da12a2b", "value": "T12623F10DE9963ADCCA7E6F3DC1E705D86C81B1D353890EC883BA4E83923652768964D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686210090, "uuid": "808a1158-7e16-4214-a592-4a24401e1312", "value": "768:8v6fpctpcOPX1NT3E89TDw5NE0TVg9xYigEjqVX6Y+ePXJlkLrsZm2K0xwWMh:+cONNT3h9wg0ixba5v4nsI2KF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686210090, "uuid": "82215940-c49a-4648-b556-678d9fa27d51", "value": 47384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686210090, "uuid": "13909506-4e96-47d9-ae5b-3d604a12f4d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686210090, "uuid": "7bc5eb3a-a33b-46e1-a3cc-1a8c6a9dc71f", "value": "47265241f41c486bfce4567db46ee4c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "893c9628-05c9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686207364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207364, "uuid": "f0396739-246f-4f6f-863d-5eabf6375d11", "comment": "Malware payload (RedLineStealer)", "value": "228cddbb01f2805f52f167cd184fe3b0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207364, "uuid": "7694dfe0-11a6-467e-9c6a-67ffe654effb", "comment": "Malware payload (RedLineStealer)", "value": "ebb2ba69aefa29443238a76949a991384b01e4bb8291cfc5531e233d448cb280", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207364, "uuid": "f505d63f-d610-4a81-8978-4056b4b3438e", "comment": "Malware payload (RedLineStealer)", "value": "6cae484aa3e232b6809937d30adc9561f02c861f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686207364, "uuid": "cfb46cb6-caaf-4084-9321-3cfd95566c67", "comment": "Malware payload (RedLineStealer)", "value": "477923e9c4b84e5e1c24242d4ebb9eb890e6127963f31c29d4068caa799eaead87089c0b8ec0f85c07ddfbba47a1f147", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207364, "uuid": "7618eed3-1216-4bdd-aea1-696dcd865a7a", "value": "T179845B13A3A17C54E53D8BB38F2EC6E8760DF6518E797B692219BE2F16B1072C163710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207364, "uuid": "af58f5e3-8546-4d5c-910b-3aab4d3d8216", "value": "af40ca862bb560756a6239b041d2950a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207364, "uuid": "26ab5ec1-9d81-465a-9e84-61f17907911b", "value": "6144:zsrqGnEHqBkGM43xKtMjEdvZTqtAYMpjXmJ:zUqGEHqBFMSpjIvZTQAzi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686207364, "uuid": "749d1b77-e1d6-4c2b-8f48-e0d17fb8c186", "value": 390656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686207364, "uuid": "3b626036-ec70-47a8-914a-c060af46deb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686207364, "uuid": "1047827f-7943-459d-aec0-d754a4d666e2", "value": "228cddbb01f2805f52f167cd184fe3b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f34a5106-0620-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686244908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686244908, "uuid": "3169bebb-2b65-4026-9283-bb7a92a27f8b", "comment": "Malware payload", "value": "be6cc226bfc0431aa2c8b33fa2fd763c", "object_relation": "md5", "Tag": [ { "name": "BlackBasta", "colour": "#ABD0CC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686244908, "uuid": "623f9d6f-4969-4621-b484-be39b8238d2d", "comment": "Malware payload", "value": "ebbd88b3ba1b0750cd8f0326dbabd94ed97cccd83baed2121e6ceaefa7f7eb1b", "object_relation": "sha256", "Tag": [ { "name": "BlackBasta", "colour": "#ABD0CC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686244908, "uuid": "4e0e21c7-1f02-42f6-b574-22309b4fb80c", "comment": "Malware payload", "value": "5a5987b0df0043bb2bac77597cf93f5c3ffaa514", "object_relation": "sha1", "Tag": [ { "name": "BlackBasta", "colour": "#ABD0CC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686244908, "uuid": "334cffd3-4b4c-440e-a8e3-20188145ba93", "comment": "Malware payload", "value": "f9f1b47d0ef4d20c1c3c6617c8ee16cac7bab3aaf2a4a921c9b7d1bc407a8048a3e5d0e213dc004a973b8ddf5aed577e", "object_relation": "sha3-384", "Tag": [ { "name": "BlackBasta", "colour": "#ABD0CC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686244908, "uuid": "578885a8-9cf1-4d16-b3f1-3cd9fcea62b6", "value": "T1BF9312DC06B8FD11C8971431722DA524EF822ACAD59BD78CFA135A6E440A1F38FCF569", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686244908, "uuid": "5350ba1a-d1e0-4597-aaa6-954f0621f7a5", "value": "1536:pBkDdkPCHK2muW3X8Gjk+bd9gjhia+5w79SGfmGzQt8xY+Ja4jXITDBp8tibaBlw:pBuKaK2zW3ssFwI+cGfTa8xNJa4jgGDw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686244908, "uuid": "12d20a4e-20fa-4ee0-8f47-f31c11204569", "value": 94540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686244908, "uuid": "bf11bd54-ce79-4ed5-9ea6-4b395127e37b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686244908, "uuid": "b7604f0c-1dc2-4381-8956-8fafb39ad79e", "value": "10691677941.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aab39d4-0619-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686241699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241699, "uuid": "e561e288-1d73-410e-9b22-598221606c0d", "comment": "Malware payload", "value": "51fe24ee8dd7886ad88c675fcad81118", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241699, "uuid": "0a632494-191c-4bea-a4cd-5fdf3e9fa189", "comment": "Malware payload", "value": "ec025f81261683fdf2357e373ece5e6a6544e3b0796d829d847ea972d70b1df0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241699, "uuid": "46cb659a-ab14-4547-b753-3bbdff7d5124", "comment": "Malware payload", "value": "592d52ce750d4bbff1dedd814c0a2a7a29b1d55b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241699, "uuid": "d5e12600-3227-4842-868b-d95134b3c447", "comment": "Malware payload", "value": "25347debb245f81245b4c21cc6421260c4c523d9f3520fbb6974e7e764ddaabe540e4b775cfdb01b4d363ec21e746915", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241699, "uuid": "1096702b-61b0-453b-bfc0-dac8ee7bf3aa", "value": "T19C9286E67AEA5DC6EA64623CD9F6D236363CF5F007534B039A3494365B22E923DC4207", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241699, "uuid": "90eeb4e0-e19b-4848-9770-a57251a2ec3b", "value": "b7807db007f83cabf42d42741e66ca75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241699, "uuid": "f7529008-3e1e-4fd8-9080-ee12bb19c232", "value": "192:isHTtHXN9E+k39f6AhzYgycffo2AUHV7jyrwYlf7XCDwx:fGTyABpJffo2AUhecYlf7yUx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686241699, "uuid": "aa1ebf61-8a50-424d-b7d8-1eedbadda643", "value": 20419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686241699, "uuid": "1d3c6ba3-d2fd-404f-8c16-041afb37a439", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241699, "uuid": "edc89180-eceb-4c28-9438-08720a4114d5", "value": "SecuriteInfo.com.Trojan-Spy.Win32.Small.14000.26680", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aff1776-05fa-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686228412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686228412, "uuid": "204fe276-7034-4201-91bb-f2b5e2e2e00e", "comment": "Malware payload (Formbook)", "value": "6372f9467a5871b623c6ab551e391609", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686228412, "uuid": "fa9a642d-e4a8-4938-a866-c2a4eb102cac", "comment": "Malware payload (Formbook)", "value": "ec8274a6215ce3ba6409ee82bd9b97f3428f9aee670b64d50e1ac02e68b5e8d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686228412, "uuid": "738ddccd-fc18-4ea0-a786-02e027f9b488", "comment": "Malware payload (Formbook)", "value": "16801651e9852aab2a2d4a9c2ac68c77a990d437", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686228412, "uuid": "b957b701-caf1-4717-a655-349f31d5f2a1", "comment": "Malware payload (Formbook)", "value": "6277807fc18a9d47fab7b19633a7dd408cfcc96fc5f65b4a91ed7294a0b2f0a334b75be82dabc14cf44143584ce2776d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686228412, "uuid": "4303f950-86df-4996-b8c3-f058a6954256", "value": "T12CA4D14C36D46E6FCA5BC638CEB11E649776600A1393D3938D8741F51D2BAC9EF089A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686228412, "uuid": "128de0cc-21c1-42c1-ab07-955fd8cdfb14", "value": "6144:XXEAqfrdZSUxp+Yi9tIZt9HtfuFMVPbJDZMypEFwPW/gLPw9nWDs7hDYZzSTJbOu:nwZm1tIZnHtm+NJKiFPw9zuFwtOp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686228412, "uuid": "90acf868-eaf0-4d6a-9b2c-cb7bd9828905", "value": 459264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686228412, "uuid": "10f8b52a-b650-4411-8138-35e6ca7775d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686228412, "uuid": "c60c1615-df93-4871-8bab-74523ca02c77", "value": "ec8274a6215ce3ba6409ee82bd9b97f3428f9aee670b64d50e1ac02e68b5e8d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "929426f9-05a6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686192347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192347, "uuid": "d4fe3b4d-cebc-4743-a438-55a4ff1822bd", "comment": "Malware payload (RedLineStealer)", "value": "45153d76b94f0c3a77c0acd64ccf7f1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192347, "uuid": "bc2ab408-b171-446d-b087-a23270588356", "comment": "Malware payload (RedLineStealer)", "value": "ed6e6544fde726df44c84c40fc252842cc59bb72756c111fda6ad2c74540dc07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192347, "uuid": "eaea532d-6205-4021-9ae9-ba616aabe324", "comment": "Malware payload (RedLineStealer)", "value": "d35c5027dd178a00c819f6f1c89203233612545b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192347, "uuid": "a7e6e361-2fa7-4596-aaac-bd16abfc1607", "comment": "Malware payload (RedLineStealer)", "value": "ac491a47db32e052b7acba6dccc97d88a2bf784bc3214475abd90903a129850ed0a7e82fabd48bb4ce5c4882d2abae91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192347, "uuid": "852d69c0-b2df-47f7-b1c5-6d0ba68e7aec", "value": "T16054480227C78C7DF8AA073D60D48F3EC877ED60165464FA37A89A618ED0313959B5BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192347, "uuid": "6e6596f3-86ee-4b46-8392-26812d9e72b1", "value": "f264906d4975bf1277da66f2124faba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192347, "uuid": "0a8e943c-03d1-400b-b42e-56cf2dfaa999", "value": "6144:eQvoWvJKbEVxwvTygXUNVS4MGh1aBFrvz1xcxcWh4rt:eU4EMyR1aBFrvz1xcxd4rt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686192347, "uuid": "f5e15403-e378-403b-be14-5dc6fc85b186", "value": 288900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686192347, "uuid": "626969d0-a759-4669-8158-ebdbd1c6f0a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192347, "uuid": "2c705e6e-77da-497f-84e0-1939274ed8ca", "value": "45153d76b94f0c3a77c0acd64ccf7f1a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d22ffad4-0602-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686231968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686231968, "uuid": "5667c5d5-c99a-4260-b27b-db2d37a67034", "comment": "Malware payload (RedLineStealer)", "value": "ce2c3a89794dc0210918ffc885e11e9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686231968, "uuid": "1ce641ce-2179-4d4f-9830-b4e4e30d9ec4", "comment": "Malware payload (RedLineStealer)", "value": "ed91a0b62d5734b2037d9264d1caf1b12e8ca5009a72df4db3be11bfc30e450f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686231968, "uuid": "fe8ff11d-1afd-4fab-a3fe-b8f1611fb316", "comment": "Malware payload (RedLineStealer)", "value": "81827b45a14e2868faf48c06b865bd3eecd16016", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686231968, "uuid": "aa951fd3-6cce-4d1f-b6c3-efe809914cfb", "comment": "Malware payload (RedLineStealer)", "value": "a4f2f74524045f94967abcc1c58c4974a2cecd3201b7be307503efecf9e889ef4a4824795483c4b1ab0199722ea22c6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686231968, "uuid": "bd35ef31-37d9-420b-b3ff-6c92f6d7b96f", "value": "T159F41207E3D49022E8F6077048FA02C71B367C5299A8835F2785AD8F1DB3699663677F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686231968, "uuid": "5bbff119-32f2-4a96-a4dd-962ca202fee4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686231968, "uuid": "289f5ae7-f82e-440d-b914-c6b45a5ee043", "value": "12288:rMrky90qkG37bpF/xakgqPafzhDpZ9a0yMrFAW9o43RsObfB+XVhngfwebg1YP:3ydv4nqPgzhDX0DwFlvqQAXVqfwebg1i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686231968, "uuid": "1ec60608-0456-4813-9457-8c9b70feb12a", "value": 776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686231968, "uuid": "384b2b75-bb05-48c1-bd04-cff52dbc0313", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686231968, "uuid": "f599aec1-0d54-4657-9a51-adfb38e882db", "value": "ce2c3a89794dc0210918ffc885e11e9d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bc18103-05f0-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686224011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686224011, "uuid": "8dd91ed3-0465-4bb5-91e5-1163920a8e98", "comment": "Malware payload", "value": "0e956c84929ac16b36339ec4305c9b4a", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686224011, "uuid": "94492bc5-23ad-447b-91f7-8f86f56f398b", "comment": "Malware payload", "value": "edbc39ee76f318a70ce0083fe1d3260cc4422291e8c9ee40cf7bbf74230cfd6c", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686224011, "uuid": "6c7c4f9f-c230-47d7-a233-d0f5e7aae2b0", "comment": "Malware payload", "value": "1a7a6622ed94252de408ab5e72d0b49a56f7bb8e", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686224011, "uuid": "1d18ad75-5d08-4d50-94b4-b0b5aad74743", "comment": "Malware payload", "value": "25e49fcb6315f8fb5f2f9e122da2ff455c7339d697823d67b323656e3141964675e5234fc948c2c12e3c821f3795739c", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686224011, "uuid": "d7bbffb9-c610-4927-a13c-07917c2bc291", "value": "T1FD173374C455D5F1C589682D8C8AF1430245D8CCF2BE9C46F7CE0988BB2FB8B549A9FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686224011, "uuid": "a3dcb6d8-d5fa-42d8-ae25-3addaf603a8e", "value": "393216:EiEH6hd8xsOtcg2O9BXFNlkRmw0N9pTqcXkeX3E5B1fg71QFIcV/:EilhdgsOCgd9VFzkRmdN9pTqcUeXU5BD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686224011, "uuid": "5606b0dc-a72b-4b14-aba1-4e3b91670b58", "value": 18883584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686224011, "uuid": "b06ea167-f84b-4fc4-b09a-f20e38e5df03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686224011, "uuid": "18ce56e0-0715-4e62-afba-aeae67b8625c", "value": "0e956c84929ac16b36339ec4305c9b4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ec6b374-05c3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686204662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204662, "uuid": "765dbd8f-02d5-4fc8-9aaf-9bacb3561704", "comment": "Malware payload (Mirai)", "value": "9b116b5404861136a923c5d7cf9b8b2d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204662, "uuid": "17a40983-d71f-403d-a1fa-991f77ae1cb6", "comment": "Malware payload (Mirai)", "value": "eeab02468cfef5043cfadcc59b49a650689e0977355f51e578d1af4674712832", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204662, "uuid": "2a4c1001-adc5-46a4-a4ef-127ff4473948", "comment": "Malware payload (Mirai)", "value": "aa196ac7884efc3bd38fbd6cf8dd48fe1389548e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204662, "uuid": "28086389-2d5d-4cb7-a4b1-65d51b1b4924", "comment": "Malware payload (Mirai)", "value": "4ca1c9fbcb8b21e74ba1b2c98e64d15d5041e8701b36a166eeb2970c1840c318614ef8b7c155b7ca7f10d6a0fb96d660", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204662, "uuid": "3a782043-3ca3-486e-a761-d3870ffc1dbd", "value": "T1DE533CDAB801AD3CFC5BE6FE80160A19F931366065A30F179697FCE36C321B65D1AD42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204662, "uuid": "ddd9c457-7373-425a-8d60-680d0d96f453", "value": "768:HeBaz0tMQaaZ261DmbgiWJNS5LhZFGG9kdZnCI7PLzTaT+9uQ8yhh5Cu7VqntyPp:HUfi5Lh7GG9mNtH2T+MQ8yheu5q4PGEj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686204662, "uuid": "54982002-4feb-4e01-9e34-0da399ff8373", "value": 61288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686204662, "uuid": "8afa22b0-9f17-4579-9a63-5aaf0565c3ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204662, "uuid": "daf2491e-0efa-4bb5-8d1f-f2025226abb1", "value": "9b116b5404861136a923c5d7cf9b8b2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a99e0d0-05d9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686214211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686214211, "uuid": "1c0e8e1e-294b-409e-bd33-1fe4d728336b", "comment": "Malware payload (Formbook)", "value": "29e08138c62f63dd42f6b1d84c4c56a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686214211, "uuid": "195bf49d-fb03-40cf-aae9-424eb47663b0", "comment": "Malware payload (Formbook)", "value": "eed6daf044779a9e7258ef8e0a4d35b5d174fe4c38678efd4d28d1d15a500541", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686214211, "uuid": "35389cfc-e5c0-47f3-b730-4b71c3610abc", "comment": "Malware payload (Formbook)", "value": "2275e0b026a76a90b1bd58f74f01106a09eb0f85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686214211, "uuid": "0e29e7f0-5d1d-48f3-93e9-a72414508ccf", "comment": "Malware payload (Formbook)", "value": "60d06247bf405298fc74357cac3ba7f32d59630e1179c823750e40353a8d5aa8caeee386c84161420892ee528021c7e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686214211, "uuid": "571b7d86-0489-404d-b58d-a456e3774167", "value": "T1E405F118B1BA35ABC5BA2AFC4850817593F44087F4AAE3C64ED36CDD5EE8BD04F511A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686214211, "uuid": "d3eccc52-9074-4bcc-85b4-c74fa3082c9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686214211, "uuid": "60ae8074-af9e-4dc3-ae4c-1f0e9d12767b", "value": "24576:TzlWxMiQW/O4ue7jGg/BJCKEgq1Wdz80w/q+b3j:flYMiQWmS7CgU423iWz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686214211, "uuid": "c0f7e8d1-0358-49df-a8f0-58a0fb4cd683", "value": 844800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686214211, "uuid": "1f104637-23a1-40a5-8308-662bf5fd2f38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686214211, "uuid": "b889d27a-2b77-4a27-a82f-d0142eba0d8a", "value": "Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "903dc9c2-05bb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686201363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201363, "uuid": "eacb4887-029c-474a-ab40-f00296893c58", "comment": "Malware payload (RedLineStealer)", "value": "9f083a4a0a3987c18ca7d599c577fe9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201363, "uuid": "fa8343ce-a674-414c-8ccd-bc580a3b5d50", "comment": "Malware payload (RedLineStealer)", "value": "efb2ffbbfa32b0e481590e9e70031b9507fd6dedc3e21c5a3b8b124146cb29eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201363, "uuid": "7d38bdcd-e506-46c4-8153-a62ed4e25933", "comment": "Malware payload (RedLineStealer)", "value": "b039242312441c32e37c9a7333ef4365e3065a2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201363, "uuid": "e4f01b6b-0fa9-4e11-86d8-41fbfb4816af", "comment": "Malware payload (RedLineStealer)", "value": "5eb720cb04efbf88ea1584bcdb9877df253b763206fe853a8eeb555a110e75688ddd000134d59e1099f6dba55e5ce0be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686201363, "uuid": "8a2704c5-ec28-4de6-80d3-b049190df6b8", "value": "T1FDD41203E7E49133D9B1577118FB23C31B38BEA04C7492AB639AA60B5D736C564B136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686201363, "uuid": "801fc75e-8f88-4124-9c91-af3dd4054aed", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686201363, "uuid": "387aac7a-eef9-41a6-800f-d9d61d94c361", "value": "12288:uMrxy90GS6BBgDLxjBFEPmXZVDPiIT+/9P+54lZkQ9NbrwzJ:/yvFgL3aPkriIT+/9PIOX9WV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686201363, "uuid": "e8760c53-4ea0-4856-b061-449926ced158", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686201363, "uuid": "03d357c1-c84c-4bb4-931e-fdca3bde3bf5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686201363, "uuid": "8df596c1-1bf3-453e-b84f-6b9e8f5c959d", "value": "9f083a4a0a3987c18ca7d599c577fe9a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f048e09-05d3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686211669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686211669, "uuid": "9b6d8e9a-05c0-447f-a483-d518c6c5cdd0", "comment": "Malware payload (Formbook)", "value": "1a8ea472a0ac9bce55b509987177da0f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686211669, "uuid": "82f6fddf-6180-4b23-8836-b65b7bb07228", "comment": "Malware payload (Formbook)", "value": "efb771f2192494023b1fbad8942e8d4f73c260ad9d40840fa192d755189961b3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686211669, "uuid": "5a925c83-95e6-4413-a6c0-e4f985968439", "comment": "Malware payload (Formbook)", "value": "90920ee7667657422ccf05133b77b3c1f50ccf0d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686211669, "uuid": "3375e548-32d4-4ae4-bfe0-c610de93ae90", "comment": "Malware payload (Formbook)", "value": "8d4f25f966603565e23306f04bfdefba3130232a6d5b5d8b9cbdba14a83a592b1468cb9504d83e4672a552d211197ccf", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686211669, "uuid": "e604b7e5-d7c4-469f-9358-8ef8574d7f38", "value": "T116D423329584D0BE4322EF96E3E6307D05A794B6B6510C9DA7AC7D01BB86C14CEB49FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686211669, "uuid": "ff6fc9e5-6051-4c30-943a-3993b3d1399d", "value": "12288:5Ts9HPhIY0H10xrI9ZBgTVn49lABfK6/2AaSFBs3h5fpV3uyNcHE0MR:GHqvH10xURgTa29/VE5fpV3uRkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686211669, "uuid": "4695b1e3-5fd3-4de4-8729-16d2496e383a", "value": 649623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686211669, "uuid": "33a1f729-58a1-4ae6-bda2-28fe52bdc3be", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686211669, "uuid": "1fbe0ec2-f503-4f41-b220-fbb307c720c1", "value": "PI.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b64b9bc-05c4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686205113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686205113, "uuid": "6955dca1-71df-461d-be43-d922c13c9e84", "comment": "Malware payload (Mirai)", "value": "0d32aa71559768236bf7548c80287592", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686205113, "uuid": "66407b75-37a6-4531-99b8-0cfbec03f2b0", "comment": "Malware payload (Mirai)", "value": "eff9ef9396826d5bea95181e250b783d5bfc2b72e5aa702e82c06178e3bf006d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686205113, "uuid": "2ab4bb2e-ad34-47d0-afb0-7d6c62af335a", "comment": "Malware payload (Mirai)", "value": "6dd55a337dbe319f7e24cfad2aec47879dba8032", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686205113, "uuid": "b305ffb9-2613-4f37-bc64-8815d29ec53c", "comment": "Malware payload (Mirai)", "value": "0557e90ef6a7a7d1f2db82fb9c1334d876d6e930fb1cde5747310c9d09113344d6ec3dc2f737da86b9a89a1a52d9df73", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686205113, "uuid": "4fe8b269-9360-4c26-b039-a88f7a9145ab", "value": "T14CD34C46FA418A13C4D517BAFAAF4149333297A4D3DB730699185FB43FC67AE0E63602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686205113, "uuid": "85ea0212-0257-4b55-8714-3922062461fe", "value": "3072:ZgauByoyut54A17i5tmFz7rRUQ0IqCDHUAYM/9kAYj:mauB3yut54A17gmFz7r2QzHUXM/9zYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686205113, "uuid": "681ba162-586f-40cc-87b0-41bd1cfc0f6e", "value": 136306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686205113, "uuid": "5c80cacb-c151-4a24-af7d-d438b86fad53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686205113, "uuid": "98597fd7-917f-47ca-8392-fbb4c52b6a89", "value": "0d32aa71559768236bf7548c80287592", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71e811be-05c3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686204748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204748, "uuid": "d0f86e99-4cee-4c08-90ba-72323f7b619d", "comment": "Malware payload (Mirai)", "value": "721f2a5aa00d0adfa7ee4fa9da3a5971", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204748, "uuid": "3d914078-0f67-44a0-ad83-9b8c920d56a6", "comment": "Malware payload (Mirai)", "value": "f057f4c13f51bcb6936ec2bc7c8079f6366335cdfb7e47996b67e92305ec1906", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204748, "uuid": "155095e3-808c-4191-9397-2b30173f6da0", "comment": "Malware payload (Mirai)", "value": "7cdffee638d88a9aa734aa465537ffced4da8e88", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204748, "uuid": "14606696-e7fb-4219-bff8-75b72cbeae3b", "comment": "Malware payload (Mirai)", "value": "6eade14c3c14c8d85983ef67d766df13aeb58420f7296f3910eeffca63caf4454af79af6b618f68894cd5c1421b7df59", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204748, "uuid": "9b60556c-2f71-4aa9-91dd-66fffb830bb3", "value": "T1AF730756B8814B12C5C5127AFA2E128E332317FCE3DFB2129E206B2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204748, "uuid": "9c7be134-f1c8-4a95-b1d2-4a098c121384", "value": "1536:Wln25xPBXk1wnnkL7+KE007YKBsqaT90jIbiJNrsvHTG8V5GYIW0G:bxpXCMkM/9TaMNrsvHq8VER+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686204748, "uuid": "df44858c-66ec-4fb4-87da-831856fe6b17", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686204748, "uuid": "4100769b-fdca-49e2-a2d3-04ef2af728ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204748, "uuid": "ad0d4711-dd45-4225-91ba-86bc4c3640af", "value": "721f2a5aa00d0adfa7ee4fa9da3a5971", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6fa01c3-05f1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686224728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686224728, "uuid": "1bc4b4d7-d86f-4c70-9056-6f6a1a613125", "comment": "Malware payload (GuLoader)", "value": "585b19a86892224376494bb8a009f797", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686224728, "uuid": "fb5fa7e1-d13a-412c-99f9-928e23694606", "comment": "Malware payload (GuLoader)", "value": "f08084f6fcb1cdf16eb76512fc925e000cb005f08305528488228e097c89f97e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686224728, "uuid": "2538f382-98dc-47a2-9b0f-ef10d313e699", "comment": "Malware payload (GuLoader)", "value": "9b5b751a44b6c359c100858556ad469648bed52d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686224728, "uuid": "5b4e9c40-300a-4da2-9a59-1def23602d88", "comment": "Malware payload (GuLoader)", "value": "9381e328423a26617e140b3c690e640175dc310afc910853c6eac434c5ba2f16e41fc0b5216b743ada0b7133fa60a97f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686224728, "uuid": "38e56d0c-0acd-4834-bd7a-b31ffdbd0384", "value": "T1B3E4E0023F2CA55DC5F5C67227539BF50BA9FE2AC4F152CAB7C5B30CAD749920A8E502", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686224728, "uuid": "0774d358-e693-4d4f-9725-380c61708c22", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686224728, "uuid": "4f5c2ed3-a81b-41c9-b1fc-577e63faca54", "value": "12288:04+L3gMNEauRir739U3bokvPKENrhgozt5a2e+OvTMvCROkwFmUiEE7Gx:a80EauRir7NU3lzrWoztlOYvCROk2mUX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686224728, "uuid": "d2ff1524-8f54-4a34-b03e-156fd43b1eab", "value": 668207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686224728, "uuid": "d420858f-dfdb-4f9c-8d5a-0e6c80a0f3bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686224728, "uuid": "03b15336-0f8a-4185-b5a0-b75fb4ff5d22", "value": "f08084f6fcb1cdf16eb76512fc925e000cb005f08305528488228e097c89f97e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e10732e9-05ef-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1686223832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686223832, "uuid": "0bd67fc5-90e7-4dcb-be19-157f9c89c1c3", "comment": "Malware payload (RemcosRAT)", "value": "c54fea66c5150e6d924ca83f504c1aa4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686223832, "uuid": "5abc2925-a064-4ff5-b869-34c7851f15fc", "comment": "Malware payload (RemcosRAT)", "value": "f0b85c3d890019c1d88274fb49f4caa52d696917a418ffee89324ad40d0076c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686223832, "uuid": "ca17eb6b-b484-4f1e-b63f-316da52024ea", "comment": "Malware payload (RemcosRAT)", "value": "14bb12af44b33a9177bd38f22f970f7e3db80bc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686223832, "uuid": "e8341224-aa2f-46d1-89e3-924bac49231d", "comment": "Malware payload (RemcosRAT)", "value": "c2b3b7724ca0bf6fc7a20951c1d5063780b6c19286e50ca4fbbb2c5f84ba46ff4f5196091275484b26978de68c83ed54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686223832, "uuid": "a3a542f6-23de-4621-8561-1bd2a2e97040", "value": "T11A25230435169E1BE5A777711A21AFB04732BC9A3420E7CF78C167CF5BA1B650235B8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686223832, "uuid": "47244431-0220-4025-a7e0-5a32cca6cb6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686223832, "uuid": "e90df966-5dcb-4c81-8d47-c5afdd0cdf53", "value": "12288:s7z5GoJiGaq5aurWxRe3H3/U7FuMM/e3ColjhNETt9iUME6nlXl0iNawmPV2/1DL:65GoR5auvU7kKXsAE6nj02oc/SMtwY7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686223832, "uuid": "51e3b7ad-7221-4d26-a8a6-83ce3e86f1fa", "value": 1008128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686223832, "uuid": "490ed766-be3d-429b-8b00-ac618f5bd30a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686223832, "uuid": "9addedd9-3fbb-4b44-ab80-6f230b28554e", "value": "f0b85c3d890019c1d88274fb49f4caa52d696917a418ffee89324ad40d0076c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96c19f9c-0646-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686261074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686261074, "uuid": "d343574f-7ddb-4dac-b270-6440d4c81626", "comment": "Malware payload (Mirai)", "value": "cb0738a9806ae1557eaa90a2dba8a205", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686261074, "uuid": "d670ec57-ac99-4a76-bf22-6758c587606e", "comment": "Malware payload (Mirai)", "value": "f0f2091d2d138821d30f1d7fe29a28e4d50e420c9f9e68688a503d3cd35edf18", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686261074, "uuid": "7a288f4c-7d8d-4b8d-afe1-6c02403762a6", "comment": "Malware payload (Mirai)", "value": "ea63d0862e9b8471a967b7247349c042a9d5efac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686261074, "uuid": "d8884502-befd-48af-b67b-9b45a0d7330c", "comment": "Malware payload (Mirai)", "value": "c91d1fd7049308d52d44eb496e710083f8293c64d304b26df0368a6db7e40ed2371c5c07146f1c8ce40019d19bbbd6a3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686261074, "uuid": "870efb5d-78dc-4e34-93c7-d5034e1728df", "value": "T1C9634A01775C4E43D1A61EF8293F27E093EEEE9021F4F5842A0ED6465272E33994AFD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686261074, "uuid": "77ae5abd-da2d-42c4-b467-a24ad790a2e2", "value": "1536:ZjVO2KsrO4zb5Bd9MBpTaQnQSe1ECj5ds:CPsTHd9SNQSe1bjrs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686261074, "uuid": "4eff01fc-8cee-4375-9ba1-990d6256bf54", "value": 67576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686261074, "uuid": "7b915553-26ba-4f45-a9ca-fa29323674af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686261074, "uuid": "037e4eec-b213-40c2-89a3-52ba79db861a", "value": "cb0738a9806ae1557eaa90a2dba8a205", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbc7cfe6-05bc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686201892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201892, "uuid": "16b5a164-097f-4d08-88b5-2e4364e7534f", "comment": "Malware payload (Mirai)", "value": "91e73e4a93a5f96ff6f797953fe15c17", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201892, "uuid": "f4b013c4-5116-4ffe-a408-87954b579734", "comment": "Malware payload (Mirai)", "value": "f110d1fed2877750ff1f37829984711e94519d7a464e61ef333e72a13ba5e54a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201892, "uuid": "94ab92f3-c53f-4e45-9e91-4274fc636e82", "comment": "Malware payload (Mirai)", "value": "1959e15eb2e0110c4af81c4b8c838a0361e227c3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686201892, "uuid": "2ee71eb8-57de-419d-806e-e8250cb2d442", "comment": "Malware payload (Mirai)", "value": "74ab809bb5f94f9e15735be6d08173679d0c73343a42e0b7e369216c0ee5e13ea474c7a0e2c2c8ba7d08e6f9136ab1c5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686201892, "uuid": "4ad82913-cc55-4db2-a5b2-68eea40adc79", "value": "T121438D22FC111D62C43182F6B0B0D679C3525EF642E65C766DEEDA4904FBE8DB88D7A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686201892, "uuid": "c7363a8f-0a87-42cd-843e-a4e567f8d8c7", "value": "768:urJJ7s5LUkGDsIzHceVnuxAsTOT8sNiNH1MMuQ9B1Kn8GicO9rrygwIIErD:IJ7s5PYyOuvmbNuHD28KfBwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686201892, "uuid": "dcf46cff-aa68-4c2f-a23b-7f877faf167a", "value": 58204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686201892, "uuid": "befe6e48-05d8-402c-9a92-0b6faf88463e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686201892, "uuid": "7ccfdaaf-9d5d-4893-a1bb-7d0e23d94af3", "value": "91e73e4a93a5f96ff6f797953fe15c17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94838791-0646-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686261070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686261070, "uuid": "46b34b34-5e7d-4fb0-a492-f36fc34573f3", "comment": "Malware payload (Mirai)", "value": "6b2dceb0d4a6b42261acae22ac87df46", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686261070, "uuid": "80d2bf82-4bfc-4d46-a100-58ae6cb844e5", "comment": "Malware payload (Mirai)", "value": "f13536b76223fa54a928197dc0c2fc364b767f8046637de928f2b6e515fa8c39", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686261070, "uuid": "3c98b67a-5894-4380-8902-61c1f7fbd3fe", "comment": "Malware payload (Mirai)", "value": "3aeb98df6a0927dfea0b0fc6e9d059c5c71351fd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686261070, "uuid": "b26b81ca-d3c3-4f81-bb7c-1abed223d90e", "comment": "Malware payload (Mirai)", "value": "fdc61f156662ac358f9ccb1fbe56ccc0f9847106bd505066a5682c1082d18a52e55dd038e845defdc88068b7df3d0581", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686261070, "uuid": "fb8a9b82-55ba-4c2e-86bb-61ebc58f31e5", "value": "T177831946BD819F01D5C912B6FE2E118E33131768E3DEB2239D109B247BCB92B0E7B559", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686261070, "uuid": "c3b5e948-8810-4634-9ddd-9e58296f9376", "value": "1536:CxnjOSuwgUtOJ8gMeoJep0gNaIAEbSMDiYyom8Kxcl5kYG:FS094C0qaiyom8KxcliZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686261070, "uuid": "fc64e4f8-0102-4ed0-b3c1-b7df9c6933bd", "value": 83084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686261070, "uuid": "83228b01-3fbe-479e-a598-1bbe0188e476", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686261070, "uuid": "1af4e82e-e958-4f4d-9e04-c25f4eabac13", "value": "6b2dceb0d4a6b42261acae22ac87df46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bd61552-05ba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686200845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686200845, "uuid": "0b71b428-97b8-42d6-9ea7-57f98dcd011a", "comment": "Malware payload (Mirai)", "value": "f0fd70dde8bdb4516f94bbe43c0e7c78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686200845, "uuid": "4c653960-ea2e-4b2a-9319-227e9320c47b", "comment": "Malware payload (Mirai)", "value": "f18804b4f0879bc5daae7f4b64f797b7cb84b166d1cef222232cab347ba95078", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686200845, "uuid": "2768e5a3-f6e5-4983-b94f-efd2dbd95893", "comment": "Malware payload (Mirai)", "value": "570d2fe56a26830ad5383a9b390472f0e52bfbe2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686200845, "uuid": "4ff26492-6b31-4c08-8b3f-faaf86eec5ea", "comment": "Malware payload (Mirai)", "value": "fcfa81d1bf671c2bd95473139565a00921cb3d54fbdf46a1ce2440fdddd417d126e0b5b28a9b55cbf4ee53a8adf2dced", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686200845, "uuid": "9f75e03d-2c0f-46b2-aea0-b21f56eccbe4", "value": "T106443B7BF693C5BFE10663B00EFB81E1A674E0743330A00F779159696A29AC14E4B75B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686200845, "uuid": "bb602521-eba8-4f10-9537-e7da3dcb41d3", "value": "6144:OhBzDD4/42fkBHEk7xNLH8LXn+FVwyPp5geI:Oh9D4tmpCeI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686200845, "uuid": "d048ff87-b273-4a2b-809f-36bbb9adec27", "value": 255680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686200845, "uuid": "130b06b5-20e2-4284-a8b9-af58b1763458", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686200845, "uuid": "86b68cd9-84ac-4baf-b834-88a6dd4b43f8", "value": "bott", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "528cca07-05a7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686192669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192669, "uuid": "7c40a525-0eb7-4b14-b54b-ded64e8fff2f", "comment": "Malware payload (RedLineStealer)", "value": "e97f78f0b367a8c789c4ae08f473ee95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192669, "uuid": "e1804116-1d56-47ef-9cae-9e1197063f8d", "comment": "Malware payload (RedLineStealer)", "value": "f1bd09d8480358fd21e2ceb0d807a8ae4686dd862469da9530eaa32962c0eb53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192669, "uuid": "872829a5-ce51-4977-b121-b947aece64e0", "comment": "Malware payload (RedLineStealer)", "value": "44e0ab7eab8bf746c8b83029358e988b9df693d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192669, "uuid": "42545e1a-6823-4bf3-8f53-d6e1a46646cb", "comment": "Malware payload (RedLineStealer)", "value": "6edd01e3f657630f511f29beb671209642004d3e71998ad424fc48fc6798d5dacf37acffbf18fabdf630b1ae3d6c8437", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192669, "uuid": "d59c1613-fe6e-451f-94e8-0ec42fd00114", "value": "T1A5F41262ABC84072D9F52B7019FA03570B77BCE159689327179698AE1DF3480F87633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192669, "uuid": "576297e4-9998-4c40-a91d-8222f5f1b9d3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192669, "uuid": "5b0cdcdf-3fec-4376-b5a0-0689eb7ae172", "value": "12288:oMrZy9073lUvBNm3LfU6fPJ0rKABSQ8jDfpIQHJvKClmMsmxr4SpCaOz1/L:xyQaNmrU63yrhSQUDKyt0MsmZ4UOztL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686192669, "uuid": "9d2625df-8b6d-42c1-8567-4a1074b961af", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686192669, "uuid": "edbfeaf4-9945-4f40-b675-4c804a17a966", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192669, "uuid": "a02e9a43-b85a-43e2-bf93-f7238fde6793", "value": "e97f78f0b367a8c789c4ae08f473ee95.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "814425cc-05e7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686220235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220235, "uuid": "9ce03d6d-12e5-4c79-9b15-0f770a44e070", "comment": "Malware payload (AgentTesla)", "value": "80500affc4d3734701f4d66473465f96", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220235, "uuid": "1199df51-3035-4c29-82e5-b24f0ae792f0", "comment": "Malware payload (AgentTesla)", "value": "f1bf8b2454c2ca8961343acc4201349f0aece7080de6e0d08aad2a2b04dd4da5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220235, "uuid": "a094268e-f01c-42bb-bdcc-bd6c32356597", "comment": "Malware payload (AgentTesla)", "value": "5e4b9feb1a733300cfa62c9d042fa3c74b824d76", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220235, "uuid": "8153716d-30a6-4170-9490-2f777894135a", "comment": "Malware payload (AgentTesla)", "value": "be7cdb2507727e220d21409251addae9dd08f483e764fec859be4489d145882c0805472b3d5366e5bcd2810353137093", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220235, "uuid": "60203a6d-4af7-4505-940e-6aad2fe4974e", "value": "T10C15CF50A2A85F5AE43A87F54471D87403F65E6EB87ED60B4EDABCCB3A72F510250E03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220235, "uuid": "8ba7c00b-a687-4671-a1f4-41fe7e59e8f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220235, "uuid": "a4ee68f7-78fb-4afc-90b4-7bfcb70264bd", "value": "12288:sS8hue/3H1XDC4n1Gm/yWk3QxVRN8wf5xXIe63soOHlm6DCfpGIu15YaAsjTaZ:sBXDCMq0n2wfAJ3H2m6GubmZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686220235, "uuid": "fd29b70a-451b-42ad-95a7-f50cb1169fd1", "value": 956928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686220235, "uuid": "c22d0aa3-9d7c-41e7-b413-7c20568a2372", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220235, "uuid": "2993d5ea-554c-4a59-8c0a-b4182d861040", "value": "f1bf8b2454c2ca8961343acc4201349f0aece7080de6e0d08aad2a2b04dd4da5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e23d4b1-05df-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686216660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686216660, "uuid": "87acc21b-e2b6-406b-8ada-ab5f23b74a70", "comment": "Malware payload (RedLineStealer)", "value": "cdfde6899ae1a4dfec19f5e9cfd66c8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686216660, "uuid": "3d77e922-92cb-4a17-81c5-fee6e1d316cd", "comment": "Malware payload (RedLineStealer)", "value": "f1f156e52ff0f345a03b78f1b52e616225816a4ee2094a385a21636e1e3a433e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686216660, "uuid": "5fbcf31a-34b3-434b-a421-0496bdf1f21b", "comment": "Malware payload (RedLineStealer)", "value": "44be8d7bf20b5f89bb4f15ee10881cf168bb4b2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686216660, "uuid": "3b2d9217-1862-4497-9dce-5b7c794ec59a", "comment": "Malware payload (RedLineStealer)", "value": "318129b36a77f8e0fa9c0f35ca7a30901d8745ec1874e2ebbdc2313b5c6d75065f3716cfa1c4ff3ea3a98505e7d054e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686216660, "uuid": "b0ade58d-fc90-47e7-a133-b1f1194770c0", "value": "T1C5F41221ABD88473EAB6373128F7138316367D916D38876B27555C8E1CB36C1A83277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686216660, "uuid": "0ecc92cd-f3fc-40ce-b0c1-b21cc8e7b30d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686216660, "uuid": "08672464-5401-407c-8031-0422717bc500", "value": "12288:OMrCy90sZTeI3otBJptI3Uyj2oZLZV7jX3FR/mEig0OAbx7NDkdzc:8yFa5BJpqhKo3V7yCA7Dmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686216660, "uuid": "1625d2cd-2515-46a0-b004-43714cd885f7", "value": 791552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686216660, "uuid": "aaff9319-7b01-4f43-81dc-1747bfa81498", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686216660, "uuid": "0341d20d-7cfd-40d3-ac1a-d49042cade38", "value": "cdfde6899ae1a4dfec19f5e9cfd66c8f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48d497e4-05b6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686199095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686199095, "uuid": "e4bc4dbb-b853-42b3-bf90-6ae0902d4dd0", "comment": "Malware payload (Formbook)", "value": "3abfcd50698f63ec13889697874b0dfd", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686199095, "uuid": "4f71541f-aca6-486f-8205-bfd69764bf7c", "comment": "Malware payload (Formbook)", "value": "f287d933ff17b3591ddd689172c4d8964644bf3740ac8d9418365b3b97c51c2b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686199095, "uuid": "3f0ac215-cd55-4c6c-bfbe-36a41126bd63", "comment": "Malware payload (Formbook)", "value": "10934d356d6bf22b54fea6249d80f749ad746c8a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686199095, "uuid": "bbd77efb-aad0-4713-9652-745bb4501898", "comment": "Malware payload (Formbook)", "value": "f502e47bab75da293fd042c38d579b933378a840300df99f39706ae173945d754130c83a7ecf33c56314ad89a42a3a25", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686199095, "uuid": "033daa6e-2352-4e99-a857-a1b87fdccbc8", "value": "T15DB224565B8C4C61F35AE87B475EA00E49BCF63A31C205D4BD9DE2703B6E10E4B6B1B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686199095, "uuid": "9f6865c4-b27d-4794-95b2-453ce936164f", "value": "384:PL8yqfpijwB6fPIsKTT9gNUXDVfcwBbCvdHHWvhdCT7TuEUiVW0+T2J11ArdNWAn:j8yqfpiJnZKTT9gNQDVfcwBbqdH2vhdv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686199095, "uuid": "fcda5f1e-1821-46ab-8218-6f691d9afd22", "value": 23937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686199095, "uuid": "404dda28-bde2-4d7c-a775-0aadaebd9686", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686199095, "uuid": "2c72de45-1c5d-4d3f-a951-6abb1faa8c8b", "value": "3abfcd50698f63ec13889697874b0dfd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c4dbabd-05a7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686192659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192659, "uuid": "93798ef0-7f6f-4ddd-987c-44123978a749", "comment": "Malware payload (RedLineStealer)", "value": "c6c858abefb590c51fdd129a9e1edb21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192659, "uuid": "4653ac61-98f4-4253-8278-2b97c8a945f4", "comment": "Malware payload (RedLineStealer)", "value": "f2b8d1534304d9f725cd730506d57660300457eba9a70b998ac16a959b444413", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192659, "uuid": "ea63fb38-adb4-4fef-8698-2b9f65db908e", "comment": "Malware payload (RedLineStealer)", "value": "4e29dae85b1baaf46eb6ed8a2a3d11df59ea61e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192659, "uuid": "f97880ca-e2d0-47c8-b1e8-a3bdb9f9be39", "comment": "Malware payload (RedLineStealer)", "value": "1b061cea1399b94ea93a26327acbdff2ff04d4775cdbac9903c6aa38188ad302b1e57ed5f5d1fb548f952678c4cc0ff7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192659, "uuid": "239ff1f9-f3c2-4038-977c-2b02f1f86aca", "value": "T17ED41212B7D55472ECB61BB128FA02C31E35BCD25939926B3B86AC4F19F3584D93132B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192659, "uuid": "1eed305c-2120-4f7e-b039-766f7482407a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192659, "uuid": "2cf7c8c1-4c2f-45a5-93b7-0b6c4b5c4f3f", "value": "12288:LMr/y90hM1DhxWBW/intIDZ3qbRt/EEy6i9eMfvcugPHrQl8QCF:4yMMDPu2WRt8P6iEMfvBMLQlY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686192659, "uuid": "346a66ae-a532-4145-8140-3c37859b6a6a", "value": 606720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686192659, "uuid": "861b20ce-171d-465e-8d4d-27bca499d379", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192659, "uuid": "ca09401e-d98d-489c-9877-f4fd42cce330", "value": "c6c858abefb590c51fdd129a9e1edb21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2895fd97-05cc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686208490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686208490, "uuid": "b17f0f52-97cf-4853-9e47-474c951d976e", "comment": "Malware payload (AgentTesla)", "value": "ae6c61186f442fcfe791801d50375add", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686208490, "uuid": "9075a3e4-74ea-49fc-9d28-dae7a90ea773", "comment": "Malware payload (AgentTesla)", "value": "f3c00fb75da49f73a9945b562d748ff1b6958e3bfdbb1e833d6a16ef4d063092", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686208490, "uuid": "dcbd8125-5df6-41f9-b99b-75d9bfd71ab2", "comment": "Malware payload (AgentTesla)", "value": "1d04bee70997b3d3eb08d4b8c3a2efe6238c79df", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686208490, "uuid": "e04c4ce8-2616-4ab3-8b07-0893820254c4", "comment": "Malware payload (AgentTesla)", "value": "414d7c74b222ec69bd8111a29e413ab19a82c24bb63c86653355ed5371009283f49b4b624e926f7c4b0fb8a1dcb36b72", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686208490, "uuid": "2e2c61f5-65ef-45a6-af35-a58d1828a374", "value": "T141F401593AF70A0FD56B7FBD58200170C6F95D463123E39B4E9B794E8CA1B424EC1AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686208490, "uuid": "17e791fe-65f0-48c7-b38c-025dbda4934e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686208490, "uuid": "c018ff91-b51d-42f3-9b83-0661dd8ccfe5", "value": "12288:5uu3as/16/YHmM9mARLAV+/3e+vcGD89J31rcs01kFps9XabXMTyJPa+sQmN3:5Ks6cV9mA9ImJD8z31r01q8ToPqQy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686208490, "uuid": "bfeec106-6a5b-4447-bd23-59c061c295d7", "value": 761856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686208490, "uuid": "b76feb34-3012-49e3-958e-63cbb6345c02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686208490, "uuid": "8a1c689a-0197-4a14-93a5-545ff7dc5d96", "value": "Purchase Order List Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3c19af2-0610-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686237930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686237930, "uuid": "d28b06ed-0136-44a4-9725-2549ed799265", "comment": "Malware payload", "value": "5a0cdc8aed918501ad546276a89dff79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686237930, "uuid": "a901b04d-34e7-427a-ae0e-4b91b15a7b13", "comment": "Malware payload", "value": "f414adb00f03f65ae0c2beb324117c44f1ea7e46b7efe10499bc387858a9b4a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686237930, "uuid": "7818a419-c13c-4ba6-a59f-33eacc0a609b", "comment": "Malware payload", "value": "9cf7cafd711e1735f61d202b8353bf6b4cbc8e25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686237930, "uuid": "96a7830a-4d19-4efd-ac13-d87664ee0479", "comment": "Malware payload", "value": "5e3cb200036509d7333c9c50f9b47d2866790bb8aed41533ca51c3a4c6eb78db9d9f069dd90b986d228e85db59468c20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686237930, "uuid": "3946623b-f49a-4b38-8ade-70904ad146ea", "value": "T10C93E8024B5E805CE39F9AF771391DDA031DF2E1A161D2CF6989B2A1091F8291F47E7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686237930, "uuid": "62915d7c-ce19-4e5b-ad21-5b021e1efec9", "value": "9fe876e5c825ff60cb31e833b62270b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686237930, "uuid": "8c223ea3-05a8-48d0-9084-fd437e3f2ee8", "value": "768:lPoGvw9AS5VebKWCk4ZudHYDPxLLLLLvH:J9v27mKWCk4UOH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686237930, "uuid": "6428a316-474d-4e2d-8666-b26d184c9454", "value": 95744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686237930, "uuid": "8db3cf48-3c81-4ccc-9a40-480cdaeefba4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686237930, "uuid": "6183a4d8-2eaa-4842-9c70-7cb6a3fcb719", "value": "Excle.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cd0e059-0619-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686241703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241703, "uuid": "bdb0f159-c17e-4ad6-982b-66eb85bb06fd", "comment": "Malware payload", "value": "83d84d0935a816f94df5dd834180c90e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241703, "uuid": "66e010c5-9908-49e6-9988-7b8763e5e289", "comment": "Malware payload", "value": "f417cd821d852b502b6681046afe6557bc14b4737c5c1f1199025eefe88191ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241703, "uuid": "1b115066-200b-4fad-a6f5-eba005796448", "comment": "Malware payload", "value": "a3dea1f4bbabc156526e98b47df61fc63f61c40b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241703, "uuid": "a3b43b82-36f6-43ec-ba4f-8ec77e161946", "comment": "Malware payload", "value": "3dff1e164ab06208b2d3663c5f6a0817f65ccf14098ae9d4e1956e4a1a1d67c55b0079917aabdd567326a528a662c7f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241703, "uuid": "bdd353ad-fddb-4b18-ac20-ef5e6c86d027", "value": "T173D5672968F5622AD1FAF1B3BFC6F157C203726ED2022F2AD9E517064631D21674293F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241703, "uuid": "b1a3465c-ddb4-4469-a8d1-2ea72b703d3d", "value": "4e3bb059a4bb7b776ab3c1ca8c44d314", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241703, "uuid": "63fb24ba-78bc-4878-a200-70fee172a4e3", "value": "12288:Yx/11AwZmcBul1WpqWZ4t27gT5XyqLdS9O3jzF4f/YVXTSK8iO9lqGCkl:c1Amcj3j4AVXeiO9d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686241703, "uuid": "8f1123c9-d280-4713-bd10-f242f2290a7f", "value": 3018752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686241703, "uuid": "72be81a3-89c3-473b-ba95-7b18df304bfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241703, "uuid": "756de067-18bc-4733-961e-0963f1c4e0ce", "value": "SecuriteInfo.com.WIN.MACRO.SCRIPT.IRC.WORM.Virus.15635.15293", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a0832c4-05ea-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686221485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686221485, "uuid": "0c5de827-73ce-444f-bbf5-610b14615093", "comment": "Malware payload (AgentTesla)", "value": "865453d35978362a078b83a0d81fd4d7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686221485, "uuid": "7ecc5709-030f-410c-b139-7fcc56785fa6", "comment": "Malware payload (AgentTesla)", "value": "f45d13987da07c44c15886a61b0534254e8dfc55b9dca16156df5e2a21bfc5fd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686221485, "uuid": "f2272fed-9d2d-4772-bcf2-0b63836c53f3", "comment": "Malware payload (AgentTesla)", "value": "4ca31c90c511e6deca6a003f017f0aac68cea1d3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686221485, "uuid": "7ec1ca77-11d1-4b80-b0dd-016fb6d01403", "comment": "Malware payload (AgentTesla)", "value": "f61e69ca4605f9b2714880cec9b31ccd4ed57358bec7502c379908564feb5a1be3266a0ca69c100bb59ba23adcbbfa1a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686221485, "uuid": "e5c9be51-8ceb-4554-b79e-6b3f8d08eaaf", "value": "T15715D09062A48F19F6B69BF65272E53447B53D25F626D21C0CE07CCB3E76F822A01B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686221485, "uuid": "3daab36c-bdf0-4d0b-ae86-06856f5f8692", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686221485, "uuid": "08887d79-7124-4b5f-8a41-c2621857e01f", "value": "24576:kz8P0OEsxo86h6ZAx1GSlnNHL8JG67YDtzH:1P04o86h6UsuxLIVEtzH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686221485, "uuid": "22e9b0ea-6efe-49e0-9545-872bf406fab8", "value": 953856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686221485, "uuid": "3db3495a-ad28-498e-af58-0b3b071354cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686221485, "uuid": "85187e37-9095-4bd3-bbd7-0e7e3a58bd6e", "value": "f45d13987da07c44c15886a61b0534254e8dfc55b9dca16156df5e2a21bfc5fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad31b220-05c8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686206995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686206995, "uuid": "a751e5e6-a235-42cd-8fb1-568a62a6413e", "comment": "Malware payload (GuLoader)", "value": "e95742503cd258666b61c5dde8a9003a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686206995, "uuid": "86bd4c8b-73d2-44c7-a907-3602f692d9f8", "comment": "Malware payload (GuLoader)", "value": "f52f3c64c7e5729b929919c449f9087899823470d11335c5dad97f8c19ce2679", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686206995, "uuid": "d0efff16-567b-4cfa-9a2c-40fba0cb1744", "comment": "Malware payload (GuLoader)", "value": "cee3b32cbbcec87c7393a066012e6a2479867d4f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686206995, "uuid": "c1516d49-93d9-4c6f-bbdd-6ab54347769b", "comment": "Malware payload (GuLoader)", "value": "85176577bb7ced839eeedf022aad4dfed53f4c5e7b8691a305281b65cf7bb5c38fadc6b9d7df93f510e9e9d3a746c649", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686206995, "uuid": "d2f39f84-09b8-4557-9aa2-0637ca0cffe0", "value": "T14A45239279D0CAC6E40802F01EF3C5A665797C201C9BB687B1CDB7AFD636446DC19ACE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686206995, "uuid": "f017b4a9-6a74-410d-8af4-b43c197befc2", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686206995, "uuid": "8313a7da-5380-48d2-9e7f-816420060772", "value": "24576:7Pw6DkT6kfGME6G3VibpHIdebodR6jlKFtQVUv+iP8o79bO+s:75gTvG32poHRS2tQuWikK9js", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686206995, "uuid": "17645a8a-2bf8-440c-9552-0a02f38b5ecf", "value": 1273800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686206995, "uuid": "40223e73-336e-4c58-b924-a739d342b858", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686206995, "uuid": "d242e6ca-112f-4d7d-b80d-fe39b46c148b", "value": "e95742503cd258666b61c5dde8a9003a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3297072c-05ce-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686209366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686209366, "uuid": "1a1a03ba-176e-44d1-87ab-edfaca8abace", "comment": "Malware payload (Mirai)", "value": "190237d286f94bbc79a1f136168ad59d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686209366, "uuid": "091b34f5-c5a0-45f6-a0ce-83ed454ccbda", "comment": "Malware payload (Mirai)", "value": "f5ccb4d61aafa08e2216d3f207ec7a70e4a022978fe7141277007c924fe3e4df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686209366, "uuid": "811d89b6-6aef-4524-8329-0e2d3ea59f6c", "comment": "Malware payload (Mirai)", "value": "d38076c5f1d6c7096eb159af90256a4522d4011a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686209366, "uuid": "968e42c2-201b-4223-a72d-e94d3dc5531e", "comment": "Malware payload (Mirai)", "value": "5cbed3169a54db53fae6c5d3fc02a9dfb93f93e2e17fd74b7d81c017aaffbdbe7e09b1e96b578e90447282875a4e7d34", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686209366, "uuid": "ea5cf488-aacd-4713-b683-2c2bd5e47823", "value": "T19413E1A581AA822DC1CDA1391CAF7F250E09E49CCB1519F1BF8C3B9E18B77707758319", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686209366, "uuid": "7c0bf7fd-b75c-4124-9efb-33a1a92ad41b", "value": "768:4ryy1i4WU+3HDWPlgz2E4W/b7BufftMykAYhpXyAJouSEMoOZ7nbcuyD7UVyqt:4Z10lqP3EtU9MykVhpXyN3ENOZnouy8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686209366, "uuid": "0f979b32-39c0-43a1-924b-b3d500856324", "value": 43424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686209366, "uuid": "dfe0873f-7ffd-4193-b42a-7a6ddc9322c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686209366, "uuid": "06a3651f-800a-4569-b47d-50072249ddd3", "value": "Yboats.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc700831-05cc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686208765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686208765, "uuid": "6faf7d27-59ac-49bc-b85c-c8485cf2d0d6", "comment": "Malware payload (Formbook)", "value": "b21f2f0fa8b26138467217186835305e", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686208765, "uuid": "52ace996-cc5e-42d8-b679-1cdde49c01c8", "comment": "Malware payload (Formbook)", "value": "f731018a1b9dc756637d7eb47f4ed2932a531f86a43470cd69659c25cb78a804", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686208765, "uuid": "9969eb9d-f1a5-47cd-8501-49b64227a968", "comment": "Malware payload (Formbook)", "value": "a867a234e4e16764d07155c225e4bb8e5cd2d007", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686208765, "uuid": "a866a17e-996f-43e5-9d4b-04575bb97698", "comment": "Malware payload (Formbook)", "value": "691dc6ab222ae06e8797e3f316451b28fc750d0598f04e5c063170c599cbfc489373f47283dc26aedebdc5ab0909b30e", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686208765, "uuid": "153c251a-7a3c-4de4-b938-b188ed00586c", "value": "T1C9E2E85AE79B02788F511376170F0E89AABDB22DB35155B1789C833433EDC3A42766BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686208765, "uuid": "b044ac93-4b6a-4b14-ad95-dd16b5af6b74", "value": "768:KFx0XaIsnPRIa4fwJMWppSyu8gpJOQ1/PSDGaExb:Kf0Xvx3EMWeyQpAQ1/qEx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686208765, "uuid": "990e83a1-9c31-4145-a52b-c73bf0943fae", "value": 33565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686208765, "uuid": "89bd3691-9266-4382-8523-c7bb0b899796", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686208765, "uuid": "780ae883-3793-45d6-98ec-67baa717ec79", "value": "Fizet\u00e9si bizonylat.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ca3b0f5-05a6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686192364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192364, "uuid": "4e9d1894-8e01-416d-ac8c-adf6fcc0faed", "comment": "Malware payload (RedLineStealer)", "value": "733420fbdf245ef0ada55be86069d4e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192364, "uuid": "3b6b0f50-42d4-47a7-88f4-7495f5a567f9", "comment": "Malware payload (RedLineStealer)", "value": "f78651f01c6f75cb62c1c41255a29951352859e825e0cce579f46e15fba330fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192364, "uuid": "4e6e0778-ecb3-4856-90d0-2e884ead6bbe", "comment": "Malware payload (RedLineStealer)", "value": "c94cb34fc87ab9888f8caf3e89ed468314295f6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192364, "uuid": "2ac86e52-6c25-4114-9c3d-dd51392cb857", "comment": "Malware payload (RedLineStealer)", "value": "1c4c82fb2a5a7fc33aaf266cc0661dd5410041f4141b31d61cad37046039c9bc10bc8250c784aec0abb00e9cc7aa18d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192364, "uuid": "6d65b758-43cf-4c5f-b44d-7de0f9030704", "value": "T176F42317BAD99462DDB8077018F701C3073EBCA29A75127F27A2685A0E735E9D83137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192364, "uuid": "d25be62a-993a-4601-8eb0-aef49575866d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192364, "uuid": "db570e61-867a-460f-b471-724209c47ff3", "value": "12288:3Mr5y90Uln+iAMj/CJHLYfTeVxSI2wB/Vwyns2SehojVWxVhyFdv1ryA:+yhn+iA+CVNV8EVwuKVWr0pryA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686192364, "uuid": "760afa8c-49ed-4918-94bc-07e170ced62d", "value": 763904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686192364, "uuid": "cfaeb299-1a86-4e7e-bceb-4a6c0acd2060", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192364, "uuid": "a6c6eaf2-6d6a-45e8-abc3-9af2f5514adb", "value": "733420fbdf245ef0ada55be86069d4e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5235122a-05ff-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686230464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230464, "uuid": "ea6a901e-fff9-4663-b580-f9372fe450d2", "comment": "Malware payload (Amadey)", "value": "73d2db72094b52cb10e05fcea4d818e9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230464, "uuid": "ad56e660-785a-46fb-8004-86678f476eaf", "comment": "Malware payload (Amadey)", "value": "f7edb590ef4e0f1e865d66dd358b20a8f1e4207cfb35eabbce0f9a7771ec03c6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230464, "uuid": "ce140d2c-2f38-4a93-89df-b9abdafe14a1", "comment": "Malware payload (Amadey)", "value": "108d885ab904073c141852c321ba91915f2b9ab4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230464, "uuid": "7353386a-2d09-4b31-957d-ffb93790f6e8", "comment": "Malware payload (Amadey)", "value": "96f45bbf620b9cfbb0bf2f2368f58f8c2eab2fc0dc4bdc9564a5c79551a4426b29e75d835c26c4e2d5d5a61ad6c039a7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686230464, "uuid": "d3ae4719-1f19-493e-96d6-18e8aa47871e", "value": "T187F42243FAE99027E8F127349CF60B830E36BD72487C9B977349694E58726C5A831736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686230464, "uuid": "042b5f26-48de-48af-b42e-7e0505fcf3fe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686230464, "uuid": "6df3730a-3149-42ab-8ccc-d04bb6b252b6", "value": "12288:LMrYy90xaoJA+/VLnupmTxS7sgQxXKMcDL6qQaWQf3/GEwccLJkrOYEVy:LyOs+NLomdS7dyKL6qLWi/1gWOYD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686230464, "uuid": "dd5a2ca1-a1cc-41d7-8e68-e34339bb84b8", "value": 791552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686230464, "uuid": "2147d948-e359-488e-affe-9cf8a3ad328c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686230464, "uuid": "1028729f-c19d-453f-9e0b-48d517c4f2cc", "value": "73d2db72094b52cb10e05fcea4d818e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05a5b066-05e8-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686220458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220458, "uuid": "cf92fc59-b10c-46e1-a5e0-5af3892fd865", "comment": "Malware payload", "value": "b07d700dbaf000d13091d07f7d825ebc", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220458, "uuid": "d2ed1ef6-619b-41e0-8f7e-fabeab5a2b2f", "comment": "Malware payload", "value": "f7f545d0ff95710774d7fbbf2775cebded8e066fa8ab89c89aff82bee0e662a6", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220458, "uuid": "fdbb86dc-473c-467f-aa51-f3fcc7968c4e", "comment": "Malware payload", "value": "6285ce4eda4f63535bfd98ac5685fdff4ae83063", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686220458, "uuid": "6339c4b1-d9de-4d84-a7da-b4903ebe8105", "comment": "Malware payload", "value": "eee7940594b76d23d540f809e7afeb7258946a7ff7af1fac05f2286a3a42b9607dbb8b7a7bb4a003bd64e1ed22df62b6", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220458, "uuid": "43906fd7-333e-40d2-9dd9-53488d90997e", "value": "T1C3B199854A22E13E4B52CD096F53BADC6918D9EFD5C9A309B1840F4FF1A833D90E67C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220458, "uuid": "e1ac016b-0eac-41ef-90e5-197aaaea69af", "value": "96:+Gc3vl07guAeSyANKo5N4P6//HqNJFjTZKIDoh9O3/k2j:vh7VSyA4PP6vcPZFmOvJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686220458, "uuid": "098be945-8d1f-46ea-bd31-800a1fb0b3d5", "value": 5280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686220458, "uuid": "98cd4a91-2af8-408c-ba77-85015037468f", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686220458, "uuid": "321f49be-f1c0-4657-8f99-74f839ab1e3e", "value": "0.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c52fb7a1-05e4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1686219061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219061, "uuid": "bcc85d6d-6959-457a-92f1-b2ce55fb8f0b", "comment": "Malware payload (AsyncRAT)", "value": "595879a2801a78b8b56e7d970db35b69", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219061, "uuid": "b7cfa5bf-c8e5-4114-b94a-a8f83776bcb5", "comment": "Malware payload (AsyncRAT)", "value": "f864fe5ce96e3e05ea0eac5c7feea7f23bc3c03935faa2d699dc7d5f27d963bd", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219061, "uuid": "912a0c01-97dc-4ab9-89ff-ff52bbab2a4d", "comment": "Malware payload (AsyncRAT)", "value": "3f4b57cee068dac3adce8c2ee8faaf9dfcbb2d6f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686219061, "uuid": "b49aca43-ca1c-4871-8809-184adf011b86", "comment": "Malware payload (AsyncRAT)", "value": "020c74f274525f03786493350233bf7ff753fd32a151903faef04ae378d7dd6a85fe0fc9dd7926b0735e2eec7f31da9d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219061, "uuid": "714dbbcd-1483-4adb-a23e-d807e8e22113", "value": "T178E4DF172EB67709C46B6BBB4820527C93FA2D1E7CF2D2074D8E78C9DE36B514A40993", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219061, "uuid": "596b28e9-8d61-43db-8bee-a86525fac98f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219061, "uuid": "723ea2d6-fbaf-41f8-b595-9b03c06a3ade", "value": "12288:oW4haDnLMzIL2q+RTdOL81eQoVCAVAYu3WY+swISk6rxXn:8OyqGUL8kFVlVYP+swIQrxXn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686219061, "uuid": "113f9076-aa77-4989-afb5-a762d7e8b2fe", "value": 717824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686219061, "uuid": "69c6c9b0-1d43-4ed9-8a3f-2ef01c9345e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686219061, "uuid": "4e28bdae-2bd1-4c21-a5a0-72eed0b45170", "value": "Request for Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59c72bc4-05f8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686227471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227471, "uuid": "27c1edc6-ce05-4c64-a0be-c6c12a5529ba", "comment": "Malware payload (AgentTesla)", "value": "2266d028b418dd59fb82994ae4557134", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227471, "uuid": "ec9a8ac4-4532-4b6a-8e45-c63592d900f7", "comment": "Malware payload (AgentTesla)", "value": "f8b91735d9157e4c518afbab6e6a4f87513002ea869da820708486b9cb704b71", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227471, "uuid": "6c9e407d-9aa1-44e4-9969-4dd540b9a4da", "comment": "Malware payload (AgentTesla)", "value": "080cb616975988a1d41f085648ed76b86171b07e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227471, "uuid": "1ad96e0e-c69d-43ee-959a-b91a3143f64f", "comment": "Malware payload (AgentTesla)", "value": "afed247a05119b6aad7adcd77ffe660943e18a894e3362421936fce3ee3c491ff3c2e1c3ea914b16420e3f7005357e4e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227471, "uuid": "a334b09d-0b46-4e46-9e80-d6590d1c4127", "value": "T166E474388B75237A92BBE39447C6B49FB1909C36B2117BE5E491230D4931832FAC7D5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227471, "uuid": "6ae9d029-7fef-4b7f-9fcb-96de97e95cc2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227471, "uuid": "5585426e-27e9-425b-82cf-756b80d7b720", "value": "6144:30Zqvy0o79RRcje4xB2bX7A6BzgE7XSPVTyrer/AwIczT7XzEhh:kZqveRR0NxAtBzgErrekw/j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686227471, "uuid": "be4dde39-e895-4cce-a686-2e6c8ad8b18e", "value": 693760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686227471, "uuid": "a6337a2b-7326-4a51-b40a-89ac10ae9419", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227471, "uuid": "0e67789f-ffbe-4def-a2eb-7e3ed1c0c0e4", "value": "f8b91735d9157e4c518afbab6e6a4f87513002ea869da820708486b9cb704b71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f18fc08d-05c2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (NetSupport)", "timestamp": 1686204532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204532, "uuid": "19601c80-5bb9-4cdd-93fe-7ad8988c0305", "comment": "Malware payload (NetSupport)", "value": "21a1f5f026daca2ccca000d4f41e2103", "object_relation": "md5", "Tag": [ { "name": "balibumba1-com", "colour": "#191C23", "exportable": true, "hide_tag": false }, { "name": "balibumba2-com", "colour": "#638CE9", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204532, "uuid": "53f94fac-304c-4014-b219-3375667a387b", "comment": "Malware payload (NetSupport)", "value": "f96304b0f12b42c6f067a10870dc78a9ec7fdb226e7a4b23e14987e1fd222e7f", "object_relation": "sha256", "Tag": [ { "name": "balibumba1-com", "colour": "#191C23", "exportable": true, "hide_tag": false }, { "name": "balibumba2-com", "colour": "#638CE9", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204532, "uuid": "6fc11a1b-ec09-4cf9-b381-c98c7f9b9965", "comment": "Malware payload (NetSupport)", "value": "9a8677940d0a052ad739a742fc36f8433954c1e8", "object_relation": "sha1", "Tag": [ { "name": "balibumba1-com", "colour": "#191C23", "exportable": true, "hide_tag": false }, { "name": "balibumba2-com", "colour": "#638CE9", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204532, "uuid": "fcd2a087-2fe8-458a-ade2-8b22f0aa1e9a", "comment": "Malware payload (NetSupport)", "value": "53df949fa084cfe8e5917d5d96571e73f9bd9f7a7e0942adc1195b921004d2633c0be27613f74f93810e21d72a764806", "object_relation": "sha3-384", "Tag": [ { "name": "balibumba1-com", "colour": "#191C23", "exportable": true, "hide_tag": false }, { "name": "balibumba2-com", "colour": "#638CE9", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204532, "uuid": "3fe6bbee-574e-4ef1-aab4-dc20ee81f286", "value": "T172512C21F2A53F5C73756742EC96C5AC9D11A445426DE98672FCD1418AF80E53B3F0AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204532, "uuid": "cf26091c-afe0-416a-a572-59eb461780e0", "value": "48:1hoN4PxGIb9P4Ax2PvoXZiuQ8NOgOLHnAfpl4sKCKiC1e3g:/7X7xooX4sNKLw9s1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686204532, "uuid": "332cb513-6e90-416b-978f-a37d4dd775ae", "value": 2477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686204532, "uuid": "6a207608-3b76-4ac3-a1d3-5f90fde05b8d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204532, "uuid": "bd18615c-ce22-4bb1-bbf2-098b0b491410", "value": "docse.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8030f942-05ab-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686194464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686194464, "uuid": "72c531f6-0030-4641-83ca-e859046d92ff", "comment": "Malware payload (RedLineStealer)", "value": "856cd56c655fa0ae51ec7ebfc83cb35b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686194464, "uuid": "e9753578-ba27-4007-8c64-f181d233b1c5", "comment": "Malware payload (RedLineStealer)", "value": "f96b114cc41836909d5427999633b0bd6dee9aabd22cf4f6b6210903c6bf8f50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686194464, "uuid": "f880c2ed-52e4-4eaf-91e8-a03ae4b84c40", "comment": "Malware payload (RedLineStealer)", "value": "abf3c8f78918b2bcaa69191fd5201770ef96d54d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686194464, "uuid": "e89bbb0d-e1ba-4bab-a629-2e19fafdb0c0", "comment": "Malware payload (RedLineStealer)", "value": "73d9571dc670619761d9f510cd150d2482dcc0a044d9a17b163e0b853568c3360669f0ea758d4978ac24c1c5beb847e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686194464, "uuid": "905429d9-7fe3-44c8-8ac2-ba084bddc2ce", "value": "T1C0D41242E7E95633D8B40FB059F213930A35BCA29D7456A73BC26A2B1C732D0B43576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686194464, "uuid": "95010de6-5ce8-4857-a3b3-aa810aaa64f0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686194464, "uuid": "97eb47c2-5316-4933-9187-36b027e67021", "value": "12288:iMr9y90iXBUFQUBnkpfSrx+HIC6LUb6FtzCRSx1eUZVN:fyZWmS+l6LC6Ftju+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686194464, "uuid": "0578c859-e7c1-45b9-aa69-fabfe6233c8f", "value": 605696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686194464, "uuid": "b55bbaa8-f6ac-43f8-84dc-e9ccc13369dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686194464, "uuid": "2da6c776-898b-45e7-8978-1644bd8fe144", "value": "856cd56c655fa0ae51ec7ebfc83cb35b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c1e1260-0611-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686238239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686238239, "uuid": "6dff6c37-fbf7-4551-8798-71b06d0de428", "comment": "Malware payload (Mirai)", "value": "578b1434305e388177fda87b8a5e7a54", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686238239, "uuid": "8427bb82-f0c2-432b-8c84-b1d0e9040c31", "comment": "Malware payload (Mirai)", "value": "faf62f6803b75c9922fb21af35b1f46373b87b0bc791f8c890d66403533b6260", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686238239, "uuid": "3a2193a0-49da-40de-b7bc-54d5129a5235", "comment": "Malware payload (Mirai)", "value": "5a972c9975a7a0226387ca6c8c4cd43c317bfad9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686238239, "uuid": "99520222-5cf0-406e-a58f-215a32765db6", "comment": "Malware payload (Mirai)", "value": "464ae66beb2ead2d0550b0f7e1459a9d6db85940d2842b8d4b70414c7171eacb9e3988e48290b65378a3f554350cb583", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686238239, "uuid": "30392695-099c-4b1d-ad0e-9d471768d605", "value": "T1C8E2D012F32A99F2DDB378F08952E690CB905B5637F9DE7243C89F308ED15369281AC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686238239, "uuid": "80371354-54a8-47e4-9232-8cfa55c23720", "value": "768:Z8Fce4oVnnNfuTWEMfwxcFWcL2bE0BQAB4uVcqgw0RKWX0:SmMuTUYcFp7eB4u+qgw0UWX0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686238239, "uuid": "a4413d23-7990-46db-8188-fa3556b2dca1", "value": 33676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686238239, "uuid": "e268d576-7780-4a55-819b-9a118b12b7fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686238239, "uuid": "ea9bba2d-45af-48f7-8a35-ebc3da8beabd", "value": "578b1434305e388177fda87b8a5e7a54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fe74035-0619-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686241681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241681, "uuid": "1c5e482e-2f23-4d64-9b17-201c465728f1", "comment": "Malware payload", "value": "4c2f4a87b5e76448b48b99ed4efcecb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241681, "uuid": "2e5a9ba5-506e-4557-9736-5f858cd268d5", "comment": "Malware payload", "value": "fb2f32a74864309c7fa49bc5ded04863f3d9b72a1f907675a7ab8d2bb2bb081d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241681, "uuid": "6c2be6d1-c1fc-4a40-b307-18018a97042a", "comment": "Malware payload", "value": "e59520de239843680cd30727cda0e43074dcc5ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241681, "uuid": "980a94a4-8035-4f24-8613-d91177954fe7", "comment": "Malware payload", "value": "c54803c54853058494bc4cb4b745656e3a9e238ab0b5fc600eea5cb96b00ed05d1cbef5ae8f39e0b36c7bfcadd193ada", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241681, "uuid": "a4e26e18-5403-4508-9c1e-6ed835fa2789", "value": "T14C643A23EAA06105F02306700DBA567A186B7C382D12ED4B6B41BF5E6576DC3E6F172F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241681, "uuid": "c99df648-9680-4ed5-a582-171d0d12575e", "value": "6144:uAXv4YWuKqNUAdpECKlRUuZxnbJRHIHfqooOX/w2W:jQYFF6gECKlRHJ+AOX/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686241681, "uuid": "038fae4a-acca-4918-a7d4-5d6aa39cbd7c", "value": 311296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686241681, "uuid": "e02fc69a-38bc-416f-9ac8-acd8c98a65b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241681, "uuid": "c7aaf162-4bb2-4cf1-87e2-3ceefcb690c1", "value": "SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.8384.4846", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1c5f055-05a6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686192426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192426, "uuid": "564c874c-e74b-4b51-b98a-b5db79920801", "comment": "Malware payload (Amadey)", "value": "aa9462a53e3fc2ff2adc2258bb2b0daf", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192426, "uuid": "9151d05d-93f2-48c1-8554-7f5c50ea34b3", "comment": "Malware payload (Amadey)", "value": "fbc6da599bbb6e9f8910a1c9369049dd9e7cf0e91f65c52dbe4d8c7204d85c02", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192426, "uuid": "17990eaa-5d19-402b-9b25-5fdcf60e8e07", "comment": "Malware payload (Amadey)", "value": "e11a6bf8b5d1a951f43e72c1def57316164c9309", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686192426, "uuid": "d032e3a4-f87a-4b71-bf5b-c23543242eb2", "comment": "Malware payload (Amadey)", "value": "9fce1f826d819d1b071e67a7ad12c9311e85e32a761f6f4dca5156c812d47a18b747f592e7d564bf7f05b1edb3b30ccb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192426, "uuid": "68d94fa8-6138-4791-90d1-434ba141cb00", "value": "T1A424F7257D12C032D56061B619F5BFF2C59C6828ABB049DB7B800F77DA122F73A61E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192426, "uuid": "1532c52d-a5fa-4829-8ced-d041576204d4", "value": "f8cc61ade86cb7277d0ab974de6323cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192426, "uuid": "926b0146-2b2b-4bfb-9646-b225b1346648", "value": "3072:H/DmgskHbfHN+Pst60p0zuNmnKG7peNMQbuZAIqbey3lfbi:fDmfAfHN+wiuInRexuZAIij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686192426, "uuid": "811c7fd7-ba28-4f4c-bf5f-9d2dd00d04a6", "value": 210907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686192426, "uuid": "9cc29ca8-ab52-4684-9f58-aba84f562f0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686192426, "uuid": "d84be7a1-a3f5-4cc2-ab35-a8693498622f", "value": "aa9462a53e3fc2ff2adc2258bb2b0daf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f3ed788-0619-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686241680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241680, "uuid": "4771cc93-6e08-408c-be3d-a71068edaaf3", "comment": "Malware payload", "value": "f3f38ab5312d89d3b3ce6d86ed88493f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241680, "uuid": "497fc7fd-5172-4634-96da-80865aac518f", "comment": "Malware payload", "value": "fc482b15b255fe39fb113337b52035a30dc4188b1abc2d0488842870a25311c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241680, "uuid": "d2991e9a-f26b-44b4-b912-0119a7cf8135", "comment": "Malware payload", "value": "140884a900b1b1044a0d6700a5c6539fe262342b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686241680, "uuid": "a3735938-572f-43f7-ad24-694de377677c", "comment": "Malware payload", "value": "a6bcda4f8bdd0aba046b885fe9cacdeb8edbdafd67974d719d6d266cca2e5b8428f5d2da631bea9b4ba64d91c30ce2c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241680, "uuid": "fd661890-7559-41f6-9626-dfb0cdb37be4", "value": "T1B4B37D61F5C195B2C0260D7C8C0BCB68DC3A7A60297C36C6BBDE4A5CDDB93961D0C6B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241680, "uuid": "1cf23784-b984-461f-b4f3-597b3b2bfedb", "value": "1536:eaq9Nf0JayTVRVOj6pPMLMZuJRTmjjtACe7ZHN:pyNMJbKMZcpmj6N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686241680, "uuid": "5cf1c074-7f2b-4af9-b0ae-cccc12f57d91", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686241680, "uuid": "0c5eafd0-85ea-4270-9967-5f0aed22eb17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686241680, "uuid": "2e762b23-7bd7-4abc-a17a-a353b65d68f3", "value": "SecuriteInfo.com.W32.A-62389890.Eldorado.28176.29361", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "667375c5-05c3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686204729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204729, "uuid": "14f52f3d-1549-4082-bf76-63df941cfa89", "comment": "Malware payload (Mirai)", "value": "e2d664f19f2aeca28e95669ceba79982", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204729, "uuid": "97b9b0c0-fe10-41a2-acd5-4ff57ac611e8", "comment": "Malware payload (Mirai)", "value": "fcfb34866064c427302bd3e360f439f73b56f16b54cb6f9fec5da9002aa9f3b5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204729, "uuid": "5b5df950-56cd-4378-869d-3e266273b32c", "comment": "Malware payload (Mirai)", "value": "87b1fa023f63fd32feba4fc0fb872972683e9d1c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686204729, "uuid": "7820d43e-6ddf-46e9-9a8a-96a16f3af061", "comment": "Malware payload (Mirai)", "value": "9db3717247804a94bf7d16fd0a490e230cdda679fda55386997fb8be8b2e3870ec564895e146e777b55fac84dc610e00", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204729, "uuid": "eca07f1d-6fb7-412a-8c31-0c65cd0c2628", "value": "T1F2633921BA761E1BC4C1947621F74B25B6F143DE26E8CA0A3DB20D9EFF71A442543AF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204729, "uuid": "7c490250-0929-486f-a221-ad9e1e0a44ab", "value": "1536:lmxqDIWoVvhGIAsIft/ALQFOG75CmntCt0DkXA:lyqrhZpOGVqYkQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686204729, "uuid": "a6edb696-073f-41dc-8d40-2592ae726d1d", "value": 67336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686204729, "uuid": "3642dd62-0a98-4d91-829e-572642dd757a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686204729, "uuid": "af764f18-8370-4baa-a313-2b4a999a8412", "value": "e2d664f19f2aeca28e95669ceba79982", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c494556b-063f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686258144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686258144, "uuid": "da45916d-77ad-47d7-9c83-70d8ab516a51", "comment": "Malware payload (Mirai)", "value": "3575794f54657b25748f7bb5eeda7f2f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686258144, "uuid": "ed1fdb88-b264-487f-bbe8-6d0da0799f78", "comment": "Malware payload (Mirai)", "value": "fd2743db38a3b3a66292127045344ee0552e1c4f79037eff3dd8d8ac7276c8b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686258144, "uuid": "28843731-1fa1-4705-ad07-9c3aafb8dc6f", "comment": "Malware payload (Mirai)", "value": "d4b3da4789c6d56f5667eabe9e2ef2fc59979b36", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686258144, "uuid": "09b0cf64-b080-4359-b2c1-553972ce473b", "comment": "Malware payload (Mirai)", "value": "383f1b7b3f4ec9ee09d58490137bfe386db662d012f98cc008491366dc3a000f6a32e361c27f32698adb6e704bd5c697", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686258144, "uuid": "29db92c7-006f-44c3-b3b6-b82d6aa33dc0", "value": "T12AA2C156F28D7FE9DEFE0F10DFC262C26E551FC9A25BD5A750854F11A90308336846E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686258144, "uuid": "1297a00d-472e-4f22-a910-769fcc1d9080", "value": "384:m/JywWc84Tp2YshxqlDTI1jW+9ksgoDExGbTYH6gZpM4uVcqgw05VxJd:mRxsSVsMDTIFusgS4H6gw4uVcqgw09/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686258144, "uuid": "0b1f6916-963d-486f-85b0-d659cfd2dfa7", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686258144, "uuid": "232b0b03-5de0-4088-8fcc-fa01a59f2ac4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686258144, "uuid": "0372ae6c-cf08-4b98-a6f1-6d128d3ad370", "value": "3575794f54657b25748f7bb5eeda7f2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfb6831a-063f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686258136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686258136, "uuid": "d7119d90-0efc-47c1-b2b0-ec1b64e15d18", "comment": "Malware payload (Mirai)", "value": "075bacd5f284f58f225917e5bd1bd706", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686258136, "uuid": "2b343195-a42a-4053-91d3-0fe4df59dc13", "comment": "Malware payload (Mirai)", "value": "fd34a02657dc2cf7b37cb39eb21b2eecd643100a171a2ea2611d1137b756f391", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686258136, "uuid": "6ab57d94-3960-4e78-b756-88f6a89152e0", "comment": "Malware payload (Mirai)", "value": "de61d765cd680596be0b5b90e826aca8c867bd23", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686258136, "uuid": "977c28ab-932e-4f4d-9686-fa0d467eb868", "comment": "Malware payload (Mirai)", "value": "f964fb84cc365026e4ca1262d66f58d2da11c46690581995b56fbc15cd1d7e7f8044b13f2047040925fdd27e22c5646d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686258136, "uuid": "0046f1dd-3117-4030-b44e-839e20623513", "value": "T111C2E1D17A10FC21D5303CB2CE6A8E8F59C64A3C90EE3A7619248855AFE39C797F8503", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686258136, "uuid": "b05917c0-81d0-465d-ba86-10a05afb8fb3", "value": "768:RMKyhegCCMqf1MFTd/14teAp909q3UELu0:GKy4qf1kTp14teAJL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686258136, "uuid": "a7fbed16-cc07-4661-a464-5056c192e902", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686258136, "uuid": "4451e771-649a-482d-913c-0450ed1c6273", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686258136, "uuid": "16bb83b9-91d1-4129-879e-86732cd2ab11", "value": "075bacd5f284f58f225917e5bd1bd706", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77f2809a-05d2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686211200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686211200, "uuid": "4399a948-33c6-4c43-a7fa-e2f94e947b86", "comment": "Malware payload (AgentTesla)", "value": "2fac554cd8458843cd787c9b108d550a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686211200, "uuid": "b813edc9-5580-4317-a12e-cf6af7345c09", "comment": "Malware payload (AgentTesla)", "value": "fd99ce94e714433a5baad5e3bc3980f911f2970f34f023578435a7c687049b63", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686211200, "uuid": "b086c21f-a14f-46e9-9d4e-4057edbfbc06", "comment": "Malware payload (AgentTesla)", "value": "ddcc1105c2376494be254fa54ba5dcf5e0a33035", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686211200, "uuid": "15982d7b-8b60-4fe9-8cc2-886fa2224993", "comment": "Malware payload (AgentTesla)", "value": "1840e2b5758785e2bb3222294f27d1ebb5434eeb6f7ff1030be194a32575d6ce4ff8cbcc0f97a4de4ff249ed9fa50524", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686211200, "uuid": "6498b544-a3ed-49d1-b456-a546225ffc70", "value": "T16615803816741E62817AE26E55D9F91BFA844CD3360CDD1E8AC64FDA4A03732E1CED1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686211200, "uuid": "0daba7ef-699c-4947-a90f-9dbcb09f3429", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686211200, "uuid": "5322d92c-7747-4110-a8b9-03d1d1e57e62", "value": "12288:DLEkyk9sYz5ZRL9RMAR7rpgOdXkU9xHACiDMWmUvCJa21B:vEkl5ZR9r9/9xg99moC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686211200, "uuid": "4fce6540-82c8-466b-a8fe-8518c6e378e1", "value": 957952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686211200, "uuid": "c3d5ecac-2070-4ead-9393-d15fb0a5aeed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686211200, "uuid": "f09d3ce6-6fd9-4c32-8273-89e1dddcffa9", "value": "Statement.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3dacc14-05f5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686226414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226414, "uuid": "0c2d3f27-837f-49c9-80bb-38704f3b4af9", "comment": "Malware payload (AgentTesla)", "value": "097db3d7b5f2d5c94d45e96274f6c219", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226414, "uuid": "60ad84ae-05e1-427b-8e0b-d6977d09220b", "comment": "Malware payload (AgentTesla)", "value": "fde58fc777d2b4f3a2cb1b5e818132185df9135fc85a1a4456574c92b30e36ec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226414, "uuid": "1d3ebf74-8058-4140-a170-6722b0853d02", "comment": "Malware payload (AgentTesla)", "value": "3520ea144518235ee7bd0f0e6391bd50c948d42e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686226414, "uuid": "86408623-9da9-4cd8-9b3c-7cc00d17ff70", "comment": "Malware payload (AgentTesla)", "value": "749bbb02e9eb3d7369e82c51cb999caee63062d271b583dc090a43d3d9b40583984dfd48f99c45f06a2b4a7d7dfc0263", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226414, "uuid": "f53bf9fa-d831-4088-be49-a486f93b7930", "value": "T1B6F4126063B68737D6BF47BD60546E7503F6778A3B11E38B8E83B0E89B2AF540912507", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226414, "uuid": "489bc0b0-8590-4096-a013-416f92b0df45", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226414, "uuid": "87cde1cb-a7c3-4b10-83ea-aa3ef8e7517f", "value": "12288:K0HkmFx2iqNhujGjUGp8rl3BCHXe07W0o2QMEC3DEPHCLS6EK7:ZEmFxU9pWzJ060fDESDEPilN7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686226414, "uuid": "a18f9959-c4dc-420e-852a-c896841331fc", "value": 726528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686226414, "uuid": "5962a986-0bf4-44ae-bad3-870ccd9b8bc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686226414, "uuid": "6f66a5dd-e958-416f-afde-24ce02b65d69", "value": "fde58fc777d2b4f3a2cb1b5e818132185df9135fc85a1a4456574c92b30e36ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63be656a-05f7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686227058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227058, "uuid": "092cc950-ff61-4826-9598-8af9023695b3", "comment": "Malware payload (AgentTesla)", "value": "aae1ea71703a93297015f003a3578261", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227058, "uuid": "f439daff-434b-43d2-8bb1-cfcb629b88a3", "comment": "Malware payload (AgentTesla)", "value": "fe0c3d21e905cd9a01ec8d4bf81bba7e15c6dec43dfc70d00514b1b01c3f61d6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227058, "uuid": "6fb5f12b-96f3-48b9-8166-c82bd75604b9", "comment": "Malware payload (AgentTesla)", "value": "102fb1967fdc5bad52702f8e29ff6bf97adbca78", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686227058, "uuid": "4c311b88-55c5-4f66-8fc7-1be63e013c2d", "comment": "Malware payload (AgentTesla)", "value": "33b7714861fa3fbacf74dbbd71e6082624e7bee39e17cc565ddd756e7bbb1441fbe8f5afe045187cc37885ee874253d4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227058, "uuid": "a51000a6-82fa-4027-9938-50cad2e57f10", "value": "T144554B388B75237A91BBE39447C6B49FB1909C37B2107BE5E491230D4931872EAC7E5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227058, "uuid": "bffb32fb-9dd9-453d-a2e9-08211fa28af4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227058, "uuid": "73163ddb-7ec9-400e-93fc-5242c4631223", "value": "24576:D0ZYv3hllGOJfYToHD4Rwf4CKjEtuG+ct1/WC1ft:QuQO1YUfNCEwGfz/WC9t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686227058, "uuid": "aaf05261-e4ef-48a7-a786-50e3ffa665fc", "value": 1373696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686227058, "uuid": "866b652d-dca5-4823-b13a-cc0b165c0fcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686227058, "uuid": "8c58cb74-ce2d-493d-9740-3a6364a7fe41", "value": "fe0c3d21e905cd9a01ec8d4bf81bba7e15c6dec43dfc70d00514b1b01c3f61d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b9e5df0-0600-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686230856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230856, "uuid": "cb502169-3a4e-4a6f-9cc7-0c06814bb225", "comment": "Malware payload (AgentTesla)", "value": "d5e26aa8659ad695a309319c06a32a8e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230856, "uuid": "a5ea5e8d-fe00-4656-8c7a-84adf7d80b85", "comment": "Malware payload (AgentTesla)", "value": "ff8f076ca18407b0ac9796ff5d32f1ad41397cfa0f633d366274676f124508cd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230856, "uuid": "8e913004-be41-48a4-8a06-c475687316c6", "comment": "Malware payload (AgentTesla)", "value": "f06a8647c6b019daf5592faed65c117bbe2c8d5e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686230856, "uuid": "3b56e2e2-904f-41bb-b325-e803fcd0b508", "comment": "Malware payload (AgentTesla)", "value": "cb1607aa6f3f24270134800dd577ae1fe6c6841021ea8955c5d9241ed1c2ca0bbff5a45b9b8ee350b811224d3797ce38", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686230856, "uuid": "08fc7016-a1c7-44dd-ac0d-fa9e9c7580cb", "value": "T174526CBD29A00914F859C43A67D31ACFE3207915D97C133C8295CBAC36BBD48CAD0DE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686230856, "uuid": "0d4b747f-f175-4832-9e39-85e8aba8e4d5", "value": "96:COHEHtNzVGz9zLTrsbyrDJa+szmhKhqJsq9FrWJcZnsx87sBk5R:COHeRkFTrsbsd5gmUhqBrWJss7kT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686230856, "uuid": "fcd1305c-612c-4a91-accf-3eb869cb97ab", "value": 14004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686230856, "uuid": "ebc7c430-eb07-4747-97fc-13bb69dea476", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686230856, "uuid": "27119706-a49d-4175-aec1-766956f3ebaa", "value": "Nr.2178759 Technische Dokumentation.chm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }