{ "Event": { "published": true, "date": "2023-02-18", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-02-18", "timestamp": 1676764981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "0b87c4cd-6169-444d-b8e0-a63ca5a29ad6", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faf33758-afc6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676750466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676750466, "uuid": "27974010-8a2c-4305-aca3-029e2b4deb71", "comment": "Malware payload (RedLineStealer)", "value": "bc809024e23d0bfe34ccc2a167a07d84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676750466, "uuid": "387f78a0-1b61-4fda-b27f-42f4b56c0aaa", "comment": "Malware payload (RedLineStealer)", "value": "001b09ececb8774d65d01bc2d0e8361072bae77ccaa7f309ed7fe57c8a8c1c28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676750466, "uuid": "b8428e19-c5d3-4dea-b0cf-64192188f7cf", "comment": "Malware payload (RedLineStealer)", "value": "8d6e56c97288375fe75ff1eef852d70d57e24387", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676750466, "uuid": "0f3b6e32-1481-48d6-9cbb-8899a884138d", "comment": "Malware payload (RedLineStealer)", "value": "c3375d66ec1c7d0a8d36acab83cf858204d1201778c62ac12eb05a4b00fb1d21ecca0685b99cfe0e508161583f326795", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676750466, "uuid": "223e6a4f-e26e-4172-87f6-dc51a185d262", "value": "T153F4120BF6ED4435E9B403706CF603D30A33BDA16B354287174B6E690D72AB6623576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676750466, "uuid": "423a1090-7ba6-4392-b635-aecfe4b7b63b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676750466, "uuid": "b6dabbb3-0d74-4b07-9e47-019ad7a69eca", "value": "12288:FMr1y90G3AttcG241fvQ67XIbb34qrH+kbC1qnEUFLWmaCEaUDZamRWtedlMCEmU:0yn3gtF1nQuIbbhDoqdFAi0VW4+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676750466, "uuid": "3d97ede9-1986-4889-ac15-b18343db8501", "value": 764928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676750466, "uuid": "14c89d6f-9f71-40fb-ba2d-2d6a95df3669", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676750466, "uuid": "9be2b713-2cb5-44e2-a999-22944e15e712", "value": "001b09ececb8774d65d01bc2d0e8361072bae77ccaa7f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f69cd87-af86-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676722637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722637, "uuid": "1980caf0-a9c4-4b4f-9194-2355a4d601c7", "comment": "Malware payload (RedLineStealer)", "value": "1c59cac37cc8c63ab213b289e3325cc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722637, "uuid": "de567e6a-54ff-49c1-8217-e141c062d265", "comment": "Malware payload (RedLineStealer)", "value": "00a7d28a276609b852406decc4a1fd384d618bcf2a88d8b36732812f557d8751", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722637, "uuid": "2b3c8850-da5c-4053-93b9-988ebc3d6506", "comment": "Malware payload (RedLineStealer)", "value": "2f545f2c7f29cac7cb837a1ca6db1da11a5c31e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722637, "uuid": "5c65f9d7-bd1b-40eb-9e21-e2152101132b", "comment": "Malware payload (RedLineStealer)", "value": "263fa9ddccad22d7a75b61d8f2651c614b07d626ebfc5b894797832677fd6eaaa9d6de6e34843b7642da02528493dec7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722637, "uuid": "4e068e47-81fb-4796-a12a-a38bba5a1450", "value": "T1C3C4024763FD5262E9B5A7B019FB02C30A31FDA05A384397778E9D1A08731B1A67137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722637, "uuid": "fbd51559-e276-45bf-8399-7627f1099cce", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722637, "uuid": "d76fb4f9-f923-4222-8072-03071a66c5d9", "value": "12288:VMrpy90jDW5bWTGPiPe6jlidnrvVu18qYeON5Bn:wyUWRwLynu8qxOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676722637, "uuid": "79d28970-3c1a-473c-80d5-82d771b11de9", "value": 571392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676722637, "uuid": "c67eceeb-8542-4d34-aae9-247b59e52db1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722637, "uuid": "c80c9992-9a25-4a08-bce9-86785ed2045b", "value": "1c59cac37cc8c63ab213b289e3325cc1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f17d79d-af60-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676706450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706450, "uuid": "41793213-37de-4812-b5b8-89a6ad9554c9", "comment": "Malware payload", "value": "2cc6385122a67770220d1c213a7e81cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706450, "uuid": "882a4b10-31fc-4e62-9c07-6dd008904dbd", "comment": "Malware payload", "value": "0166d08fb9b423a63a9e1f2db64f38f5d268531dd24d667030b193e555a8af69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706450, "uuid": "31b757ca-a9e5-48a3-91a7-712d6c1c1df7", "comment": "Malware payload", "value": "6331d5796d1b5fe2379daec7844c7887cd32670d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706450, "uuid": "69a738c9-fe23-468a-b456-863f4d58a119", "comment": "Malware payload", "value": "44c51c1fc35813bd6e7b888d64515de6debc37d5749bb8d1e26d086043287b74dd6959e1c8e0604b52fc9cd63b4b82c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706450, "uuid": "9288c96e-3122-422a-a38f-e82528d51bfd", "value": "T170764B07F85190E8C1ADD230C66692A3BA717C894B3027D73B50FBB92F76BD46A79314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706450, "uuid": "7099729f-cdf5-443d-91e3-d03fa3398ad3", "value": "57c9b357ae0cb2f414b0a5873e2f216d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706450, "uuid": "01a6ab9e-01ca-4398-b25a-9f96d669d9c4", "value": "49152:N+7tI4xumAZCrb/ThvO90d7HjmAFd4A64nsfJGJvhLeVx+7Sl+x+71hNz53GXgec:S3fYw+7A7EeROEWAzSrC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706450, "uuid": "c70ca54d-8855-49dd-b254-0d36ad02bc55", "value": 7806464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706450, "uuid": "8ba2e242-c3ac-4cd6-94ba-1434eaa183db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706450, "uuid": "482479db-4b5d-4fe3-a19f-ed73fe6532b1", "value": "2cc6385122a67770220d1c213a7e81cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f13ca24-af8d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676725670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676725670, "uuid": "4ee5dc9f-620c-463c-931b-214cd7fc55b9", "comment": "Malware payload (RedLineStealer)", "value": "546ffd390789a92e9d11490f2dc5d737", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676725670, "uuid": "dcfc2c58-6c4f-4f34-a6ec-3616fce8b6d2", "comment": "Malware payload (RedLineStealer)", "value": "01a26de4b40471ee09819ba41fd5ce7f8d13ed413fa934b3659bb334005c879b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676725670, "uuid": "953807fa-7f1e-470a-9877-5285e71cbc36", "comment": "Malware payload (RedLineStealer)", "value": "d63d83db9d180f645ca8c5e3092f53aae37e9aad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676725670, "uuid": "67feda93-1068-4c1e-aa97-5cf4a77a6455", "comment": "Malware payload (RedLineStealer)", "value": "3eebc20886e2507329a9d8d9c6a8e0e5c2cf22b76cac1bd97487daf887aed54c709c7e9a6ef45d822e6f1049e90d459a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676725670, "uuid": "d0ae55fc-2964-4d77-9e48-cb55f5faf8d0", "value": "T1A3F4124BA9E48071D8B2A77019F707D30A3ABE616B78478B264E6C1D4CB3674763173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676725670, "uuid": "b9bafd56-b2fd-45c3-abf1-34180a13653f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676725670, "uuid": "493cd5aa-2466-4dc2-ac27-ae314816724e", "value": "12288:vMrPy90VgLxsIr7vy2330nqJmtMdvkPduhlknlirnVYM0Nut792sndBszw02QTWY:8yL+S7JHmtMmYknvM0Nub2y02MWY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676725670, "uuid": "9ce314f9-26ce-46db-887e-fe59b9c365bf", "value": 765440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676725670, "uuid": "db097055-134c-4e9d-9c24-e2998942edbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676725670, "uuid": "5dd5bda1-4bce-4485-b395-db1c7687e8e2", "value": "546ffd390789a92e9d11490f2dc5d737.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8763a1d-af66-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676709123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709123, "uuid": "28b1cdd0-4d46-408f-9a6c-f81e080eaa06", "comment": "Malware payload (RedLineStealer)", "value": "b6f08bef9043fe15f76007433cb194b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709123, "uuid": "d43b4b05-60ee-4a33-89fd-30cf46b0fe04", "comment": "Malware payload (RedLineStealer)", "value": "01a4d474bb873397b572bcb6babf556a2b00c866424acd92f9eb478b46e42112", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709123, "uuid": "7a1d56e5-4d9d-4085-82c4-44f6ee7e6d2b", "comment": "Malware payload (RedLineStealer)", "value": "6e992ebe23d31af196927f1591fedce99691b612", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709123, "uuid": "fc90b519-8ac8-43de-ac82-a9634a402a70", "comment": "Malware payload (RedLineStealer)", "value": "4bb3b432fc5eb5bba2f496c2f265f07d00b3eddec8900682c14ad8e57bdb588091a0f37535a2180d50d3559cfca1abbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709123, "uuid": "64e71870-dbc3-4a29-872f-976ab8ad39de", "value": "T108B4020BB6EC8527E4B45B7059F642C31A32BD602E39879F234FAC991C726617235737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709123, "uuid": "3e74ad7a-3906-401a-ba6e-38961e301fd7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709123, "uuid": "a7da2b60-95ab-4189-89e5-96b976076d0a", "value": "12288:BMrgy90+yhXZaiKZj+fOAOtNTQ7cQPcX/Iw6Aj:VyMxdNOnTQ73Po/Iwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676709123, "uuid": "5a503f1d-4092-48f9-a540-448a5f81701e", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676709123, "uuid": "924c9a54-ed5f-4320-98e7-372aaab64896", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709123, "uuid": "76a9daa8-cc97-404c-98ef-da9a274d0b3b", "value": "b6f08bef9043fe15f76007433cb194b3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93aea162-af69-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1676710350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710350, "uuid": "869bcb72-ce95-43e8-beb4-a63b550b4efa", "comment": "Malware payload (NanoCore)", "value": "0c7c570656c8d2e747654bab956fc616", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710350, "uuid": "5a0dc325-1187-4ba7-94b9-b7b05540648a", "comment": "Malware payload (NanoCore)", "value": "0237f0e94e8125c80b2792a8adae0644a44ee71408fb122f599fe99d2b03d869", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710350, "uuid": "03550f75-f138-42fe-94e3-ca3dc2967f53", "comment": "Malware payload (NanoCore)", "value": "b3f74edc206d163abc33584bde97b1c579e415a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710350, "uuid": "b3ea5b0e-665c-439f-8b22-bdcd5ff1847e", "comment": "Malware payload (NanoCore)", "value": "80afe77ce09534336c026f47e21748c08e716ad0c28e031fc2e99666d9a76a7b0a95bc5542f1b347d98f7f62369bb805", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710350, "uuid": "4454975d-ca58-4e83-834d-5844324543c0", "value": "T1D9F49C8C91F2EA3ECB098EB9371035081FE055437924D9E6E3E5FAC22F36523599D936", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710350, "uuid": "a261ada1-ec99-43db-ba55-27e759751914", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710350, "uuid": "7f692ab6-c3d4-46bd-984d-9349aef76634", "value": "12288:DsQRqDSu+Dsv9tqqAPLyyYV0JqI8psV3T7VVQoKzUZT98/k57lR7UtbWX7L5GgoO:DsQRqDSuDEIgqpsVnIET90c7fUtqX7g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676710350, "uuid": "1ae94067-3083-471e-84a1-7519e5c04dd8", "value": 744960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676710350, "uuid": "700d2d2c-b89f-4c74-a402-172f7a119e01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710350, "uuid": "4bfb9ae0-d368-4c7c-ad8e-01b89040584a", "value": "0c7c570656c8d2e747654bab956fc616.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87ba1e88-af64-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708182, "uuid": "1b32c46a-3210-47be-9d1a-84312585190b", "comment": "Malware payload (RedLineStealer)", "value": "202afb4c56653ee68b64b82114e4f475", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708182, "uuid": "d30c6dde-8cd4-4881-92a0-e178f8f57e01", "comment": "Malware payload (RedLineStealer)", "value": "02c9140d44e72395c362e1f27d3906a5da4cafbca0b4af0ac9cf588cfa0907ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708182, "uuid": "ad510fc9-50e3-40c4-876a-59e8540ef4c3", "comment": "Malware payload (RedLineStealer)", "value": "d57123448e64a55eea99c4e29fca7135ce75129e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708182, "uuid": "46923638-a84d-4ce2-9eb4-50150cfb3445", "comment": "Malware payload (RedLineStealer)", "value": "fec4c8e6c6091b9cc2624fd95396edbc1a16e29ac40d9e865c847d7acdbc5b59f2c5e01a73e643ee43035219b4203615", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708182, "uuid": "9884dae4-4665-4c70-b909-105cf21b9be0", "value": "T10AB40107B3EC8472D865AB7009F307D31936BD616F78824B624F6C4E5872A74A63137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708182, "uuid": "1460d211-807c-4e8f-a9b7-a115aaab3211", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708182, "uuid": "aefc307b-64b5-45bc-9f03-80ab4d545437", "value": "12288:XMrcy90HLtV6e1yQhd5/JzR57FgZJMhpn:DyQxVnXdjFp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708182, "uuid": "117b1df0-f4de-4f74-ad17-9d3e71c1ae77", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708182, "uuid": "797e1620-8771-4563-b311-0ce4c469997a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708182, "uuid": "5185a17a-e066-4cf6-89bd-cbbecd171192", "value": "202afb4c56653ee68b64b82114e4f475.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2bc73b3-af63-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676707905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707905, "uuid": "0592c9e7-9188-49d4-b8f8-41157c08addf", "comment": "Malware payload (Amadey)", "value": "6c9c85aca6dc77d9c970293a25d74010", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707905, "uuid": "14880587-ba3a-4329-91db-0f62ecd1a2a8", "comment": "Malware payload (Amadey)", "value": "032d9807add535d0b07987da3a34a2849eec683b255f99e7c8de1935c3f40489", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707905, "uuid": "378045ee-777f-4af8-a013-1bfb1efba7b0", "comment": "Malware payload (Amadey)", "value": "ba922b834074c572a9636feb1f599d237a75a6f9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707905, "uuid": "3374623e-15a5-4645-8013-ffd01a3ee444", "comment": "Malware payload (Amadey)", "value": "bb3e9562b8618a49da98a21493bfeeddda28494ac8fc5333f7273e761bf8fdc9f19ec76e72a910f9650704e8a8032715", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707905, "uuid": "a1771a29-32f3-4fcf-906e-c7b7ecd963bf", "value": "T1DBE5330BF6CC8003E6F5AB3009FB07D219357DA34B7C45962B8AA95A18B1635B5363DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707905, "uuid": "9f21fb3f-338e-4243-905a-29d774cc2ba1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707905, "uuid": "706e6788-6afb-4059-9237-3ad090a35d63", "value": "49152:9brDsLj1J7BlpQm4JTn1QwXvC5o/JX4wQerF2LcIoSLEbQbd+rwVMGp2v:MzBP4JzGwXvgQXF7rF67EQb4wVMGwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676707905, "uuid": "73f4203c-3d7b-4e67-8519-d23fd4c5326b", "value": 3112448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676707905, "uuid": "bf7639b7-ccbc-48e2-ad5c-f7b9fe4a724c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707905, "uuid": "fe34d783-3df1-497c-b7e2-30186b8eb157", "value": "6c9c85aca6dc77d9c970293a25d74010.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bb53000-af60-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676706364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706364, "uuid": "d14c7142-b6ba-4c62-a6d0-113728689d20", "comment": "Malware payload (SnakeKeylogger)", "value": "61d31218fbba6d9c54870e092250bb84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706364, "uuid": "00116cff-7698-4764-be99-9610bb03d717", "comment": "Malware payload (SnakeKeylogger)", "value": "03372b5bc8f3150c3698ebb6f356c11ffec8e23961e8d32b0c7ccb4ee5742636", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706364, "uuid": "89bb8f9a-a06e-486c-ab59-e0c50a51b0c7", "comment": "Malware payload (SnakeKeylogger)", "value": "cca19b675a2341382754a84a69751d6da6e8f707", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706364, "uuid": "af8774d6-5754-411f-8571-062e1692d855", "comment": "Malware payload (SnakeKeylogger)", "value": "b1da93175eab83ce12586b83c25fa852f7187f6b66326ab891148afd6f91445f2491a85c3530c9ea3c9f4ca00318be6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706364, "uuid": "d7fc311a-1a6e-467e-ae3b-110e3649ebe8", "value": "T1BDF44ACCB1F0F67ECA0ACC75AB102C14ABE0655367168593E267B6D99F3D4638E1C4B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706364, "uuid": "198deaf5-1f45-4099-aa84-e45378e1cab2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706364, "uuid": "6dd6fcc9-2276-4e6c-a5fb-095ddd2b9bb7", "value": "12288:bFhCRqDSuMDsv9teBws48tPSVycPflIwKr2Vji5ElK1Ax7r1PmDsv9tLoiM+KFie:bFkqDSuOB48tQycP9IwKKN0SXX19g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706364, "uuid": "3a1276b5-1e73-4922-9276-a6bdf92772f5", "value": 761344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706364, "uuid": "c4d6fa20-9df5-4373-9e7c-a7c0dddd99e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706364, "uuid": "16641fb8-fd6d-46a6-be63-48bf698c5cd8", "value": "61d31218fbba6d9c54870e092250bb84.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d068ddc5-af63-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676707875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707875, "uuid": "d05fc599-1a84-4d30-8fb2-b48d61388752", "comment": "Malware payload (Amadey)", "value": "015c612976015491634d16a95b87f719", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707875, "uuid": "db710e62-eac9-4487-99e2-b2c3c1d78ee7", "comment": "Malware payload (Amadey)", "value": "03811bd40c1e97ca1e8e3fbe0a93229a8e6749da9ff2c4711c7e53075f99fc14", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707875, "uuid": "327cf948-5184-4b50-9cfe-6dfa824cbcbf", "comment": "Malware payload (Amadey)", "value": "c8562f62fe6453efe9e05cce1466e89459c36b3c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707875, "uuid": "3a004a3d-e5f8-44a8-8188-dcee52e0e270", "comment": "Malware payload (Amadey)", "value": "9398f29feff897b39b50d185ce894798a75baf72effc1cefc1769a478ad8e2e7c569ad70fb81c0ca196b15af2f854161", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707875, "uuid": "2d90d50f-1b2d-474e-9ffa-cd88aa11912d", "value": "T10CE5335BB7D59033D9A8537018B743D70B33BD830A608E972B4E686E6DE12E0A1717F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707875, "uuid": "550d1b86-d081-47dd-a21a-a1a23a44452c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707875, "uuid": "f3911e63-9e81-4690-9505-0da4e70115ec", "value": "49152:Egd+XWqxbi1EdHU8P0m+/Yj/23Q56F02E8xGDnf+YgQrfWl3ehQ2xAx0LHrUYfwt:d04x8P0hAj+3K6AtCz7lOxYcQYYVpOEr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676707875, "uuid": "6acd5196-52e0-496b-8272-8c950dbf6dac", "value": 3102208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676707875, "uuid": "e378b195-d45c-445d-9f87-bc5361ef9e68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707875, "uuid": "5ac666c5-2ef1-4602-a5bc-de0b49ce3deb", "value": "015c612976015491634d16a95b87f719.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "493c2232-af60-11ed-88f6-42010a9c006e", "comment": "Malware payload (Matiex)", "timestamp": 1676706359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706359, "uuid": "a3f03062-294b-4a0f-b578-c9799b23657b", "comment": "Malware payload (Matiex)", "value": "74708639af3add94f159cc14c291f4e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706359, "uuid": "0ad70f74-6835-4fda-bd97-9e70700a517c", "comment": "Malware payload (Matiex)", "value": "060a619222ca31fb3ddc58c9f0faa45e05016d13cd9c32709d55ce5f40e4c621", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706359, "uuid": "6378aeee-241d-41e2-9361-d0211df48063", "comment": "Malware payload (Matiex)", "value": "d988103baf9e95b1b129b6226ca587389ec4bfe6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706359, "uuid": "2f984331-df5f-4838-b6a4-0d9d3c844ba3", "comment": "Malware payload (Matiex)", "value": "f5e39f592f056efc76ea7f4c5506bacbe2590c631fc87d4796815f277a1a0eb56927cd6ef8427915f517bf02646d7d7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706359, "uuid": "bdb82d8a-7444-45ba-a666-cddf4570a071", "value": "T132D40191A32480ECC46BD1B4CA046627DAB3746817783EEF4BA5CE614F23BD5F43EA15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706359, "uuid": "3c47723a-d026-41ca-85e5-cd8708a5f1fd", "value": "755b26ee88bff31382938e00e4a0bfa6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706359, "uuid": "9cfb684a-f35f-4803-a2da-0fc27a15ece5", "value": "12288:aCe8LxGQ7MRSRAsDYeQBWlWc4b70eU06zTwjZ++R5Mi6/ZVgCp0TLAXZoCzZW:aN88Q7aQjDYLWlhW7JUyZ++R5PyZ5pcQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706359, "uuid": "8e40dbe3-4c75-4fe3-b483-0197d927357e", "value": 655540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706359, "uuid": "522417cb-f794-430a-a1ed-6b7703e31e50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706359, "uuid": "105581fe-44fe-4356-9792-c837f1dd03c7", "value": "74708639af3add94f159cc14c291f4e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d5c66d3-af26-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1676681455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676681455, "uuid": "06893caf-e9bf-41d8-abc1-b6a80e84500d", "comment": "Malware payload (DCRat)", "value": "6e43c83495b8c26f904291aa1a5a8ecd", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676681455, "uuid": "f2fd035e-c86e-4821-aa16-a00911a093b5", "comment": "Malware payload (DCRat)", "value": "06d11deaa622fa2963736caf01ffb52f8532fe211e91879905dc5ab5c76a1df2", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676681455, "uuid": "26be7f44-ca7a-42f2-80b3-3a082559dd2b", "comment": "Malware payload (DCRat)", "value": "13e2de4f6f711d7839a53ef32e54a35f5e6f0cff", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676681455, "uuid": "3c9fcd9b-98d5-4b50-b3dc-4f13454c0b7a", "comment": "Malware payload (DCRat)", "value": "15dcfea9ce9b85d6446403d71a6a074cbb709f2b3d7a3a28bfb63f652e791ff77160b2af0602d9eeae21ae277864b2ba", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676681455, "uuid": "80d3938e-58f5-42de-96b2-6d11aeb0692a", "value": "T13B455A027E44CE11F0095233C2EF454887F4A9516AA6E31B7DBA376E59133AB3C4D9EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676681455, "uuid": "d569bd77-3a19-4c0f-a619-ba3a2c400703", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676681455, "uuid": "fef9016e-9b88-4f39-b198-6c095fade66f", "value": "24576:AdFv4AIRyMAlRzUWyPpryc5bIlawDq6AIo5qFX6HrdaYRDZDzF0z85:AvNIIj0WygnaaqNIo5qFX6HrdaKZHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676681455, "uuid": "b9642fba-f6e4-46bc-b477-dfbb733bd615", "value": 1241600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676681455, "uuid": "466135da-4bf5-4ba5-a31d-b41794c93609", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676681455, "uuid": "37106568-cde6-4e8c-8afe-dff80e253697", "value": "6e43c83495b8c26f904291aa1a5a8ecd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90cf38b1-af62-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676707338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707338, "uuid": "4484c0b4-83a2-4c7c-892a-923782dfce99", "comment": "Malware payload (Amadey)", "value": "367d0031023ce2ad5a817fe3fc0e721d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707338, "uuid": "1634183e-455a-46c3-abaa-3ba10062f203", "comment": "Malware payload (Amadey)", "value": "0743170c3740b5e4c2ec73f03d32aacbb6709d990a499eed040205d746687ce9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707338, "uuid": "152ed46e-8967-4ca3-ae9b-d8a7e98864cd", "comment": "Malware payload (Amadey)", "value": "c1c1eb039fade44146d111043178476ee842a5a5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707338, "uuid": "32444192-9ad8-4bef-8f1d-fdb0cd77bc5c", "comment": "Malware payload (Amadey)", "value": "93531d09674a2f81534fcd40cad94d8352dceb14baa9a9d510aa1479425e645de5d2a2fc918b31ea6ec66b394a781f9a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707338, "uuid": "42a2f6bb-3f62-48ab-a530-870f73a7ebd9", "value": "T119E41207E7EC4022E8B4277419F217D30F357DA15B348397278FAE5A18B25A6B63076E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707338, "uuid": "7f56c16f-c0d5-4b1b-a281-84ef72095287", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707338, "uuid": "27b9786f-789e-4b5e-bde7-4445b80ef612", "value": "12288:eMrqy90qIXLV+oif1bX5FucXsGp9kcqovURCvREeeBUqYwP8Zc9D5K+tlxda:wymVZiNDOc8GYacRCvSesUdxwjxo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676707338, "uuid": "307cdd68-2651-484d-8e47-68f019566df3", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676707338, "uuid": "143217b8-b5a0-48d5-8e9b-62a22d599082", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707338, "uuid": "e80efe61-1973-4e7f-8bde-4b0563572816", "value": "367d0031023ce2ad5a817fe3fc0e721d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9eea1ac-af64-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1676708266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708266, "uuid": "cbd26c8b-a3c3-4811-b9c1-8b614d8a14f1", "comment": "Malware payload (RecordBreaker)", "value": "a09cbee32196a5fa2d81e73c6a9b000a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708266, "uuid": "9d48c318-ce61-4425-a58b-fb15436cc65a", "comment": "Malware payload (RecordBreaker)", "value": "075ada37310d3dfc31cce3fabaaaea32e7aa420520ff95fec7ad4e1c36ea3257", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708266, "uuid": "6ee1928e-a51d-409b-877e-0273fac37e07", "comment": "Malware payload (RecordBreaker)", "value": "640119e4fdba50e19ab36a8d880a16bf21582b28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708266, "uuid": "0e771d90-02a6-4751-8658-5d8e905375ec", "comment": "Malware payload (RecordBreaker)", "value": "95838bfce70f88971a8c9eeb0de145bf7516a781a24ed8532c771bb4b8f3f8876d6df5343d1ba67d5b6dfd9d84ad312b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708266, "uuid": "e54863fd-c46f-4a8b-a414-9f46bf3b58ed", "value": "T1A3F3DF2236D1C0B1D467563058A0CFA56F7EBC924974858F3BA8263E6FB03C15A7939F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708266, "uuid": "fa561233-9763-4707-8c88-b6ae7e0db974", "value": "1189c0a2ecbe8fd35560b095ffebf6bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708266, "uuid": "33d8452c-3669-4c02-aa8b-8576e5cffbd7", "value": "3072:R/DfFodu/Baw4N7NECtkDalgHcAFxnNNNkm+tyPjzGXRm2/:NrF4u/cw4NhECuDalg8AFBNNN4oGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708266, "uuid": "9893a7ce-42c7-4bee-b4c2-a1dc87bdfd85", "value": 171008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708266, "uuid": "df5e1438-36fc-4efa-9d75-8d92cfa91e82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708266, "uuid": "adb59926-f0f2-4ae2-9a3d-67afd95b7717", "value": "a09cbee32196a5fa2d81e73c6a9b000a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aeea474-af60-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676706362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706362, "uuid": "d461aed8-5187-43af-841b-d326f1af141e", "comment": "Malware payload (SnakeKeylogger)", "value": "bec9e8f7f058500d5416260c1fb870f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706362, "uuid": "5c02825a-e19a-43ee-9bb8-9b948a75b32d", "comment": "Malware payload (SnakeKeylogger)", "value": "077c21196f9977ccbb68c78ec7c2687bda9b3be0ac0a387080e337d841ee1fac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706362, "uuid": "612ccf88-4902-4424-baf9-f85bb2c9f8af", "comment": "Malware payload (SnakeKeylogger)", "value": "e85ebe8585b62d2fad53f47411941de23532acac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706362, "uuid": "c8e72423-8fe8-45c2-8e7c-66220fea5b15", "comment": "Malware payload (SnakeKeylogger)", "value": "0b98bfa3258f4e9ce38588449059fce1a87f11406f8c16d4ce56c439595883ecba21df51743d2331eee8add2b6281550", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706362, "uuid": "03560354-e9e8-4d89-bf3a-dcfb23e1c3e6", "value": "T1CAF4D33D39B796D2C238FA3386E7E520B5BD89923313C959D9D62AC04F411827DCEA5C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706362, "uuid": "dc293c7a-cb87-433f-9ff2-ac75be626b7e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706362, "uuid": "dd3e5236-14ac-4464-983a-1928f714eb71", "value": "12288:LRBIkegET9jsIBMNjnNNOhAe/S0NVcs8z5x4+1CMhHRF6SeLs7L/CdFFw8Q3:LgTsIBMNjnNNOhAe/S0i4zMhxSEYF63", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706362, "uuid": "430b84de-9486-4e8c-b60d-3e1c434da8bf", "value": 724992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706362, "uuid": "953838a9-115e-4911-9e34-7f5ab1351d5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706362, "uuid": "7d6e8a36-fe33-4e79-8c7c-8a87790e9143", "value": "sales contract-876 & New-Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c8e9fe3-af63-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676707573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707573, "uuid": "72712144-2496-45e2-be13-92755eaf0028", "comment": "Malware payload (RedLineStealer)", "value": "3d6aee7bf14e6fc2b2ef40279c9e13e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707573, "uuid": "33e51e41-da0c-4399-a8b4-8507e5bcc57f", "comment": "Malware payload (RedLineStealer)", "value": "07be8ed89e6ea2bd2be78f965e5f76fa1c8458575dadf054646a919efd3ab9bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707573, "uuid": "e99d291a-3e3a-4f41-915e-0978a0f4e482", "comment": "Malware payload (RedLineStealer)", "value": "4abca7b798a9896d32a708469d4b64cfd679a0d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707573, "uuid": "56a69c2c-7613-48aa-a4d1-a8bd624388b5", "comment": "Malware payload (RedLineStealer)", "value": "f7bff52a520a0d87a00dfdb856a3631e4e52923e4a689be3d483aad82e2cc9dee83e9107b3a9ed36d0085a7283c3a30f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707573, "uuid": "5e2f49cc-49c6-4e66-b4a1-8ca55a4dfd88", "value": "T192E4120BBBDC8471E9B5577018F306C31D36BDA16B38825B67CE5C1A08B2274B9357AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707573, "uuid": "0acbe07d-6f46-41e5-bdfe-e581fecd9863", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707573, "uuid": "8f305ff3-e4ed-4692-9c65-04c054154c27", "value": "12288:+Mrzy90rqgvV+V+0Nr5AhFJayqFHPBzapN0ZyGGUGQBf43p03RF:RyLVdTAhFJa/2UEgF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676707573, "uuid": "0422049b-93db-497b-8e7d-7815cc2a4de1", "value": 688128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676707573, "uuid": "4edb0f03-2174-4a3b-a157-94494782c042", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707573, "uuid": "67f9653c-930a-40ce-80c1-c186c9136049", "value": "3d6aee7bf14e6fc2b2ef40279c9e13e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0e4418e-af68-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676709996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709996, "uuid": "1776987a-2203-4289-a2ce-eb9ad93e16d5", "comment": "Malware payload (RedLineStealer)", "value": "304766f61a677814af31d2737d118b6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709996, "uuid": "fd84ed9d-c486-4288-b1ca-f4495e9a05be", "comment": "Malware payload (RedLineStealer)", "value": "07c33396ed7ec1b40808aae921c50c552dc21b08beabbd5541b9fc9f062e08ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709996, "uuid": "5f3748f2-0466-4068-b17b-05346c6579a5", "comment": "Malware payload (RedLineStealer)", "value": "213a7e70d4f7d13e17ddff12152bcfe2c1cc2de4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709996, "uuid": "6142ff93-3126-4ddd-893e-cc01092a6a46", "comment": "Malware payload (RedLineStealer)", "value": "c51f96cb77ce384b90ccf5fbb3e298ebd81a6472a6e8dc609ad3a0872d35af82b07b693063c60339e7d5d2cba44068de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709996, "uuid": "c6a0ecd2-3ff0-49e3-8c89-4413e577df16", "value": "T1D8548D13A6E17C44E9168BB29E1EC7E8761EF5608F49376E32189E7F05B11B2C363750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709996, "uuid": "4c4359aa-e7d7-4575-a160-19b712abcfcc", "value": "84dc6e6219363c02153241783e4708b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709996, "uuid": "3c0e3ef3-da91-40d0-b970-ebcfa106c944", "value": "6144:cFYLOTDDv7lj5VN9maoUvzNMB2ENeOLHi:ciCT5jLnm9Um2Egs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676709996, "uuid": "6c8def6e-4820-468e-a99b-b6ccda81b6d2", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676709996, "uuid": "5bf0aa12-43ce-4b80-bd2e-58dc786bacb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709996, "uuid": "b8265e25-8afc-4f11-b010-e32c8dad212d", "value": "304766f61a677814af31d2737d118b6f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abea0d2f-afe5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Chaos)", "timestamp": 1676763648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676763648, "uuid": "c979490c-1cfb-4601-99eb-7d3185969e10", "comment": "Malware payload (Chaos)", "value": "2c84011564f6e7643f67211f297a8fe0", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676763648, "uuid": "83974158-b3fc-421a-ae22-4a8d410dc38f", "comment": "Malware payload (Chaos)", "value": "083b60f918a3b0310ecb73839bee58607c28b180bbe8140e26ae5426adfcdc10", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676763648, "uuid": "e46969c5-d3d2-41eb-817a-898e6dba4609", "comment": "Malware payload (Chaos)", "value": "7ca6c5c9cc1de70f9934c84bb0c5d5b20a823d96", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676763648, "uuid": "cab28b39-8e74-4c0e-814e-23e31ef32649", "comment": "Malware payload (Chaos)", "value": "332575f86f8efc837eb5e6d4e38253fc06b34c94f4b704c0b7717222cd921b65b2900234e569f21730502eec1caf7f63", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676763648, "uuid": "3b7cbbbe-fa3f-48f7-acfe-90cfe1f7a5e4", "value": "T15A03014AB1767265A04F87AD92AF9E1FC83001F625C86A9F17E003EDCA375CE49731E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676763648, "uuid": "bddc9c63-8fb5-4d99-aeb7-0f0eaead17f5", "value": "768:OpXK8bzIisLJUeQJVoRDkwSJndjnbHHvmnhDRrGQj5yavBDUuiGE:OVKMmeVotWnvo5yavBDDit", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676763648, "uuid": "1961455d-f440-43b8-b696-2d7123d2c34a", "value": 39190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676763648, "uuid": "9fa90ca7-e71f-4522-aa5c-3fd0b84d7189", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676763648, "uuid": "e479e9d3-cb9a-40a4-9d90-1fb4b12a4ca9", "value": "decrypter.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fbf213e-afa1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676734288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676734288, "uuid": "1b1b6064-6ec3-453b-963b-bea2c0cbb8da", "comment": "Malware payload (Amadey)", "value": "b4add64a16988fdaa6858eec6b3b6938", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676734288, "uuid": "985fe5a7-7b1a-420d-a58f-de4d1e03577f", "comment": "Malware payload (Amadey)", "value": "086ba35dc895c0cfdfb6c24e5ba5873e5ceffaaad276624a6857d94837e79f4b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676734288, "uuid": "7e9bb9a5-eb1e-4779-bf3d-553d7621e93e", "comment": "Malware payload (Amadey)", "value": "878ff7c5806e40b23b48b2cab916246bd50d9f24", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676734288, "uuid": "fb89b15e-a7b0-4093-a71d-9b2031f7ba48", "comment": "Malware payload (Amadey)", "value": "a7ebc12d23a17058b905898442360f681bb1807e41d3286854f346e417016db238291382c8c020a55a07f2f8901c6ed7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676734288, "uuid": "006b1f36-ea4f-41af-b674-a069cb4f0674", "value": "T1BAF4124B6BF84463D8A4477018F603C31A36FCA17B749357378EBD5A18B69A1B13632B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676734288, "uuid": "75cb1e71-257d-423e-9dd4-43b7799b6a46", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676734288, "uuid": "69d0ce01-bfea-4bb7-be74-4ae4866e0f1e", "value": "12288:vMrNy90fY19/rOxTn8Y6TCdwobK1sHQAIdnFEwuqKItu:Wy/9/uTnBdwobkAlAnFEnItu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676734288, "uuid": "acc1300d-badd-4460-b694-9d530f459cf6", "value": 765440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676734288, "uuid": "08a89b46-3948-4628-b37f-69cabe522688", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676734288, "uuid": "c341ff0c-767f-4fab-b7ac-1b3b98b24afd", "value": "b4add64a16988fdaa6858eec6b3b6938.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3e7084c-af85-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676722403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722403, "uuid": "06f93285-0d46-4e86-bf30-465d9885c408", "comment": "Malware payload (Amadey)", "value": "6d192d9a125a2cf86141c690b2982404", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722403, "uuid": "789dafb1-5325-4b61-a78a-e8eddb811094", "comment": "Malware payload (Amadey)", "value": "08dadb8116f4424edce0ea7a4ecf45a50f0b7b850184778b3e3b15d360c51226", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722403, "uuid": "a399b62f-7823-4131-baf1-ccf820a57c05", "comment": "Malware payload (Amadey)", "value": "3ad5b898d9d8348c48401d27010e0d1adc4facd9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722403, "uuid": "a2b70977-2a19-414c-be74-e58acd9a98b8", "comment": "Malware payload (Amadey)", "value": "cc562e3dc43f3e4143e8d1715a420c1cb9cafbebf5c0d4b52110f1aa5fe6e0017f773dcc84a06bd5e8a50bdf643a6b00", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722403, "uuid": "3b97943b-8fa7-4687-8cf1-a985c1e032a5", "value": "T1C7F4124773F88126D57A237058F703830676BDA58B788387274EAD1B1DB35A0AA3177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722403, "uuid": "1ea83d9a-175d-48c7-ac6d-28d1855511ec", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722403, "uuid": "77fe7927-49e2-4d32-b6c3-4a078d8ace1c", "value": "12288:YMrQy90ZUaojCuUxdTjCrcUXO+pUs5wRi5GYUnsa4erMSGDXdR0if29rbo1mplIB:4yN3jRUL4cU7h5v5GYUnocGDQieZbo4a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676722403, "uuid": "51e1536c-d230-40e8-8ca2-43e3762f4549", "value": 762368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676722403, "uuid": "c46a7438-cef0-4ffc-a54e-075535649562", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722403, "uuid": "0834cc69-da5e-461d-945a-026f8ff083e3", "value": "6d192d9a125a2cf86141c690b2982404.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97bf32bb-af64-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708209, "uuid": "01a49916-0dc3-4dcc-b1cb-238556e081ec", "comment": "Malware payload (RedLineStealer)", "value": "a14f4ceb282025cd5cf47a2ed69a9a8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708209, "uuid": "69a8508a-f36e-43b8-bf64-83fd11d7deda", "comment": "Malware payload (RedLineStealer)", "value": "0a3bb7735890f9894feb2f20e3bf06e6d877c5ecda7a2a74cea1f553da5edddd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708209, "uuid": "585f432a-1810-4fb2-89f0-662219caa615", "comment": "Malware payload (RedLineStealer)", "value": "652e27b8ef13f43d11655d306b9cc5b31b7e720c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708209, "uuid": "340b3841-cbc7-48f0-8c16-40a68b2b65ba", "comment": "Malware payload (RedLineStealer)", "value": "859686416aa9743cce9c3812127cffa9cc235f7d970e03c2daec9dee8041cae3b5c69a11426757d98fd66dae4f8664db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708209, "uuid": "7c95ad1a-5fcf-4c94-83e4-5acb51379bab", "value": "T16BE41247AAEC8026ECB5577025F103C31A36BE525B78839B174E9E1A1D325F4BE3436B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708209, "uuid": "a33c6fcc-9a80-4297-baa5-85a35bcd320e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708209, "uuid": "f5dc99ee-34fd-49b0-9052-f191fde79ab1", "value": "12288:FMr6y90keQ42zcU4NyFiJn/NpXBppsSDcCovjhqEBktJHpt5LkReFQatZYb:ry8ezE+A/PB4SDlovwEmLVPYb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708209, "uuid": "42373b74-2a75-44d9-b87c-9f45fc02c79c", "value": 676352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708209, "uuid": "f04b8b08-bc49-425a-9580-e23589d45d1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708209, "uuid": "1e8b0ac4-9492-4350-9edf-f4c5dbd866b1", "value": "a14f4ceb282025cd5cf47a2ed69a9a8e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f202ec5-af60-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676706423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706423, "uuid": "4f405e2d-b6fe-4c94-90a9-f03e47198bc8", "comment": "Malware payload (SnakeKeylogger)", "value": "61b7f3aa658a127e9eb1836399206474", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706423, "uuid": "27fe404e-5473-434f-a3ef-7728debfc252", "comment": "Malware payload (SnakeKeylogger)", "value": "0a4d53501c98cc42bae624aad84c7344d6012942a7147d73cbdeaadd7a0b4458", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706423, "uuid": "23901378-078d-40e0-b0b7-7a7ad785742a", "comment": "Malware payload (SnakeKeylogger)", "value": "1183faaabd03f69f327f1140614a6e6e5bcdc3f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706423, "uuid": "93709745-e564-4b1d-9cc8-3ca92fdfa252", "comment": "Malware payload (SnakeKeylogger)", "value": "4cde0cd62ab2a70511ab7f2bb6dfb2cd8c508e9cd2f851ddf16f19652a46cd57a3375f6f2d4cbbe2471862bce950cd33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706423, "uuid": "a4301bc8-e6bc-471e-9908-d72bc78ca623", "value": "T1B2154CC9E0F0DD7ED95B4DF17F26742015E26E4A6464811C9399FB962BB3303209EE2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706423, "uuid": "664bc9e5-d6db-4de2-8962-60a8a43f2d64", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706423, "uuid": "3608fe9d-92ca-48a8-8844-3ed49aa592f3", "value": "12288:OLKWqDSu3Dsv9tLExHUiMvA4PGkwhPSf7JA3y1bOqL334nDsv9t:O2WqDSu0rOku3MR4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706423, "uuid": "5f5bc6e4-e9d0-4245-9755-4216cd800055", "value": 951296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706423, "uuid": "0bfc4351-ed57-4ea9-b9d5-d4bf59e323c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706423, "uuid": "893261e4-cbfb-4da7-9627-2430d1ad2190", "value": "12220173387_20230207_13363111_Hesap0zeti.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43bd902b-af65-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708498, "uuid": "52a517fd-0cf7-40c9-bad5-6bb0fcc5530a", "comment": "Malware payload (RedLineStealer)", "value": "b715cb4f1db49883000a06f7ef4d5050", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708498, "uuid": "9d0d26a1-27c2-4bd1-849b-b787a0b6f9bc", "comment": "Malware payload (RedLineStealer)", "value": "0d9f8f4fb079a2ee381ff6b64bd93426dbeb03f935781099e58fa6516d788552", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708498, "uuid": "6c3d7bf8-f525-4006-815f-95d0c128d61c", "comment": "Malware payload (RedLineStealer)", "value": "783ce81bccaf85b9676bad4dde3b7ffeb35e9a29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708498, "uuid": "3ab0d34c-aa33-406e-8eb2-8de664f1ece7", "comment": "Malware payload (RedLineStealer)", "value": "d9916159071088a4fe943eeb9fa14eb60ec3af8cc219c9c820102fad9d415c5c7b60c0e8247828435eea9047048d73c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708498, "uuid": "df5fff61-b2eb-4685-bc3d-1ff3793a2178", "value": "T172440122BAE080B7D063A7306C70D6A1777B3A4055B48D8B775C126E5FB12D35F7A32A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708498, "uuid": "668844e2-bc51-408d-961f-80b37ff46e59", "value": "5d842fb7215bce40485e598d67956fa7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708498, "uuid": "82d3824a-48ad-4020-869f-8c915142097a", "value": "6144:zyn6NAdwT8kYIeLdC+OCQ9DwMvokU2JNcgsd:zysewxVeLk+OxF4gs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708498, "uuid": "9a0e99cf-f0cc-423a-b413-21d092d4b9dd", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708498, "uuid": "a02e8d45-b87c-452c-b4e7-1c647b67dbdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708498, "uuid": "85856b47-9d3d-422d-888f-052a37d0d1f1", "value": "b715cb4f1db49883000a06f7ef4d5050.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3ee1083-af5e-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1676705760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676705760, "uuid": "abc4e5ea-e51d-4ace-89aa-acc6ba1921b7", "comment": "Malware payload (LaplasClipper)", "value": "ab5d84ac38cd7fa6d8fe653bc7085288", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676705760, "uuid": "1f25ab3b-9428-45a4-ae08-d0115579aec9", "comment": "Malware payload (LaplasClipper)", "value": "0f6a9e4953f9647ca2bf29229321c7516420287191952c5df04ea71ec254e6b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676705760, "uuid": "189a9a83-6ffa-4b3a-95c0-5ccaa0707574", "comment": "Malware payload (LaplasClipper)", "value": "d4ee9075455d99e86612d394c0ecd0fc30fe378a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676705760, "uuid": "62b8eef2-530b-4bc3-af35-0064517dc9f0", "comment": "Malware payload (LaplasClipper)", "value": "84ef77be4f688641da8944b4bed98ff94bd8868f6ff27e5588c616165fa9952c79a9cf5da424bef77c6cc27d0767809c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676705760, "uuid": "34a15998-edcf-41fc-9082-855826710cf0", "value": "T168762377526800C4D1E9C83D843BAEE035F60F2A4B81AC3DB5EA7EC525B75D8FA13586", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676705760, "uuid": "6a5e1348-2f54-429b-9e83-8c36124022a8", "value": "560f5833a24923f2c6cd395059c32581", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676705760, "uuid": "0ca75f9d-1f6f-4bf9-a044-b7a068cbed7f", "value": "98304:W9OvwJ/9ZGRS0tyhPOiD+yqCbKywZ3JnZXw09TTKvuLT16yUaKseXEvg7ZwRZN:QOvoORDUAC+M+yM3dtZMIrbe0oVw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676705760, "uuid": "9263aa97-478e-4406-9363-2a0ded14fd69", "value": 7167488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676705760, "uuid": "b2beba54-c194-496b-bf95-fbf41502c8bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676705760, "uuid": "eaa29f2e-eb3b-4582-956d-770bbcaf4844", "value": "ab5d84ac38cd7fa6d8fe653bc7085288.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75063e0f-af62-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676707292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707292, "uuid": "ce345315-c315-43d1-9e6e-3f0d7d6df176", "comment": "Malware payload (RedLineStealer)", "value": "0a91a116decf3305084283a8a19b9773", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707292, "uuid": "167aa479-e633-448b-96a9-8719928d1a41", "comment": "Malware payload (RedLineStealer)", "value": "0fbf30a303e5f6c3012bb587ca39884396e97f5aa451a60d119fffe8279c8949", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707292, "uuid": "71977efb-d75f-4ce9-a297-aee50203bfe2", "comment": "Malware payload (RedLineStealer)", "value": "f8f4af96d93e738694a32519621f487b5a6f1037", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707292, "uuid": "539a38ec-245f-4094-8c5e-97376ec6295b", "comment": "Malware payload (RedLineStealer)", "value": "7083fd592e6cfe0afd2c93b76af3c2d76afc66c3c12ae6669c4e06c54a7b2daf148a90b7c6158892df49cf31f306196f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707292, "uuid": "3fed631b-a73d-4705-9684-159401522090", "value": "T163B40207FBF98432E9B2677019F302D31A36BE511B78839B174AAC5E18B2174B53076B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707292, "uuid": "8e32c1c7-34ec-4aea-bded-390df18669d7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707292, "uuid": "b1ecca8d-7aee-4f3f-814f-c9965056039a", "value": "12288:TMr9y90OrfJsyM4D3+8zl+NFZyhR1qq1OG:ayTLA4z+8p1J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676707292, "uuid": "03f93c67-482d-4725-bf98-8f8f6bcff1c0", "value": 539136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676707292, "uuid": "8acb1a71-377a-4ac2-9dc8-27fbf0a4ae3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707292, "uuid": "602def3d-cec3-4358-8fa3-79b87fe23fee", "value": "0a91a116decf3305084283a8a19b9773.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10fd9801-af67-11ed-88f6-42010a9c006e", "comment": "Malware payload (Cutwail)", "timestamp": 1676709271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709271, "uuid": "a8fc53d2-31ea-4d79-8c32-e5eb99564070", "comment": "Malware payload (Cutwail)", "value": "a0114856020c2a20c6c85a7db2027b03", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Cutwail", "colour": "#ED0EDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709271, "uuid": "e3268fef-ca44-4c6d-8457-7cf5d997573c", "comment": "Malware payload (Cutwail)", "value": "0fc239eef963bdc00f2df0e9b581c68925b86e28de511ad12efb881ce2b1cf23", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Cutwail", "colour": "#ED0EDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709271, "uuid": "d9404ff7-6892-4e69-b863-6f879a81d63c", "comment": "Malware payload (Cutwail)", "value": "83dd0f53b4fd0d479f98a80e13cfb992e8237014", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Cutwail", "colour": "#ED0EDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709271, "uuid": "80f70f0f-2f6a-4e7c-8195-d3242f9e8ae2", "comment": "Malware payload (Cutwail)", "value": "9a3ffa20955f9c8a0b12a6ae8495dc21be50cf88f3e07df6636b10a1de658264aafde2efac9807da8dc756b9fa54fa66", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Cutwail", "colour": "#ED0EDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709271, "uuid": "87bf394f-dd3a-4c92-bf6c-bfbc4412a742", "value": "T1ECA4B015F9528CF2C52306724D6CF359A6ED7A100B27C77BB3E0CB2D6E641A09E2D726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709271, "uuid": "fc6910f8-0720-4414-aa04-9a18003d6ca4", "value": "2ed707fecbbe3f29fb405542a2407882", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709271, "uuid": "91c9a936-03be-4291-a172-a19e710ed64b", "value": "12288:UAmCYO5f9gYH6O5cr+rn6uMkvWhYvD+0sP:UAmCYOReYH6NCrn6uB40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676709271, "uuid": "c36efe07-f043-4859-9e9d-37f2b6d32084", "value": 459264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676709271, "uuid": "46cadb31-8f61-478f-aa17-95a59b75a67e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709271, "uuid": "d011ef7f-b98b-4e67-b519-82f0431d34fb", "value": "a0114856020c2a20c6c85a7db2027b03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd83ff1a-afc8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1676751222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676751222, "uuid": "d1f8d001-06cb-4e01-8fe9-181a028ecab6", "comment": "Malware payload (Gozi)", "value": "ae3d7de4671718a92cdceae507d9c5e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676751222, "uuid": "61a937ba-b403-4a96-8245-1db1d84293a8", "comment": "Malware payload (Gozi)", "value": "1056ea3dad265dd554362bc0bd67f08fa2b9f3e5839e6e4fb197831a15c8acef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676751222, "uuid": "a3b84ef5-9107-40fa-86c5-f839757ef5a3", "comment": "Malware payload (Gozi)", "value": "1bc85809ddd4411897232c691a2c866f5db67175", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676751222, "uuid": "2a1da8d7-aa59-4dab-804f-39f6e18c4e86", "comment": "Malware payload (Gozi)", "value": "02f6b60a9e83afad8c461b5989e49b65b6f6528bc44ba081011a097b691eb8123d2ac4d8dd05b280722e3a8aa16e1e7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676751222, "uuid": "c82a3e0c-b5fe-4044-bee0-e959603a063a", "value": "T12B03D0AA6BA048B6C6D39335362966C4DF481732423558E0E7B749398B92C8FD56F313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676751222, "uuid": "31ad4df8-1860-4501-a8e2-7c586d137da3", "value": "1640d668d1471f340cbe565fe63522f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676751222, "uuid": "b83857f4-f278-42b0-905a-d8a9e7393435", "value": "768:eQLm41fM01vAPyRPq63goMWPXE2bE/JVMq2LATqeeAeOu2D2wqmLiuMPc:eL41fMSvGAPqlaPGhVMq2LpeReOb2Pmi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676751222, "uuid": "7819a08c-ded2-4086-af4b-16f385861b3c", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676751222, "uuid": "e9b46808-75d6-470b-9e80-6cf3e1c18eff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676751222, "uuid": "fa1dd4cd-41be-482c-a5b6-367483f72894", "value": "d2ef5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7618c1ef-af69-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676710300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710300, "uuid": "2553ac45-d839-4405-ad2c-0391434e7ab4", "comment": "Malware payload (SnakeKeylogger)", "value": "4ebda1ca3658a3741c79d040b24a0639", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710300, "uuid": "246abae8-05e7-40aa-9b64-3a6251aebf13", "comment": "Malware payload (SnakeKeylogger)", "value": "111fa339c4b6d5e0e08f4f51acfa1fc0a9a2b70f1ba3bedfbda1af5a3d030060", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710300, "uuid": "c8d0280e-af33-4244-9fb1-00454544df16", "comment": "Malware payload (SnakeKeylogger)", "value": "cbe3e0f2babf45e5c0c3256802ca727899284063", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710300, "uuid": "1472e9c4-ac7e-4c1b-9517-a87c0df1c203", "comment": "Malware payload (SnakeKeylogger)", "value": "c62309358395bb41a07b9ad75f338ea3b5c2884a436d0553d2ea38cc235e5d20e2f840d8b365a004310c03bd95c61fc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710300, "uuid": "d02c62ea-0ba2-4acf-9839-d5155844f181", "value": "T147E47B8C85F1EA3EEA898DBD271436081FE05A432B32C9F5E3E5FAC11B36263495D535", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710300, "uuid": "a246cdbb-4b3d-4547-93af-fdcb510bf0d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710300, "uuid": "a3e2dff0-e374-4b30-9f89-4131f718c37b", "value": "12288:YqzGP+XWLxftShkbS48+tYcnOcYMP+BPS80eHVYzQqDSugDs+9t:PGLxf6E6LcnxpYWQqDSu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676710300, "uuid": "ebf53450-65c6-4f41-a293-2dd36e0fff24", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676710300, "uuid": "6fdb2897-016d-4564-9eb5-29bb2dc57ca9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710300, "uuid": "d0372543-1daa-4229-9e07-3b915ec95a47", "value": "4ebda1ca3658a3741c79d040b24a0639.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc07a284-af92-11ed-88f6-42010a9c006e", "comment": "Malware payload (BumbleBee)", "timestamp": 1676728134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676728134, "uuid": "a452b98e-060d-41ad-8d8d-9b47162a367c", "comment": "Malware payload (BumbleBee)", "value": "016eae588e2e565414259280ba4f6753", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676728134, "uuid": "08ddbb18-e66f-41fe-a261-b61dc7253a55", "comment": "Malware payload (BumbleBee)", "value": "127b3506b7da4569cbdf23bb500bb95832e1a8d4fcec5e2ce6ec9e0c973ba36b", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676728134, "uuid": "6c184732-33d6-44d8-b858-1781c9aff93c", "comment": "Malware payload (BumbleBee)", "value": "6983820a0d115bb78290ce9fbd6543623281d3d1", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676728134, "uuid": "b88fcf67-8e43-4f60-8bd0-d2ba4c3b5d57", "comment": "Malware payload (BumbleBee)", "value": "b03d82ace0b59d3851a06474a38801dc11be097eea96d608a655a4f71624b50b56eec47925deae7cbb371ff62b259be3", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676728134, "uuid": "66b4fcf1-09a6-4347-8d2c-cfb1a4bc59f7", "value": "T163B5E103B66E077BC0369B3688E706C2EB7072A3E713476B0295912D3D973916E67739", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676728134, "uuid": "7bb57f97-d8c8-4629-9bba-12a1b12c9d2a", "value": "24576:MgqqFfeeOby7LSjsfIMLkC8Jsc0Q+8VC7skZ:+qFVLIsActoC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676728134, "uuid": "60bac80c-3445-4362-8b9d-fea34bfe5200", "value": 2293760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676728134, "uuid": "7d16b072-f898-4dd3-b18d-0ffcdd485a44", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676728134, "uuid": "011df72d-cd86-4d55-8f93-2aa11cb0da10", "value": "Required Documents.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7266f7e-af63-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676707886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707886, "uuid": "a447dcd8-ff33-4068-8612-c40a8b7680fa", "comment": "Malware payload (RedLineStealer)", "value": "b7efa58f4bdc8c4dddf5bb13c23168a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707886, "uuid": "a952731a-f340-4b4f-9fdc-1411dc829035", "comment": "Malware payload (RedLineStealer)", "value": "12e1e5a600dc66a27735b9f9e83866740596296a4e1417522d5b6f6a97e5c260", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707886, "uuid": "4a9ba7bb-9690-459e-8dd4-786b371ffee3", "comment": "Malware payload (RedLineStealer)", "value": "17be5394142aa442112d23fea4d23c3163ab2558", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707886, "uuid": "aacb0833-25f5-4e70-9f3a-171c761b6d99", "comment": "Malware payload (RedLineStealer)", "value": "2e8548029e305128b471603b24c4d358de6398eefe96c04514a90c73ce0448046112ae1ed800cb58e3284836fae2839f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707886, "uuid": "1d8c51aa-7a88-4572-9046-f0afc62ee28e", "value": "T13FB4121BB7FA9026E8B50B3409F603D316357EA15B38878B239F6D5B08725B0B53536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707886, "uuid": "1c4cd95e-bae7-44ae-ae32-02d8ccf75606", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707886, "uuid": "be1d6a7f-e9a1-4c0d-9589-06b9563a4012", "value": "12288:DMrQy90GXWV9LV8qMdSi9GSdqL5zAp86IcP4Rw:fyvGVgqM5wSdq1Ai6zQ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676707886, "uuid": "0201f2a9-84b1-48c1-a8d6-eb2cae67477a", "value": 539136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676707886, "uuid": "2b136a49-20c7-4127-9b28-80c3e2635143", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707886, "uuid": "f345ddbf-08fa-43dd-bf5d-fafccd38e889", "value": "b7efa58f4bdc8c4dddf5bb13c23168a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a971df5-af69-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676710334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710334, "uuid": "66442091-cbeb-4b85-9dda-86d8d5e22eb6", "comment": "Malware payload (RedLineStealer)", "value": "32c8b3b5e43f7f5899f1f3c275cbdce1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710334, "uuid": "1fc3b64b-81f5-4945-be8e-93598ac9f62a", "comment": "Malware payload (RedLineStealer)", "value": "1354fea783bfe2d72267bb11cd26ddd9850b93ad93592d9b8e48eb072cfdfc68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710334, "uuid": "42cd1c4f-5afe-4d60-979d-724fa74845c2", "comment": "Malware payload (RedLineStealer)", "value": "76fbc6dd6393febe80fc382f9de49eb5941dc3bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710334, "uuid": "5f2a69a9-db07-4863-9fe7-a5951fc19af1", "comment": "Malware payload (RedLineStealer)", "value": "20d125321df158fe3047b42e04ea0c466a0fd0c2394e8836b29d36ce5885f3beffedb1d9bd38113fca29ac419813364c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710334, "uuid": "e3557c46-2793-4aa8-aad1-a147b522cde7", "value": "T10C64F11333D09475F11741358E25D6E5AB6FF8705E76AABF378A452F8E70292CB12312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710334, "uuid": "590a09f0-4306-44d7-85bf-b84bfce05e71", "value": "29a62d14d89b432fd6115525abce5c2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710334, "uuid": "8f2782a7-bff7-493f-b9ef-d99cca83d46a", "value": "6144:j74d0qHFE2y1MPE2+XfKZwFMHhJglGgvn+kEhF3DalPcSSOS:34l+1MPKXeYlpn+bDavSF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676710334, "uuid": "0ac57025-c6f0-412b-a67d-bc3576764db4", "value": 324096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676710334, "uuid": "0937c421-cabb-49ef-8a9e-45165ed7e008", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710334, "uuid": "021852d4-0443-4988-b367-74d9a42b04fb", "value": "32c8b3b5e43f7f5899f1f3c275cbdce1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "988cc9f9-af69-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1676710358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710358, "uuid": "ba0f8563-b620-4278-83ca-eb557175589e", "comment": "Malware payload (NanoCore)", "value": "8bdc506774385fd7ccbc7ae9f57820b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710358, "uuid": "1af0f49e-fbfe-472c-a28d-7679a6636ced", "comment": "Malware payload (NanoCore)", "value": "1382324ab20ed1f623fff0f54f292ec594bae43a34be12336604ab2937a63eaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710358, "uuid": "13ae8e3e-323e-47a7-bfa6-a50c3c20bc0d", "comment": "Malware payload (NanoCore)", "value": "de39e38a19446df028de804a3b20052ed2370436", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710358, "uuid": "93a7b0dd-62af-4cd2-bf58-14539e43784e", "comment": "Malware payload (NanoCore)", "value": "910f776a80d5a164d512911cef6c942041940f95eef58ab92792f2feb98ac87f18c374d9c156f172b912faf2d8dff27c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710358, "uuid": "fbe55e40-7fbc-4c7f-8c7e-6b578a0e9fd2", "value": "T155F48D9C90F0FB3ED9498EB9731036481BF092033935D6E9CBA5F2C51B36763199DA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710358, "uuid": "ae84347c-4914-4288-9ebe-f815d18b0f7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710358, "uuid": "2a60c03e-f8d2-45f6-a8b4-6d1c4abdf27d", "value": "12288:RTLWtYqDSuMZJufomsnM/GNUzmBFJ32ckFDFBBJqgXrfk1TkR:dLWtYqDSua4fDsM/BygRNqe8Zk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676710358, "uuid": "ceef0e5e-c6d5-4d7d-9d9f-f6c6e365255f", "value": 744960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676710358, "uuid": "726ea8ec-48f1-4222-a165-0bbb6ad01cbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710358, "uuid": "5f218662-c7d9-49f3-ad14-e80bc3d129ea", "value": "8bdc506774385fd7ccbc7ae9f57820b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fe4cb3e-af69-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptOne)", "timestamp": 1676710370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710370, "uuid": "19d4e528-e6dc-463e-9b41-3c69cc4239fd", "comment": "Malware payload (CryptOne)", "value": "29618b7daa233420c4926adfe02cc3ac", "object_relation": "md5", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710370, "uuid": "74f3639c-7fa7-45d3-a0a8-d8dd9cf8d516", "comment": "Malware payload (CryptOne)", "value": "13e6ae249a601d6f82d5b37637604ce493868093d246e7f0c5b166b3dc3238a1", "object_relation": "sha256", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710370, "uuid": "f7a54830-16c9-47c0-ac35-a379c86f6a29", "comment": "Malware payload (CryptOne)", "value": "2126a85ff74ed33e4320e1c3dd8bbe05047bf6a7", "object_relation": "sha1", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710370, "uuid": "38a5506c-3fa7-4b58-be69-53dd1bb27e57", "comment": "Malware payload (CryptOne)", "value": "049e9e0b1fb079d74e916ab9114995aab9bba9855e1b6ad97bcf753ad3c97e7148eb027f2a20b96d692e01e00753f8b6", "object_relation": "sha3-384", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710370, "uuid": "6d770cb1-c39e-4933-aced-e1032089b1cc", "value": "T1285512117AC0C4B0D57608391AF5AB706B3D7D312B268EDB63846B2EAF305D0DA35767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710370, "uuid": "c5dfc940-78c8-41ee-82a6-71b9513c46d4", "value": "91e96141ed5dbe3bc541c8aad7ff3c38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710370, "uuid": "4eec5778-f0f4-4716-bb70-13bc750d6840", "value": "24576:JLllLl7tEt175wHYWv73F8+pywy0Zw7aOGRyAANkgp4Tk6VcgDpJuPFm:hllL8Z5WpzyzfG3g5Q1J+c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676710370, "uuid": "886efdd7-98e9-4a3c-a970-24ec7074702d", "value": 1369418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676710370, "uuid": "9ae98400-5062-4f9c-bfe3-52520fcc3d80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710370, "uuid": "4de60333-0f69-47c3-92d0-9af111e90c90", "value": "29618b7daa233420c4926adfe02cc3ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95c4e922-afa9-11ed-88f6-42010a9c006e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1676737841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676737841, "uuid": "677d1adc-7095-477c-9d71-f0f0ab11457c", "comment": "Malware payload (QuasarRAT)", "value": "f5ad2a45442c0028f4268c72e21e2035", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676737841, "uuid": "8d3abec0-c672-4ae0-8756-4ab2ecd54047", "comment": "Malware payload (QuasarRAT)", "value": "141056b82cd0a20495822cd2bcd5fae5c989c6d24dac5a5e3c3916f1b406bdb9", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676737841, "uuid": "cb481069-18ea-4f83-bc68-bc9917ee479f", "comment": "Malware payload (QuasarRAT)", "value": "1edc22b76db0a40f9267a10ab3805bc4955e86b4", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676737841, "uuid": "9d3e90d0-84c3-4b2c-92d4-640a28444390", "comment": "Malware payload (QuasarRAT)", "value": "b4cda6825f90d336e25c18d507a6e5c15b25624ce3d46f406335d1cd433f376d2b2453d1c25b52458220aaee8c305f23", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676737841, "uuid": "0063e1ee-d998-4bf7-a662-d2474a0f4033", "value": "T1DD2507026FF4963FD3691675E723B21C87F598333666D3567ADC21AA2F233808913396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676737841, "uuid": "5b815146-c396-47fc-9477-f38efb15eafb", "value": "9222d372923baed7aa9dfa28449a94ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676737841, "uuid": "fb5c899c-b86b-422d-a771-810dab04b726", "value": "12288:C4xiWliyNyAiySkd50hmOdEaxxTK3+VdWpthy:CkxryA8kr0PdEww328y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676737841, "uuid": "aad8f0a9-8213-48fb-b734-ab90e4157ca2", "value": 1011712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676737841, "uuid": "685b33a1-2438-43d1-8bc3-03ee1bb7a0d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676737841, "uuid": "643cd968-98ef-430f-856f-375f24bcf63c", "value": "2023-02-16_f5ad2a45442c0028f4268c72e21e2035_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9565e359-af64-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708205, "uuid": "885cadec-4b4c-4bd7-8d25-eff08c16d228", "comment": "Malware payload (RedLineStealer)", "value": "e2ae36c787b3982f1ded792efcda79b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708205, "uuid": "929eb859-a6e4-4778-a1d0-2099beb629a2", "comment": "Malware payload (RedLineStealer)", "value": "154b7f755a6b122543d59f4a264bf11d78dd0cbf92338196c644ab7ad549929f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708205, "uuid": "485a6d1e-837a-44f0-8bce-3e1e165309da", "comment": "Malware payload (RedLineStealer)", "value": "ebcaa4c9f996feb52e427ecb060109446690d0c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708205, "uuid": "ed7a76f6-3599-42f6-b0c4-dd1cc9b4a034", "comment": "Malware payload (RedLineStealer)", "value": "efa2bd064d5e28481d34bac734e5c2222404fa751f4d9f5a124a5cd28c0ebf70b1f9029552e840a631f68bd716d843aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708205, "uuid": "185488cd-762e-45f9-b7a9-f92fb89f717f", "value": "T1A7E41207F6EC5022E86613B05DF542D71A3A7E610779C38B274BBD2B1CB2670A63176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708205, "uuid": "baae04e8-89fe-4aba-9efc-ed74da97ecb8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708205, "uuid": "ac5e7671-2330-43ec-adbf-0612c680a8d7", "value": "12288:UMrBy90TMdn1t/SmkvaW/zbrh3NHY+x/slGotoBWEA8yfI21KFq+:VyNr/SmkvacrDRPTtFl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708205, "uuid": "7d2c3cbe-1299-4e5f-9f73-86057416cf6b", "value": 687104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708205, "uuid": "c9c3d2ad-7c79-48fc-964a-de0405ceacae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708205, "uuid": "0966a43b-735b-407b-86c6-8b6f5960106d", "value": "e2ae36c787b3982f1ded792efcda79b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ced5ad6-af8d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676725666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676725666, "uuid": "4cd2ce73-2088-42ee-8376-9890642aed4a", "comment": "Malware payload (RedLineStealer)", "value": "5bde9fbcb6e289885a358f7bbe784748", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676725666, "uuid": "848b3a50-9e6c-481a-b3f5-7ceebcfa4e5b", "comment": "Malware payload (RedLineStealer)", "value": "1598a44723a94b31630797016221fdfeb8a2d8f3d030956f806040591966da1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676725666, "uuid": "3e6b7486-26dd-45d8-810b-9759757a27d1", "comment": "Malware payload (RedLineStealer)", "value": "7157e242a46f5ec48f7373618010ff27a976dcf6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676725666, "uuid": "9d6ab9c3-a834-4be3-b887-3ee7f24f9e29", "comment": "Malware payload (RedLineStealer)", "value": "616a7c2b975f3dcda0f25e84a82a7c50510eb6f6a120933103fa3ad9f66b10da72c7c5100371ec25c7d462b274c3dda7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676725666, "uuid": "a2474525-51b0-40cf-a11e-b3c1f8b30a07", "value": "T1C574B003AAE87C40D9274B7A9F2EC6E8761EF5606F49773612255E6F86F03B2C163740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676725666, "uuid": "181f2362-1969-46ca-80e5-cd3685484a89", "value": "8b23c6f110add61e2d6f38c3c2656d60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676725666, "uuid": "ea848177-a670-4f02-9959-1a800d00e8a9", "value": "6144:xoLlEQVqFyU/PrKCLKacxJKq81lvs94IP0:xo5EQaX/Pr5LUKq81lv2P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676725666, "uuid": "8d96850c-7f6e-4e59-afdd-5521d1c34622", "value": 359936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676725666, "uuid": "bf5741aa-4ef9-4957-b724-6e9b561089f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676725666, "uuid": "fda6d9ff-f96f-4d5f-aa19-80559db2aa81", "value": "5bde9fbcb6e289885a358f7bbe784748.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1f5f5b1-af6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676712199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676712199, "uuid": "597684cd-e682-47a5-a1f9-b191cb1d23b1", "comment": "Malware payload (AgentTesla)", "value": "68487fbc280201de48ff3be0036f1e4e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676712199, "uuid": "ca70e145-7b44-482a-bd07-c52d6fe09e2c", "comment": "Malware payload (AgentTesla)", "value": "15c1c848addff1a5b41fad69f1a8a2177d14e592bf2584639aea2e5cbbbbe388", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676712199, "uuid": "b13aa0d5-cc5a-4e76-9348-3df7422e6dec", "comment": "Malware payload (AgentTesla)", "value": "def8e06676c6d070b172371ae702e2be5300f677", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676712199, "uuid": "f2867a39-d57a-45cb-b876-4da3cdb243fd", "comment": "Malware payload (AgentTesla)", "value": "9c57e5f20eec2ed68de4dae41707da0469e226b55a6409600ca50b1c62dbfbc783bb2ded6b6b47aa69c167758d753da3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676712199, "uuid": "f2b76293-5973-44e5-9944-15385a81db8b", "value": "T1418423C1A0BE9CA9FAB953FB4D62A03C848EF2103547C7DB1E05677B7B384D21255D86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676712199, "uuid": "47cc8a36-d427-4cf0-b923-fb15368ca201", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676712199, "uuid": "ed7fe044-fe82-402a-8187-509cf1cc5040", "value": "6144:YaaoGyrgoTVt/iLn2lPvNdH4y6RirWpjHe8fHEehNXQaM3DyUzDJnnE9t1wL/Ujc:S1mVtqLn2lPv/HvWBHHkarQuenEWb6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676712199, "uuid": "ff844e00-2f43-477d-950f-f127902513d5", "value": 386560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676712199, "uuid": "8c7d2e69-97d6-4894-86d5-5f400e62fd51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676712199, "uuid": "834f5c5f-2e71-4e2d-a54f-75911d18ffaa", "value": "68487fbc280201de48ff3be0036f1e4e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f84a8b96-af65-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708801, "uuid": "d8dd6597-ec9c-4639-9db3-4b44df883040", "comment": "Malware payload (RedLineStealer)", "value": "fd06e543d6c6fdee0f53e2aabdc66a71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708801, "uuid": "38f25ee6-f3dd-4f1a-8325-f3ca7b31174e", "comment": "Malware payload (RedLineStealer)", "value": "186ae3c3d19e037512a0c7e8f8036abe43a5a10158c0753996948a5acb6889dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708801, "uuid": "12716b14-766b-4605-964e-5f9b670e3811", "comment": "Malware payload (RedLineStealer)", "value": "4231da8a144ad99cb79bddfbf7f74eac531059ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708801, "uuid": "d2780210-e3e1-44cb-9989-935145969f1d", "comment": "Malware payload (RedLineStealer)", "value": "b66d4466fa9a8a25bf10c15a00f132540a6b0cca9c68369a98e1d51dd500b9af5fe95a85dfaf314f7b819364eb088f77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708801, "uuid": "28023594-422f-42da-8b22-97055ba40879", "value": "T14254011236E1D472D06316318974D5A5BFABB8216AB4C5CF37A8273D2E703C1AE743A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708801, "uuid": "d2d7bfb5-a2a7-419d-a73c-a6e099a7b438", "value": "1189c0a2ecbe8fd35560b095ffebf6bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708801, "uuid": "3ee5af0f-a7a7-46ab-a290-a6cbc399e4d1", "value": "6144:6rL6HNBr1AifMitBGEu/1DdMpm9LVzlYrPXKOuhyYpE+em:6rABr1v7wDdgmB8DXduh1pE+e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708801, "uuid": "3d773d76-75ea-4433-aee4-285b7eba8db3", "value": 284672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708801, "uuid": "6990ade4-922f-4b34-b42d-f79eccd98754", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708801, "uuid": "63d83a24-78b9-4158-ba08-ad9c5cd4a3da", "value": "fd06e543d6c6fdee0f53e2aabdc66a71.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "def96929-af86-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676722931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722931, "uuid": "981cd205-f836-4375-883d-68765fdc1bb6", "comment": "Malware payload (RedLineStealer)", "value": "dbdd7e94576a5731cbe3c61146768a0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722931, "uuid": "731457d7-0481-4858-91e0-c4bcc7f38ed5", "comment": "Malware payload (RedLineStealer)", "value": "186b6114ae97b541695924f8b616331e53d7e48ec9e36acd067e8599423838d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722931, "uuid": "cf3528cb-7016-4d6f-8806-95436e006a90", "comment": "Malware payload (RedLineStealer)", "value": "c7598460febe2e373ad89831b7d6670bc88be021", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722931, "uuid": "871c4fb9-ff11-4b1d-889c-1676c91fb3c6", "comment": "Malware payload (RedLineStealer)", "value": "3815c21c6fc628f0ade324da3b09a44d1dcebc5de552707312e12e36ef6f32d601c8cff9bb08a605f4ca1e54ebc4ad50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722931, "uuid": "9fe3f48c-e0a5-422a-b2c1-1d8ea05c49dd", "value": "T149E41203B6EC8132E8B8A3B42DF602D315367D619735435A774E6C6A1C726A4B2327B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722931, "uuid": "e9cc927e-14e0-4c33-8f9a-1d3db2d9e77f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722931, "uuid": "e5354c04-2725-4a40-b52f-eaceb1ddb07a", "value": "12288:GMray908cAu3VRtiP4BDb9jfXN58TDymhAMXEdduFjh1JY5BrbLt/0Xb:EyfQVDiP4BDJfdKqI4dTBrftsXb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676722931, "uuid": "e3c9c768-c4c5-4733-b16d-0ad27afcbf82", "value": 719360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676722931, "uuid": "2d630884-bc15-44de-8db6-b22bfc356f82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722931, "uuid": "6b7acbc7-5277-4c13-b476-7e1565721232", "value": "dbdd7e94576a5731cbe3c61146768a0a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7031a306-af60-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676706425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706425, "uuid": "086acec8-3612-41c5-b501-6aadcd08dc5b", "comment": "Malware payload (SnakeKeylogger)", "value": "cf53102f79e6ed7b6174027101efbb70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706425, "uuid": "9453a256-58fc-4a03-a475-1f3481116d3f", "comment": "Malware payload (SnakeKeylogger)", "value": "195b45b91e16b42cdf280caa6a828ebc3784d6f170944f08a2e808a5c6c12c43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706425, "uuid": "df7a3f23-0a26-42a7-9d1c-91a1a62c1a1f", "comment": "Malware payload (SnakeKeylogger)", "value": "6e57d26b5db188fc47a5cd127baf5ef8ee7d96b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706425, "uuid": "6daf5a40-19f1-4016-86be-8e453baa90c5", "comment": "Malware payload (SnakeKeylogger)", "value": "d01bb762f2a6c0551d8f3a65ae7db9adbd3a96592bbb0703d91ca5213d3b9cddb98c671846ef1302b2d45814953d5c17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706425, "uuid": "236206ff-88dd-4ba5-b7e8-ea3178991e08", "value": "T13FE47B8CC4F1EA3DEA898DBD371436080FE05A432A22D9F5D3E9FAC11B36263595D635", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706425, "uuid": "6dd3336a-739d-456d-8168-5939f1eb8b19", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706425, "uuid": "078aafbf-df92-47ca-9e84-c4a75db7fb3e", "value": "12288:OqzGPpvOM1VbwB6hPDZt1wZuPk2hQpzGFb5D2UXm0ffNdqDSugDs+9t:6GM7I6h7Bw8PLb7CUWAldqDSu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706425, "uuid": "47bb04ee-c776-4a51-a669-39c6fe16f0da", "value": 680448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706425, "uuid": "453d9112-b557-4bb6-abbb-c1e3e85ab640", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706425, "uuid": "eb7aba1a-e72a-4102-807a-5d2139ff14fe", "value": "PLgu0z71A6iRTDw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e281b09c-af86-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676722937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722937, "uuid": "ac31cb2e-47fc-4f09-8c88-cbaa3fe68785", "comment": "Malware payload (RedLineStealer)", "value": "bce72af69d17b425dedb45244b35ffb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722937, "uuid": "89fa4b63-77b8-41ca-ae1c-960cbf6d79fa", "comment": "Malware payload (RedLineStealer)", "value": "198e8c0e019800fa1f9140ecfa73385ead7104cab81908ea7966117101678be8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722937, "uuid": "b9799f61-3613-4285-8e29-035cc2b366fd", "comment": "Malware payload (RedLineStealer)", "value": "6e98cc2b73db188c2be839c46dbc6ea7be36efdf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722937, "uuid": "2ab41e0d-bf78-462f-9e40-747f7c6c6dd1", "comment": "Malware payload (RedLineStealer)", "value": "06bfa11b2b0a181795dd74c5f65f6b2cd71b97e20ef9be8538d591bcb3b233344283127f5b93056f7ed1cb40406ac0b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722937, "uuid": "64e9a5da-56f4-4359-b211-d338e546924b", "value": "T1E0E41207B6F95072E974973014FB07C719337AB1AB78836A264F6E1B1C726B0A630367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722937, "uuid": "55842e94-6aa5-449b-bb0b-1dd5f99cb987", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722937, "uuid": "82fa4380-c602-4322-8063-05b2ee1bb544", "value": "12288:pMrhy90ryNieVVN3GTNVtfA66lVljD9e2ZCrhHEhMqcRM5ySirBz0tk:cyJXVVN3GTNzf+lteuKhHETsFOk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676722937, "uuid": "ce59bd4b-9687-4550-b6be-27ac389a1fc7", "value": 717824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676722937, "uuid": "97793ee2-cc27-4bb6-a92e-55bb6b9473bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722937, "uuid": "da242489-d892-40a7-b9e0-b480db43b10b", "value": "bce72af69d17b425dedb45244b35ffb1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e397f09e-af86-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676722939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722939, "uuid": "bf7e1310-9f7f-4bd6-953b-d9e1c9ee71e8", "comment": "Malware payload (RedLineStealer)", "value": "5b8ebb4cc0d6e1f8a7ae0d3b0d2b8049", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722939, "uuid": "37decfbf-9df4-47e7-b4fe-47ff79b5a27e", "comment": "Malware payload (RedLineStealer)", "value": "1b4fe3e40543d3f9837f5181ecb93f816982f46331a6136823c558bebaa99f63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722939, "uuid": "8a787823-2cb5-4726-8f8d-dd510ce3f929", "comment": "Malware payload (RedLineStealer)", "value": "a833e234ebbaeef5099f1b4ff8f28257ee61ffd7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722939, "uuid": "003d5512-80b7-4947-9bb6-8c92243c8928", "comment": "Malware payload (RedLineStealer)", "value": "73c030421c5ccac7aea723ba637d46c4f0557b20563f0db060eb228bfd4dc7f2b66e7bf2a053c66df1e1ddf5a2bc6f29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722939, "uuid": "867917d0-1364-47a8-a981-27cd519437bb", "value": "T123C40207F6E89132E9B467702DF607C70636BE609B788397271E6D190872764B63237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722939, "uuid": "777d013c-b2f8-4939-9b1f-4e63a8223b84", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722939, "uuid": "99a288f1-e5e9-4039-9541-4411e967bca8", "value": "12288:sMrpy90vT23Kcf1ONPRDvh7GuNoywQkIYJJz36khvcy8a6ED:ty466eaAuNjzNYJh36kBcQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676722939, "uuid": "d5a9a33e-1b8b-418b-b546-5f0de80982a4", "value": 570368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676722939, "uuid": "740cbbc8-ca5d-4a77-a903-55c32147cf34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722939, "uuid": "81a4ddbf-813c-4798-91bf-7622f0e17ed4", "value": "5b8ebb4cc0d6e1f8a7ae0d3b0d2b8049.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fcd692d-af65-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708491, "uuid": "a4b3a3d5-28fd-4546-bf05-6384fe017722", "comment": "Malware payload (RedLineStealer)", "value": "bc58e5e489f7f9fdea5dd8addc3ea14c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708491, "uuid": "397586cf-1d0b-4f86-98d9-cc193ceb2c91", "comment": "Malware payload (RedLineStealer)", "value": "1c045f5b1b8d458335de99e6bad108c1b5aa8d580b89836309c5d240dd64b9c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708491, "uuid": "1a4eb102-9126-4601-b8c2-6a931d52f8ef", "comment": "Malware payload (RedLineStealer)", "value": "d616aa402e8cbaa7e247e264d0d4cc902ce71e2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708491, "uuid": "15b2f293-4dca-4189-b007-1b8c6e62b446", "comment": "Malware payload (RedLineStealer)", "value": "35ad46db449b7873624d58a97acf5764db206cdd41f869105e56e1dd36ed3205826c818aab49d966e8e1aba08af1d456", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708491, "uuid": "91af8ef6-0590-4110-a127-2d48fc116328", "value": "T1F1E41207E3EC8072E8701B7419F207D32A76BD715A79934B338A6D5D18B26B4A63137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708491, "uuid": "bacd66d6-8646-4076-a63e-647a962b38cc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708491, "uuid": "4f1f320b-6d9a-4283-9e88-3c57dce84131", "value": "12288:jMrFy905mE8V6Tpdr2+CyvAiEGJIuTSjyKYaBfcaFHZAMBnGkcmuvJYYp2CzbF:qy0KVqdBCyvXTKftFnPNAqYxbF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708491, "uuid": "4e77ebaa-cf46-49da-aee7-f201b3e26800", "value": 687616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708491, "uuid": "00b56530-3bf5-4ac4-aa91-fc82e6477b5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708491, "uuid": "69344a89-5e07-4475-a144-740b63a1d8ad", "value": "bc58e5e489f7f9fdea5dd8addc3ea14c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acfed80c-af60-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676706527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706527, "uuid": "9182c091-b95d-4c1c-890b-6d53c69f4c38", "comment": "Malware payload", "value": "a652453f2d0febdf7327e9163072029c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706527, "uuid": "7063822a-510e-4689-bc0e-1d233efd9b51", "comment": "Malware payload", "value": "1e47c4e19c1a7219dc579d1db61db8080cd8eeb13edad27219b4a26962b4b39b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706527, "uuid": "56ac7d34-b6eb-4839-8fce-9aab117c0c82", "comment": "Malware payload", "value": "c13b55496d27aad3bce76232fdb4d5391478d186", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706527, "uuid": "ffe5a03a-2a1e-4718-86db-ad6cdf7c5d18", "comment": "Malware payload", "value": "a3ad3931cdd0af6a25032d577a5b6a3b5fcec5a2ee7248e0afb8e9e4baae30e0f9143342b359270e118531dce192605b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706527, "uuid": "7d11c047-8b33-4258-8490-ad5cf14a9055", "value": "T1D3B6335E29DE9AFEDB856530A51BBDCF3BF313B34CE08828BDE058426D93D659020593", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706527, "uuid": "b3d96f96-3642-4405-b0a3-16ae05b1273b", "value": "577acf97f0760b9763131f344390d30a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706527, "uuid": "eb453a04-7881-489c-99c3-ebf3d02bfb9e", "value": "196608:KVdWnVxgAZGWG014BxaZYhO5ACUTBPImBpaGQsXhPmcsXxBPob1q:KVUxgAZu012AYBPZTLhecshBPf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706527, "uuid": "be28995c-b7d4-43b8-a423-ec44ec036850", "value": 11363328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706527, "uuid": "338e2110-f351-40cb-8f5d-4b887c05849b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706527, "uuid": "c58398c0-5185-40be-bbd1-d3e83df39c57", "value": "a652453f2d0febdf7327e9163072029c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c7c0565-af60-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1676706445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706445, "uuid": "81310011-804f-41c6-8af3-d4dcf4d268c4", "comment": "Malware payload (CoinMiner)", "value": "52f4f9797fbb76785a1b8cf695e65a15", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706445, "uuid": "7cd6c5ba-826c-43dd-9e43-47ce32d34d9f", "comment": "Malware payload (CoinMiner)", "value": "1ea28978334fa03b2714b5c22abd580cdd8b5b0a6fcdf895fe1367ac96da0e8b", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706445, "uuid": "107550f8-96be-446c-bd60-1bd6b67188f3", "comment": "Malware payload (CoinMiner)", "value": "32deadcec14dca90fe14030f69097f8bd6d98b95", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706445, "uuid": "7b138142-cc03-4c46-9227-868fa6bf4c20", "comment": "Malware payload (CoinMiner)", "value": "ce35b12da37b6a20b2495d0f3dd07823386424f4baf385fb38db994cea37fe4653060eb333fd00d8be981c076590bc82", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706445, "uuid": "1abc4267-1aa9-4bcf-afb6-af1efa1a1b9e", "value": "T10E860150EDCF09E7DC7A8C363DF2798FF129360B1D8A5D5D00242BAAA4B36D1C4A691D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706445, "uuid": "85e7b202-f23b-4843-8f33-405a033473dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706445, "uuid": "f2913730-c5d8-4722-ab54-2bbe3fdc95ad", "value": "196608:JzeZs7JgCwS/30xwGfBBIwwYlqvbi6aUFZTfUaawUm:JzW2TwUVeqORAUBwUm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706445, "uuid": "4df806ed-1cbf-4dfd-be5c-7d32f9502274", "value": 7874048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706445, "uuid": "18fb23d4-05c2-407f-8595-b413b45e75e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706445, "uuid": "a49e5a4d-834a-4c81-b593-6c89d978c673", "value": "52f4f9797fbb76785a1b8cf695e65a15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "922ad5c3-af69-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1676710347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710347, "uuid": "131f400c-0cd1-493d-a72a-3231fa860a2c", "comment": "Malware payload (NanoCore)", "value": "6984b8cb3db2f23249ecda2a35876b93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710347, "uuid": "6621adf3-f58f-4603-a056-c7d32345a960", "comment": "Malware payload (NanoCore)", "value": "1ec08fa4a70b1518af1c355b3064cc2865fad5d1ac6d7e1b02b042fcd0e9e842", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710347, "uuid": "80cfb4d4-3d3d-49d3-95cb-da59fc555803", "comment": "Malware payload (NanoCore)", "value": "1b102e279128986540956848f25b9303655469af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710347, "uuid": "39bb1e0f-5881-415c-9262-16d4a144e902", "comment": "Malware payload (NanoCore)", "value": "ed60ad88b0a668c44cd8e31d2ebe6ded8df620d275e3b23bfa182b559f4ee5e4edfaadb0782e8fadceb1e61eff05dc9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710347, "uuid": "4469a050-d617-42c5-8d30-705a8fca43a3", "value": "T17CF48C8C84F1EA3EEA898EBD331436081FE05A436B22D5F5E3E5FAC15B36263485D535", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710347, "uuid": "1eebe661-2c75-4e7c-a9d7-72e1b2f4b4ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710347, "uuid": "e55ae3e1-5048-423c-bc39-f0356b25d5b4", "value": "12288:sqzGPtp+nknBeVM00B1aWthhvkeIWweW6y295gFZjtrER5UxIBeqDSugDs+9t:IknkfTBJthcbeByM5gFFtrERgIkqDSu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676710347, "uuid": "9d040ead-b13e-43a5-80b2-bb452ea733ec", "value": 765440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676710347, "uuid": "442419b2-896c-478f-b14a-5fdc7516d93a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710347, "uuid": "294feecb-f634-4cf6-992b-ede48bb6bbcb", "value": "6984b8cb3db2f23249ecda2a35876b93.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff6acf5e-af65-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708813, "uuid": "d2ef97f4-cb4a-4f66-bff9-9247e7783a89", "comment": "Malware payload (RedLineStealer)", "value": "a1da923264eb42c6a55579e219c33283", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708813, "uuid": "e0a8219f-1115-4241-bc93-5c8b89643d03", "comment": "Malware payload (RedLineStealer)", "value": "1f19699a6cebc09348c0033e3027bfd92d20014b74df85f36622c65482629459", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708813, "uuid": "24ea4a9c-a3d8-4c65-97d1-d9205f4c8d1f", "comment": "Malware payload (RedLineStealer)", "value": "b3bff0bbf635d2d043d6b564d8b052748b400984", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708813, "uuid": "de2c8b45-580a-4baf-aacc-f8ef9eaa0559", "comment": "Malware payload (RedLineStealer)", "value": "9157f221a97dc7494c0281e75f35a8fcb8e41f00b491bbecc2c3af3be25d970d2369894aab738299b04a3afbf579e7c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708813, "uuid": "a4913cad-3119-43b2-aa6e-6b3140b60023", "value": "T1E8B402079BEC8463ECB42B7019F702D3173ABD616674934B234E5D6A18739A4B6313BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708813, "uuid": "6ac35c92-8ebe-42a2-a542-c4ef1ead44ba", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708813, "uuid": "6c8437fb-21a1-4178-9482-2a82a8be9f5f", "value": "12288:9MrOy90JeSVx89+n5fhOuFw8XMh6/aF8kw74p:nyIVx89+n5JF1OTw7M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708813, "uuid": "67a4e47e-e92b-4ff0-8e40-58e5b2787efd", "value": 540160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708813, "uuid": "056c2ca0-6442-494e-8ffc-3eb8bbf0befe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708813, "uuid": "81c8ab2a-0088-4423-bdb1-11a4a15c791b", "value": "a1da923264eb42c6a55579e219c33283.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "765e132d-af2a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676683242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676683242, "uuid": "2d1808b6-32ee-45a8-a50a-45ba343ed0b6", "comment": "Malware payload (Amadey)", "value": "74daf2e42dd1fbfed285285d7bcc7c22", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676683242, "uuid": "968b71e1-1d61-4d65-8d83-305d32620539", "comment": "Malware payload (Amadey)", "value": "1f849c845f9432fd803101047ee6106749a401cf954a1a77a86c84925173d59c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676683242, "uuid": "b4f31c5f-24b1-4285-ba34-8ee81a635a60", "comment": "Malware payload (Amadey)", "value": "5abf0c8b3c320897a77a1b94adbc17e9f0c826b7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676683242, "uuid": "6a3ec841-2674-4fa5-92b4-82ff89b329b6", "comment": "Malware payload (Amadey)", "value": "2e4e6e7ae75192446795e42859d883425724c8d533f3962d9d42b9f7d548e62f76b5e4bec4fe60a5dbce1cc4a038412a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676683242, "uuid": "d370ad72-7655-4e1a-b78a-d2d792d003c2", "value": "T147D4121BFAE48136E9B447700DF203C309397E615B3C87AB265FA95E1D72A70623176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676683242, "uuid": "fa4027fb-8f71-4ec8-9297-21813c7a2b61", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676683242, "uuid": "16c5f7ca-7702-4548-99d9-111f42b1535a", "value": "12288:8Mrdy90ne6KlgyZKpJ+qh6BgrWhhCUTgtA/1HP1QKMjiAWrd:RyyHKlgyZKpJ+q9ChhRMtG1H9QKhAWrd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676683242, "uuid": "7fbad777-e232-448d-b807-98f723733a66", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676683242, "uuid": "80fa4109-95e3-48ab-937a-35682264ec64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676683242, "uuid": "89c168ab-7929-4243-9198-cfd09e8e78e3", "value": "74daf2e42dd1fbfed285285d7bcc7c22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95283219-af69-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1676710352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710352, "uuid": "53281edd-e464-4ca4-b9ed-aef7b4834797", "comment": "Malware payload (NanoCore)", "value": "d5f4a624baaa4f48e3e2b2d87890454f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710352, "uuid": "497b2651-cc18-4573-9d11-89299c1ac8a0", "comment": "Malware payload (NanoCore)", "value": "21c60fcbc947a644af73ca89b387a2cf0e27d8ff54883755893e0fe2e706e46e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710352, "uuid": "ff08a887-86d4-4eff-8a31-67be8d022f68", "comment": "Malware payload (NanoCore)", "value": "261f35933ea83c785128732bf1c629fb912b747c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710352, "uuid": "04cb5b1b-3e65-4ed4-ba3c-d37a700f4edc", "comment": "Malware payload (NanoCore)", "value": "5f4f48045dc1f82d53d807b2c20c3dd750d4549e76eaf181e0d91f67c87d4a65607ea79cb5aa633bb4559061c4a63ae2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710352, "uuid": "bd8e75ac-64fd-4b60-90b4-dc134c995f21", "value": "T114F48D8CD1F2EA3EC7498EB9371031081FE056436A20DAE5E3E5FAD26F36523199D536", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710352, "uuid": "d0a3303b-547d-431c-8690-09b993399355", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710352, "uuid": "95baa2ad-e60a-4071-ac35-1caf7d588212", "value": "12288:it5RqDSuSDsv9tzFpXDrRAxU/jfQDoyUbH1Ps/izgUNOTsCKMW9xWnP++AwiLDsT:it5RqDSu/pHiU/jYcL7a/stCNWrWWB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676710352, "uuid": "a7b3a9cd-ecbf-4ee8-a28d-83dec2a1cd84", "value": 740352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676710352, "uuid": "d27d791e-26d0-4448-8e54-099071502230", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710352, "uuid": "c7bee182-ea12-46aa-bfdb-84bfc5fcd096", "value": "d5f4a624baaa4f48e3e2b2d87890454f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdf2e7b5-afd9-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676758551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676758551, "uuid": "2db29754-aab2-45ae-9053-31eab7479e82", "comment": "Malware payload (RedLineStealer)", "value": "809a4768dc20cf6f365f284d1562405e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676758551, "uuid": "de09c125-def7-4104-91b4-5b8fbbf8e495", "comment": "Malware payload (RedLineStealer)", "value": "22c0a2305fd4b7efe5da0b93c6ac9e4ebcb606e90ba78e333b058de359e075d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676758551, "uuid": "c7dc1894-1392-4477-b411-29a587162f0c", "comment": "Malware payload (RedLineStealer)", "value": "4b86055c1a6e130eb6c67dbaf4b5e77f0c5a12b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676758551, "uuid": "c0c07f1a-1525-4b1c-9360-c92595dbc400", "comment": "Malware payload (RedLineStealer)", "value": "e1dfe54068de40909c38cdd78bb8766da24d36e9e35049a3814d0e478c8578ca9996e523c5879adff556d9b52a13c187", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676758551, "uuid": "5d2e3f22-b702-4e67-894b-9451dcd669e0", "value": "T12FF41257BBE89023E87477B069F702C30A35BCA01738938B168BBE591D725A4B572367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676758551, "uuid": "593ed777-bcfa-49ca-9da7-35c803cb04a0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676758551, "uuid": "d0f9edb6-bbbe-4434-8410-376127875ec9", "value": "12288:tMr3y90MB0tYRkY0OmB/64BSfRLltEe7SGhqTwqV:6y34BXgllth5h4V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676758551, "uuid": "31aa9f85-1384-4a7a-a3bf-91a7b6a3367e", "value": 764928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676758551, "uuid": "cfb67b6a-8164-43b9-9a9e-800be325ad0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676758551, "uuid": "13565541-b4d9-495e-a59b-b47e10223a3a", "value": "809a4768dc20cf6f365f284d1562405e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f6540c7-af63-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676707578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707578, "uuid": "51c69b5b-7e1f-473e-8c3e-1b9d1d96044d", "comment": "Malware payload (RedLineStealer)", "value": "68f6966902150f7b0a8d72706937af33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707578, "uuid": "d16dd055-36ef-4498-8297-98551ef6e731", "comment": "Malware payload (RedLineStealer)", "value": "239d8d737fb793b73074e1a1151d00785d914d681f15cb205abd99b04bebfe22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707578, "uuid": "4c88816d-8e8f-4bcf-b508-d1d18f90b5e9", "comment": "Malware payload (RedLineStealer)", "value": "89c522d4a957a7cdf60eda9b618722eb5443efa8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707578, "uuid": "82fbc365-23f3-477e-b48a-af357f4a0afd", "comment": "Malware payload (RedLineStealer)", "value": "322268d6bd7be4838189a7dc7cf34bf40564ad0f8e80879294e18317fe5889f42407b466e8429d9c3576b03130da9a3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707578, "uuid": "bf87ce94-bbbc-4df7-b2a1-da078d7dc9e1", "value": "T134B40207F3E89073E8B15B3019F713E316367E615678829B739E1C592C726E5A23272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707578, "uuid": "159b5f6e-734b-42b7-9cd8-3982de8e4cc5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707578, "uuid": "954e3190-7009-4e02-ab0b-27eebfcc64cb", "value": "12288:2Mrty90TI0ViH5m6psFfbSeLs+w/l63cR6LP:vygVaxpsFf2eL1wd6LP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676707578, "uuid": "7433a107-8fd8-4ec1-9fab-24074f22c864", "value": 530432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676707578, "uuid": "2f8df906-6311-4db4-9339-6583f52d16ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707578, "uuid": "7794c43e-97e2-4652-b76d-604e64e8dd5a", "value": "68f6966902150f7b0a8d72706937af33.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f808b2c5-af8f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676726839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676726839, "uuid": "6d695aac-b632-404c-b3ee-947fc0fd0ea1", "comment": "Malware payload (RedLineStealer)", "value": "a911e227d6cdee452eaa8f06f36687ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676726839, "uuid": "8a93b261-8239-406a-92d8-8a0529531cc8", "comment": "Malware payload (RedLineStealer)", "value": "2480422d1db35870be30ffd2245818b5ac1be51fba181faac08a9a3d7d76a6fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676726839, "uuid": "8171788b-9ccf-469d-a698-7891833f165f", "comment": "Malware payload (RedLineStealer)", "value": "46e135f48d4636ea90bc42df323bbabfe8509eb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676726839, "uuid": "a8b358f8-ef50-4892-b778-cc4c4479dc96", "comment": "Malware payload (RedLineStealer)", "value": "335f5766e78561d7c25e3e292ed728ba915644e96e09abaf0614aa53814cba224588f2cf507986f76f5ec2a559213ade", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676726839, "uuid": "c215bcb1-c054-4805-bf2c-c296c225b611", "value": "T1D2E41347E6EC8032E4A543710AF907D3163ABEB15B7887AE27495C591CB36B4F632336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676726839, "uuid": "ccecc8a1-25eb-4870-885e-e712a60c68cc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676726839, "uuid": "b31c44f9-1f1f-4711-b21e-4f58b60bbec2", "value": "12288:eMrmy90xkdJPxaYR4ht+sArII/2VrK5nG8nM0nuVEnr4We5P8ilQj:4yekdJZL4bxE/2xK9DM0nuinMWiEi6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676726839, "uuid": "dd028835-7548-4237-812d-e2ba22ecc513", "value": 722432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676726839, "uuid": "8a403c09-687a-4146-8e4e-994439baa99f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676726839, "uuid": "02d47afb-8901-4ee7-a578-f211f13cf409", "value": "a911e227d6cdee452eaa8f06f36687ee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20b78061-afa6-11ed-88f6-42010a9c006e", "comment": "Malware payload (ManusCrypt)", "timestamp": 1676736356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736356, "uuid": "ac5c6a36-28b6-4832-b93b-801fd975dce8", "comment": "Malware payload (ManusCrypt)", "value": "84f648551b9439a26972c66f9db7f882", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736356, "uuid": "f6efd416-e4af-4248-8cf1-40fba104f5a1", "comment": "Malware payload (ManusCrypt)", "value": "248cc9a72ef0f0740bd05bf10b56345530e820a2179ccf295722cd85667ee8c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736356, "uuid": "0b9b84cd-e803-4636-8078-02ea28a8c670", "comment": "Malware payload (ManusCrypt)", "value": "add0fb629e1e2def23f47039373c1181d63aa70e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736356, "uuid": "de8facdc-3bff-431a-863d-191a2e787163", "comment": "Malware payload (ManusCrypt)", "value": "4d334a691721f4bb75b4fe486fa996031ea8d227a6e3b8a4f3cb495dea5c5773a87f5be102097b66a807bc016497ed85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736356, "uuid": "ce3fba0f-3a28-4456-bd15-6efe7a3500ee", "value": "T15775E04E13813228C8D1BA333939766F2C4F5A623A3C506D642DEED74A277525CF47EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736356, "uuid": "bf0f3943-775c-4ef1-9d67-15c934939424", "value": "90aa300f8b98c30a131430c7f96d8b4f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736356, "uuid": "6fc817d8-5da1-4b05-a3af-fb26a700a4fe", "value": "24576:saI6lJWATddBMPVQ5Nfjy1eXPQG+A+uoagb2tmq4ncspDX54B9/Gjei59:m6l5Tddkuxjy1efZV+uoaIG4nTpbC3S1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676736356, "uuid": "c6c9eb32-98a3-42f2-bf99-25ad185f5381", "value": 1564704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676736356, "uuid": "8718c8d1-8202-4a03-b474-acc3eb291132", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736356, "uuid": "78e88633-6fe0-492a-b75f-d4e05f89fc1d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8358ce0c-af61-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676706886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706886, "uuid": "b218ee10-c220-4f85-bf5b-9bda2339a8c4", "comment": "Malware payload (Formbook)", "value": "ce02e10bf8de65619ae4296d38288219", "object_relation": "md5", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706886, "uuid": "a66efe1b-b5b0-4b6f-a891-002d1c49f742", "comment": "Malware payload (Formbook)", "value": "24df0ccdc95c15d68f1bdee2d09ec3cd9fafbe9913cadacee75889d407cd8f84", "object_relation": "sha256", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706886, "uuid": "c5640a20-7d40-4360-8a79-0776f6e1a9a4", "comment": "Malware payload (Formbook)", "value": "e8a6f91c9978e5604c9edc90b33001da3278b618", "object_relation": "sha1", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706886, "uuid": "e75a4100-5afe-4c73-a34c-5383169709c2", "comment": "Malware payload (Formbook)", "value": "8e0e80753a9ee6eb75e80a317622341417ce395f7231aba3205fec1a28478194c97f5cfc4fa721b94ce59bbffcc05461", "object_relation": "sha3-384", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706886, "uuid": "de1bf83a-5df8-4177-a54a-b14d88cdbe54", "value": "T1BD84224CA2BBC0EFD9BB5B310A3D97ABE1E4C6100161C79B0331468EBF51642E94E739", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706886, "uuid": "82209cce-bc40-4c5b-90c0-9a70179dafcd", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706886, "uuid": "25d3ba2e-c3b5-49b1-b6c8-e200036b70a5", "value": "6144:vYa61AmQ4LtnYVg2eu/G8Ebxkm9/iJSIvEgXev2RQHqMQMZ6b2iHFSS29JRCbB:vY/AF4LtqgPu+LNk8LC7WHHW2Dsl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706886, "uuid": "122f11b2-27b4-489e-a067-d8d9f2c49521", "value": 388797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706886, "uuid": "3ce44e0d-909c-4d1b-84e8-cfed0bf27813", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706886, "uuid": "a51cfea7-9dd3-427c-9f23-d1bbdd527f58", "value": "T.C.Ziraat Bankasi A.S_Ekstre_20191102_073809_405251-PDF.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aa6106f-af69-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676710308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710308, "uuid": "35d11d1a-7def-4e31-8f14-83bdc488c097", "comment": "Malware payload (AgentTesla)", "value": "5316f051834042c21c30b15489732589", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710308, "uuid": "619986b5-5ee9-402b-9b1d-fabeb36b6924", "comment": "Malware payload (AgentTesla)", "value": "26b70686814f11ee1cfc7490fc25dd5b49553e70f94903a710f7802b6f4ecb78", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710308, "uuid": "4d45d74b-143c-4840-9738-1ada24d23ad4", "comment": "Malware payload (AgentTesla)", "value": "60b7c71ac031b2ace0b78c28687f5f01047e0502", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710308, "uuid": "040485d3-7cb4-4b06-acd9-ea45f3d855d6", "comment": "Malware payload (AgentTesla)", "value": "c18e4d7388b15509ffba3ff84c0b538395b232ca75bf7a496d64c9b1c6ce3ac0a762bacbaad1b49033cdde7cec44d4da", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710308, "uuid": "c4f654c8-b022-4883-a7a8-2f86be9c3491", "value": "T146E48B8CC4F1EA3EEA898EBD231436081FE059432A72D5F5D7E9F6C12B36263485D635", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710308, "uuid": "8db64cbe-1544-4857-a567-7047c796153f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710308, "uuid": "38d88652-ac54-4bba-bcbc-cf2c17bd00f1", "value": "12288:ZqzGPACeL+Z1MSiKuHlaZhBEOxrN8zfWiRY+dALM7NiEqDSugDs+9t:rk+AauHUlxrN6fY6TNiEqDSu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676710308, "uuid": "be8518a9-4b05-41aa-a2fe-c3b1f7df47e6", "value": 716800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676710308, "uuid": "6c7e080f-b738-414f-9009-795a0eea7b5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710308, "uuid": "3f6a623b-88dc-4a7e-9a42-65cbfecd782c", "value": "5316f051834042c21c30b15489732589.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b085186-af61-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1676706899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706899, "uuid": "9dc44b4f-b6a3-492f-ac8e-1044dacc81b4", "comment": "Malware payload (GuLoader)", "value": "779cd354bd8a84f58397f2e38f37abf6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706899, "uuid": "65809737-a699-43c4-b356-8c8c2e5212b2", "comment": "Malware payload (GuLoader)", "value": "26bfaa7e59333ed083221feb958e4fbd72168818082630c675edbb81472f03b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706899, "uuid": "48b1efca-48b3-4abd-9f0d-9b9bef1be305", "comment": "Malware payload (GuLoader)", "value": "3b13bb58f8e9d19d5d804df5af8de45cb45f99fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706899, "uuid": "a619b58d-d195-4493-8b29-9152f882a948", "comment": "Malware payload (GuLoader)", "value": "a6f984909126c1adc89c1df13128294181f214c0f76007817b4fb61431fbab2642ccb4e686a6fbe607660138eebc808b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706899, "uuid": "98a29325-32e8-4f3b-8b07-d18f4dd0f7a4", "value": "T1CA8412557BE0F427C6258F381E60E63293B76E206E25DA537F913F5F2C756828E1408B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706899, "uuid": "4a9b5b84-c336-4679-a144-fe4dd3e7e9a8", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706899, "uuid": "17a780b1-3028-4019-907b-36c94e64c03f", "value": "6144:fC2+8+wthK4yIWNqx8HoDpfS1Jg34g3cErSEEENcNxMMDy0Q4Y3Shi5:fhCI4qm8fcJgoREbNMxMH0Q42n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706899, "uuid": "8956729d-d604-4bb9-a702-7df7f2b50c7a", "value": 391091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706899, "uuid": "f54a8519-ada7-47b0-aa16-2e2a135feb66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706899, "uuid": "071c85ba-396e-4972-aec8-e15415ccd230", "value": "42131007530_20230216_09111964_HesapOzeti.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe5ed619-afa5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676736299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736299, "uuid": "f60e5851-9d09-4691-ad66-de45de9b237f", "comment": "Malware payload", "value": "42726f90c24fd4a8b5d58f808bb29d69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736299, "uuid": "42c9c7ca-88b7-4cea-86d2-6397062a65d3", "comment": "Malware payload", "value": "27510c6b33943e9f3709266b1f6d117a3a3818928b36f7f8c4250794df463b28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736299, "uuid": "5010e6f2-c5c2-4537-89b4-671011661044", "comment": "Malware payload", "value": "6d637b9b02008969825df1bb7509eae405b51602", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736299, "uuid": "2f5cc2fd-dac5-4915-8a20-efa2cc809334", "comment": "Malware payload", "value": "8e4fab51f1e133f2273b2390e2badb3f196b42391cddc974472a809d3f2c601fc02ff3296cb62eb6342e67fd87885bc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736299, "uuid": "875f416a-611d-4d7e-a4e8-69042a21e293", "value": "T1F5E64B03F89190E9C4ADD130CA3596A2BA303C984F3577D73B20B7B92B76BD46A79354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736299, "uuid": "fed5017b-8787-459d-bddd-9b9fb678f073", "value": "57c9b357ae0cb2f414b0a5873e2f216d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736299, "uuid": "e59f3abd-2535-4aac-bd06-332b706b5771", "value": "98304:00cD1LfEA9Pcx33FCtJYk4ObmEX/4LAqOkuAse:VgZfEA9PcR3Fs4uALAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676736299, "uuid": "72b13258-7959-4d38-b029-b2d1c64519f0", "value": 14544896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676736299, "uuid": "3bfb2fb7-6d46-4e0f-b810-1a48319e84aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736299, "uuid": "a5ba6cce-ae7f-4121-b079-c20e87d2ef97", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eb89d93-af64-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708194, "uuid": "9237d33e-1f72-4d46-ba62-a1a8956ee196", "comment": "Malware payload (RedLineStealer)", "value": "746158ba22b3af8f569c7410a55c3cd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708194, "uuid": "1e6981a4-b121-4684-b4aa-5768234bf3a5", "comment": "Malware payload (RedLineStealer)", "value": "2850a4cfaf2a7c6f1347e71f9466cc779ff3adcf54583d29769130954910a310", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708194, "uuid": "b536b3fa-aa0d-4c27-867c-a8904f04b442", "comment": "Malware payload (RedLineStealer)", "value": "300b6212144897b92ba24c434588ba236da18da6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708194, "uuid": "383f43f1-c9bf-450b-b5cd-6193ff70626e", "comment": "Malware payload (RedLineStealer)", "value": "654ee7ad8ee3a3c551a026cfbe57d13f3345780c403a5317644aa667462fde21c76741d74efe3280d5df6d6eb1c7f737", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708194, "uuid": "d3294019-1622-4d21-b3bb-8f2034d837df", "value": "T15D44011232D1C0B2D42756702D6CD6E6BB76BC3156B0CE873B98072F1E741D39AA937A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708194, "uuid": "aff48581-14d1-4b5b-a3f4-c330f5488271", "value": "8cdad4eae189848d90763fd3d82d253c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708194, "uuid": "75a7fba4-6494-4ab9-a660-835179cee612", "value": "6144:+PuQSYHY0kRoJbEtqssTMJRU6n16XUv1Jg3X7:+PiYHYtSZEwst2IYXUv1Jgn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708194, "uuid": "cbde988a-6d3d-4cb2-9d6d-80a102ff00da", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708194, "uuid": "2627995e-22fb-4c88-9980-5f0734d619f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708194, "uuid": "1f797dd2-3110-4c85-8f0e-6fa8e2f1b317", "value": "746158ba22b3af8f569c7410a55c3cd4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b6c6071-af64-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708188, "uuid": "74d817e2-0c72-4f3c-bc68-5ff5a91484b7", "comment": "Malware payload (RedLineStealer)", "value": "4e50652655f859a4f31b80b5831ceeac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708188, "uuid": "75a17227-67a4-4320-8874-9884e780fa49", "comment": "Malware payload (RedLineStealer)", "value": "2a33ff935116d2741e724574bdf25fbfce1478e68156b692601d5859c1afa935", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708188, "uuid": "3c9e8899-f2ff-4bfe-8250-d4373d163526", "comment": "Malware payload (RedLineStealer)", "value": "61e19f2d472e473c47440e34e6b7c8dec1f031e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708188, "uuid": "4676ef3c-aabc-47d3-b645-001657cf4f94", "comment": "Malware payload (RedLineStealer)", "value": "dd38bec974cb5e8f9e650efa72b62b277aba41b9602d3c91af9ca2e7fccd8bf6816c76f0f8dfa65cc08ba14a989c0760", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708188, "uuid": "2b057da8-bf1a-4427-bb43-6d9413e29894", "value": "T1DAE41207EBED8567E8A167702DF203D315363E509B345297778F3C6D18B22A0AA3176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708188, "uuid": "53e1fc0c-b1bf-41bc-9a29-139a568bedd7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708188, "uuid": "40e2b7cd-4c09-46f9-92ea-306138bedc04", "value": "12288:UMr5y90Yj18lq7oCNsbQEcu46IP9eGS9KU3RU/eL/9z3lXg5ELUdQ/AvhA4:tyzUq7xeUzPPI3U/eL1zp/4lp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708188, "uuid": "fb1c2529-c58c-4884-8a28-73c6f21371d4", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708188, "uuid": "2c3355b2-a70a-40fa-b31d-f89942c6348f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708188, "uuid": "f51b145f-50f9-46fe-9364-8b0b292d6956", "value": "4e50652655f859a4f31b80b5831ceeac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04a8d565-af6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676711828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711828, "uuid": "577c1a32-c664-439c-b9ae-9d58e029cb87", "comment": "Malware payload (RedLineStealer)", "value": "8d2926835c1c4c97159ff4c9ebc46490", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711828, "uuid": "6c3801ae-4c0f-47d6-bb87-05ab80b58753", "comment": "Malware payload (RedLineStealer)", "value": "2ac1a1e1e32fe4e86af8aca3cbc99d60177e79f015638bd3317d17d76ebea86e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711828, "uuid": "7631b8fd-80d8-408a-b8ea-3b740ca111e3", "comment": "Malware payload (RedLineStealer)", "value": "c8c3d8b6dc92e7374af02c443a8ee590ae4c49f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711828, "uuid": "b738e73b-e9f8-4e1e-8422-ac2fa12077db", "comment": "Malware payload (RedLineStealer)", "value": "2288240fdfeb4039d19f083ecdc973cacfe80d04b91dc083966ab88c5f09b4ff38bca77bef2ad9a6a9b56ee9eba6eb37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711828, "uuid": "9ae1a4de-0b85-4268-b11a-d7a74759afdc", "value": "T1F8E5338BF6ED0432E8F4573144FF42D31636BD96473487B6268758CA1A32460EAA1B7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711828, "uuid": "e81e4ea6-fb7b-4e97-a3c7-6762f49f208c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711828, "uuid": "0c0cd2e7-d186-4881-b50c-a74d92519c95", "value": "49152:YFlV7VCI2VYKC5rzF2RFPw75WY4jPQUdls9uB9WUSsjdSBLRFjG3QT:QVJCB3ErzF2TPwNp47QYdrDuG3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676711828, "uuid": "f0b0e6cf-f862-48e4-997a-54cdf6124a78", "value": 3154432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676711828, "uuid": "74408c5e-0ff3-4fb5-b62f-67a0cc87560c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711828, "uuid": "614b0df2-3f0b-4037-afdd-21ae03a162ed", "value": "8d2926835c1c4c97159ff4c9ebc46490.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19ad4963-af63-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676707568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707568, "uuid": "ade72e5c-7591-428d-af97-0c52396191a0", "comment": "Malware payload (RedLineStealer)", "value": "87bd8cc79a035b6b2991622ce6538991", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707568, "uuid": "506a5f47-880d-4841-bb31-63132b852c0a", "comment": "Malware payload (RedLineStealer)", "value": "2e0f796d16e4a89e5405468cf9db200efacfa12d3418443324e43831c2a023e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707568, "uuid": "2bcae3ab-bf14-4ea9-8896-ed0e810dd9b5", "comment": "Malware payload (RedLineStealer)", "value": "3bb091a5ff12225116d32a881e100739f7d951da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707568, "uuid": "b2ef916a-863d-4b76-94bf-b69a79d2d656", "comment": "Malware payload (RedLineStealer)", "value": "8db685111459f6eea99a1342c20e9bb7092003a8aaba31e295ac979d3d72d592f7720246f9e43ee2ffcb68427265c813", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707568, "uuid": "ed5a2acc-42d4-4ab5-98e3-91c9f7170a78", "value": "T182E5330B92FC4137F4B577B0117A82A31B327E932B3947671A4928EE1CF199572B076B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707568, "uuid": "cf0c931e-92fa-40fc-9ab2-14473f46a877", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707568, "uuid": "91578c4a-9b43-41ff-b3a6-5c488b93acd4", "value": "49152:rXhYmNNWTPwCwdsKv+AcafkAa3w5135cda2meAgRMMEBHJr8e3iRIFegXwGifD:sTPwXs2gWkA8qNqda2egRMMEBH58VKIJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676707568, "uuid": "d19357e0-b4e0-4dd9-a591-f44711092490", "value": 3122176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676707568, "uuid": "a2991e28-7501-4cff-809f-9a26b14a31bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707568, "uuid": "555061a0-8ae2-4122-a9d1-f26d61544526", "value": "87bd8cc79a035b6b2991622ce6538991.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01a2157c-af66-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708816, "uuid": "0b749db6-57b8-4515-81a6-79c900514c38", "comment": "Malware payload (RedLineStealer)", "value": "fb43c7e8e404402c0a179778676126f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708816, "uuid": "909fae61-4e48-4bc1-b593-5642b391a116", "comment": "Malware payload (RedLineStealer)", "value": "2f410840009abee6d4a83cc6482cb7da5f186b38392bd04da20045c2d12bd85d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708816, "uuid": "0e351b27-04f3-464d-b812-3330693c0d5d", "comment": "Malware payload (RedLineStealer)", "value": "14f3e2895579d336ec6e72c6da5683cdc3020e71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708816, "uuid": "2b4aab15-18d0-4bbe-992f-ffb3611fa63d", "comment": "Malware payload (RedLineStealer)", "value": "61e721021e5254f27e78f5700594051f01c0a1685b23430adae3cf1f135d15ffbfc5616d4cbefa59655d0101f8b627ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708816, "uuid": "a7ff22bf-5259-4559-90c3-8865521d454b", "value": "T18E54F21277D0D072C48B5531A9F0D2B52B7BB9115179C78727A8673E6FA02C2AF3C3A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708816, "uuid": "fc25bd36-102c-4956-bd22-18b28270bfd8", "value": "1189c0a2ecbe8fd35560b095ffebf6bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708816, "uuid": "ac8d0ac6-6aa3-4784-8a1d-b557d5533cca", "value": "6144:6BrWeiJeBu30VsAGBo5iXgd+Yzy4XY/Ar:6BkJeBCqsAoo5WENzyX4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708816, "uuid": "3808ba9e-ecb5-4876-b409-a894bb3426af", "value": 283648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708816, "uuid": "c217745d-ba03-4037-bcea-68a7cd509c7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708816, "uuid": "96b06826-f02c-4894-beae-10b38b01c79c", "value": "fb43c7e8e404402c0a179778676126f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2be85bb4-af86-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676722631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722631, "uuid": "654ce27e-b8d4-4c3f-a3d3-d666f7f115de", "comment": "Malware payload (RedLineStealer)", "value": "36e3feba3c30c665485ece400e9c0e9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722631, "uuid": "4b7fd5a0-6e3a-4330-bbe7-7e0712f554fd", "comment": "Malware payload (RedLineStealer)", "value": "2f5eb84fce28f5c72817232fcd4447480cc37797991de825b5c74cd1bb64a5f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722631, "uuid": "3d57abf5-ef0c-48fe-bae2-aa1480ea4c95", "comment": "Malware payload (RedLineStealer)", "value": "d799081d60e550de9128630ee6daf37703b73d5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722631, "uuid": "d0219b1a-58e5-43ea-bcaf-098f313a9cfc", "comment": "Malware payload (RedLineStealer)", "value": "a6bf40fa8a528021a28a1fbed7b471cf0d780472688e2af9b130940cd2319946fd52e391cf12d73be166074fa5695769", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722631, "uuid": "95d8ee0d-2503-4df2-b3d6-fe8a55cff1b0", "value": "T129C4024BA6E88132E8B45B7019F703C307767E606735D35B278BAD6A1D736B0A631327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722631, "uuid": "69ee497e-1f42-4172-b4f1-c85923d94439", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722631, "uuid": "43917c5c-91d8-422a-82aa-3b2b161245e0", "value": "12288:sMr0y90+WNjfRv1xnGSr+HLhvqcaZwZ9bqskmw:wyH2jQa+HLFD0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676722631, "uuid": "247923fe-7201-496f-8ca0-c67b657a5a56", "value": 570880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676722631, "uuid": "e5db81a5-12b1-47d3-93db-e08066e4ad34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722631, "uuid": "74f2e492-b028-4268-8af6-02a78590f5c7", "value": "36e3feba3c30c665485ece400e9c0e9b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e4c611b-af67-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676709509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709509, "uuid": "91a2aaec-5353-4615-a185-f217ba4329b7", "comment": "Malware payload (RedLineStealer)", "value": "917f8ee570ae60929e39e0a8105ec5d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709509, "uuid": "c3d9f177-bf53-4cef-8469-df463b5b1b2e", "comment": "Malware payload (RedLineStealer)", "value": "2fc1443b801e60fd5857f7da37dc68b5484b58d4ce88e4784f1b7593d27ef363", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709509, "uuid": "46988a33-7f94-4b29-94ee-7992ca481311", "comment": "Malware payload (RedLineStealer)", "value": "b6bd8c9951f522e9e77c99c71b93f371dbc5c98e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709509, "uuid": "3cde3e01-faba-4dc3-becf-3de907b24caa", "comment": "Malware payload (RedLineStealer)", "value": "6c162680e23bd4595b9d352745bdf862ccccc7a956eaff84063e3a36f42ad44cf4fb3a60d7048ea10436846af84c7f9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709509, "uuid": "786a257c-a40f-41a2-b78d-8cc9a667ace6", "value": "T186C40207A7E85132ECB517F01DF302D30A36FC614B38C75A228E6D5E5C72A95AA3536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709509, "uuid": "e390c615-7d36-46da-bdc4-9b0687f869e0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709509, "uuid": "1b9a6972-1323-4b5a-9162-15e678ac5cb8", "value": "12288:gMrLy90BSkNxZN+8sOXgYi4+YxlxyIGMw:by6Nxl+YxP3w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676709509, "uuid": "5c4bb86c-2afb-47b1-80a6-2d2d7fec3075", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676709509, "uuid": "583910c5-d4f4-461b-8560-86825398935a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709509, "uuid": "28238957-effc-41b0-9771-9548c29e0d30", "value": "917f8ee570ae60929e39e0a8105ec5d6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02592457-af8a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676724279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676724279, "uuid": "b339e858-695a-4663-99c5-ed456414fdee", "comment": "Malware payload (Formbook)", "value": "5d6cc3be61be6da345351e77e0e2d364", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676724279, "uuid": "331b4584-1253-4b37-a8d7-54e8ee367ef9", "comment": "Malware payload (Formbook)", "value": "30878b10f60fb6a1d6573ecea8246800052690ecc25c944c10ff8cbb57515a20", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676724279, "uuid": "01c352bb-832e-47e4-8095-aeb7bc2ac13c", "comment": "Malware payload (Formbook)", "value": "3e30bc6216e5b7c73a36aeb9b2eca18eab87b5fe", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676724279, "uuid": "1353a1cf-6088-4c32-add2-3acefd5327ab", "comment": "Malware payload (Formbook)", "value": "ae75c5819016b5a129a1cb94b2773216fe69bfa9c10f661ddc249973b8a8d23aa9e1f6c087332d991d939f329dd63fbd", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676724279, "uuid": "9dda975f-8720-4fca-b60b-7f1f6f59fbed", "value": "T19B441250AA67D95AC3759AF02D2867E1C03379602931F26A348F15CC4FEF78B162A357", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676724279, "uuid": "f3fd5cc3-cc84-4dbd-831f-193bdf4d18c8", "value": "6144:2ssuVIOEiuSdZxupsuJAk2zuGIc/7NAyfrQ+N7:t/EildZxumu2Sdc/KYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676724279, "uuid": "9ada910a-0e09-4b04-8a11-9d3e44cdb5df", "value": 260096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676724279, "uuid": "62d60adb-4c0b-43fb-886b-2760abb8acd1", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676724279, "uuid": "84525728-f441-4b5c-9074-5d1520d3867e", "value": "nPayment Advice - e-Advice Ref_GE533872939119022023_ Priority payment.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f9f4229-af64-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676708061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708061, "uuid": "5cbdf426-a5a5-4684-afcd-f47a176c393f", "comment": "Malware payload (AgentTesla)", "value": "a8a42b667df370714dc10df07f8c5405", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708061, "uuid": "531e9bd1-2700-4c5b-92df-f2d03c116b21", "comment": "Malware payload (AgentTesla)", "value": "30940d9b877543d2ccfc9a1b800a2459d0acb9b832a10766ba27692d70c9fc20", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708061, "uuid": "86458c99-0e77-41a7-8f16-1c7daf7810a4", "comment": "Malware payload (AgentTesla)", "value": "091a995fa95bfa8f21c18f410187e56aab31416a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708061, "uuid": "52485aa0-8bb1-4c6d-9ac0-e79f986af072", "comment": "Malware payload (AgentTesla)", "value": "e9a31a1dd81023e2fedcf3df1888e2e86c17cb17483a6c9a17d2da793d0933470f188bb9fd7e519c4923891e7a9a2594", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708061, "uuid": "33f30dfd-a6a5-478c-bd59-edbe61436fc9", "value": "T1DA6413086AA8C0B3D9B34A705E745F3756F677156CF1030B4B540FB539A12A29A5F3F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708061, "uuid": "d6ea569c-2ed7-4454-8e8f-0c13446fc1bc", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708061, "uuid": "22fc5aa4-2528-4f1e-9fd1-869bc8e5b7f4", "value": "6144:DYa63JZBp2PhodIq0y/yGKXz3vVwgg0iy1LpNPEnUkhD+v3:DYVJLuodFJ/yGKDNDgDEwUkhD+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708061, "uuid": "bfa6fb27-c302-4a24-8980-3f27f6604fb1", "value": 325456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708061, "uuid": "386218a5-bf6f-4c0d-aefa-8b1538b9ed9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708061, "uuid": "9cccf35d-b93e-47e9-9bbc-1065eb4db128", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6fd9d38-af61-11ed-88f6-42010a9c006e", "comment": "Malware payload (AZORult)", "timestamp": 1676706946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706946, "uuid": "e710572d-49ab-4c48-be7e-e3b268eb4c0c", "comment": "Malware payload (AZORult)", "value": "9cca8501babe60de4a0c31d2a8e75767", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706946, "uuid": "1b344187-83a0-4b43-a2bb-091d1b18c107", "comment": "Malware payload (AZORult)", "value": "30b676d0b67ccb1e3bbe2d3970590703261f16afab976b2ef20275f8a410ed11", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706946, "uuid": "668f5e00-dc77-43cb-8ef8-b4feaaa65fbd", "comment": "Malware payload (AZORult)", "value": "5f6a5743f6d6786190e6200dca3d83d9a9605213", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706946, "uuid": "e0a7a518-a39d-4452-8c41-dfd9e9330730", "comment": "Malware payload (AZORult)", "value": "3d74e33e283705e8ff27ad71058ed8cce7b79a070e8b365e021cd74f1f2b706717b184e831c859c1db5c982228949382", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706946, "uuid": "4e7966ff-9961-4669-817b-4fc9e4f53f34", "value": "T149D39D14DB58090E8D4B2B5BEC432E49447E40B9683A11BAFDFD074D158369DC37E7EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706946, "uuid": "8692251c-5cf5-4be4-8d42-91d17b678f56", "value": "3072:EbvZVYA71CIjVo3oIpJK1i+CvYE3X6/Kg05AQ65nyHyc+sIY8SpWoR2:wvZB7cmPeK1DiX6yFY2I7cWoR2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706946, "uuid": "426b1244-c016-49fd-9c13-20d3fccec172", "value": 130478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706946, "uuid": "35a21423-f366-40d4-a821-38aaf50be27d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706946, "uuid": "aa5cf822-0209-4bea-9449-53c07fe57f48", "value": "metalwork_orden_0214.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c349da0-af6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676711840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711840, "uuid": "46e0393e-2069-45ee-85cd-5693147b9257", "comment": "Malware payload (RedLineStealer)", "value": "732f692adeead40f5f93aae102cd0c88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711840, "uuid": "2cb22dfa-9c95-4ec4-814f-5a0f6d4b876c", "comment": "Malware payload (RedLineStealer)", "value": "30fae0cfca494715f6252ffb6f20f822ebb250df7e6db46d3a565f3600a9788a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711840, "uuid": "a7eb2887-6d5e-4e12-be25-743dccb7aaa4", "comment": "Malware payload (RedLineStealer)", "value": "2ac657b7a62df5b9a1684a00f228f0cc277bfab7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711840, "uuid": "01b39bf8-48a8-4594-b78f-8db4addd368e", "comment": "Malware payload (RedLineStealer)", "value": "95eefa2b66eea1beaf54576c6c070454ce4be1d60a8bf81032510e84316954fc5758eb6612c4ba4dba8b13c427b4b9e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711840, "uuid": "c6d2b99d-2939-4f51-b27b-1f5d67065742", "value": "T1CA74BF03AAE87C40E9264B739E2ED6E8761DF760FE0973662259499F85F03B2C173750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711840, "uuid": "5321451e-57a8-41ac-a293-d5843cef73e8", "value": "c300bf53760e8f2f60cd0361a9c25234", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711840, "uuid": "97204817-66df-4389-b078-7a96094e310f", "value": "6144:mz68LkXYPGx2t4BiQ/ao0ITxzCv9pWtZHJlUfW0tzCKoz:m9HPI2t4BioYv+tZpb0RR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676711840, "uuid": "b4a385e7-cfc5-453a-ae09-e36d96ecb3fc", "value": 358912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676711840, "uuid": "53d8ff5c-b625-4fec-86dd-4f074028f59f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711840, "uuid": "4209e0e3-5904-4334-9a63-9839fff88a4f", "value": "732f692adeead40f5f93aae102cd0c88.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9347b7dd-af87-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676723234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676723234, "uuid": "9ab231c6-15f2-4a2a-9d86-c05e2370a24f", "comment": "Malware payload (RedLineStealer)", "value": "5473f638d07c14ed0343613520f16bee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676723234, "uuid": "ab58c5a5-3c06-415c-a423-6b24ed546af9", "comment": "Malware payload (RedLineStealer)", "value": "3387be9656b507db05217afe6c085ad7513f5f40382853f6f500dd8a0ddb414b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676723234, "uuid": "f3d2d8b5-49d6-4a50-811f-2ab22e8a1f04", "comment": "Malware payload (RedLineStealer)", "value": "71c75ffaffe4f643e31e4efbf3c8324d0d4075c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676723234, "uuid": "af3298b9-9a66-4c43-84c8-ab4095349ba9", "comment": "Malware payload (RedLineStealer)", "value": "9b55abea21c20e176524026cd22a462f94f194a0a0c60585b3c7ef248ec5a5c1ad27ff9cb1629ea4cedf3cddfc9eb3ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676723234, "uuid": "8500c682-0d5a-4e55-b2cc-ef3d9d9c38f7", "value": "T16CC4020BAAF94073E975637028F707C31635BDA14B3983872B5E9D4A0CB26A4B53537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676723234, "uuid": "c512456c-572e-4b31-a41d-408f6c99127d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676723234, "uuid": "a00f2089-2fad-4507-bd12-dad674a76628", "value": "12288:XMrny90ryvbreUHgVryjIUsNh0SefMT5Bc95zXNsw:gymyvb56eIf0S95y95rNsw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676723234, "uuid": "ecf62cde-6990-4ec4-a291-f803dd755384", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676723234, "uuid": "36fb9465-82ae-4f3c-88e0-fb17a68093ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676723234, "uuid": "4a4a7084-9367-41bc-b72f-270fb7206638", "value": "5473f638d07c14ed0343613520f16bee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48d879bc-af69-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676710224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710224, "uuid": "320a88e4-63cd-4231-9867-ee7db7a07b2c", "comment": "Malware payload", "value": "c4b8aebb8e8e37b17bd2f2f1d642d0ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710224, "uuid": "72e5647f-059f-481f-81a7-45459cb8ffd1", "comment": "Malware payload", "value": "343677962738056afb18481da92493241221b2f2280ba601d983c639061b9b0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710224, "uuid": "8fbd1523-3651-401f-a25e-973d2de2c566", "comment": "Malware payload", "value": "1132c21a222b380052f59855ae36704b81101009", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710224, "uuid": "0fc3f632-2284-4e5b-ab06-d63a978ed8fc", "comment": "Malware payload", "value": "60fffca493ec5031fea0c89f23070aa90d9133a54b1d215b1bfc3a1bcd50336d1695e9c9cbe44d091ce35a328524c1d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710224, "uuid": "b4ab8887-c99d-4b6f-9c13-2c4774ead3f3", "value": "T143442803A2A17C61E52556729E1FC3E86E1EFE509F5ABBE71219DA3F05B11F2C633240", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710224, "uuid": "61e42b6b-48ac-42b1-b41b-2dd4ed3f1486", "value": "2c399d381d03e44b02e91ad01ca3c756", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710224, "uuid": "d663bba7-2f15-4046-866b-97cdeb8c9378", "value": "3072:wr6uV+U34/MGgI5y5RbohIl5gqMz71V7DJGbj9/6rBxL4uPqrKuI9nfy:C60ylp0UilWqMz71lFGErL8uPQpunfy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676710224, "uuid": "b4f3c1fc-618c-4c1b-86d1-29e310f6d26d", "value": 269988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676710224, "uuid": "146028d3-9e16-42c4-9741-af7846639e1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710224, "uuid": "95383f31-4c68-4738-91bd-29d039aee6cd", "value": "c4b8aebb8e8e37b17bd2f2f1d642d0ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b1dd1da-af86-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1676722683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722683, "uuid": "a63fa851-9746-496f-bff7-90d622bf1542", "comment": "Malware payload (TeamBot)", "value": "3eb8fc05a7968465034bafd019786578", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722683, "uuid": "96102fad-88f0-480a-8459-447d2961a0ee", "comment": "Malware payload (TeamBot)", "value": "348ae2e449af8f83e056c6e07088c8fd79c1b9ef348923ce339cd0d196d07277", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722683, "uuid": "13f24ddc-81fc-4996-8495-2be64b7a24e7", "comment": "Malware payload (TeamBot)", "value": "2f9417f4de4ce616e33eacddfebf2f06fa470bb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722683, "uuid": "869cd0c2-90ab-458f-86a7-324d85ef885f", "comment": "Malware payload (TeamBot)", "value": "37219af2c9b4d254700d8ff52d874c12b13a8fae41a6cc429409d3795df7a38f17006c9111f72e38efe6cfd1082f5157", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722683, "uuid": "ee6a571b-abeb-44bc-9cd1-c0a616734296", "value": "T113448E337AE83D50D91A4B329E2EC6F8761DF560AE0977661218595F45F03BAC2F3388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722683, "uuid": "14394dfc-7625-4bb0-8116-60445ef5cae9", "value": "8b23c6f110add61e2d6f38c3c2656d60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722683, "uuid": "6132e03e-0c8b-428f-a53e-1554a8a7ee84", "value": "3072:el2TwL9KYIK7hDkKJp/5mwdy4xZ5kkQNrg2iuVuc1V:eOwLN7///RhxZ5GJn1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676722683, "uuid": "a77738f9-5c6c-492e-ab6a-c561ba9082e3", "value": 254464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676722683, "uuid": "4b10c161-972f-43c2-97c6-67596e628c4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722683, "uuid": "55253f92-0f60-4eaf-be02-beb9ee83793a", "value": "3eb8fc05a7968465034bafd019786578.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa8a2379-af65-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708804, "uuid": "11e1257c-7804-4082-a132-d5824d877299", "comment": "Malware payload (RedLineStealer)", "value": "9e12e7a8b5d4a5f28e8235d367a97645", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708804, "uuid": "4547fc4f-b44b-4a92-9465-9c2358bc1721", "comment": "Malware payload (RedLineStealer)", "value": "36bc6b32db709c1c37b78991949e533a100a10977d69eec644eef2a11bf0b204", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708804, "uuid": "fe20a8ac-b1b1-454f-bd31-981321cb52a8", "comment": "Malware payload (RedLineStealer)", "value": "da2a074d47bed79528bc0f5b98909987769ac6fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708804, "uuid": "f11b5f9b-ec4d-4657-9eb5-e05049fe6f8f", "comment": "Malware payload (RedLineStealer)", "value": "1f3d591398f0c5c9181108f0c3e2b3e63eb0b38c04191c5b0293f263d89ed550ef42d64810bbaa228fac83f83c6357b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708804, "uuid": "d6fe91ad-7c2b-4f96-903e-d5db97727fda", "value": "T114E4124BEAD8C422F6B1577409F612C306393E725B7843A6274FBD6E2C725B4A274363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708804, "uuid": "49d0e764-246e-4dec-9c1d-8ee845b19bfb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708804, "uuid": "760ca38d-b775-4161-8ee1-a4c763b5de5d", "value": "12288:mMrZy90BI1eGGmB/ah2ERwfZyhT7I4+JBEkerhKi5jF1ZmBep4agiH:fyvwE/akEayhTSCk8hflnZmS4axH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708804, "uuid": "d0a1f4a5-562a-45bd-b3d1-90aeb8416071", "value": 677376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708804, "uuid": "3cc25e00-1b81-42c5-b57f-64ad3c7f0312", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708804, "uuid": "6e1b47ec-9bbc-443d-ab26-c5f487d0efa2", "value": "9e12e7a8b5d4a5f28e8235d367a97645.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3b5ba27-af65-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708793, "uuid": "e8fbc2e8-1401-4dcf-98b0-791bcf834cad", "comment": "Malware payload (RedLineStealer)", "value": "eef42c49b2c3ccdd3b566854de8b7fee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708793, "uuid": "7ffd1b0b-5b4d-41af-9428-d13102b6adba", "comment": "Malware payload (RedLineStealer)", "value": "37b3b2490fac285961c47acdc781a855b75a1fb76bfeb2c9ce7f6ad476a2f799", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708793, "uuid": "0d9802ca-e78a-4f0b-95a0-79332bf8c895", "comment": "Malware payload (RedLineStealer)", "value": "95d67150723cc6a60bfd05dbddd46932ef83444f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708793, "uuid": "1bb16953-0544-4b87-bb83-f930144e54b5", "comment": "Malware payload (RedLineStealer)", "value": "a55268dfb58725fb44b556cfd53921fd1e41094b668abeae0e1416194ee64ed3fde9052a613343fa3cd2f51ef20ac41d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708793, "uuid": "a7a97417-856a-4125-a32c-25d7f41c6484", "value": "T19AE4124BE7FD8422D874577049F613D329367EB05A38825B26CF9C4908B39947A3673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708793, "uuid": "4fd56e88-f938-44c4-8b0a-a8d24b3a987a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708793, "uuid": "6d95b636-8c16-42d3-8ec4-f92b071f9785", "value": "12288:6Mrby90I/P7nTVQK1DG3IsTxU7Gt197EGsD5Gy3mN/Snyem6nye:Vyb/P7TV1GDf2rGyJyem6nye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708793, "uuid": "b2395cc8-9d7a-4ff1-8a22-df2efbc2a63a", "value": 691712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708793, "uuid": "db3277bb-a717-4715-be72-da0f2bbf918f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708793, "uuid": "bbbc1011-a1de-438a-a0d0-8e82bed81b1c", "value": "eef42c49b2c3ccdd3b566854de8b7fee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdf6e051-af6c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1676711817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711817, "uuid": "fcc5b1af-7b18-422d-b3f7-7e9bcfbca3cc", "comment": "Malware payload (RecordBreaker)", "value": "8f0d49001382056bb22d498b0c1e8426", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711817, "uuid": "e2d34b73-d2c1-4307-8b42-e21472fdbe24", "comment": "Malware payload (RecordBreaker)", "value": "37b90013b2b05efd0ff943fb6b3173bc802d5cc7eb0d24801ee5c298f30b5b3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711817, "uuid": "c1a87d68-be00-4010-bf2f-d1841bdae6b3", "comment": "Malware payload (RecordBreaker)", "value": "eb76dca9b1b9b927d6b4895f7041c9e8656b91f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711817, "uuid": "59ebaaaf-fd99-4169-b3a1-f82ab2cf47b8", "comment": "Malware payload (RecordBreaker)", "value": "3f01a6d34d62201836236bd66a244ee1957000125e92f06d6523d561166d66aae5bd56425aa558ee3df01b9b5236bee9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711817, "uuid": "19f23b80-4c5f-4304-a2a4-3216d1fd97ae", "value": "T1EF76237623A0109FE3D68C31422F7EE662B53FDB3641EC3816857DC125325D0AA6DAB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711817, "uuid": "57f977de-6564-4a1e-be5e-bdfc3008ae79", "value": "161839a78ef6f07a30d3f07895f6fe23", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711817, "uuid": "e460fde3-83fc-4c00-92ad-624da07fe2b8", "value": "196608:hJwaVL4x+Zr1By4jOrscVh6qpmMgkFbO8E:QaVLACrvTOoiEqpmMxb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676711817, "uuid": "4a100000-0575-424b-8589-5b6b7def0fd8", "value": 7313920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676711817, "uuid": "b936a282-9528-4b4d-9b52-f014ba38fbdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711817, "uuid": "348ad0e2-4f75-467d-aabe-6681143f2a95", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47272d74-af6c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676711510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711510, "uuid": "e6ad1e9d-7ea8-4f4d-b49b-0d5f6e449b80", "comment": "Malware payload (RedLineStealer)", "value": "5d2f256cba020ad24ed29fdf8ff680bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711510, "uuid": "327ec74c-adc8-4604-8ce0-d813ea3ed5dd", "comment": "Malware payload (RedLineStealer)", "value": "38d72bdf9398e538d775bb1601a47e77d5c3c4d0479d13c14f2627bd26d8490c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711510, "uuid": "de2ae50e-682e-4e5b-9303-8c6e957219d1", "comment": "Malware payload (RedLineStealer)", "value": "158e3574b78a29ce235aca0fe1bc71b814022454", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711510, "uuid": "f23a97ab-6d10-41d0-b788-e45ff3d0860c", "comment": "Malware payload (RedLineStealer)", "value": "d79cede12abdd554f044655ec479f6a564ff379235bf9a3e683c2b2c312dfe1d826701919c6f44e212388ba07ac3b0d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711510, "uuid": "41427689-8235-402b-be6d-ac732af9d69f", "value": "T131E5335BA9EC0433EDA50BB14CFB43A33B367BD7673C87D2028715551E9226A72A121F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711510, "uuid": "81d04092-0f09-4da7-84d1-f995290cf8d7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711510, "uuid": "9b4f64a3-d651-40fa-bfb1-e0299c1d2b25", "value": "98304:iUex10UKTRGpb0pYGvWxPqNAlh8QKakxpecG:iUexCPtG4YGORisG3akxw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676711510, "uuid": "2408df1c-bde4-491f-8ca0-582ad1ddf3b1", "value": 3154432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676711510, "uuid": "1a93b456-3515-451c-97ec-85b1464b5117", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711510, "uuid": "bba8b039-0b36-4bc4-8dcf-901eebe76258", "value": "5d2f256cba020ad24ed29fdf8ff680bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98e95b85-af64-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708211, "uuid": "52171706-e86f-4472-bba6-53c754349db7", "comment": "Malware payload (RedLineStealer)", "value": "86997de6c96f4411a4cc1c6d3c48e288", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708211, "uuid": "4599ff4b-6f0f-425a-85bc-c37bef860ba8", "comment": "Malware payload (RedLineStealer)", "value": "38f89f3feb0576eaf45e0ef87a2e1ea4fcda4719905355014f88e1f60b751204", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708211, "uuid": "7c876c32-45dc-44f3-bda2-4629ba763ead", "comment": "Malware payload (RedLineStealer)", "value": "baf162995631d2947fbd5af7cac91f8fa302a5e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708211, "uuid": "27eaeb99-4def-4fab-a729-f881b4670d8f", "comment": "Malware payload (RedLineStealer)", "value": "68358e04b85fdcaf4b0605d5bacba393d797349af74b5e1a0483430f361bb6885dd1b1bcc9b6b45deb2725560618bad8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708211, "uuid": "fd639c6d-0577-45de-9b5e-b97d3e19c6a0", "value": "T1D5E41217BAE94572E8F167B119F603C31A37BD615D38839B234AAC592C726B0733436B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708211, "uuid": "bc2aba22-4e35-4b74-a112-4bf52a91670c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708211, "uuid": "d4f7b5b0-0ce3-4529-ba4b-88da61c6c616", "value": "12288:qMrFy90PBMOO3arrUOna163hXy7NMa8Qk3nhNTQ56mPbJALQExRrY+co:rykSOO3ar3a1ih3CkXjTQ5HPbuUEL9co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708211, "uuid": "79acec09-c3d5-428a-a569-b0d6bcc93e1d", "value": 687616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708211, "uuid": "a8e49572-99e9-4eea-a636-17ff84adaf6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708211, "uuid": "911466ff-1f82-40af-8781-c7961525a8e8", "value": "86997de6c96f4411a4cc1c6d3c48e288.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b9b4a1d-af65-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708511, "uuid": "4ce7ebcd-187b-4616-8f35-6e460e3dfedd", "comment": "Malware payload (RedLineStealer)", "value": "583b02651c8715cc246e15339538e0ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708511, "uuid": "1e0f9844-edc3-46ad-8534-827ea99c8264", "comment": "Malware payload (RedLineStealer)", "value": "390981345909bcf9e2dea6ac6bec35f3deb835b475afe3dbe9b8732d8e9031ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708511, "uuid": "d80d3d2d-60ce-447b-8d12-89f97c7d2586", "comment": "Malware payload (RedLineStealer)", "value": "541875a73e31add89745ab188ccbe1bb13bf21a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708511, "uuid": "fc343504-f4e2-42a8-94c2-9f852fd1f82a", "comment": "Malware payload (RedLineStealer)", "value": "2dd716bd60f5f2167a97a1448cc061275f28a2687a0e79de7b20a916ee015c92b8636ad2ee3db96325e5c596f830f5f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708511, "uuid": "34e11073-528b-4631-805f-2e33796af41f", "value": "T18CB40107ABE84033E8B6AB702DF602C3163B7D20AB348657174F9D5A0C722B4B675767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708511, "uuid": "df203414-6d74-474e-b789-c797b92ae87f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708511, "uuid": "ead0b1a5-d07a-49bb-a560-d1c8d6674343", "value": "12288:PMray90Enc4EsJj+h2fq9fV6EZkQHHEq5Lfku8C:pyLmsJq1f8ENLWC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708511, "uuid": "caa50e2f-b650-4f28-916e-3e2011b85026", "value": 528384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708511, "uuid": "75e6cb11-b829-49b0-9fb4-55f57c1e9c5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708511, "uuid": "96fa4534-ff41-4fe6-a32d-717e75788db2", "value": "583b02651c8715cc246e15339538e0ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "880e570c-af62-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1676707324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707324, "uuid": "78319a13-cafd-4063-9565-450ec2f16b8d", "comment": "Malware payload (TeamBot)", "value": "3c438fe7415755367e1db055457ba3fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707324, "uuid": "c323e772-edbd-4a9b-a698-0c1efce4cfe3", "comment": "Malware payload (TeamBot)", "value": "3a215e3f20150b83e390f7e63e10eb692d9f5f862bc593496afa9d3128c4b397", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707324, "uuid": "37c328db-bbfd-49dd-a304-9fb24fb4ec0f", "comment": "Malware payload (TeamBot)", "value": "56659398badb2c5dbc21784a34e74b740da8aacd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707324, "uuid": "e50b34c6-9670-4f5c-b39e-4cbd2b7ae755", "comment": "Malware payload (TeamBot)", "value": "27f4d3f29fa09f0e2e4f0b8198169a0184adde29daaad0a055c4e0e47f1b9c40f27bc26a2d4894608e6321c9efd537ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707324, "uuid": "12e95f10-36d1-430a-aa6c-9750989b79be", "value": "T114F3D0127AD1C071C1A751305860D7A16FBEBC2259B0968B3BA8173E5F70BC25F793A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707324, "uuid": "47548542-eb58-4ee2-9d3f-2f979f51fed9", "value": "1189c0a2ecbe8fd35560b095ffebf6bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707324, "uuid": "412ab512-fee2-4590-ba29-c0a619d25117", "value": "3072:dMDVt+p8ZzO3rbNeeT+xs8+XzYB1gbQR8+2KKjXRsdm0ag:mRt28Z63rBeeZzvu2nTudm0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676707324, "uuid": "5344b0d3-a0b9-4a53-92d4-e5d54802e8dd", "value": 171520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676707324, "uuid": "9d645a13-d056-4c2b-b389-294ebd70c7c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707324, "uuid": "6976c0f5-c271-4537-931d-7a871b713e84", "value": "3c438fe7415755367e1db055457ba3fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65188fcb-af27-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676681925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676681925, "uuid": "7c615913-4051-4e13-a052-3094001167c3", "comment": "Malware payload (Amadey)", "value": "45468661bcc4aec731c71e20f0c901b0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676681925, "uuid": "61fa9d65-aae6-4486-991a-07edb3ffe0de", "comment": "Malware payload (Amadey)", "value": "3a33afc3b70224236136b758367745f98be78ad47f9dc62a8f61a0a5da749e22", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676681925, "uuid": "2db2ef53-1225-4fa1-b768-205f96b25442", "comment": "Malware payload (Amadey)", "value": "d694122fbf9c37cfcf16da53f82470d6ebc3be7f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676681925, "uuid": "5cfd7c40-95ee-44b2-a9ed-db98550e28ce", "comment": "Malware payload (Amadey)", "value": "3c5883e228bad9cb37115396b65fbbd7359a8dd25d1d3b9d487b8005d18989c1f80b8cc875ea088b4e2f3604a81bc35e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676681925, "uuid": "3ea16f52-fc20-40a1-be83-398181f393bf", "value": "T1C7F4120BB6E88072E8B457B055F612D3193BBD215A79C38B338EAD490C729B4B231767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676681925, "uuid": "6cbbfc9b-af74-411b-a114-4e314a9037d4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676681925, "uuid": "0658828c-9cd1-42cc-9fce-eef38a009075", "value": "12288:fMrLy90QZoDSwrQueP17hHquZdTlNTQ5s3PcLFEmi:8yHsr+P18uZdTfTQ5QP1mi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676681925, "uuid": "d7ea38b3-36ec-4232-8c3c-08eef5c67b3a", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676681925, "uuid": "b637f4a1-2361-4656-a54f-e6a455d91ba0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676681925, "uuid": "9a6e6f36-1dec-4736-923c-44a6d9a009d0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0824fb4e-af6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676711834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711834, "uuid": "3bbdfe4f-cbba-4ca3-8131-c5df1b3c41d1", "comment": "Malware payload (RedLineStealer)", "value": "dbaccb5cd4dbb9785c4907d9e9a9dbf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711834, "uuid": "61b7c7d1-82c5-4d77-adc7-d1f87d9f18e9", "comment": "Malware payload (RedLineStealer)", "value": "3a86c0311d4cd63f72e20bdad9163a7adc46b509a60da180f33593549b83df55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711834, "uuid": "b18c28b3-82db-4ebd-a91e-24ad6af21349", "comment": "Malware payload (RedLineStealer)", "value": "578bd54529c358d3f29e93a8f7fa99908123fae9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711834, "uuid": "f85500ff-2f61-4db1-90fe-1a88d874e6ba", "comment": "Malware payload (RedLineStealer)", "value": "47fdb1148f6087b020eeaf45dbcea44b33d4861a79f196057e1846ddb15e01a88b2cacca20b70aba42566818320973f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711834, "uuid": "665c2968-3a91-466a-b845-1a70021f9341", "value": "T143C4020BEAEC9436E8F417B008F602C31636BDE19639875B574E2D691C73AA0B53573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711834, "uuid": "dbf8a15e-065b-49fc-b5c3-659151a31d41", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711834, "uuid": "12c4115b-ff1c-44ea-b08d-f20ff045d042", "value": "12288:BMrGy90Gz0eSdOpieMIpuE2Dau0FsDzHgQk8GTXex70y:PyPiYvMIpP6aSDzAdNza7B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676711834, "uuid": "9c8dac72-6a03-4a04-ab8e-eec5662e9129", "value": 569856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676711834, "uuid": "0a0569ef-c92e-43c7-b9be-7d1d009da358", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711834, "uuid": "eef8572e-13e9-4758-9ec0-bddfe2a96e91", "value": "dbaccb5cd4dbb9785c4907d9e9a9dbf3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abf881fa-af61-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676706955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706955, "uuid": "622051c0-c642-4369-8271-ccf70aad6247", "comment": "Malware payload (RedLineStealer)", "value": "0c95cda3895eb073414c716d186e4004", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706955, "uuid": "406a973e-fe75-4985-8701-79b9ce548a65", "comment": "Malware payload (RedLineStealer)", "value": "3baa60570d3b29c6ad081cf1cf3c87b3a2d6f0a8c0218acb72d03aa1042b26f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706955, "uuid": "95d7625f-a459-477e-a7d1-a8481bdcc5ce", "comment": "Malware payload (RedLineStealer)", "value": "ca83c35b986a6e5d0d952de33787f0d93ebf21e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706955, "uuid": "9ec1defb-1570-4a1c-a4d8-772a691a90ff", "comment": "Malware payload (RedLineStealer)", "value": "0f1d82da8c32fe5e89d9b84d7b91925a74e6121e4b0b24e33c1d61da13953d53b938474e23485a664e5f90c30357e988", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706955, "uuid": "f5090451-3aee-40bf-9dbc-a076bafc69fe", "value": "T124E4120797FC4432D87567B15AF203D31B3ABE219A78C356234E2D9908729B4B6313BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706955, "uuid": "8f695aff-3497-4085-9010-0e17a4889400", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706955, "uuid": "1b9aef39-771e-4f3d-af43-611235a1b341", "value": "12288:RMrey90kqY+hYMI9DjXbNICnGwHJF6kVkeqLarFqZ+MSSoA4a8p4kOpgje8:nyWY+hV0DDpGkxHF4oh4Uj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706955, "uuid": "94a893c2-7726-4ab0-811d-4aeab75b0216", "value": 687104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706955, "uuid": "74633e3f-ee4d-4413-a460-9cf21b02f47b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706955, "uuid": "fd7d57de-1c3e-4ffd-823f-0b64c69a19c8", "value": "0c95cda3895eb073414c716d186e4004.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7af9e05-af86-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676722973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722973, "uuid": "12f59b48-ffe4-49ab-9510-6e5943155283", "comment": "Malware payload (RedLineStealer)", "value": "fd7c36d1a36c308d4d057672b6f5c199", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722973, "uuid": "58226c38-1c25-472b-89b8-38f591a6c978", "comment": "Malware payload (RedLineStealer)", "value": "3c4f5ec6a5bff324424c2481aa8cc165e27fe27530fa7c9b11be5dbeb3066230", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722973, "uuid": "ce4058a2-285b-46af-ab31-9ff4d493da7c", "comment": "Malware payload (RedLineStealer)", "value": "3b583193873d5ee9711eb3ed1aa6e82412c1306c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722973, "uuid": "0cbbc6bb-f5ec-4338-9ccc-6fb1c833b2e8", "comment": "Malware payload (RedLineStealer)", "value": "ca1447c0a7a07ad6ad7abd05376f9562efd7a26beb543cf60c04e61818c9f3a8fcf727cba1ddee6fdc0df400bf5cae77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722973, "uuid": "e05cbc30-b33a-468d-a4c6-7c80a930f0ad", "value": "T1FBE5331722EC0173F4B51BB401AB97C71E75FAA3596C4B8B27475C5E08B23A6E1B2363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722973, "uuid": "ed52bce7-2d5a-42a3-bc90-ed3f1162ca58", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722973, "uuid": "7be532d7-fda6-457e-8832-4fbc31366d53", "value": "49152:hsSfTMBlf0T1Hep6kOy1uuyLyaDEGmEJjUJTeMPKmscmB3sLunVsrRzZ7B:WS0F5O5uzGmEJE9PVs7FsLuOrRzr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676722973, "uuid": "a5fbc905-ff69-4f03-a66e-a6ac9b380b8c", "value": 3159040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676722973, "uuid": "d8d36e8c-165c-445f-b1f3-7eb77c5fb718", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722973, "uuid": "142897c6-d0da-4d65-94e0-c72fdb1926fb", "value": "fd7c36d1a36c308d4d057672b6f5c199.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47a34338-af65-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708504, "uuid": "87cd1b8f-cf88-467f-bf7a-5c322b4bc639", "comment": "Malware payload (RedLineStealer)", "value": "64a66d31063155efd169283a5472fecb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708504, "uuid": "c6fdd7ef-feaf-4a2c-bfdc-d17c05c52472", "comment": "Malware payload (RedLineStealer)", "value": "3c9c3901f6f448faf8a07226fb1078ab3a804ad6dd734e510068c595772edfbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708504, "uuid": "0491293a-dd23-48ac-b38b-9005333641a2", "comment": "Malware payload (RedLineStealer)", "value": "046fd4c73b8120ced0dbb4ce1d836d7985eaf1eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708504, "uuid": "ea194fd7-eb95-40e1-bd7a-52c0856e6e3e", "comment": "Malware payload (RedLineStealer)", "value": "765b2324cfc8e79d0f5cb5e6b46f97e76fc67e38845b95c6aee67086f25923c88452a1385576d7eeb33d082b709c3d39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708504, "uuid": "435dc727-d82e-4439-94cf-810191018536", "value": "T1A2E53347EAD054B6D2B02BB445F545D30432BEBA6E355BCA32019DDB3C22974B738B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708504, "uuid": "84d63720-004f-4a23-a2ee-ba5fbfdcfbf8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708504, "uuid": "2ed71e88-823d-42b9-a5f4-45148cacdd91", "value": "49152:VIe/yKUiPLzTTZ95i5iQAjkZ8dghs5iQnJY9F5TWYi9XT9ICHHjEZh36Cp/:ae/vr5i5eTdkGiQnJY9F5KYiNHAZh3x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708504, "uuid": "a8cced80-160b-4093-aea0-35b5897ebc16", "value": 3124224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708504, "uuid": "88d1bd02-0a40-4de8-8752-ed32cccef512", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708504, "uuid": "0731b213-c530-4930-8910-d4ebe8b55d21", "value": "64a66d31063155efd169283a5472fecb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcb90b76-af8e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676726310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676726310, "uuid": "031104c1-3ccd-4edf-9231-e02c4edbcf2a", "comment": "Malware payload (Smoke Loader)", "value": "25fbf05368b42f1dca2fcb6f1a5d211a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676726310, "uuid": "c7d3f596-20ee-471b-a1bf-2c61691a5dc7", "comment": "Malware payload (Smoke Loader)", "value": "3cfb91c3c0f6ae7b2ca3cf117487660f59c7a1ce9bcdb11643c6b63e15f3e2e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676726310, "uuid": "69889d26-48a0-4ddb-a5da-f33995f6e85a", "comment": "Malware payload (Smoke Loader)", "value": "aeb1165ffdff914972df09af64a60db9236118c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676726310, "uuid": "e6118ec4-f0e0-4059-bf70-2ac07fa325a7", "comment": "Malware payload (Smoke Loader)", "value": "16e86a413a63714b531ae726818a921be41aa6626f03bd9091a90741646ad48bf726c82b167e7af9d448a5d189125fc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676726310, "uuid": "a1af1f45-98b5-464f-9bf1-d8d5f23c8c7b", "value": "T12834AF03A3A07D93E61246729E1ED6E47A1DF9704F4DA36792381D9F08F01B2C6A77E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676726310, "uuid": "aec25412-a219-44ca-9326-e141ed358944", "value": "7a00f8b37dcaacef0b587f3f169176ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676726310, "uuid": "78bf6306-145a-4e6b-9db6-9b962dbf9f9c", "value": "3072:du2nlLk01YIW0dAsiMvvf6W7BR3RavHFBdS46du5VUXa+:oilLi0EMrBReBsoT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676726310, "uuid": "289efad7-1f50-457a-aac0-2e30943cff52", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676726310, "uuid": "fdcfc3cb-f2d5-4dc4-93e5-ee9114a90d08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676726310, "uuid": "b01ceca9-799f-47a7-8a83-8565dfb917dd", "value": "25fbf05368b42f1dca2fcb6f1a5d211a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dfeafdb-af63-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676707575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707575, "uuid": "9079dbf4-28a1-4f66-98cd-5db96281067b", "comment": "Malware payload (RedLineStealer)", "value": "2f3e15af86d4be82e9a616021fac5f99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707575, "uuid": "8d836188-10e6-4022-82cc-3796210935db", "comment": "Malware payload (RedLineStealer)", "value": "3eca2d42bf74dfdcb63444f6d2efd4ada5c0621f5a9b877f981bb55b1fcf6a8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707575, "uuid": "1ff97963-d5fd-4a9b-a9f4-10f53dde199f", "comment": "Malware payload (RedLineStealer)", "value": "63b2d8b42f8d779f9629c0c0a150a21471cd717d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707575, "uuid": "dff4a673-bc40-44c4-adf8-97a433ba8e3b", "comment": "Malware payload (RedLineStealer)", "value": "0d18158b8a72f3f5a401ca3c01fe43053026daa7c3612f4ad4d6336bd4b0bc98cf738efef521043c9c82bc5a8ea3058e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707575, "uuid": "b0e03a6a-c4da-469c-89fe-ddf0d611f57e", "value": "T1DC44F11276E2C475D06B5A31AC348290BA7EBC629771C9573B58023F4EB12D25F3B36B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707575, "uuid": "7d6a8e2e-ad95-468f-b3c9-bfade0de9646", "value": "5d842fb7215bce40485e598d67956fa7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707575, "uuid": "c65b4001-b146-4f87-875f-a604fb4bd7c5", "value": "6144:VGEzubYQ3R4PPoy8w+YmO+jpa60tHEBG5mCmyY:VGDbYE4Ho/YmOpRtHEBG0Cm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676707575, "uuid": "708634a6-9601-4dfc-a9c4-a75102031f6e", "value": 265728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676707575, "uuid": "8cb6a400-d7b8-46fa-9fd2-1b2e04f5ee36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707575, "uuid": "ffd27e83-feee-4164-9c45-7cbedb6fecf9", "value": "2f3e15af86d4be82e9a616021fac5f99.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec046755-af9a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676731543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676731543, "uuid": "784ad970-f167-49e3-9d14-06dfbb1563f9", "comment": "Malware payload (Amadey)", "value": "09308b6cb8e480ec95580ef52d3a6406", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676731543, "uuid": "819bd405-9a70-4245-9a03-d4fcd02a0e01", "comment": "Malware payload (Amadey)", "value": "3edc23c06e853f72ff1556cb8d178ee42cbefa77ea5c182d0015a35db3b8ac9c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676731543, "uuid": "420b5afd-05bb-44f3-86f7-6d29de9b4f07", "comment": "Malware payload (Amadey)", "value": "4fe14bbbc6adbd5c2a09222ea7c851d161b45692", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676731543, "uuid": "7cb76a15-8ea4-479b-9212-45b35a839414", "comment": "Malware payload (Amadey)", "value": "c943ed8249f2e64e1d179e341db48b873d07dd37707bfce7f006f7300c66eb37b32bd7c47de1b24a993fa75a70e72f1e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676731543, "uuid": "2c9f5370-9a39-4d90-84bc-4d3541f4af23", "value": "T10615120BFAE89536D475137019B207C309327E616639C7AB270EBD6B0932674AB3573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676731543, "uuid": "f19b7005-8896-41d1-b288-4f4123946ad5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676731543, "uuid": "0cd9f1a9-0fcb-41d2-af43-8edf9b48aa16", "value": "24576:oyUN/p3vHBuz6VquiCWYSMOHr6pbwpIYLZog:vUNRy6VX3WbcIL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676731543, "uuid": "a1213d58-267d-4916-9695-77c8e8a1b1f2", "value": 913408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676731543, "uuid": "d504bcb6-c26b-4d03-aa83-40c5b75f2080", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676731543, "uuid": "62abc57f-2b33-4c20-9860-99d7eb7b1e63", "value": "09308b6cb8e480ec95580ef52d3a6406.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7394dd6e-af62-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676707289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707289, "uuid": "f5f0aaf4-df93-4408-b621-53ca4b38fb79", "comment": "Malware payload (RedLineStealer)", "value": "05572b6d8b13f9afbcf08d9facde7c92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707289, "uuid": "07555dcb-20ee-484a-af94-8a2ce7247175", "comment": "Malware payload (RedLineStealer)", "value": "3f2c4e9d21bed230d6d35b9f3982d67d9d514bdaf89207b3161ceb425ace0a9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707289, "uuid": "1884b06f-05e8-46e7-8ddf-0215256d646b", "comment": "Malware payload (RedLineStealer)", "value": "432b43abe210391ebcd2efaf678fe4d04ae55af5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707289, "uuid": "77b85a61-425f-45eb-9350-3427354bd37a", "comment": "Malware payload (RedLineStealer)", "value": "8689f04d14a94f69fccc85c06bcf13d30648c70be5fb5177d9e30c518c2ca3fc630cedb677e36874b3fea0607cfef38e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707289, "uuid": "b6f88bb4-d72e-4151-b653-857c01f5cf26", "value": "T17354022232D0C0B2D8476239DDB4D7687B6BF8212AF4954F37A8173D6E607D09B353A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707289, "uuid": "d2c832b9-7636-43cb-a587-59f8c5703993", "value": "1189c0a2ecbe8fd35560b095ffebf6bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707289, "uuid": "65293fc7-a5a5-4a81-8e05-5a0a2aa243c8", "value": "6144:PQZRjcQL4LpuzZrzX+4bFHZ5MztEFS/hAR4Ti6:PQZ5d4Lpuz1XpFHZ5MhJA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676707289, "uuid": "e895ab13-50f1-4889-ab96-bf4e097587cb", "value": 284160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676707289, "uuid": "f37c89b9-cf95-4da9-b4da-e225a8711acb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707289, "uuid": "a6bf1a3e-42ad-4808-a97b-88fe9a6ab6c4", "value": "05572b6d8b13f9afbcf08d9facde7c92.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59ad801e-afcf-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1676754061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676754061, "uuid": "22329623-460c-4fa0-a394-221f956575e3", "comment": "Malware payload (RecordBreaker)", "value": "e66dfd2e9ee3aac6b41a8cc165c82c20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676754061, "uuid": "1e36e210-f7bd-42dc-9e0d-2879db405f7f", "comment": "Malware payload (RecordBreaker)", "value": "3f51464b59805b90b8763426e583ad7f82ec15ab41949ce4b64c5bf0db5f5e38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676754061, "uuid": "e6c45429-4844-4125-a885-02c15e1d4e85", "comment": "Malware payload (RecordBreaker)", "value": "69de6178f2bcc2e0ae156cc25d607e6070465286", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676754061, "uuid": "08a42eea-6476-4369-9cd0-ec6fb4aab117", "comment": "Malware payload (RecordBreaker)", "value": "6af3bffa7b43f23b95cd7afa46bfb689a3696dc97988a1e0619609588a1a49930048c4e57ec84f4948d79734d03f02c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676754061, "uuid": "4e96009e-016b-41dc-a058-3fd8b24024a9", "value": "T14C349E0372E07D91D9574A729E2ECAE87A2DF9204F45A76613385E9F08F01F2D7A3781", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676754061, "uuid": "dc0e7dac-c288-418b-9afe-11406adf5515", "value": "b13253f4369bf042858753b80eccf26a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676754061, "uuid": "8fe5595c-f6f2-402f-a9a6-e810f9885e71", "value": "3072:Da2FYU7L4hJOnE+ed81wKB8hY2QZsukda4JYQjS6Y3oVU9f:Ocn7L4hT+Zwv22I2a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676754061, "uuid": "514068f8-2801-4a67-a504-2ed7bf9a5437", "value": 252416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676754061, "uuid": "5d6fd8bf-2eda-41a9-b24d-6661df7293bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676754061, "uuid": "276b54bb-0a35-4ad7-815c-2425acb9c537", "value": "e66dfd2e9ee3aac6b41a8cc165c82c20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6122fad-afab-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1676738754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676738754, "uuid": "c50609d1-4ba0-46e0-bddc-b08d6a25aac7", "comment": "Malware payload (AveMariaRAT)", "value": "44345a597af1a1696051743ad408019e", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676738754, "uuid": "35c26b60-904c-4470-8405-ff84ac35cdc7", "comment": "Malware payload (AveMariaRAT)", "value": "3fcdcd0f061f178a69ad4154845aba5c339913a1c06fa4d942fdcb5a05be363c", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676738754, "uuid": "6a6f8af3-4255-483a-9e0c-7fd7261fe451", "comment": "Malware payload (AveMariaRAT)", "value": "dd141b687d31458192c2eeeae0b4a3ae2634ce09", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676738754, "uuid": "45e7f954-b9a0-4a01-b879-2ac29abf5245", "comment": "Malware payload (AveMariaRAT)", "value": "f42d8e876160144a2d8f54882ecfc7073d44b357ab779da1b4f672b3525e1da2b78c50cbdbccb88c2306cc87ad078f4f", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676738754, "uuid": "c8a116d7-4d00-4208-b72e-5f884df4b4fb", "value": "T189E37D227BF54439F7B705301AF93E25D2ADBE310E31CE4B5BD4488658B1589E93A3A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676738754, "uuid": "832ae61b-0cf1-4b86-8eff-dd64423c667d", "value": "570db8ef63a92b7fa4b4955d1d36a178", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676738754, "uuid": "eca907eb-ec2f-4221-a5f5-822a6940a74e", "value": "3072:RARHROub6IiZktM+t4B6IZeAzaZyJ6QYzHHxgGT0Iw:RkxbQktMo4BRiyjYz6GTrw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676738754, "uuid": "232ab74d-fe83-4f53-9114-4140a26fe95b", "value": 144384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676738754, "uuid": "1b69d9be-6b89-4778-a0ef-d76b11fa2038", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676738754, "uuid": "8aba564b-5de5-43c1-9e4a-0d11bf55c028", "value": "44345a597af1a1696051743ad408019e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c8e329e-af69-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676710365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710365, "uuid": "4f565f71-368b-4ace-b007-415df0f5a4bc", "comment": "Malware payload (Loki)", "value": "1499897d0160b3d246513c4d1a43ea13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710365, "uuid": "30eedd79-ec61-42f8-a631-8f7894d60f0e", "comment": "Malware payload (Loki)", "value": "3ff129da1bffaa9e882a0f1a3f83dd8e10307d3aa5e0e0a4384b3e6de3dcd825", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710365, "uuid": "c4046ea4-e93b-4184-9d87-bf2d5776f164", "comment": "Malware payload (Loki)", "value": "bb8cb4dbb2959ea8148d8e0ece71d481f0d43949", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710365, "uuid": "7c982433-6402-4591-9aff-a3555eb3f2ae", "comment": "Malware payload (Loki)", "value": "6e06b55ee5dbf5a21fa1b601b926e347fe3e99074de91cc30bc7cb0a4684fb07147f97f506301af6b6f06912f4c31926", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710365, "uuid": "8801591a-f7ae-4529-9a56-eafecbe38253", "value": "T14ED46A8C94F1EA3DEA898DBD371436080FE05A436B22C9F5E3E5F6C11B36263495D636", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710365, "uuid": "ecb00689-deee-43c3-9fa6-11679bbe98e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710365, "uuid": "f096dafb-c690-4b24-843a-9d49dc1d6a3b", "value": "12288:YqzGP56jq2F3oRTLqUl7JJAnP04MrGsoirqDSugDs+9t:rjq2KLlSs9LLrqDSu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676710365, "uuid": "10a67072-86aa-4a28-b3c8-68d532b5e5ad", "value": 645632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676710365, "uuid": "eeb87cad-8b53-4e21-8ccc-11d762d7883f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710365, "uuid": "3124c303-378d-4651-afbe-df85cf5ad37b", "value": "1499897d0160b3d246513c4d1a43ea13.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "008621f4-af66-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708814, "uuid": "5d7becd1-99b3-4254-aa42-391858d14a21", "comment": "Malware payload (RedLineStealer)", "value": "bd45dcfabce9ae2cec0439766954085a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708814, "uuid": "cbf46a74-be74-4d60-8376-d5c75ef8847a", "comment": "Malware payload (RedLineStealer)", "value": "413b9bbc560431c681819e5d4482600e99606091a232bd19aa7654d75034846e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708814, "uuid": "41f35364-c87e-4b78-a2e3-8c0bcaf73f43", "comment": "Malware payload (RedLineStealer)", "value": "05a9c0301f6791c76cdb1104ecb6758308726cbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708814, "uuid": "f70b8d1e-1eee-4b5e-baa4-00771e3d0ce3", "comment": "Malware payload (RedLineStealer)", "value": "aea13f10b7d99c8f6268f8a202b82b835410f6b75947b0813ef65ef1e9a1bf304ed3c8f5df06b9d278a432c53f10a52f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708814, "uuid": "ee818411-0e8a-4865-81cd-42bf8afe3344", "value": "T101E41207EAD88072E9B597B019F603C3097A7DA15B3983E6634A5C4D08727B5F23277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708814, "uuid": "5dcfa505-3b59-4f83-97b9-633f16f4ba65", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708814, "uuid": "cc3f4988-4bd4-4cb6-96c5-7271832560d7", "value": "12288:gMr6y909ebAsqsRhBQu9Xdp/QvNkjSMYycNpkv3YQlyNTQSbEPHTPdZk:KyasqshQubhZ8pkvMTQSwPXk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708814, "uuid": "ebab3451-6fed-40df-9aeb-5747611dd63e", "value": 687616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708814, "uuid": "c5bff918-4b39-4ef0-b8d6-d984211628f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708814, "uuid": "dd4e0389-241e-4a65-92fa-477c0da223ba", "value": "bd45dcfabce9ae2cec0439766954085a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "064a10f9-af66-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708824, "uuid": "8d8501f3-985d-43aa-9ffb-95819792b9aa", "comment": "Malware payload (RedLineStealer)", "value": "dcef0b3b447767eed69867c7322fa0e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708824, "uuid": "8ad0bb23-48c1-4039-98a8-b2cecd904950", "comment": "Malware payload (RedLineStealer)", "value": "41c7dc48e6ba465e5a9863c3bcfe79a23e352d96a1df1173fca65d256b9f8896", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708824, "uuid": "d6d61a45-8047-4f1b-ae43-b1043e216d62", "comment": "Malware payload (RedLineStealer)", "value": "aebddf7d5f19c5a3f856a2133bf8e08cd46349ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708824, "uuid": "156a79cd-4f2f-4c7f-a2e0-f766b0660d01", "comment": "Malware payload (RedLineStealer)", "value": "5b1f66be3ab7ac8ea4f2c9d803009858f3373e7428cbc4113d22a0d32681e6395b97b26fb286b4d1e90426636dcb807b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708824, "uuid": "5062205f-cc1e-45e4-9f7a-7c47fa1eaa77", "value": "T169E533426B8D1127F568233808FF03E32A37BE72997D02912B589E5F6591175B2BCFB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708824, "uuid": "7ca9da5e-e0c0-4f84-94b2-cbe006f99747", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708824, "uuid": "1895e800-dcca-4a9b-a46d-3b45747c9054", "value": "49152:oqgY873iWL5cNfPHMSWnHHFBo1jMbPs3d5TIrAQOLQb0PC/QjrJYlCT+an1luW7y:jQ3VcXH5WHlGjaE3d5TIrBOLQg6/QjrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708824, "uuid": "90c2bc3d-3600-45ea-b133-7b6308fe3f92", "value": 3117056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708824, "uuid": "7ced380c-9f65-422b-8cf6-d40b0337c0dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708824, "uuid": "0c33d820-2c2f-4f98-a654-075467550157", "value": "dcef0b3b447767eed69867c7322fa0e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86613dfb-afa7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676736956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736956, "uuid": "7e4ff07d-6fe2-40a1-a4c7-7826265a7fa6", "comment": "Malware payload (Amadey)", "value": "deee163f5a08496b5f08f488daf75e9c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736956, "uuid": "21ec3f66-b370-4c66-a45b-73f76c7c5cd2", "comment": "Malware payload (Amadey)", "value": "4395b63ec9b205d9097ca1754792013080d20533c944c57d2aa96aaaf52d0572", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736956, "uuid": "49c0c17d-4ace-4a6c-ab0a-ddabe14a2bd7", "comment": "Malware payload (Amadey)", "value": "b8b90616674e06726c4a833a986340649fca94a9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736956, "uuid": "db2b0524-06db-421f-8d03-285762c8bb6d", "comment": "Malware payload (Amadey)", "value": "5500de0bff6a9ef0f0d172fe175bc60ba3c82689f8ee4928bda3bbdb05f360bffc857af884659d0995b791175c65f386", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736956, "uuid": "afd337b7-f67a-48fc-b9e7-f316e8631601", "value": "T110F41247BBED4031DC7813B01DF103D30A36BD954A78A257235AAC5A18B2AE5F1367BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736956, "uuid": "2b1fd58e-6799-4165-b03a-637dfd571056", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736956, "uuid": "5a093e11-23c3-4493-9de6-2846c9f4c020", "value": "12288:DMrsy90OnKwFGbeRP9+rV6KCpr1EN/gVG9gI3o3rQVrLSGVahieVIN5f+QB5:TylnKwFG6R1+Z6lr+tx3GrWqGVqiQcfb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676736956, "uuid": "704f4016-264e-4f5c-ab37-8b3f2ce6acc7", "value": 765952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676736956, "uuid": "78686596-5ff1-4747-a0d5-5a3c5ead55b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736956, "uuid": "3cd75fb3-1ea3-4227-8e6b-d004b98bc3e4", "value": "deee163f5a08496b5f08f488daf75e9c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5cb7905-afa5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676736284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736284, "uuid": "a679cb2d-b139-478e-9dec-b9100e36b464", "comment": "Malware payload", "value": "a83d528c3debe4486cc91b5922040711", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736284, "uuid": "4edbed24-e77e-4406-98ed-829bc943d14f", "comment": "Malware payload", "value": "446deb48d5641c4977a2cdf9eb3722cbd4170a2eebd2d8c6fca1430767af04ad", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736284, "uuid": "509d5109-e45c-4027-b10b-3a65b5eaa6ac", "comment": "Malware payload", "value": "765d88a6a2ac079c0a7a7ac23dc630b82095339b", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736284, "uuid": "4f4f9ac6-68aa-4498-a2b5-4861b570b633", "comment": "Malware payload", "value": "2044431fb602203d610182bea03d2ab9fa97e0da02815f35b052431df7f6d88410e06157de9d8a9d0607144763dda725", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736284, "uuid": "e87214b0-2531-429d-80b3-a4103bb3a42a", "value": "T19FA523577310D697C5080ABA84D3D2B86B30DD420937C767A8DA7A6F3EB33E68D44395", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736284, "uuid": "f0359f90-b1d6-4ea8-a08e-aff00e7dd911", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736284, "uuid": "58b0941c-8712-4885-bc48-73449bd0c670", "value": "24576:Nwksz4Fw2f16CwIUEirFZTUvIweQ3qRbYl6DLJMv4oVI1ZwF33z5hG4vkXZurFJ:4bCwIUE2jvdQ3mb1ZGvVkZ+3lfgy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676736284, "uuid": "e5db3106-8e8d-40ed-a159-479c13f71e61", "value": 2132480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676736284, "uuid": "80d41a34-d843-468f-a049-87ceed914f6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736284, "uuid": "610f6f86-f30a-47d2-999e-7d75ab952bc0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e1317c6-af69-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676710260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710260, "uuid": "a4b12f24-8c5d-49a2-b3b8-d49e787fd54f", "comment": "Malware payload", "value": "7e8aa0ed6cf2e4d2ec8558cd10166113", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710260, "uuid": "c3b5b904-2cdc-4038-b062-bd382d9cb889", "comment": "Malware payload", "value": "45534b79ee2a4f80f15ea34db053a46bef303f3a1f3a58031c3007c90d3f999e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710260, "uuid": "ec6ff404-fa9d-4e2b-b976-c4df50d90ac3", "comment": "Malware payload", "value": "f6678ddba395cafd700195f6b97a27abea71c1a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710260, "uuid": "2b01bbfc-7456-4e95-975c-cb9e9af1d4af", "comment": "Malware payload", "value": "22c89f2785b097beca076a905670a52566a4e4f7ce0608e3434d86c28355c4ba2721d2254c697a19769ea4e23b380737", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710260, "uuid": "458e347d-2db2-4b42-8889-e21939c1eea0", "value": "T15604DF917AC6C4B3E52B12B85886CAB50A37BC714B219ED727C4065E4F373D29E353CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710260, "uuid": "3d26ff10-9a3a-4fc4-9dff-d5d434895658", "value": "567ef01db2b6d39e4e9ea86cbe761513", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710260, "uuid": "2f5859aa-6e6c-4d7b-8318-68b891ac3802", "value": "3072:QtWrhX1ohkFuoVS5BdqYzZpAYoU4V6tilupqC7e+m+DqA:UaNeaVKwUAjAtilupq+GA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676710260, "uuid": "c0d6bc1a-ed40-4f1e-8999-173a5d979e5d", "value": 189684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676710260, "uuid": "ded5d2ff-acfe-4cd3-9dc8-9824446ea2f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710260, "uuid": "37f643af-1ba6-44c8-8e20-b4c21c934471", "value": "7e8aa0ed6cf2e4d2ec8558cd10166113.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f2594cb-af62-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676707282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707282, "uuid": "5164ecf7-a7af-428a-b9a9-9dc5f89a603c", "comment": "Malware payload (RedLineStealer)", "value": "2ae5662e976b013af1d95508816c6c01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707282, "uuid": "6f665d46-c043-4ca3-a5c0-c0c0bf587e85", "comment": "Malware payload (RedLineStealer)", "value": "456758011a20b4844a9d635fe22f96af4b9f41d0596f502535d6bdeb9d7ad959", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707282, "uuid": "731f0df6-67d1-4e6c-b9eb-00ab7e53426b", "comment": "Malware payload (RedLineStealer)", "value": "f9f21b793fd41c6e279222533bdee628ba2c96aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707282, "uuid": "7b44a2d0-a431-4a88-bd51-245225184122", "comment": "Malware payload (RedLineStealer)", "value": "02990e8a56931c7b6cf2e89da4f163cf372b177fdaf5619de6f5924d7f8e3c8d1166e53b43f0a4d8297d4062f7ff715f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707282, "uuid": "f6427d8f-fe61-4841-8f90-3b7aadaac8a0", "value": "T1F7B4120BABF85432E9B647701DF607D312357EA05B34839B724EAD4A18713F4A6353AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707282, "uuid": "ffea1eab-252d-4ee9-b755-26ddd1606fd8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707282, "uuid": "05a5f693-d358-4446-85fa-7144f28719ea", "value": "12288:YMrby90rD6KCjIv5+ck3vi45qL5ibp/jV2GycwzJRnY:zy2D6rcv53Aj5q0b1icwl+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676707282, "uuid": "5fc948b6-b87a-4cf4-9567-4a70ab4026b2", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676707282, "uuid": "f0a70d84-2c67-49c0-857a-ae51bd3c88f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707282, "uuid": "9bfac8c1-ed85-4930-984c-5354563bad16", "value": "2ae5662e976b013af1d95508816c6c01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4de81856-af60-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676706367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706367, "uuid": "850074d5-e559-40d8-a8d3-90c8373b2c8b", "comment": "Malware payload (SnakeKeylogger)", "value": "71fe66f2b1af2641afe17ea7985515d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706367, "uuid": "8e83e740-1b80-45b2-a515-c61143c62cd6", "comment": "Malware payload (SnakeKeylogger)", "value": "462999c3c88e038ecd00d8fad28c660839f9b23361fca8a5cb77aabf879bea7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706367, "uuid": "dd20548b-319c-4492-81be-81dc8f4325aa", "comment": "Malware payload (SnakeKeylogger)", "value": "97348bf9f7c1a27f4d344928454975c7e8c65825", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706367, "uuid": "6964badb-1b18-4d11-9b35-7df542e37f5e", "comment": "Malware payload (SnakeKeylogger)", "value": "b2fc58cf377a3d05510e69fd8a6ebd49f5cbfac87de332817903dd0d472e6e2c58f3aba1df17154f8acda783727ced3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706367, "uuid": "6ed32cb1-0a56-4eee-8252-46e2b5b1adce", "value": "T18D153BD8E0B0DDBED85B4AF17F26752016E26E4D6864C10C9799F78627B3342209EE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706367, "uuid": "5747cccf-aaea-4555-93c1-173316eeea16", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706367, "uuid": "b9a898f7-d3b1-43b2-b772-de467cbd9ac5", "value": "12288:jTIjxmKqDSuvHqdJD8QFf/LNCrmCW1JaKIqMMn6hPZCF:PIxmKqDSuvHi9F3LNomCeJyqp65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706367, "uuid": "7d529c2f-1d28-468b-87d8-d43827194cba", "value": 957440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706367, "uuid": "0b9ce4ac-023c-4abf-a370-6bb1614f2d21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706367, "uuid": "e6d87855-17df-498b-9036-4e4e57e7520d", "value": "Belge.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d4ca711-af60-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676706420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706420, "uuid": "1761d763-5000-4120-968b-494410742969", "comment": "Malware payload (SnakeKeylogger)", "value": "3d1e8f38ea65e72600aa74c5e00c1a05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706420, "uuid": "7db0635b-a81c-4318-a7f6-f3c32a633a91", "comment": "Malware payload (SnakeKeylogger)", "value": "46bd05b2c23ee105c0751672ba1c42001fef337a50368130278d2782d8d1e8ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706420, "uuid": "d33af481-cb1c-4038-a91e-44393a65e516", "comment": "Malware payload (SnakeKeylogger)", "value": "b4991dcaaf19c9d61a5e6b12cb3f5d4ed4b28159", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706420, "uuid": "728cea9b-52ce-4d74-96e1-4850cc8cbc9c", "comment": "Malware payload (SnakeKeylogger)", "value": "b4ac8c618d657204d704456c5023b29cf539ea025a24c00f11b10b5de314669a1caa3e245d6e8daae5b87c3422c49a0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706420, "uuid": "43d5267e-22e8-42aa-a5f6-d8793bcf6b8b", "value": "T1925412343A61ECABC4E542715E3A9F2E5FDAB9116C9A820B27007B15FD213C4DD0E7B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706420, "uuid": "23412d08-ba09-476d-8d18-a8601634df2a", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706420, "uuid": "bb50fbce-c1e5-4d64-a979-671d4bf1851b", "value": "6144:PYa6szn6T6JmbE3WNen65830XWnrqQ0HaFhtjJPWJU/2Ymjxx+AB:PYCznTJR8830gqQlt5WJwYx+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706420, "uuid": "cfcfa65d-c626-432b-bcc6-f009ee153d0f", "value": 281600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706420, "uuid": "d174c27d-9279-4be2-853f-eb820757dd2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706420, "uuid": "e8f8395e-e42f-437d-ae97-0c604b9890b6", "value": "PAYMENT ADVICE 2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dfc345c-af62-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676707280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707280, "uuid": "73c0a20e-b40b-4fa7-b114-0ce2384dd7f8", "comment": "Malware payload (RedLineStealer)", "value": "1ae56d352974a0f4ea22f1a3220bd2fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707280, "uuid": "a67d3ea5-8792-4a61-8510-5dae2148cdc1", "comment": "Malware payload (RedLineStealer)", "value": "481fdecdd8079c2818fb6e3dcb5e6fa8fd43efc0b7df34e9514341f130017916", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707280, "uuid": "14cd56d4-7c39-493c-9420-10c26c233b1e", "comment": "Malware payload (RedLineStealer)", "value": "bca39ed4228c3121ed30797114615b9d18459335", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707280, "uuid": "cd23a8e6-0b56-443b-8aa4-2acf61c1f227", "comment": "Malware payload (RedLineStealer)", "value": "497d79f28df8cc76ae3e66169f3208127134adc68f230f02f95c65b07bab0e4ecc2e11a0423f4eaef29c21222ac5c4e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707280, "uuid": "b925065b-b6c2-4bab-abcf-80b3bedca200", "value": "T116B4020BF7F88463E8B4177009F353C31936BDA55A38435B668E6D5D08B36B0AA7172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707280, "uuid": "1a4c2daf-7590-4009-b183-cc38646fd0d0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707280, "uuid": "44b686ba-92b0-4762-bac8-5dc3f22b2dd0", "value": "6144:KNy+bnr+Bp0yN90QEjMLG8qVLV8IkPcJJP8ZdMzifMitBvEu45DdMpd9LVzlYZ5z:zMr9y90SLcVLVD/kUy8vDdgdB8gr12r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676707280, "uuid": "8bbe99eb-d8ef-412b-832c-69c7b49e38b1", "value": 539136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676707280, "uuid": "18bb053b-2fab-4e8d-b8cd-b334e0cf33d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707280, "uuid": "83c7671a-fce8-432f-a020-6fb9244195d1", "value": "1ae56d352974a0f4ea22f1a3220bd2fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc2dec02-af66-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676709129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709129, "uuid": "492f2627-34c2-4c98-b726-041f2d0ec8c7", "comment": "Malware payload (RedLineStealer)", "value": "ed8032666bd27a61d3dc25b3419df551", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709129, "uuid": "230becf8-278c-45b4-9340-9f66e9a7d659", "comment": "Malware payload (RedLineStealer)", "value": "485f925edd2e71f8a06be73c4cbcf0c4cd9f9e5cf6bf580ed9ce4939a3f7bf4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709129, "uuid": "5e0d30aa-e4bd-4aa4-8dc8-2bb735a3e144", "comment": "Malware payload (RedLineStealer)", "value": "8031e5b40e0b5483eb8cbb19465a1960193d12df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709129, "uuid": "7286a156-fc6d-4490-9f2b-fb13717792ec", "comment": "Malware payload (RedLineStealer)", "value": "c6478e79e736b7c5397b5fa7c4d137e06dee69ce92bddde8ce872465d6750e89dd3f95eb98f2c940ff11183c8e5d2f6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709129, "uuid": "c3728d9d-362f-4247-b990-57a69c1d075b", "value": "T16CB40247E7E88531E8B5577018F702C30A36BD515B3483A7264E6C6A1C73AB0FA357AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709129, "uuid": "7d7d7131-e8d7-40ba-aa58-8141e247e8fe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709129, "uuid": "1d6f5a15-de38-4d9c-9052-f08c6d6ebf56", "value": "12288:iMrKy906oe0e1DlZc+Rx7RRtHLBFQFHI82d3Y:MyQTqx7RRSFo8M3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676709129, "uuid": "23870581-4538-4e88-b948-bced85909c39", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676709129, "uuid": "348e68be-eb1e-449d-94c6-f78ea3896fda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709129, "uuid": "c3e80bec-b1ab-48fd-b355-81634a315920", "value": "ed8032666bd27a61d3dc25b3419df551.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04bb85ff-af8e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676726001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676726001, "uuid": "979a1278-4d63-499d-a417-474712e18db7", "comment": "Malware payload (RedLineStealer)", "value": "150ba458801a2d18480af100a61cdccc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676726001, "uuid": "164b6d7f-978b-4951-a574-5d6765bf182b", "comment": "Malware payload (RedLineStealer)", "value": "48e5254ba169afae1d8738c988a7c00c34f12f452f28a7f19c4ed34ae0014d73", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676726001, "uuid": "019ccdb0-0325-411b-a70e-4c9e358e6afa", "comment": "Malware payload (RedLineStealer)", "value": "07bc99e5946f368f8f1eb3f7b360219c942fb6c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676726001, "uuid": "5ba75d3f-3647-4b1e-a2a1-0b84593eb7b1", "comment": "Malware payload (RedLineStealer)", "value": "f51e5090e5d704a2237ef0a7f02604bc187f50a06e07152016bada47af01d524638e675d0c0094f55f83a149bfa4924c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676726001, "uuid": "c4be18f1-a240-4bc8-bc91-ddf972ba218f", "value": "T14B455D0723964823D463DE770A70EAD48ABB6CD487E604D6AA738965EF50D0079E3F4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676726001, "uuid": "430e0ac6-9aa0-4650-a12a-47b207a81041", "value": "19f63d24f8949fc723d269de46ddfe98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676726001, "uuid": "7c00f69a-f72e-4215-b138-110653f16d75", "value": "6144:sL/cL7UuPiM+887AO+mN6g7aFXbwgxURLvNVZxmw8Zj:sL/cL7U1M46guFXbwgxURLvNVZxJmj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676726001, "uuid": "14382193-57b6-4207-80a4-a88b65c6c49c", "value": 1234944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676726001, "uuid": "d70e5d39-f44f-48f8-ad57-f264ab4fc682", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676726001, "uuid": "8674a2ed-f39d-438d-a02d-be8bde937ae9", "value": "150ba458801a2d18480af100a61cdccc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56c7a687-af95-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676729145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676729145, "uuid": "c9c90064-a50d-4645-95b2-ff2a931b0b74", "comment": "Malware payload (RedLineStealer)", "value": "fec260517731820917cb103157cf1b81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676729145, "uuid": "72b75204-b08d-46d7-8ab7-fbcb443e167e", "comment": "Malware payload (RedLineStealer)", "value": "4905f70ec881bb6afcbc0fa1d635e4d23a681d02f0c8d70dcbe4bd61d8695d70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676729145, "uuid": "f972207a-2b74-47c4-bab1-787509306850", "comment": "Malware payload (RedLineStealer)", "value": "ab8bdad733b921ff917b93b5d1903e86818e69f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676729145, "uuid": "a09d3eef-d3ce-456a-8121-1efa00f4b22f", "comment": "Malware payload (RedLineStealer)", "value": "2e9fdd4129b46a58bb959290852e3e704625f3bf48651aeca11913a7a8fccadd8a93ee808196c0bccbc04a795248b9c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676729145, "uuid": "4ed266e7-3e5a-4eb4-8ca9-f27dc53816ba", "value": "T1F215120BBBEC9072E8F553B068F603C31976BD609A78524A334F2C2A18735B5B5357B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676729145, "uuid": "9764b578-0817-4b0b-ab68-3fde62780cc4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676729145, "uuid": "879b5b44-94e9-40f5-af1c-a16df972b823", "value": "24576:Xy8XHpioIh+wyfhKFogisTWANKgO9C4rA8R6:iyCripGLWC488", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676729145, "uuid": "5187e2bd-767c-4b0e-895d-b929a7b80040", "value": 912896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676729145, "uuid": "dc45159f-9ba3-465f-982c-0417fb3e0343", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676729145, "uuid": "55bdcfa8-8bc9-4ec0-a2ed-669a7cee0f42", "value": "fec260517731820917cb103157cf1b81.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f5c8f57-af20-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676679016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676679016, "uuid": "eb6a1f8d-632f-4fef-ae20-106105c145b5", "comment": "Malware payload (RedLineStealer)", "value": "20cf003e3276be2825eb5b65a667f473", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676679016, "uuid": "ad60d7af-064f-40b2-844b-d2585cb1bfb8", "comment": "Malware payload (RedLineStealer)", "value": "4b7d247613e7df42de9569d5c996000fde246422ae7ce29bedcbec04e1f6d97b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676679016, "uuid": "d5a2357c-e1cb-483d-b759-17cf0abe3aeb", "comment": "Malware payload (RedLineStealer)", "value": "5a202adfe88c726a4d54ddf05054b50d4d46aec8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676679016, "uuid": "aefd4ffc-720c-4eba-8747-058b4cbee32f", "comment": "Malware payload (RedLineStealer)", "value": "daaae82e7a09d49f4da179b87807fc943916c013ac211ecd0ed6eef818e59966388aff4b29079f97af78e6f829e14471", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676679016, "uuid": "c9830f47-28d0-4e2d-b3ee-1141eeac424e", "value": "T1A1E41207FBED9562E87417701EF203C31A367E906E74A297278E2D5E18B3190A73176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676679016, "uuid": "c4e10717-1d89-4a55-a3c2-97139e9ead93", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676679016, "uuid": "2f7d966d-a8be-4687-9fe9-d6967635734f", "value": "12288:9Mrzy90dIwUe5IbLJzmGwoFM4dfAOdeLJijAwQwJnB6ze6QEoW:ay4IwUeSfJLFM4TdeL4jvJB6zlQEoW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676679016, "uuid": "c1d3c788-21e8-406a-85b0-33d56b221ca7", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676679016, "uuid": "e992af7d-2c09-4edb-979f-1ab97106d59d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676679016, "uuid": "7371e844-f59b-4c24-b63c-c5f0f1d6be26", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86978342-af64-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708180, "uuid": "1f3b0133-e93b-4cca-b351-fad2bd8b2f60", "comment": "Malware payload (RedLineStealer)", "value": "28cc09acb080ef09cca1f75cf2cf2c13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708180, "uuid": "169520c0-2b6a-49e2-b6c5-d22386b1cdec", "comment": "Malware payload (RedLineStealer)", "value": "4bcca9108d64a5ae57ec872640fea12995e9ba87ea25ea34bcac151d95271119", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708180, "uuid": "a1053f87-8af7-456f-a03a-331b7f2881e5", "comment": "Malware payload (RedLineStealer)", "value": "fff14cd49943774138d75e403996b2046ae5dbce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708180, "uuid": "ac2b58ad-0ba3-4324-a3f2-cfb44bb4c47d", "comment": "Malware payload (RedLineStealer)", "value": "b99799be929a346b0469a947dd937ec04d62c4bf998044d5263d3114d08aa16e74c8982601f083f9e05d05d524c6f105", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708180, "uuid": "947ec94b-4033-4552-80f2-6cbbbbd6a58c", "value": "T191B40247F6FC9032E8B9577419F703C30639BCA06B38879B628E9D1A1831A75663177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708180, "uuid": "ff1e0cab-51af-4f42-95fe-671546981b70", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708180, "uuid": "6c2c7e7a-bf00-4952-b61f-0fbef19db808", "value": "12288:5MrXy90dkiioTA0yibq5f9P+Wm2LY5wf9jdVjkntk:6y2kiiknbqpF3mehjotk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708180, "uuid": "4d5769dc-1e38-4f5e-b425-42d20eb5b164", "value": 527872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708180, "uuid": "d2d1a296-1f86-44dc-962b-a57e10b48b8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708180, "uuid": "dc5a8b1d-5fa5-44b3-ab86-23354d7ad5df", "value": "28cc09acb080ef09cca1f75cf2cf2c13.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d9ad290-af64-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708192, "uuid": "d0122231-7723-44bc-93ba-cff11b8e649c", "comment": "Malware payload (RedLineStealer)", "value": "4556edcb78ea3f15d34b4ebda00f598d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708192, "uuid": "da8048ab-63d0-44cc-b393-0c0a8c0ebb65", "comment": "Malware payload (RedLineStealer)", "value": "4e2118734c6efbe99446f36ee842a4b45a1fea09a946ad05467524b80991d76f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708192, "uuid": "8d317e1c-20c2-4fce-a2e1-2c065a995b60", "comment": "Malware payload (RedLineStealer)", "value": "6392fc6d069171865247ff06eacaaf62211bdf58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708192, "uuid": "b8d68900-760e-495e-838a-8fa8b00515e3", "comment": "Malware payload (RedLineStealer)", "value": "f00afae84f66b6ad5178a6b2d96866f27d4cd4c7032d4855b8c8a19e40a0dbd861b185a9f2a8c7ba039463f06f5450be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708192, "uuid": "2c02b2bf-57f6-4816-8b48-4749692be754", "value": "T15DB4020BEBEC8076E8B55B701DF603C306357E615B34426B129F9C5A08722F4B67576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708192, "uuid": "d5305477-e96d-4065-a6fe-a7ea51004f2f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708192, "uuid": "1fdc8d81-db3d-41fc-a649-a111559e2c4e", "value": "12288:TMrcy90ylqlQHnxpoQM4ttkCta6EZkIHHEq5Ln6gMxbB:vyPnoF4HkmEVL/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708192, "uuid": "3e29594a-8502-44b4-9a5f-1ba496f38707", "value": 528384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708192, "uuid": "f0b50a9f-3846-4a8f-bc3c-2b72c26a6957", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708192, "uuid": "84fa2060-229b-49f5-8d46-b6cf76bbf093", "value": "4556edcb78ea3f15d34b4ebda00f598d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "908eedc3-af21-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676679421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676679421, "uuid": "2abd593f-9f6f-47bb-bdb9-3421aed6b043", "comment": "Malware payload", "value": "e79c3953f7f36ed49603c26a22bc1f68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676679421, "uuid": "a155bf98-308c-421f-a454-feb088018b81", "comment": "Malware payload", "value": "4e3c38a0a74105dc4e63288f8b8c8f89499ab8a5b4f6d5ca884eab31d913df87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676679421, "uuid": "1280c891-2446-4e10-bb18-46b99bd5777f", "comment": "Malware payload", "value": "c1ba663f6b101342adb0e2c353bb239dd6b93111", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676679421, "uuid": "2b9bbb67-f957-4417-8a98-3fb6d306bba1", "comment": "Malware payload", "value": "0f03a106c66b730ad246d70a50ea3753389bcbcfa5fdf30fb26788459432f891626ada382fa34d8365b1502d64c2b57c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676679421, "uuid": "0c902120-7b23-4946-8d41-a8b701f9cf07", "value": "T148763364B8D2D578E68B043352546FFAD7F8CB440B70FE23738F4C197BA6A50C2296A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676679421, "uuid": "32a3da93-bd9e-4947-897d-6f034b6c75f5", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676679421, "uuid": "818d5f48-3e15-4898-905d-a89aac38d488", "value": "196608:91OCSsuVCSp+zTT5oCSNBMH9PTUItFcvlhRlOyc:3OCS41SNBMH9PIKcvnRxc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676679421, "uuid": "b247bab6-e031-4f52-bf2b-7fc32cdb2d24", "value": 7586974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676679421, "uuid": "6b46b77c-c6b2-4ab3-b0f7-c46496b4b692", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676679421, "uuid": "37c74c04-d1ff-4283-bbde-8a04f8c0318a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36d879b3-af63-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1676707617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707617, "uuid": "9b54f864-1d81-4b96-9730-11888a2ec36c", "comment": "Malware payload (RecordBreaker)", "value": "05f7554a7cc5f329cb905145b21362db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707617, "uuid": "90f30333-8315-429e-b483-c3dfa909d3c1", "comment": "Malware payload (RecordBreaker)", "value": "4ef232229380c19bb92ec5bec35979f1713f67a1adababa0ef77ff53e39a8505", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707617, "uuid": "ca511b33-dd39-470b-80df-3b2797051d96", "comment": "Malware payload (RecordBreaker)", "value": "4d98537a038787031070235262ceeb1f616ecd54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707617, "uuid": "9f41ac6e-7741-4ade-acab-7dbdaf255c8b", "comment": "Malware payload (RecordBreaker)", "value": "2f247d75d7909cd9d4e3c582ea7c086495b476a4dbe34415e55a3c9d0c0ddb671daa75f5787c64951d4475f69b5662cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707617, "uuid": "714587ff-d57c-4136-92e9-7cbab5514c95", "value": "T11FE3D0223AD0C077E06756305CB4C5647A6EBC229678898F3754173E6F342D26E7E3B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707617, "uuid": "d9748248-7d92-4854-bbca-f804375de882", "value": "5d842fb7215bce40485e598d67956fa7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707617, "uuid": "b0d13fc7-7f2f-4f74-83b9-f53f67c90efb", "value": "3072:lFsNWtJMiIYrFD0z+Efj5UyOGBlz8OtUxazcJ39XPGzil:kstJLIYjEfj5U/GBlz8OtUxbLuzi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676707617, "uuid": "02ec535c-a36d-4b3a-bf3f-4b1b8915249d", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676707617, "uuid": "67cb229e-44c7-4d5d-9d6f-52643489fdd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707617, "uuid": "107ee439-6495-4611-98f3-679e25b2b205", "value": "05f7554a7cc5f329cb905145b21362db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cdc68bb-af60-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676706365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706365, "uuid": "5248e777-3fd4-4952-9f0b-8410debc41b5", "comment": "Malware payload (SnakeKeylogger)", "value": "11fcd4e0e9b6a0f1592c7b8ee54ab148", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706365, "uuid": "6c57f447-2683-4f44-8799-983f0d928f93", "comment": "Malware payload (SnakeKeylogger)", "value": "4f523193ac9b23eee38414ec05142a0c0a75a8ff2511e74466b83dbd91f4f2e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706365, "uuid": "38693659-fed5-4136-abaf-56734e4005d2", "comment": "Malware payload (SnakeKeylogger)", "value": "84309045ed2304a5efbb20f0591b66e03060930b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706365, "uuid": "4e1cb237-00ed-428e-a6a5-711f3c702c20", "comment": "Malware payload (SnakeKeylogger)", "value": "f9348ec3896986418f0b8c3c36d0bd1f4b2177c399d681d871004354b72405c334a70ac0bc9e4d3bce8598f2a9d04a34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706365, "uuid": "d8de04d9-81ac-4064-8abe-613c557e5e47", "value": "T18DE48D9C90F0FB3EC909CEB9731036481BF492033925D5E9CBA6F2C51B36763595DA2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706365, "uuid": "59bb3456-2cee-4a23-b9eb-cd554fa65bd3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706365, "uuid": "4a48ce95-e322-4d13-ab26-40d206bb1916", "value": "12288:pTyJkLqDSuydArYbZ8Asgn9RmWumMKJ1aSNNS5ykt+n:VyJkLqDSuvkbaAsg9RfurejYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706365, "uuid": "07057f55-3161-492e-91e1-ecf467dd5140", "value": 661504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706365, "uuid": "d27bb394-335b-4205-bbeb-f9864e80af37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706365, "uuid": "9b7e413b-8e23-416c-beac-cc9c1d55aceb", "value": "New Order list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14cb159a-af66-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708848, "uuid": "ae496800-7719-4349-8c5f-e4c9b65906be", "comment": "Malware payload (RedLineStealer)", "value": "ae05c8bbd9d0b00079a5ae2e72c6cfbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708848, "uuid": "bb22170b-f0be-4fad-bd72-4b43687c8b6c", "comment": "Malware payload (RedLineStealer)", "value": "4f5dcefb330ac453589545596e5cd3d6e2e6475bd1090301130a947d9c59597a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708848, "uuid": "df0afb95-aa5e-443a-a28f-79f1078cb25e", "comment": "Malware payload (RedLineStealer)", "value": "49b1a65896f865676806457b64988d8990f01b82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708848, "uuid": "f267adb6-d0d4-422e-bb06-e54aa0616949", "comment": "Malware payload (RedLineStealer)", "value": "351d3a8c7eac7eb5d0f19a63acdd8cc330cbbf67b1da60f63427e051bb0d45763fef2d69ecfe12d48f83a4ba499960da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708848, "uuid": "bb99ef4e-9117-48b8-a403-2a7104fc72ed", "value": "T1FFE53353B2D44422DA991771ABFA53C30F3179937E380A17578A2EC518B1BAB6C3137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708848, "uuid": "08866759-42cf-410c-9356-caf434deaa98", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708848, "uuid": "51fe7626-986e-4e14-bf8f-af8ec9a1023b", "value": "49152:lSjYEnPxK/u01uy2IfaIjseX8xljlqrKOa/njJ0iPMPz2rQD2Cry5sMTUGbXjUuF:4rnPxK/u0Q7KpjseX2ljlqr7ad0iPMap", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708848, "uuid": "204972df-8735-42f5-bfdc-3be41d4c377e", "value": 3117568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708848, "uuid": "3eb2c7c7-f0fd-4c6c-ac32-db54833907c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708848, "uuid": "35173b7f-f7e2-4059-8039-b6f079ccecd2", "value": "ae05c8bbd9d0b00079a5ae2e72c6cfbe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f636c832-af92-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676728124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676728124, "uuid": "d420e721-8845-4593-b405-6c753525e2ee", "comment": "Malware payload", "value": "91f6e85d88764ca6fa45d8772e9e2d23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676728124, "uuid": "c046bf5f-f1cb-4a37-9415-39ff625226fd", "comment": "Malware payload", "value": "504915325cb3388bfe4d43d189241e4ebe6c647169bc49c199a7c74a764f3510", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676728124, "uuid": "49763161-a894-4e19-8970-213eae67bec8", "comment": "Malware payload", "value": "cad37470c33c630aa6cec32696b60044ca176d95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676728124, "uuid": "0b421531-b5db-4fd5-b6ca-a16a254cd8aa", "comment": "Malware payload", "value": "c43dc6a161faff3ef03325bf15aab280e0fbe20faa9c408cc3c1f0a1f71f951459b26a02dd110919c9d3f1aeaf870006", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676728124, "uuid": "4a4c13b9-4d23-4f5d-9d6f-cc5bab49fda1", "value": "T163450EBDB24A8B89DD6885F495E180219AD33E094D6F4B6CFC0A8F52EC579091FF243D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676728124, "uuid": "cae13519-5eff-4137-9527-a933be425eae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676728124, "uuid": "4d657291-fb10-48eb-8738-1110c3c9950a", "value": "6144:k0DYrSj0QX/pUaVI62s4MUfFLmPDWcByo29Qp:49QPb4/fF6HR7p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676728124, "uuid": "e38d9e76-c1ab-44fb-9181-46e0899e7c36", "value": 1214128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676728124, "uuid": "20befb96-1536-4430-a482-a90f3355f6e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676728124, "uuid": "238dec91-31af-4e0d-9798-addf63256ab2", "value": "Doctor's recommendations.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad825b0d-af5f-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1676706098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706098, "uuid": "7ea1e786-6949-4006-bc65-3be6b1ecf771", "comment": "Malware payload (NanoCore)", "value": "883024ca315da7998a6eba20ae6055d0", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706098, "uuid": "12a17057-be51-4c57-bcb7-3d200872b02f", "comment": "Malware payload (NanoCore)", "value": "50c4fee0134f3238bc0c99b60a4418cd2b853ce3a68bb010b950563d686b38fd", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706098, "uuid": "f40b52d9-ee8a-43bb-b1d9-2e7eeec2d448", "comment": "Malware payload (NanoCore)", "value": "23f60a5c61dbf2d7392dff25bbb614eaba929196", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706098, "uuid": "0c2616cf-4002-4cde-9f14-790393720187", "comment": "Malware payload (NanoCore)", "value": "37b94dc779ff96f2246f1137094c7ba68fcd62f4019516036203b50c03365e94ce5d53e0b702697abf28a012a8f73f83", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706098, "uuid": "00a475c9-6ee8-4f83-831f-a7e5a5ac0649", "value": "T1F5134B5AE78F0265CF811273531A5A8996FDB33EB351547134AC833433EDC2E46A6ABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706098, "uuid": "88beff00-b2da-4c82-9511-ddc20203062a", "value": "768:KFx0XaIsnPRIa4fwJMyHlcR5B8I7NU76k+wE/VvqQjJZ1gpEftGnoRED/:Kf0Xvx3EMJm+U79+wWqQjJZ1guGnt/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706098, "uuid": "04f2e3c9-8ba6-4448-aa77-48182d181286", "value": 43402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706098, "uuid": "242145ce-fb7e-424b-b533-9ab769eff508", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706098, "uuid": "df1e9a0e-7df5-4c59-be04-f882898c2216", "value": "PO-298723.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c280c027-af61-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1676706992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706992, "uuid": "b9428687-3b3f-4247-b898-dc9f9611dcdc", "comment": "Malware payload (AsyncRAT)", "value": "7f7adea899a434cd6de3f0237d9b4e86", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706992, "uuid": "52c001c7-bdd2-40df-b9bf-634a3e549ef9", "comment": "Malware payload (AsyncRAT)", "value": "51782b4669997d616d0c92f725fd6022cebaafcb93cdc0b24c3165ff1a91461f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706992, "uuid": "7f96435d-7df8-4f6f-8369-99b47fc5d3da", "comment": "Malware payload (AsyncRAT)", "value": "c1fa372f98c9209e62810617592eff196ce6486e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706992, "uuid": "c7508088-9dbf-4fad-87a5-639a721a8a8d", "comment": "Malware payload (AsyncRAT)", "value": "8d122baea69037c21295a1f8c322cce6712c101df81db2e4393f91ba78361321a5c2d7f964b733db689c5d6925f89655", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706992, "uuid": "115a7760-91fd-43fb-81ab-b95bd8776da6", "value": "T1EE247C4072AAA4019AF338479E57FA2C477F7AE846324F5AAACD550E0BEF040E5173F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706992, "uuid": "ef6574b3-cf63-440c-bc39-576d967da545", "value": "48:ND5wwVga1vfHWWIdpxr4g6Os1VkBAAwJRh/WmElPtTPk47Tz+us3H6qdtxISm1Cr:xEDs1VkB3wRqh77O7fxISm8h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706992, "uuid": "41623341-78a6-4f1a-b30f-47d00d9eb5cc", "value": 224014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706992, "uuid": "2528426e-7a75-45fb-9f2e-2e13be50c5fa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706992, "uuid": "6852c785-640c-49f1-9b75-c8e91c6d5d63", "value": "INVOICE_TW001.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3d15bdf-af69-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676710377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710377, "uuid": "a41a8f11-5081-46d1-b7ec-410a67759db6", "comment": "Malware payload (Loki)", "value": "894c86d13a34c83652e56c0c0fd56d5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710377, "uuid": "8b4e22ae-65b1-4d32-93bb-daebe5400e40", "comment": "Malware payload (Loki)", "value": "519ce7c158cc6efd1c30436ec5b237fda2915964c888fa83b7c12c2e24a1573b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710377, "uuid": "93993790-89d6-4680-949d-4dbb4ceea437", "comment": "Malware payload (Loki)", "value": "97b2689eb7fade71f06539e4ce770a7c32ab3553", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710377, "uuid": "565206c6-fd50-4ebf-9ebe-efd77b6fbab0", "comment": "Malware payload (Loki)", "value": "a5047cff70f10cfdbcd1cfd027ab6eedf67a8eeeaa1d825a8141beef25d48e181bc6bea27d42c704c26a1955dc5c10b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710377, "uuid": "3ff2b649-c5b3-44ab-9d38-ddda55e70b11", "value": "T1F4F44A9CB1F0F6BFCA06CC76AB103D146BE0654367168593E2A3B6D99B3D4538E1C4B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710377, "uuid": "40dfbb52-54b0-44e4-8442-12ea21e5f742", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710377, "uuid": "6000c2ca-19f9-46e8-987d-10e9cece5d99", "value": "12288:oAeqDSuPDsv9teH5iOsA9DgfTVMjGORv9iq9r25RvW8LaX9UtADsv9tO1L5x0IHh:oAeqDSu7sCD+TS9Rl9r25d7+9z7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676710377, "uuid": "9306826f-7c5b-4471-953f-35c0db71e49f", "value": 734720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676710377, "uuid": "8fe8dcba-b7e7-49df-a28f-8b8a5e810ff2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710377, "uuid": "633f5887-8da8-433a-8bb7-4d04fb3c138b", "value": "894c86d13a34c83652e56c0c0fd56d5a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0508294d-af66-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708822, "uuid": "aac77af1-0975-4713-8bc3-d79c86bd637c", "comment": "Malware payload (RedLineStealer)", "value": "d1e51d7123db949526694a069af1ca1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708822, "uuid": "1537c7d8-ef3c-45ca-8939-4694a9d0c584", "comment": "Malware payload (RedLineStealer)", "value": "51f82c8d1baa271bf34432e93ac1764f2966ca9cac3029958a21d58dd8e9f62e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708822, "uuid": "e852d9bb-6c2c-40ec-a04f-5e52a0dc1d68", "comment": "Malware payload (RedLineStealer)", "value": "184b88891147512ba9c86b8e1ea92bd1fd23ceb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708822, "uuid": "feb8819b-89a2-421d-99e3-06e99514b915", "comment": "Malware payload (RedLineStealer)", "value": "fce6867b55fb2f4b7fb648c5e08bb72fb5e86af1a25cbf92f8e4981c0831f0afb4311080fbcdb50e580627cbcba27fa8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708822, "uuid": "07e7cfda-f614-4369-8ac2-9bb6bb764fbf", "value": "T1B6E41207F7DC4032D974AB7009F203D31A367EA59A384357664F2D2A19B22B8B6353B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708822, "uuid": "1c075181-fdb0-491e-b38f-1b38d07973ba", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708822, "uuid": "cf51b067-7c13-4e4a-bd7e-723c7b727920", "value": "12288:wMrHy90HwMymVB5NYJjLHZEUnqx4VL+yYgsieLsRu2ck5N4HL8+NA:ny4woV/W7EMVL+ngsieLyut2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708822, "uuid": "b8933c77-de48-4658-8a44-9af9312ac40b", "value": 676864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708822, "uuid": "af5c295d-efd4-4a2a-af0e-24b5dfd2d494", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708822, "uuid": "07ec40cc-abc9-42fb-8467-fd9a1d915884", "value": "d1e51d7123db949526694a069af1ca1b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e935519a-afd4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676756449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676756449, "uuid": "bcf7a908-e844-459d-b9c1-b9a82f21d392", "comment": "Malware payload (Amadey)", "value": "60f8d283ab3af0415ef4ad2c1d929d6e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676756449, "uuid": "45e5b0d7-ad57-47e6-9ba6-46e62600354e", "comment": "Malware payload (Amadey)", "value": "52c8eaba663edd79de79e4a5b01e6aa3b90e7666beca18cf5275d0d76fd1ca42", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676756449, "uuid": "37fffd6e-5bdb-4ada-beed-6d3a8dd466d9", "comment": "Malware payload (Amadey)", "value": "43ad3d753efebb0b4bdf70552b2802d7c6040303", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676756449, "uuid": "758ba1ae-c394-4a59-b09c-fade63d03961", "comment": "Malware payload (Amadey)", "value": "cb9c74d0099f6a32d6cf8fcb5f2c641bc6a60735d6580ccf907167f8be05b35d9eb63a69ab53749a139e8b3ba4f50add", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676756449, "uuid": "27607e21-e42d-4875-8b25-f6d5350227f5", "value": "T194F4121BE2EC8572D4B457705CFB02C30A36BDE05A78436B774FA80A19322B5B63576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676756449, "uuid": "757b04db-f5bc-4809-8aea-aaf2ac3004fb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676756449, "uuid": "64b15ce7-08f2-448f-b9d1-8a46de9d72f8", "value": "12288:qMr/y90rSeRQ5nrYQ7Pm6ENdJjjCBE3DltNCo5XBQVzOgbdPAXb3BFTL+obgP7yD:9yOBRQ2Q7e6enCUDhbGuLWggOAKwSp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676756449, "uuid": "52df8a40-754a-4999-a1ee-d8e82329b145", "value": 765952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676756449, "uuid": "292d8b51-8733-42b0-941c-745efa95f7a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676756449, "uuid": "3bf52091-e47c-4f36-9170-c5a02557a79e", "value": "60f8d283ab3af0415ef4ad2c1d929d6e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f380c67-af65-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708517, "uuid": "80a7e6f2-6047-4e7b-8538-db29b4f3dd7e", "comment": "Malware payload (RedLineStealer)", "value": "7f4570a33352024f88fbd6116edf8c19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708517, "uuid": "3e5853ed-e2d8-4166-b2c6-30ba421ecc30", "comment": "Malware payload (RedLineStealer)", "value": "53063b2c39ab9f6b6ec9dcf2668819c1ae9cdfbd1a73f55991440de2b1329fa8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708517, "uuid": "78dd2a15-5bdd-4577-a701-a39d4799f3a3", "comment": "Malware payload (RedLineStealer)", "value": "e9c761d0c658ba572c7a8ab40164b1c5644d75e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708517, "uuid": "8ddb9e70-6d69-4d39-a409-83d76d849b12", "comment": "Malware payload (RedLineStealer)", "value": "fbddd87e471ca46f522e3becd20dc8f10d1c7b223ead8204d67590b34d3576f9a1d88223ba11aa449dea1761208c4bf2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708517, "uuid": "80f95a41-36fa-413f-b8ca-f3d1667910c9", "value": "T1C1E5338BAEDA9456F9BF637408FA07C32939BE774E38415A13C4DD5F04B06B065207AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708517, "uuid": "5c3e20da-58e9-4c59-a7c2-f2b04d290ebd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708517, "uuid": "6dac1a21-084a-4161-b1cb-6560abc39238", "value": "49152:ser1+Hhih3qOEqyX9sYQVCnliJ6hh8tKS4JV+RGsAoRKikoaZweQyZhrz9AwIHil:vShm0ttsylM0h8oSmV+RGsA+QoalZhFv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708517, "uuid": "cfb5f719-cbd3-40d4-abde-7e91fbfcc571", "value": 3127808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708517, "uuid": "16df55ee-3e02-44c3-a603-ab18964c09d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708517, "uuid": "dad9d43d-86ec-4afb-9a2d-2659af1b49a1", "value": "7f4570a33352024f88fbd6116edf8c19.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "665a4eaa-af6c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676711562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711562, "uuid": "436f63ae-7e5c-498d-a1c4-53908374c5c2", "comment": "Malware payload (Amadey)", "value": "6d1db43f4a6cc68f38f0c55cb79b0abd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711562, "uuid": "a19ba7fc-ab96-419f-849a-dce707dfa816", "comment": "Malware payload (Amadey)", "value": "53872b2c7cf4b327d408b987a1c0c3dc0a4516e34483f2ff896755484c9093ac", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711562, "uuid": "879ae381-b33b-4fdf-a159-69dc05ca1b92", "comment": "Malware payload (Amadey)", "value": "5d4154efacef73747bcd15f15ed8171459cd48c3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711562, "uuid": "00f6d624-f7df-4a00-81ee-2c8eee6c95d3", "comment": "Malware payload (Amadey)", "value": "cde52ad791872d0eb2fb1fd3b8eed224567556da80717de65ab82182e772a5adbd5ac23d57c72ddf2ea4e9d2ea3341aa", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711562, "uuid": "d79299ce-2f8f-4692-88a5-90331eb24c95", "value": "T1B7F41207A7EC8062D4B053B018F602C31A7ABDA19B74C397378E6D5518B36E0E63577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711562, "uuid": "5c1fccb1-041d-4cfc-8480-4a36d0b02c5c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711562, "uuid": "3d4ff2e9-1e4a-44a5-a860-70518a12e43b", "value": "12288:XMroy90hRrdkqoHtwcnS7hEMc8MY31jD4u2Fsow6W+M6i0gffUfDm5Dh:jyyNoNFMlxMsCSowX+9Oh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676711562, "uuid": "ddd7deea-434c-4e0d-9928-61f36d11bf1c", "value": 762880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676711562, "uuid": "d605af57-58c1-4c11-ab54-db1d448d25f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711562, "uuid": "412f0e45-ea1b-4e6c-a109-10ef49cf553b", "value": "6d1db43f4a6cc68f38f0c55cb79b0abd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe46fe04-af6c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676711817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711817, "uuid": "fc44e1ba-454f-401f-a7c6-e59db24672cb", "comment": "Malware payload (RedLineStealer)", "value": "1804f0906453d8703821579c176bd8fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711817, "uuid": "463249b6-eeab-44fd-8678-8b5d1d681148", "comment": "Malware payload (RedLineStealer)", "value": "5490b09411ad6639b3d896bb1f234fc5b55e19e3dcb97fff1c3d6953a82599e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711817, "uuid": "acb1eab4-2666-4734-a719-7fed4d7b04bf", "comment": "Malware payload (RedLineStealer)", "value": "95bad2034d20e7bd759520a5cfc0adf5c79c02cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711817, "uuid": "a59ec802-a179-4f53-8584-167a388a33e1", "comment": "Malware payload (RedLineStealer)", "value": "de177c794040515b20c33dd9369f659611e6d3bcedf6f48d616b860c7045a7a62f1a211a30438f878bcc2c11527c714e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711817, "uuid": "ade29a9c-a4b1-407c-b3eb-1db0d0718452", "value": "T165C41207E6FC4836E4B5537009FA02C31636BDA0AB7483EB674F6C595D726B1A53832B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711817, "uuid": "fecebc3d-c4f7-42d6-b169-26acb0221a37", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711817, "uuid": "3dea2c40-83d2-40fe-b1c5-c2ace2a6507f", "value": "12288:DMrey90LmDzON6pxaK6diiCL0rp1nummv6tZproRmfW:hyqmD5kI09pWv6tA4fW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676711817, "uuid": "1587b9f8-073f-4624-90c2-838222dc0c32", "value": 569856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676711817, "uuid": "8ae36f12-1147-45bf-a8b1-bc40ca447acf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711817, "uuid": "536e9e5c-de05-481b-8346-985f9e3f9eaa", "value": "1804f0906453d8703821579c176bd8fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a558a46-af69-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1676710361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710361, "uuid": "e3e16207-10db-4d46-a7eb-9cba907fb585", "comment": "Malware payload (NanoCore)", "value": "7d443d34cde5562f86f443f5c663011b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710361, "uuid": "c31759cb-adb9-477b-9d76-f9198c3225e1", "comment": "Malware payload (NanoCore)", "value": "56370fb64b05cc316eaa1ab45d3fd48c00f35eb63c2073323d022f413af3c528", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710361, "uuid": "d9e37c81-fc0e-419c-a867-d1d3c6affc3f", "comment": "Malware payload (NanoCore)", "value": "69c4125e35d7d74e88d3dffb5713a79984442132", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710361, "uuid": "4886b612-c184-40c1-ac33-03a82dd80c83", "comment": "Malware payload (NanoCore)", "value": "9fbb388bc3394901d7a5cd2b73728198fe45685940846af70c301e10773bca4fd45044ecf1c5961f5246ed95f327fd26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710361, "uuid": "2ac363ab-8258-4274-9feb-7f828be31e6a", "value": "T14B056B9CB1F0F67ECA0ACD76AB103C14ABE065436B168593E253B6D99F3D4538E1C4B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710361, "uuid": "16a6501e-a066-4f7a-84f3-784c7375e656", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710361, "uuid": "f93b9a2b-7e23-43b6-9ffc-6c9ee3eb7eea", "value": "24576:zE0qDSuOz/QSqHrIvpKeEEeVkjB2sctSLr:DzSL8K7wBXctS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676710361, "uuid": "ebc28ff2-66bc-49a2-891a-1601792f27cc", "value": 849920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676710361, "uuid": "be5b03a0-6a33-469f-a05c-ba1f1e5a60e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710361, "uuid": "b657b94a-148d-4688-8350-4126d14c4259", "value": "7d443d34cde5562f86f443f5c663011b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36dfe2a5-afa6-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1676736393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736393, "uuid": "c06af111-856d-45fd-9d97-ff9d5f8f050c", "comment": "Malware payload (njrat)", "value": "46d5080340708e1c7e9d04d5e55f8972", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736393, "uuid": "7f9fd173-2156-4fd5-b4a9-d2c9bfc9fd29", "comment": "Malware payload (njrat)", "value": "567fc92993e43bdbb1d9e74b75d482d459097de0daa26c0375fb4c5c3ae95c1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736393, "uuid": "eccfb374-4248-4652-9c64-e826dc0094df", "comment": "Malware payload (njrat)", "value": "3a7e9215f6f4ce4a57d935aea96fff76edfcf66a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736393, "uuid": "c29e7110-0b25-4943-a033-c2e85f8cf79e", "comment": "Malware payload (njrat)", "value": "8bffba03e1d674aca70f4c443b2d2f4c4553c6a33529e59f9761888184817fd92af678b4478a4a1efe498d2bf3419a19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736393, "uuid": "10a33b04-2ebd-4de2-85ec-86a320c646bd", "value": "T1C4033A4D7BE18168C5FD157B06B2D41207BAE04F6E23D90E8EE564AA37636C08B54EF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736393, "uuid": "07eaf022-6873-4ddf-9409-1e113c2012a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736393, "uuid": "32e3e19c-c77f-44a4-8926-81766f69b647", "value": "384:ejVMiL5BndznNCyMGm9oyXF3cGKjCprAF+rMRTyN/0L+EcoinblneHQM3epzXQNd:evRNRMGm9ZJ9K0rM+rMRa8Nu+lt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676736393, "uuid": "520be017-f100-4382-bef0-6b772eb40551", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676736393, "uuid": "c30e4a9a-ed15-4331-8bf2-b616c0d05fd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736393, "uuid": "6c8e03f7-c145-4292-8110-f46f8253c109", "value": "46d5080340708e1c7e9d04d5e55f8972.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b90b826-af46-11ed-88f6-42010a9c006e", "comment": "Malware payload (zgRAT)", "timestamp": 1676695331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676695331, "uuid": "0da2ceac-d3c7-4c4f-94d8-583f154cc173", "comment": "Malware payload (zgRAT)", "value": "d33260365436afa22dbdfc5109d4f8a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676695331, "uuid": "075165b4-ed51-4864-8a51-c10508ba82f8", "comment": "Malware payload (zgRAT)", "value": "576449483e9522dc46f4815bbccd02fed4d908cce0c8edd56131c206eeb90cf5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676695331, "uuid": "cb2a24b8-5c06-4983-abcd-bb0fed55cc0a", "comment": "Malware payload (zgRAT)", "value": "4fcba484c2ab88565ca5cf793cf243d30790ece8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676695331, "uuid": "ac76d11d-ac23-4331-acf3-0df210f66ae1", "comment": "Malware payload (zgRAT)", "value": "59e6606bc40dda6b5ff51fdc220e7d7ae9828655fae1ec50851b1773cde3a28902c5ea23fa65fcfc5665e98186cf2609", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676695331, "uuid": "b89d3e1a-a63c-4556-b1a1-9cf72a6761e3", "value": "T1C6456C417BE8EA27D15E5772F4A241244BF0D806B753EB4F27A8A5AD1C43740BC892FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676695331, "uuid": "12b2c9ec-1133-48f7-b2fc-b2a067990464", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676695331, "uuid": "5f049ba7-821c-4bad-bdf9-cf5be8bca32a", "value": "24576:RtTwMFkTAB4f27kovjgUpf7yJ1rga/v7fFsuwB:RtTh2wR7Srf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676695331, "uuid": "5c659cf1-3046-411c-b56d-52e3ffc37266", "value": 1187840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676695331, "uuid": "1b9047dc-7ae1-4b2e-a436-fc035bd78d08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676695331, "uuid": "8ec12f86-55c4-4845-b783-29e256a891eb", "value": "d33260365436afa22dbdfc5109d4f8a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "029b659f-afa6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676736306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736306, "uuid": "21adbcfb-6531-491a-9c35-f78e1b311581", "comment": "Malware payload (Smoke Loader)", "value": "23d656a149c2858db13a5e15b9cb40ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736306, "uuid": "4a0c6bbe-2e65-454a-b5d3-84de62aa024f", "comment": "Malware payload (Smoke Loader)", "value": "5878e738c8b3e36e7b1778ba14f8a00766f079d9c7555d9de2a01f633d7dbf37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736306, "uuid": "8bb52cd3-d871-47dd-ae52-596a891e748e", "comment": "Malware payload (Smoke Loader)", "value": "4d74820df4ba129f8661143ec4b488f9aa1dcc19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736306, "uuid": "486aae02-0670-4409-b4e2-cb3b35261a62", "comment": "Malware payload (Smoke Loader)", "value": "5f71163065986e61489eb6bbf364059304a74bed4e86d8ffdfe60c6b6230b35596cf0568506dddb418f6921af15d8c79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736306, "uuid": "247c52c7-ae52-4fd8-a495-5693cee8810f", "value": "T1D554BF13B6E07C51D9124E729E2ACBEC7A6DF5204E44A76A123C5DAF08F41F2D7A3781", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736306, "uuid": "4334d527-f5f7-4512-8de0-8aa2f0f12839", "value": "81831dbd0bb62ee86f0858d78363b4f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736306, "uuid": "aefa796a-e312-4aa7-b470-9852c27004df", "value": "6144:o7r6LhonXq02R1lzaCZ9BaURjOrkMpgamtw6:oP6tonXNI1lzag9BlF3MRmT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676736306, "uuid": "22277a52-a34a-441d-8c7c-4c629bf23e2c", "value": 297984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676736306, "uuid": "2010d5de-16b3-4af9-9c49-5f91067e7698", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736306, "uuid": "7085d7c1-ba38-4c75-8271-70cd56dc7132", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eb25bd4-afde-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676760593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676760593, "uuid": "3be19d8f-6b3a-482e-8975-caf75f1a5e3a", "comment": "Malware payload", "value": "b13bdc689dd8c1ec9f9fd5524ad5dd58", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Ursa", "colour": "#C6451B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676760593, "uuid": "ed9fb984-1be4-454c-abea-681a02ef1010", "comment": "Malware payload", "value": "5a0da9f861885cbc014ce5f5e0fa839f7af6cf651dbc46ba072e9e5f2d12c259", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Ursa", "colour": "#C6451B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676760593, "uuid": "c96e78b5-f5d7-4607-9807-cdc752a60914", "comment": "Malware payload", "value": "9aa7d969adc6723823ead242ab2fc1dd3ba3d6cd", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Ursa", "colour": "#C6451B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676760593, "uuid": "ad28f3c3-a528-4f3e-b0be-8a152fc50f9e", "comment": "Malware payload", "value": "dd26cf6164d5a6c5659fda82132a42740553d488cb5c91327d1611141827f81d786808a2c966406ed0b994849c2654ea", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Ursa", "colour": "#C6451B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676760593, "uuid": "6a710348-0f1d-4d24-a311-b0bc221a7797", "value": "T164F4339D6E3F78AD13C4300A5EB7B49E4D6A63B0327816A539EE1C7D85EB320C49424D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676760593, "uuid": "e9fa3f0d-5ff0-4444-ac3f-8c6e1a9a5a8c", "value": "12288:t0uLfeno1F6VP2WBXBMCJ/T8QsrhlhSzSsWKwZ/dP76fh1UNEczrwwpLbBhRMAeO:t0uCAF8+WdBMm/ejhSmRlNShI9H1deHu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676760593, "uuid": "b6f2e5fa-eaf3-4414-978d-03d125d86ab6", "value": 730685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676760593, "uuid": "14144bec-3e47-4c5d-94bb-9d3010b12f23", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676760593, "uuid": "26f62eb7-a4f9-469e-89c6-2504c5dd9271", "value": "doc-Factura_836504.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "940bfb47-af46-11ed-88f6-42010a9c006e", "comment": "Malware payload (zgRAT)", "timestamp": 1676695318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676695318, "uuid": "c77580a0-458a-4b00-8772-c99ab4586253", "comment": "Malware payload (zgRAT)", "value": "613814e5d37e4771ce8d3bedc63c7f22", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676695318, "uuid": "8b02774b-488b-43db-b83a-f282680dc27b", "comment": "Malware payload (zgRAT)", "value": "5a38b7d37447ed3fa3bbcfe8739b68e76ab2bd4def3fdb85e117238d45a2d84a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676695318, "uuid": "4cbb80ea-d29a-488a-9d26-2154522f3f84", "comment": "Malware payload (zgRAT)", "value": "42b19807c5fecedbd84600eb245cb4aa5dcb9ea5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676695318, "uuid": "83a8b87a-e89e-4479-9b3a-6de278e64bd4", "comment": "Malware payload (zgRAT)", "value": "4100af259da82862f980dd4921e21e09c78fb0d2001fd36145d47db00e8fe1637bef491035c2d86183f228266c95d513", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676695318, "uuid": "0995a07c-175b-4b6e-a81d-54654012a9ae", "value": "T1B6456C417BE8EA27D15E5773F4A241244BF0D806B753EB4F26A8A5AD1C43740BC892FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676695318, "uuid": "fb273cb6-51b9-4210-94a8-fb51a69a3064", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676695318, "uuid": "447485ba-2756-4075-a560-1f3f2dfc81b7", "value": "24576:hXdXoY11b8ur27EovjgUpf7yJ1rga/v7fRsuwB:VdXCusx7Srf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676695318, "uuid": "cc520f9f-93fc-4c1a-9e45-0a5a2a63b75a", "value": 1187840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676695318, "uuid": "72482eb1-6123-4c2a-be0d-25659cab94f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676695318, "uuid": "a063639c-5333-4e00-831e-b12770c5542b", "value": "613814e5d37e4771ce8d3bedc63c7f22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53d3a2fc-af65-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708525, "uuid": "d3baf46e-bb21-4277-b0dc-4d2a3fdcfaac", "comment": "Malware payload (RedLineStealer)", "value": "73604983427ffc48299f7c8c4b6ff796", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708525, "uuid": "06338927-8442-4317-9c40-852de1cbe45a", "comment": "Malware payload (RedLineStealer)", "value": "5af24b8b88efad56b745152b4bb04edafcec3d6efbdcdb8f1d13e11c4e605bb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708525, "uuid": "8a855072-2092-4d6f-beb0-fc321baaff29", "comment": "Malware payload (RedLineStealer)", "value": "8cdfafbba2db28418feb4271b7a2b181d646aea1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708525, "uuid": "aee9b706-f45a-4ced-8e48-0545d0ad9be9", "comment": "Malware payload (RedLineStealer)", "value": "4c1463758577e08b17b2f4f1cc0438409d6ce2a44fad9a4adc7ed3c89e54afb3c809af92db0d04e9f261024d357b8cb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708525, "uuid": "ee4dfb1e-aa71-492d-8b22-ee821a7d40e2", "value": "T1F5B4020BE7EC9232E8B567B158F203E31A367E6057388387274E6D5A1CB2560B53177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708525, "uuid": "5bd25137-259e-4a57-b679-322ed94f332b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708525, "uuid": "938d336c-6faf-41fa-b614-dde87effb5a0", "value": "12288:dMrDy906yRTAjBKqa+kfr9H82moo3WEN/y+L8Q0IYfOW:iyFumKqatWTTLCIYJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708525, "uuid": "73c29c91-dc04-4b74-b018-05b35c03019c", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708525, "uuid": "5e827dac-6075-468e-86ae-a49f96d2f658", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708525, "uuid": "741f762c-cf1f-4307-880a-4c63f2bcb72d", "value": "73604983427ffc48299f7c8c4b6ff796.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5185ff47-af65-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708521, "uuid": "8eed98e4-7dec-4b23-9598-2f11342cb609", "comment": "Malware payload (RedLineStealer)", "value": "bb4280e00ef6b2aab0a199deca28ace8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708521, "uuid": "da540e84-469c-406d-823e-143fc69f2b47", "comment": "Malware payload (RedLineStealer)", "value": "5c8b69b8b0afaf2975462e59b9242a6ada15f7febb3907e6c95058834d942be1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708521, "uuid": "b8390104-a9f0-4350-8fdc-f918ffdb2700", "comment": "Malware payload (RedLineStealer)", "value": "91996efb9610440c6f82a0394457ef3506393b0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708521, "uuid": "140f3c4a-4c10-4eab-b6a0-3715abe0926f", "comment": "Malware payload (RedLineStealer)", "value": "69a7efb56f378cb880f233eb1b6185eda1718824efdd2b9da797e174b2bfac9957ab60983cd0f4c6e263d84025e1bc45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708521, "uuid": "ec374acc-f21c-44d5-b590-d6fba804ef63", "value": "T11EE4128BA6ED9071F8B52B300DF607D311367EA25A384797238F7C6A18725B0713A767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708521, "uuid": "c65c9f1d-8c84-4c61-9a66-f932cdb738f2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708521, "uuid": "edbeea8f-365a-4cbb-8508-e340c1da8b14", "value": "12288:IMr4y905upVXKcu2rtBes0roPSuuKOUdsoqL5yHpbO760OU:Ay1VDug0rWSXUdsoqcHhO5OU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708521, "uuid": "78b84c7d-e901-4849-9c76-ba391260b6e0", "value": 687616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708521, "uuid": "976c1903-3ea0-4224-9d6e-1178bae78d2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708521, "uuid": "e5523326-ad07-4200-a7ec-9d416ee33cc9", "value": "bb4280e00ef6b2aab0a199deca28ace8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d413a6d2-af63-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676707881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707881, "uuid": "56291b70-dd58-414e-bf92-9e1e3708f066", "comment": "Malware payload (RedLineStealer)", "value": "947b4fa25b9b563837d62e8dac394a57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707881, "uuid": "e410f61b-65b4-417c-9ed8-37211c66d652", "comment": "Malware payload (RedLineStealer)", "value": "5cda278396be9ad779e31b37e00b9751e944127f4b6df8ac5ebdfd767da70a8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707881, "uuid": "b2b2b708-11d2-4bc8-9c3e-3c51e042c12c", "comment": "Malware payload (RedLineStealer)", "value": "0b587240fc8a5b0a501fed081ee7c1e8d7b47d91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707881, "uuid": "de7b5057-2391-4c73-881b-e6f200ef6e38", "comment": "Malware payload (RedLineStealer)", "value": "ad046771c9958a38567408427f4045fb6c6ad673e82fb9805643643a3f88990e92179c83165eb1fd44c2002c20a79e4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707881, "uuid": "dfb31ba6-46e9-442c-810a-62badf69a170", "value": "T13BB40107FBEC4171E8A517B049F246D30A35BDA0563D878B278AB85E1C726B4B63137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707881, "uuid": "b5914c2d-1640-4ef6-ac4b-76206d6ffa50", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707881, "uuid": "69733d40-5dd9-4da0-ad10-96490ec1fe7b", "value": "12288:PMrxy90FwqWP25nGDedh31cU4Yo6WENFy18g0vWYU/:GydnPbSnfRTH9vY/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676707881, "uuid": "2a7a07f5-bee5-4089-9e54-00093f52e146", "value": 539648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676707881, "uuid": "4a3fe145-6582-47ff-a08d-77e54e2f3bc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707881, "uuid": "e98f1e3f-2a9a-46cf-ba84-fd68636135b3", "value": "947b4fa25b9b563837d62e8dac394a57.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b2e8601-af64-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708215, "uuid": "2fa5c8ea-ce89-4299-8882-36f040a55d59", "comment": "Malware payload (RedLineStealer)", "value": "b7dd856e3dc4f8552a69d93b0c719819", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708215, "uuid": "b527e7bd-0f5a-49d9-85f3-24bd0c75b58e", "comment": "Malware payload (RedLineStealer)", "value": "5cf0f62e4c631fde2abf6ee0d978ea84176692f7d68426ebc6d47e6c5c35ccf1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708215, "uuid": "883bc0d2-d849-42e6-a5c7-2c02d002a0e4", "comment": "Malware payload (RedLineStealer)", "value": "7ef57f5c0f2ea681324e9ca9a2f2efaafc526476", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708215, "uuid": "15660f95-25c9-462e-9a0a-1a61926a55e6", "comment": "Malware payload (RedLineStealer)", "value": "7b28b82c2db782c3c7d0afd04b559dacdead1bc567b06eaad30a0c6d84ac570f96c604519e67e8e306f43192e75b83ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708215, "uuid": "92bfe194-c1ec-4147-8a57-3071bc65798c", "value": "T159F41257E6DDE432F87017701CF503D306367FA15A38836B278F6D5A04A2AB4A2357AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708215, "uuid": "76faac77-9f67-46e9-9df6-1e07909fe5e3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708215, "uuid": "ae6a0011-c0b9-4ed8-976d-4d6a59dfabf8", "value": "12288:uMrqy90+cy7Vshya5YpRZWD2IyNhsizdqL58dp64fz605hBi:wy9cy7VTaILY2IyN2izdqKdwQ6uDi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708215, "uuid": "0723ba7a-f73e-4a6c-b37d-2ef347543d49", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708215, "uuid": "1aedc6ad-20f7-49f3-90ac-70e19bd17b05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708215, "uuid": "55d9cda4-a8cb-4557-9401-def3fe32ea8e", "value": "b7dd856e3dc4f8552a69d93b0c719819.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85655730-af4e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676698729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676698729, "uuid": "04a461d9-b0d6-459e-894c-36054b513f7f", "comment": "Malware payload", "value": "8a847b0f466b3174741aac734989aa73", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT42", "colour": "#37A01A", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VINETHORN", "colour": "#74CF3E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676698729, "uuid": "12760020-903e-47e8-ba9b-9204f45bd008", "comment": "Malware payload", "value": "5d3ff202f20af915863eee45916412a271bae1ea3a0e20988309c16723ce4da5", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT42", "colour": "#37A01A", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VINETHORN", "colour": "#74CF3E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676698729, "uuid": "be787279-f819-4cd9-bd0d-3ddbce27de21", "comment": "Malware payload", "value": "03eadb4ab93a1a0232cb40b7d2ef179a1cd0174d", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT42", "colour": "#37A01A", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VINETHORN", "colour": "#74CF3E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676698729, "uuid": "5bd7df27-1c8f-4304-be33-ca4396b0c307", "comment": "Malware payload", "value": "3b13646f0369edde2d18d9368c89c20ee480d23ea577e24d295dea697be477085ae7169e24346277adb98e59543cb870", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT42", "colour": "#37A01A", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VINETHORN", "colour": "#74CF3E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676698729, "uuid": "cf25ed38-cbd2-4bc8-be1e-63049fa853ce", "value": "T178C62383F708E52FC537C0338EA2463A66474C4586539B176568B32C5EBBAC45F9AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676698729, "uuid": "156826d2-6648-405d-97c6-00f34a36fd36", "value": "196608:0/ruFMnjielhXAzLekMhH6rHVFIA2+7zWc7yi0UWsGZaHlgcm+2YplVl2toTkUmc:0/ruqnjiNPqhiF2+Z2x9taFgspDl2to1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676698729, "uuid": "489f834d-e3dd-473b-9a86-536939f1a542", "value": 12322427, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676698729, "uuid": "4c6709e8-e541-4cd4-9709-e21aa489a144", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676698729, "uuid": "d8953f6f-4988-46b0-98b0-cf9806b9eeb5", "value": "5d3ff202f20af915863eee45916412a271bae1ea3a0e20988309c16723ce4da5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "694dc82c-af6a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676710708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710708, "uuid": "a19f0494-274a-4118-babd-8c2502009010", "comment": "Malware payload", "value": "415ba3f996fabc7647dce9b3a972eb21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710708, "uuid": "802d2b23-e6c1-4aa1-8318-9151755d3b22", "comment": "Malware payload", "value": "5d5eca3b47bd89c255acf300f276a38401de87f82975518d1179f935ae644b74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710708, "uuid": "085a7b32-59e8-4049-84ad-9819582af5be", "comment": "Malware payload", "value": "83366abbabad04de018e10b8f299236d563802c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710708, "uuid": "64fa7bfa-0da4-4836-be79-0a69d93c7c22", "comment": "Malware payload", "value": "3ff4b855a01a6463cc84a1b55a4f84de60bbc9245b8c8a6e9b7759442868ae939754790cbb5eb2d4d4dd42f6076c7ae9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710708, "uuid": "c52db5c6-9e13-480b-ba50-7a6a5dd56d77", "value": "T143241823F3A2A509F22284B13D34D34E667ABE314846E94EB6823F5534324D7E5F5B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710708, "uuid": "6c373da6-3438-4828-9a44-815fd82cb80f", "value": "3274dc16fb06c92a0119b94734d01456", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710708, "uuid": "a3e9f0fc-0965-4b95-a282-25540dbd46b6", "value": "3072:so8L5tpw+pSA1AAPoCpxW5AT4fUNjpS1svkTVC9FieYTTLprx/m3qT4S826guKq5:EtpLoCpbNQ1jQdi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676710708, "uuid": "0e8bcd41-845e-48e2-b30a-bbe3f2f37d84", "value": 225280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676710708, "uuid": "da55c999-7e75-46bf-b78c-f9a239257aa4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710708, "uuid": "e5af426b-ce93-4e57-b916-fd913c04b81c", "value": "5d5eca3b47bd89c255acf300f276a38401de87f82975518d1179f935ae644b74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a88ea26a-af61-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1676706949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706949, "uuid": "94e4c5d9-2f06-4604-bd5c-839993eca95c", "comment": "Malware payload (GuLoader)", "value": "afa5b2f8f047794fad7da9ae4f93a530", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706949, "uuid": "ab55eb4f-925b-4371-91d8-0644407dd989", "comment": "Malware payload (GuLoader)", "value": "5f992b9b00c34e338b4d834066b95c0f7d0d532764a4d53602182b21bd4d86dc", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706949, "uuid": "e6bff4d8-4157-4a46-afb5-47f8269eba81", "comment": "Malware payload (GuLoader)", "value": "c9a5d0d497c3d3b760bc5a3a28648098d4e80501", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706949, "uuid": "54e58c1b-58d4-498d-93f5-3168997bd253", "comment": "Malware payload (GuLoader)", "value": "e84825be2758667dbd59f04c3fa18d2ae4788433cfa1293206490e3a9c85db038d237d8c43a0365bc000e905976a3ded", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706949, "uuid": "746ccb05-6110-4f57-b59b-569904be429d", "value": "T1ECD38D6ADA68070ACC0B3B69AC613F89483F4026DB2B5168FDB50B5D010B65DD37E77E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706949, "uuid": "15b3f814-e535-47ed-ae2a-1ddb61c1bca6", "value": "3072:EbvZVYA71CIbJv3Jbk0yVR1pVug05AQB5nyHgc+sIe8STWoR2:wvZB7ckvA7VTpVuFFSIRgWoR2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706949, "uuid": "423a4460-3a7b-4844-a99e-da73eef0083a", "value": 133316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706949, "uuid": "4fad0e3b-e396-47f9-a2c8-97ddea9ce4de", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706949, "uuid": "97856028-768b-4294-a1b6-e9b549691feb", "value": "metalwork_orden_0214.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45b8d5aa-af69-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676710219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710219, "uuid": "846bdcae-d30f-4ad5-ba1f-f12c38ce3b4b", "comment": "Malware payload (Formbook)", "value": "e5970132d467f3bf43f9f9f7d2f18fc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710219, "uuid": "e298dd7e-0be8-4e25-aa4e-c1739f86213d", "comment": "Malware payload (Formbook)", "value": "5fe93d9730b1f7d667b106fb482894dcdc0aeeac61ab1c1f26227cb46c27c947", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710219, "uuid": "501d5b5c-aa4f-4b33-98ba-4fd188aa5cc0", "comment": "Malware payload (Formbook)", "value": "d559d5090b228ccefce30fbbb2dab800d42fc7ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710219, "uuid": "1f9bbc3a-1c48-409f-87b7-424f9659658b", "comment": "Malware payload (Formbook)", "value": "512ebfd6eec531a289f55c410b832f3c1152a79ee889d35a102264fae2d03a32d1ae37f022419e8e6a230e56f483b606", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710219, "uuid": "ec86a765-d713-4134-81ae-f302004cca1f", "value": "T1BEE49C8CC1F1EA3ECB498EB9371035081FE05643A924DAE6E3E5FAC22F36563199D535", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710219, "uuid": "9ff2741b-35f2-4374-9305-c044f101e82f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710219, "uuid": "f9d06bbe-38f7-46f1-a28b-5eb41b22d4c6", "value": "12288:44dqDSuQDsv9tCJ6FRXeBXnjmO0Tfnn37Bl6am43DHONzSDsv9t:44dqDSuSMeFjmOQn37BTmv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676710219, "uuid": "7cfc85ac-901b-4d75-82cb-963e38a926ba", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676710219, "uuid": "f2bed785-feae-445c-badd-8897444bb00d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710219, "uuid": "1a629dac-441a-4892-8976-3a96705ede2e", "value": "e5970132d467f3bf43f9f9f7d2f18fc4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cdab9d5-af94-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676728672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676728672, "uuid": "de41f912-f6a0-406f-bf56-8f73eeebf016", "comment": "Malware payload (AgentTesla)", "value": "e91b33bce65eed8185c1e7e45da0c4a3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676728672, "uuid": "26409d3a-0fc8-4805-b94c-9ddc266dd3d1", "comment": "Malware payload (AgentTesla)", "value": "6074e7916a2a76a23bf2ed289fbf2d6b354688325d9352a0481294e09a0e971a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676728672, "uuid": "c47e9d3a-f200-412a-a5b3-14f71140517b", "comment": "Malware payload (AgentTesla)", "value": "bb76b665ff870c09b961efd1b10bb831621f513e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676728672, "uuid": "5d984eed-cba8-47eb-bd02-91fe119f9388", "comment": "Malware payload (AgentTesla)", "value": "51bf98758ba9c90381996a9b6dd0d6a4f036a2fb230d5aa062dee70f97e925aca887c47bd05d3db0578152dac0ed17ea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676728672, "uuid": "a5a2fcce-5522-4679-96a6-c2902fd268fb", "value": "T144641310C2A1C6E7D5F302705F394AB69DFEEC362C58461663AC8759BB73241C66F362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676728672, "uuid": "0b804468-232a-4de3-810a-879f19355e23", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676728672, "uuid": "3930b938-d1ff-4efe-96f5-0fdb5f12cc8a", "value": "6144:PYa69DS79qrneqA++jTJ4zLNPCeb8e+O0xEu6p6o:PYPmoFEjTcNPCebeOso", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676728672, "uuid": "bd8b9146-bc2a-4ddd-8e12-058388c5848c", "value": 322802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676728672, "uuid": "41afdc9c-f6d3-4f78-bc22-4ecf6210efdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676728672, "uuid": "9e3247b6-7d91-47f1-9152-063e04a41af6", "value": "P.O# 21-1477 - POT and Plunger.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "918bfb0b-af87-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676723231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676723231, "uuid": "8f13e2fe-1b36-4a4b-8eef-c6d0cb797709", "comment": "Malware payload (RedLineStealer)", "value": "12569e0c214ae0dbb4e9c3e99ff9f24a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676723231, "uuid": "544b0cb6-39ca-4619-9453-23a43c75e08c", "comment": "Malware payload (RedLineStealer)", "value": "61a6521c637c997f193d40e43ca71634759b3a1677a94fb0f1022616737d25e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676723231, "uuid": "cb9839c3-d184-4695-b917-e8888b5f31d9", "comment": "Malware payload (RedLineStealer)", "value": "bac1f0dd32c09ff0bbb5bcb7beec1a25b8dc53b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676723231, "uuid": "5e4d3e4a-d62d-4495-a2ce-fc94d2681afb", "comment": "Malware payload (RedLineStealer)", "value": "f4fd28689cf77c5ae85db12731f6cf737d2880d9b65af2c6275692a323c1a9b49659a7575c61844b398dc7bf483ffe92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676723231, "uuid": "fa6ebec5-08b7-4043-a051-f4f70d225fde", "value": "T15BE41207F7EC8522E9766B3049F616C31B323E615A7A03AB338E9D5A08727A17535337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676723231, "uuid": "a48b9b5d-93ad-4db7-b8dd-6181090ea0b2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676723231, "uuid": "e1b3b5a9-a899-409f-b34b-10b7f52a4b37", "value": "12288:LMrny90iSxTtviVy3ntQ1HXOJV4tAvbMLD/3tINjPj9vuX7xJFX6mOwVYLtANPWP:EyfgQV2QpXOmAjgcjPVuX8mOw+q81lX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676723231, "uuid": "4b873290-b2f3-4989-ab7e-4e6ad36640a5", "value": 718336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676723231, "uuid": "aba5ef59-add8-464b-927a-d6797b5239ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676723231, "uuid": "af10251b-2635-4fbe-82af-757bdd366289", "value": "12569e0c214ae0dbb4e9c3e99ff9f24a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4e9024f-af86-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vjw0rm)", "timestamp": 1676722941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722941, "uuid": "34f7011e-6cc6-4212-9b4d-58bb61bf582e", "comment": "Malware payload (Vjw0rm)", "value": "6aaf489923e41a6a48c3c70bd33763d6", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722941, "uuid": "8480a02b-dfa4-49ee-a5ef-445fcb6ed948", "comment": "Malware payload (Vjw0rm)", "value": "61aea0e09f6bf0722ce9d516032d8d8dcc3e1a262a8a7c622f81158c12d55435", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722941, "uuid": "9f206524-3730-4bcf-9398-fccb8ec6d2f5", "comment": "Malware payload (Vjw0rm)", "value": "7bfb6ea711609aad62819faefe54cb4ee207b670", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722941, "uuid": "bcaafe16-bd65-418c-9f36-18a95050eeda", "comment": "Malware payload (Vjw0rm)", "value": "ffcd28042eab111f7c1e797b722abf9d75cd334bd522ebec6956cea14e5a68133fe1b01460fe126d6164c21cd2a04ac0", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722941, "uuid": "4c5272c5-3790-476a-984c-fe37068ecbb4", "value": "T17EB3A0073C5BB93C1A4F2D0965342E791E9EAF65C609A12B388E6F3DC32205D137F56A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722941, "uuid": "b5417ad2-84d4-4f75-aa9b-20da0fb15c19", "value": "1536:AdkYPxC2uPxC2JPxC2iPxC2cUOxk5eRHUH5:Adk98", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676722941, "uuid": "a62fc816-aab6-4f83-809b-de382ec3dd94", "value": 114726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676722941, "uuid": "7dd9b943-0cf1-4448-9da1-6671b529ec1f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722941, "uuid": "f1191307-68c4-4d0f-ae92-f491ce968833", "value": "ORDER-17886.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e48a403-af86-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676722635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722635, "uuid": "10dd8188-b7d4-44cd-bfbb-27d6652d7541", "comment": "Malware payload (Amadey)", "value": "cc4de831acb06bc9acacd2e57cedd957", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722635, "uuid": "c6c27211-3afd-4160-b7cc-dee299aec50a", "comment": "Malware payload (Amadey)", "value": "62011a808288f797483dea9bbb85bc84c69ecc35f237ed7347e1ca6ade318db2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722635, "uuid": "90850b71-d8ce-4d7e-9d95-bd667dadc89f", "comment": "Malware payload (Amadey)", "value": "83d9ed709038240ae2606d33ce2e93524425049c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722635, "uuid": "5c2a0f2e-f809-4fa5-aeb5-ad47c57f4b1d", "comment": "Malware payload (Amadey)", "value": "658b5f56c2b3d0f122bae056ddf047e7bd5bbf2ffca1388d9953eebfa605c196bd8920a5c4c3883feb8b087ed517a3c4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722635, "uuid": "3ab92ba0-e69f-450e-a5c0-65f2f57e7093", "value": "T1FEF41207FBEC8472D9A55B7019F207C31D357EA2AA71879F770E6D8A08326B46670327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722635, "uuid": "135f2d24-62d8-49df-ad08-6762aadc1913", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722635, "uuid": "88beb88e-f521-4b1d-98a0-a69b012bd2fd", "value": "12288:WMr3y90GXC9/oSV4O7Kv0cUVAveELdMj6BDdKe8uYDlVp92bGPm/7kQ746hqiblY:xyXXC9/7VzxcUVAxMQhh8uylXv8dmp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676722635, "uuid": "a2427a73-acd3-466c-995a-18b2bbfe8b15", "value": 762880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676722635, "uuid": "f4064c9c-8a7b-4065-90cd-b83094089d30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722635, "uuid": "85cc8b84-8f9f-4cd1-8b9b-45828acb2280", "value": "cc4de831acb06bc9acacd2e57cedd957.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8ede61c-af86-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676722975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722975, "uuid": "5b96cbdd-05e4-41a0-8819-aa03cb92e548", "comment": "Malware payload (Amadey)", "value": "74d02450c87adfd75478c1a7b379e2fc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722975, "uuid": "88a88963-f818-40c2-a9e3-6a79a7dee757", "comment": "Malware payload (Amadey)", "value": "620d61bf6261a9332cc9b6f37e53efd45bad77f152d6172e8c90a239465e9ea3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722975, "uuid": "813ee93e-928c-4a8b-b8d7-13d653991d21", "comment": "Malware payload (Amadey)", "value": "ca8aca2697b67c88fdd88ee19edf10359f836e77", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722975, "uuid": "9908d896-aa21-41b8-914a-32630630bc09", "comment": "Malware payload (Amadey)", "value": "c19b60b90922686e3053f3bebdae82c152a2f77ad7227876570d9e39b92d3293aba0ffd2ebc0f4a1a9c908be78d1c364", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722975, "uuid": "87ecb02e-f25e-4cd4-bb39-ae728f5234e0", "value": "T1F4151207FAF88022E5B523B016FB52C31E367DA55AB5431A271FAC4618734B4E635B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722975, "uuid": "5b897aca-6892-4ee4-8058-b19357078e5c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722975, "uuid": "84c0a47b-c46b-4cf1-bfd3-c89d275ddd1e", "value": "24576:Py57LVnsP6Uvuinea8Q3xaCP5HrQCGP+EA08yaromn:apL2PnRneap3J9rHjEA9Hr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676722975, "uuid": "f78f5dfd-340c-4ca3-86ad-5586174cf98c", "value": 905728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676722975, "uuid": "be85b8a2-bb4b-418b-b669-710b268294d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722975, "uuid": "00867fd6-99df-4803-b152-8c2bbb841fe5", "value": "74d02450c87adfd75478c1a7b379e2fc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7765624-af24-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676680748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676680748, "uuid": "9c40a1c8-d138-46be-a38b-7ce79a53a043", "comment": "Malware payload (RedLineStealer)", "value": "bab8522c4ee95eca66983ec90a2edebb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676680748, "uuid": "49bcd5ba-8123-474a-863e-d1a7c27b5244", "comment": "Malware payload (RedLineStealer)", "value": "621ccf691f7df273e47ac3ddb553a7683c52745f9e0a499c347ddd21955af7e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676680748, "uuid": "335ae4db-db25-477a-b868-d0b0ad506730", "comment": "Malware payload (RedLineStealer)", "value": "2613e26f3aa72316030e3add01c392bcb4aa4089", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676680748, "uuid": "f02c57ff-cf00-4a52-ab76-502ec4dbe981", "comment": "Malware payload (RedLineStealer)", "value": "3c7e8fcc6dc1896f5765e604e9079b689e8637ae1d945cd7d3e8e3c3ae02a53299b84ead0e5da2ff179f73da2dd753c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676680748, "uuid": "502a5c4f-5ec5-4e8b-8d5d-cf63279c6a15", "value": "T14CF41247B6DC8016E9B5A3B058F702D31A37BD70193A839A379D6C4D2C33A65B27472B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676680748, "uuid": "c3dead38-3d1e-42de-9172-6dc12bc1f9bc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676680748, "uuid": "507129c4-e482-4ac8-a501-b1692bc772f4", "value": "12288:mMrFy90ifiCqCMPFgufyiWZ3/+b4tNTQH7EP1bKdIY+5An:/yJf9qrdmZ3nTQHAP1+dId5K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676680748, "uuid": "da56c3de-3515-4003-aa92-d99566236f13", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676680748, "uuid": "da82465f-d9ed-4224-b72d-603946096129", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676680748, "uuid": "34594d65-e852-472c-887e-f78d81a0743d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09e4bb87-af6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676711837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711837, "uuid": "9aca5601-6465-4e60-9eb8-85df63cf80a4", "comment": "Malware payload (RedLineStealer)", "value": "6f0bc3e421a5249b01cd5710f6ce8990", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711837, "uuid": "159d9962-915b-4a93-a0c7-410b859898ee", "comment": "Malware payload (RedLineStealer)", "value": "62fa7fcf5cde27363e69da4813b5fc0c987494634c0e8514e2ca974fa3e7a00d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711837, "uuid": "99f1e138-ff2a-4b85-9356-29a3aac62e68", "comment": "Malware payload (RedLineStealer)", "value": "3e91716ae0c65771b4cc34f34df2e27e140990a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711837, "uuid": "a113cf11-05f8-4b06-abd5-362d0c84d8e7", "comment": "Malware payload (RedLineStealer)", "value": "582d31c45c41ae548179679de487f6c903d92e8f119ad8fb2d87b9cfdc704d1e2e69a1e9d78213feb270018978c88880", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711837, "uuid": "3f7b5c16-b54f-482d-9177-1c57afba57c6", "value": "T1F4E5339BFDE91836EA6623705AFB06D709317C70647812CB6792FE47683163076703BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711837, "uuid": "c1c5223d-1ff5-42af-9392-f04a4556e57f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711837, "uuid": "e8afacfa-59af-477c-ba7b-4790dd78825f", "value": "49152:KkgyXTdJmOcoLx9yVRiibTB/QYEg58t5GMB/lsWSVbbWGgMuCouEE9NazQG57I4d:VeoTeRiiiYE62GMtsW6bKdTBJzQY7IJN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676711837, "uuid": "4cd2ff8a-b402-47bf-b853-b03f298b8241", "value": 3122176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676711837, "uuid": "4dcccc19-7666-4455-bbc9-11be050a8c0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711837, "uuid": "3e9da74e-3c9a-4db9-97e5-06ee0cc62986", "value": "62fa7fcf5cde27363e69da4813b5fc0c987494634c0e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74682be6-af6a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676710727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710727, "uuid": "a10c1f11-18b8-4434-8d20-fc624a932056", "comment": "Malware payload", "value": "a2a2121f4cc081b892a81ed56908a5ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710727, "uuid": "debd57ea-c4cc-496a-b28a-be1bf8c3fecc", "comment": "Malware payload", "value": "633cd894a8480256fed469343e652c0b82f176d466d14576e4c4a7ffd508a814", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710727, "uuid": "139e2455-a3fc-40ca-9c81-b40b386c4e4c", "comment": "Malware payload", "value": "5fb1b628e68534a74ce7131f749223ff3b5d5252", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710727, "uuid": "973da5da-96e1-43bc-8adc-cae4487f0650", "comment": "Malware payload", "value": "b16085ad6a76ab36b0d1c2b26097fcadce3c20a7957473df827e23139fc4a5874462b4e55d3e69ac8c760e0cf9210fb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710727, "uuid": "f260f4ac-41f8-463d-a7a4-beed0a95cf1d", "value": "T172C3F71133FC5A1FE77F06B9B66124610FBAF81B6142DB596DDD20EE0A223D04B42B67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710727, "uuid": "de9f8723-72ef-43cb-b382-d738187a6aec", "value": "3072:omYQqraJh+GViS5cA1zzLnF4ZbhQf7qvHusRCmg5IIaPy3YxETQ7:zYQqraH+GViS5cA1zzLnKZbuyjR4NE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676710727, "uuid": "3e56b026-f2ca-4a83-9d90-be4f61bf373c", "value": 125792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676710727, "uuid": "c22f83b0-c130-4f1c-89b9-1a4879e33f21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710727, "uuid": "bc9879be-6ae1-4083-814a-b973f4e60b93", "value": "Shipment-Document_Invoices.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4514851-af61-11ed-88f6-42010a9c006e", "comment": "Malware payload (WSHRAT)", "timestamp": 1676706942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706942, "uuid": "d941fa0e-17a7-4c08-97b7-e77de10fef46", "comment": "Malware payload (WSHRAT)", "value": "cabfb532b1a74b86c6e2bda9d2085079", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706942, "uuid": "52a529c4-bd8f-4439-94cd-8c5baf2e1b6a", "comment": "Malware payload (WSHRAT)", "value": "64271b2cc7849f1e9ea9d881f6014af70db7800dd86397437342b11ac6ed9d64", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706942, "uuid": "08e95579-9765-46f3-b1ae-c1112621facd", "comment": "Malware payload (WSHRAT)", "value": "076889ea3c5850677c67fad271028d717c21a37e", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706942, "uuid": "70856d32-5997-4ab2-ace3-9de685f47619", "comment": "Malware payload (WSHRAT)", "value": "348f4e8cbb49603ca3d27dd77fb09475b20adbf955138ee73847aa86da9d856624dd20efedee02736601bc571e64dc29", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706942, "uuid": "0db64c9f-1434-412a-86de-0f87b3440bec", "value": "T1F11463073E47F93C164F2D04A2382E7A4F4EFE61C558A51A22096FBC836368D17BF959", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706942, "uuid": "7e9b61e2-3d22-451d-8257-3050e8b3566b", "value": "384:g0EW3eLEL8Og4Rw1BMUsQ9JT2dR02zqB7L7cKF5B7A7MR9+0Kg0Bhpt7wp2k5V+0:g0ET1Epbhuh5mQBnF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706942, "uuid": "46bc6b21-ceef-4ade-8ce1-1f33887fd655", "value": 203492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706942, "uuid": "fe3f5d92-fa3e-410d-904a-be28af383a04", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706942, "uuid": "687dbca2-9b8d-4c1a-b1fd-894961f7cbe8", "value": "ORDER-230217A.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc22d42a-af60-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mekotio)", "timestamp": 1676706660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706660, "uuid": "fa7ebdac-16bc-4fef-97e3-2443b1c481ef", "comment": "Malware payload (Mekotio)", "value": "389ebb1261b3433ec157f7e8066bfdea", "object_relation": "md5", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706660, "uuid": "c541c597-495e-4525-a1be-293db4f548c9", "comment": "Malware payload (Mekotio)", "value": "64b9695d845cdf62c01e755e83cffde32adde9674af26b9c99147f177b523e98", "object_relation": "sha256", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706660, "uuid": "d7af4d99-1d6e-4936-a64d-100fb178302b", "comment": "Malware payload (Mekotio)", "value": "b9c6ae3846713e158d95a026d7417deea4faf6b7", "object_relation": "sha1", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706660, "uuid": "d8663707-0d35-4ae3-930c-ccbe329f163c", "comment": "Malware payload (Mekotio)", "value": "164aa736bd885ae59f17d00013488c5da05cdb1fd1e57d151101a93b90d1088f0eedd711a30957f890f9e3dabdf69ab9", "object_relation": "sha3-384", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706660, "uuid": "68745a93-70ef-4c79-aa0c-bce941fbf263", "value": "T1DB96232276964522D5FEC2790E37BED524F2172D83B310B7B588AACF34E57D08672983", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706660, "uuid": "a1ed2d0d-4168-4340-a852-fd9d1c49100e", "value": "196608:sXFJ9XPJkDY8iE2PKii/z4LbFfFHrmkvh0duYy12rQg:sXpXPJ98D2Xi/SfRrmC5YYD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706660, "uuid": "18c0bf9f-7b0f-464c-9048-31df37e37fdf", "value": 8963072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706660, "uuid": "187237b1-f605-4da3-8b3f-be0016d03b5f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706660, "uuid": "503eee04-170d-4ac1-996a-82f04c0682c1", "value": "FACT.862792.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6401de7b-af29-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676682782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676682782, "uuid": "f327d5a3-802f-4554-a68d-2bda85464939", "comment": "Malware payload (RedLineStealer)", "value": "59cc2ed7c3490a20d62a8004d8c0fa8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676682782, "uuid": "392a5c6b-950d-4cdf-b75c-7861742c3582", "comment": "Malware payload (RedLineStealer)", "value": "661aa10b175ac662b937411d965e22085a7cbcdb60c1b86bcceb680d7dbf8c85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676682782, "uuid": "58afbf7b-541d-4f2b-b6ea-0e52b344a270", "comment": "Malware payload (RedLineStealer)", "value": "e2ad646b79705e67dfd139e6abab0068609b6f8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676682782, "uuid": "d8ec2538-4758-403f-9b10-f6cfc2e1deef", "comment": "Malware payload (RedLineStealer)", "value": "9cd8d85730ba2808a8d6c6f3a62c1886589bc1634271c0394eb8ab4dfe89e79a381db08bd483511c6ac39e776b932023", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676682782, "uuid": "812e30cf-742c-406f-8e83-b5f5d5705dbf", "value": "T102F41217BBE88436E4B5677019FB42D7093A7D605B39839A234B9E1E18732B0B235377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676682782, "uuid": "3b6e329f-94a5-4bf8-a5bb-8c3ce2010025", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676682782, "uuid": "8b56014f-6ec4-43ed-a8a8-d2744b8b6c30", "value": "12288:/MrGy90Eb/2iN5TZEdynQSpX6NTQwzgPwuDh9mN6L:ZyHb9EQnQ7TQwMP9DrmNU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676682782, "uuid": "a88ba0ba-86b8-442d-a342-8dc19b55d765", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676682782, "uuid": "7fbfb72f-aa43-4106-889b-ce4d33a66f8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676682782, "uuid": "32aaa8ec-c07a-407e-844a-1099cea2897e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50574921-af65-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708519, "uuid": "9a192645-f902-4f6f-b015-294523a080f4", "comment": "Malware payload (RedLineStealer)", "value": "a8cc308641c2e791a639e650aaac3b09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708519, "uuid": "c8cfc4bd-0f3c-49e7-bdbe-49c4ea1e1528", "comment": "Malware payload (RedLineStealer)", "value": "666ed1af610f259c26e94f723f422e9c9aee2b82482d5fa3aad19b6176efd60f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708519, "uuid": "dec2c6d0-7368-4508-b521-898da47a3cfc", "comment": "Malware payload (RedLineStealer)", "value": "0415b43da4fabb327cc7ea72a28d0dbd0cab199a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708519, "uuid": "50409923-efb0-42c1-a7fc-a05007df814c", "comment": "Malware payload (RedLineStealer)", "value": "9209c8631ffdbbca27b44d0ae5f4770f063ce46e8bdc69ac2bb90a6ac200d1d5349c7ec2c21b8e73bb19bac73cc83880", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708519, "uuid": "7d43dba5-ae2c-4dd4-9344-688f21df6278", "value": "T183E41207ABE88063E8F54B705DF503C31936BE65AB38C257268B9D0E1CB25B0B675727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708519, "uuid": "895ed91a-7281-4dd3-b1ca-744ea25be610", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708519, "uuid": "9b3297bf-d5fc-46e4-9b38-c8abbb3dd2b9", "value": "12288:+Mrey908zYU7d/dJV5dCnC3Wrl7kQob17mw7EXkPVHKj5LkdEwnTH9Nhk:QyvGyWrlFob17E5LMTH9Nhk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708519, "uuid": "9593cad6-9485-4eff-82c3-f1da2fb7e01f", "value": 676352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708519, "uuid": "f447c8e9-1923-46b5-962c-d7eb872bee34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708519, "uuid": "b9980ed0-3df0-484e-b95f-4284cf211da3", "value": "a8cc308641c2e791a639e650aaac3b09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89f70428-af34-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676687570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676687570, "uuid": "d71ae0c5-1673-490a-b813-d7132d946d37", "comment": "Malware payload", "value": "b69418a1bae7adc347f2c8c1919fbbf1", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676687570, "uuid": "ef8b6623-5b91-4dae-b309-c786b57acb3a", "comment": "Malware payload", "value": "66e93f5fc63dfdc9f7ce0129678e28d2c36fcd83d5fa000eebb86a009d61f64c", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676687570, "uuid": "40d678f0-5c6a-422d-a48d-495bf27f19a3", "comment": "Malware payload", "value": "51dd4859b1b79ff8095bc1a21b7b3a27b14c5dad", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676687570, "uuid": "a86f4cef-541a-4ab0-84a8-b469f4cfbcf9", "comment": "Malware payload", "value": "ff71162e6ea959a0b27211aeb88635f033437cfe6accca043aaf3e17ccd8e4015adf611186d543c2e880a5abd7f3ea9b", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676687570, "uuid": "000a5fef-2735-43d9-a7ee-ff912cb39698", "value": "T17A273393081A9CDAC033A075497F1385A874CE6A3EE277621448DBB7C5F3975CAD9EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676687570, "uuid": "c358373e-df16-4f16-814a-60bd0def49f1", "value": "393216:oXXLsJA35z7A79L+vel1mbgafiubc2ZvbBT9i/zVN2I+TXzNsKpPbNiRSKcspJa:oX4JA35z7c5PjmbBffckvLi/zVN2IkDt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676687570, "uuid": "049dd9db-d592-4708-8eae-224ebf169022", "value": 21502938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676687570, "uuid": "98672f50-9fd6-4cae-b4f3-32f4c128ffc8", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676687570, "uuid": "14ee26e2-6844-4a41-9569-6f920fb7e341", "value": "prog.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd264718-af6c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676711815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711815, "uuid": "a03dc48c-4afe-45b4-9bff-3356f20c4dec", "comment": "Malware payload (RedLineStealer)", "value": "0ece28d626ecff74722c3152b11b37f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711815, "uuid": "f252cfa3-5c53-4680-88c7-1a89462b5413", "comment": "Malware payload (RedLineStealer)", "value": "68563e6ca83d6b092e0183df588edadee42641c086f0398c94d18b3b61f85f9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711815, "uuid": "e1320e7a-ddad-4b95-b363-4bd5fb7295f3", "comment": "Malware payload (RedLineStealer)", "value": "95e1578a239b47dc46b9734d034fc5d5b63190da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711815, "uuid": "6b48aede-8b48-49df-ab1b-b0e971a08f8f", "comment": "Malware payload (RedLineStealer)", "value": "d451ded9ceaf4a31268e8236e2beb120979e7295843cf3ca0c701e2c9f60cbc4343c6e63d86f16a27c1485aec9889696", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711815, "uuid": "fe4c1d4d-bb4d-4b95-a905-1a22d9d6d41a", "value": "T193E4120BF7ED5032F5B5577019F742D329337EA11B7852EA178A9C4A18B21B0B13A36B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711815, "uuid": "8c9b2c08-8037-417a-b17b-dd6e18cca5b1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711815, "uuid": "7fd4f1cc-85d0-4c2f-be76-1228852783de", "value": "12288:EMrWy90GTZyV24M1O90vDwK/sABp/u7mLuNpZyK4re1x5D:ay/T8V275DwmsArG7mrrkD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676711815, "uuid": "1170cf54-070b-4b8f-9148-fdb82b0a4a02", "value": 688128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676711815, "uuid": "cbd753bd-87ea-4e43-a862-c63883d81569", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711815, "uuid": "816a174c-5f02-4bb3-989f-e2b4b9e204de", "value": "0ece28d626ecff74722c3152b11b37f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "721d72a8-af61-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676706857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706857, "uuid": "c2b3c78c-fb5e-4101-8222-ae128502e64b", "comment": "Malware payload", "value": "a8465750e51d64c695a02c74b4099968", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706857, "uuid": "603faa3f-ed71-40d9-b36a-151c8847426e", "comment": "Malware payload", "value": "68ccf7621036a833bc01ab5aff922b4fd0735a24f96992d9b1a6822e94f9d0b5", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706857, "uuid": "13c43cd8-350d-4188-9f2c-52473f8dd547", "comment": "Malware payload", "value": "d75d5843997713786e8410d600286b679e98dacf", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706857, "uuid": "52aca162-952a-4927-b676-54071fa2496e", "comment": "Malware payload", "value": "fcb901db2d3468ff15509ca96d9793d518b896c741a86062da477aae1b2344f2b337862b74665fdefa4630b4bf637825", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706857, "uuid": "3adf8d06-cede-4716-b71a-f8c70852e173", "value": "T1BEA4232EC049FADCDC932BBC95CCEC7289425410E4D4E0D2CDB194D93295ADA9B79BEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706857, "uuid": "bb5e2ac5-e8cc-425a-b835-16e200fe641a", "value": "12288:bYPyk291Tx1+slGm1Xk2T9RkHquZBCp4Zxrsu:bYr2H+crK2Tt6XZxIu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706857, "uuid": "dc50c545-0c09-41fe-8d5e-03c53f9dc3cb", "value": 452024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706857, "uuid": "0ff4c5d2-ce27-4ccd-a65d-d425bd43da07", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706857, "uuid": "b96fad26-6e6e-435a-900c-59b35126f73c", "value": "Microsoft_Office_Excel_Worksheet1.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5e515cd-af8d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676725950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676725950, "uuid": "96d0bcbf-0209-4981-9986-631923e23c62", "comment": "Malware payload (Amadey)", "value": "0840b0f141b0605cbc1b1f8e4fb4f0d5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676725950, "uuid": "f6c11371-0ab3-4055-a6cd-89fe971757a5", "comment": "Malware payload (Amadey)", "value": "6b0092993b5439a7682d6792454cb23f5ceb414728ac8caf1ee9ffe44e786e93", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676725950, "uuid": "1e213e3a-a41c-4b80-84b5-da1caace458c", "comment": "Malware payload (Amadey)", "value": "0ef824b10b84006b75faff5983b54557a17554b6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676725950, "uuid": "57177f3c-e2a9-4511-bbfc-f814e7a0414b", "comment": "Malware payload (Amadey)", "value": "b4c2ce53a3ce0c796a30cd2de5c9f6ca6fc98467160da4b499745e4bca628396582f83bf7a82fd1e2b2f0a4289cf2ce9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676725950, "uuid": "c5174077-71d6-4d36-ac93-cddf8336db9d", "value": "T107F41207F6EC8033E4B1937154F616D30A35FAA11B3587AB738E6C9A28B2570A53173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676725950, "uuid": "cdda0f94-03be-4e77-916f-be3487b412dc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676725950, "uuid": "10e396bb-3135-430e-9efe-0fff2973e696", "value": "12288:eMrQy90XVxCgZVb7lr/1B7OhOun/AuEYqy4tgGo/ZTpdQJGKXLXmMKlf/vM0tu4w:Oy+xrVXlnOoK4uMojdQJ7LmDM0tu4E1x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676725950, "uuid": "6f05c00f-58c4-4b26-b3c8-2d0ddd0b91a1", "value": 765952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676725950, "uuid": "1571b1c3-e5ba-4884-8eca-c98e86d68dcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676725950, "uuid": "e35ecf7b-aea2-4a27-a30a-37125176131f", "value": "0840b0f141b0605cbc1b1f8e4fb4f0d5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fb4b53d-af94-11ed-88f6-42010a9c006e", "comment": "Malware payload (STRRAT)", "timestamp": 1676728704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676728704, "uuid": "eb0546a2-17b9-47fd-8180-33eb3f6c231c", "comment": "Malware payload (STRRAT)", "value": "a4d11f5f742c70118891f930c1eaa91c", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676728704, "uuid": "475e06f6-5d34-4474-8bc2-b4b0e6d11966", "comment": "Malware payload (STRRAT)", "value": "6ce056fbfc33dd4ccf62b5a14863d873517e4cd4a1c2acd004c48e7994b207d5", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676728704, "uuid": "78582068-9b24-4730-8b11-7aac0d9bb2e1", "comment": "Malware payload (STRRAT)", "value": "3f9fb1abd16b3b03356ea5264ae75936b882f0c9", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676728704, "uuid": "8b58730f-398b-453f-b2ee-76e85d07816e", "comment": "Malware payload (STRRAT)", "value": "e88e4e58ffa4d32f4cc363f323ea868c2f2c4c442294196741a97de7afb55196e2dacf789781d8422d7197133fcd6a3a", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676728704, "uuid": "200845b6-3047-499b-a7c1-78b3d6c398a9", "value": "T12F24012FBE4BC1FDF02F90B65108D0B7AA8D14949805D42F36E948585A7ACAE1B037DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676728704, "uuid": "5285d728-1ab0-4ba7-af1f-577b7f155011", "value": "6144:uI1MQJIs3aQJmvlsmGC/yn+uJKUQqr/+yYK:VMQ73aQJQsmGC/c9UUQqrGyb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676728704, "uuid": "0321f1a1-aac7-4b2d-b2ed-24cae29f66b5", "value": 224575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676728704, "uuid": "2645d20e-5e3a-44bb-bb8f-49db9d735c5b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676728704, "uuid": "36fa96c9-1db2-4b27-bf35-b991c4ae044a", "value": "FedEx Delivery Image.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66797df1-af62-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676707267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707267, "uuid": "5fd7d203-15cf-4dd9-a2ae-9e3a663d0cf4", "comment": "Malware payload (Amadey)", "value": "2c04e0e399ef4d45552564f7db048639", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707267, "uuid": "10cfe67c-3238-4df5-b8d5-ae16447ed871", "comment": "Malware payload (Amadey)", "value": "6dff42544f3d0b8331c254810dbc9f0e5c26f375eac48e38eefe63785f99eaa2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707267, "uuid": "303cf19d-41ea-4cfd-b09d-a99a4ce04954", "comment": "Malware payload (Amadey)", "value": "7dcc219eb40205fa43a95d9413b1ec7d7f07b927", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707267, "uuid": "346a1928-68f3-4420-8a5f-e4ed90e38985", "comment": "Malware payload (Amadey)", "value": "4be0824cd6543984ea9dd513f1cbe8a545c8f77171b764f22de5d5b0471125776c32a0b898e9881251842b47184f581a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707267, "uuid": "4f6e42e8-bd20-48b0-a199-1e6ab345fbcc", "value": "T178E5338375A98233E0B0637415FA43E32630BF835A248A6B6BDA7CDD19B03F4D576761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707267, "uuid": "5042cb6e-d5b9-4b4a-9a5e-970896338262", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707267, "uuid": "80f8cf98-6015-4120-ad17-4d18867a2a05", "value": "49152:Xo4XFhfgaLFFXIKf5xraiAIX0kC0hs1o5nJV0vFgFp1Xtrm9d25+m1Zbysbpu:Y+TLFFIK7XAIXBjhp5nz0vFYvXpmz256", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676707267, "uuid": "54e5ad14-1b33-43dc-aec5-065d1541a297", "value": 3109888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676707267, "uuid": "a1791d84-6a1c-4c7f-83c1-29df0a534a72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707267, "uuid": "31dec9e9-720d-4f0f-9ab2-319dc1ad8499", "value": "2c04e0e399ef4d45552564f7db048639.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc12fe70-af6c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676711813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711813, "uuid": "32200a67-e8e5-4662-9580-e28f807e6257", "comment": "Malware payload (RedLineStealer)", "value": "1ed3811d6820b5e5f7f1769fd616436d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711813, "uuid": "9c111cef-4ddf-4b9d-89a9-c5885a3b6b55", "comment": "Malware payload (RedLineStealer)", "value": "6e2801f8f42db2a31e99ac5c7ebf2d693d78dd099f9ba3388e58fbd181c343ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711813, "uuid": "f0d80e6b-5427-42f7-b3da-43183d5ec6fc", "comment": "Malware payload (RedLineStealer)", "value": "e4c9913e1119ceabf38980a0067f904ead583f85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711813, "uuid": "3201ff01-b0c5-425e-8524-b11a05c377e7", "comment": "Malware payload (RedLineStealer)", "value": "bcf6620b3372a02f144a73e0ccd4275d7ae101f836feefb11835f7c0e00e99aa9051956a52b2c21f743351844eed915a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711813, "uuid": "0e7a2719-a308-4236-9d47-69ebf752abfc", "value": "T124C40257E3E98425E8B4577009FA02C317777EA06B34C78B638E999E04B32A0D73577A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711813, "uuid": "1c2edb6d-c0af-4793-bc92-28828b04d0d1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711813, "uuid": "78e3f50e-75c9-4517-b33e-345059a0f43d", "value": "12288:RMrRy90YfZpuoIKEsbKvRrIu25ZaMpF42qA9MV0a0jH5QAz:Mytso5bKNIXZe2qnOa0LOAz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676711813, "uuid": "d9ff61e2-643a-450b-b51e-c4bdd6b79d34", "value": 571392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676711813, "uuid": "c300143a-17d5-4b78-b240-36a53ed8e91a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711813, "uuid": "08292d54-87bc-42b3-a9d3-0dfc02d5b373", "value": "1ed3811d6820b5e5f7f1769fd616436d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90f29feb-af64-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708198, "uuid": "57a2cc70-7825-471a-84c5-c7bcdcdc452e", "comment": "Malware payload (RedLineStealer)", "value": "a841e0a310f624cde3c0bc5b5c282d87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708198, "uuid": "0ef99da7-4978-4622-a8d1-a8b24824dc7b", "comment": "Malware payload (RedLineStealer)", "value": "6e89235e27bd69dfe19d5229f554ec09d1613e2442e4de6223c02f352490a3ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708198, "uuid": "726b4fa8-7051-4713-81a2-2d98ca465c52", "comment": "Malware payload (RedLineStealer)", "value": "d9cc20e4a3c2eae3de0135fa2a140140c53a9e62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708198, "uuid": "a7f3220c-e39e-4eeb-9642-f97aca2cb047", "comment": "Malware payload (RedLineStealer)", "value": "464225ff172166ef875dd03fbce0f62c7ce4fe245df56bade1b73d9b67acf88a70b9a6823e534e37ce835840db28d439", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708198, "uuid": "078fe6df-a62b-450c-a317-8aecbc7aafbd", "value": "T1D0F4120BA3EC8936D8B457B409F203C71A7ABD716B34835B224A6D5D18736F0A2357B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708198, "uuid": "51a69730-78da-4d8a-aeae-2448121874bf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708198, "uuid": "321756a3-cb93-4027-a2ca-ef3ed856e64d", "value": "12288:5Mrpy905Gu68PojCIKj6MpFQFURaaAqH+rxFRZzMIfJbxqXEbJ4Yj+bYsMwlY:8ygGutaEp94aATF/JdVJtjlsRm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708198, "uuid": "cc621351-87e0-4851-bbd6-506ee65d2865", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708198, "uuid": "0c14987b-f900-4193-a7c0-ed93941fc4ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708198, "uuid": "59487e37-884e-4095-a2a3-166df302b520", "value": "a841e0a310f624cde3c0bc5b5c282d87.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "009fe687-afa6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676736302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736302, "uuid": "349b7b1b-0a0d-47fb-9124-bf6f735bb558", "comment": "Malware payload", "value": "d749a68e8a626d1fa86c707999e19828", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736302, "uuid": "8d54b301-76a1-4731-9abd-3daae1760654", "comment": "Malware payload", "value": "6f18c519197668bbf6db0fe9bf290d3d38d656f0c197e3a02cd6018ef5477991", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736302, "uuid": "689fa25c-ff4f-4e79-bbb7-f8e0dfeedd75", "comment": "Malware payload", "value": "5e1fdde69d8d018b712e2d86b1bc0b664477dfd9", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736302, "uuid": "87904883-8824-497c-bc8f-b26a812177ff", "comment": "Malware payload", "value": "032ad3c65c39fd42b50d998f650e6bad2cb2ed0f5e510612b4ec6c5133c2e76d4efd94240931c8284684f50814454096", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736302, "uuid": "8f060225-9f5a-4b28-88e8-9fb1edacc032", "value": "T172144DC57A0C9AA7FEC165305183AE0D2C6CBFC3B96D319F358EF2546877E189286D09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736302, "uuid": "ffae8e00-112d-4001-9c08-8ad8bff83b0c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736302, "uuid": "0ae4869c-e965-4ddb-ac0a-206d8df8372c", "value": "1536:KMDOTOoIaNlrxCka5SjXKT/aoA2O6zaTlz5vF:KMaDzVKSbKT/aoA2naz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676736302, "uuid": "af59de13-10f4-459e-bca2-d95dc41a2986", "value": 200520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676736302, "uuid": "b2130158-acec-4ac2-a717-6c7dc158d8f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736302, "uuid": "6b48fde9-34c1-450c-9148-fcf1567899c0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d5183e9-af64-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708218, "uuid": "1d71752f-8f16-4e6e-b433-d8e1bc568110", "comment": "Malware payload (RedLineStealer)", "value": "f976a8eb768e2ac7d409a6cada56ef65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708218, "uuid": "efa6022f-30b6-4e06-833a-48f2f91d6956", "comment": "Malware payload (RedLineStealer)", "value": "6ff16975cf50ef941b98d30c53979d49a945546f909f45183f6fe3541dbd07c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708218, "uuid": "266b5283-e433-4892-8bfb-25c8c441a3b1", "comment": "Malware payload (RedLineStealer)", "value": "d23faaac05f42e3f3d76a88cc9ff478aff92bebd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708218, "uuid": "e5c5b957-57f4-4c6a-9634-b55e4eeb8778", "comment": "Malware payload (RedLineStealer)", "value": "290d3536f44aa456a7497a5876f11959a8a621f331d6fbde4d050392d63a51232245bb16b38cbcd4524a87e6e578b719", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708218, "uuid": "bce61f17-79b0-4954-8faf-d9e5cb09d75e", "value": "T1F7B40107E7F88073D9B4577009F653C30A32BEA15B3883AB638E6C5A1871675A23577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708218, "uuid": "1695d856-aac8-4ccc-a4b5-319fec7659b7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708218, "uuid": "f0d6cfa9-9211-4ce1-a7fc-e708ab532763", "value": "12288:7MrSy90rL+VMbdqXZ0XXZF6sJasYMJFO5X:BywqVoysJFzfg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708218, "uuid": "0e682448-6e2b-4493-a92b-0df42beb467a", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708218, "uuid": "2ac2ab2f-ee66-4e06-983e-913e51f0ceeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708218, "uuid": "913ec8f4-17b5-4a9a-8af2-410f00c1e4d2", "value": "f976a8eb768e2ac7d409a6cada56ef65.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "629de038-af65-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676708549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708549, "uuid": "8c2f3922-06f7-4460-9785-de736a6dc972", "comment": "Malware payload (Amadey)", "value": "b8f9c1e8f7a9da79bd230010d81eea47", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708549, "uuid": "fe6423d1-281d-4ba2-bf28-34f547797d08", "comment": "Malware payload (Amadey)", "value": "7082b21d6624815ee4ed0c64cb13ce16c12d9d1f403ad0d432d79356296ebabc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708549, "uuid": "a46c3059-73e0-4293-b3f9-9d97e492560f", "comment": "Malware payload (Amadey)", "value": "76d662c3c1004b6279be55fd1c41df63138618ed", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708549, "uuid": "6586583e-6410-40d3-a9a3-e95f5d41cfb2", "comment": "Malware payload (Amadey)", "value": "1bd26272c60917dad4b9ee1a5df333b74fceb2f79de28439634d78db460660cb837a22c5992a22a3e379a2e863638c0a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708549, "uuid": "493c6b64-4639-4bce-af6a-69b0f9d70c11", "value": "T163E53367A1F80D33E97037B52DEA83C326327E72163887EB1786DDD92532364B264356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708549, "uuid": "cac6f81a-a638-4d6c-8f18-b6058eabc095", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708549, "uuid": "202021da-a1e1-4e07-a8c0-a624dc4cc3c4", "value": "49152:ghJgQLeroej8l6flqs5JHLRVzRgKwuvN+Ld4TrG+6tnkyEd:5j06flqGwuvNkaPiRkyo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708549, "uuid": "18916585-a675-46a1-836c-3b932ab744b6", "value": 3120640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708549, "uuid": "1f68f083-3b5e-400c-8e0e-6e869427a45f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708549, "uuid": "40e26650-dd2d-4bac-af11-6618262aff84", "value": "b8f9c1e8f7a9da79bd230010d81eea47.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e057d0a2-af86-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676722934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722934, "uuid": "7352fb97-d3d9-4efc-9479-b65878430d75", "comment": "Malware payload (RedLineStealer)", "value": "8cbf81dcd01ce4daa8cd37f68890acc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722934, "uuid": "dac0e759-afbf-4581-82b7-da7396ab3406", "comment": "Malware payload (RedLineStealer)", "value": "70a61dfa6b0a965b7dab0c9eb2ef510334ba88fe0d1da59cb1abe7b8fd0ca145", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722934, "uuid": "c9fa836b-b76e-4b14-a6b4-88566393de0f", "comment": "Malware payload (RedLineStealer)", "value": "41bf2f776be508a7e1729cb6683cfaa8a92c20e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722934, "uuid": "cdad3792-42bf-4ba2-8877-5c9333ca5fa3", "comment": "Malware payload (RedLineStealer)", "value": "79988ffeff31f8f8e87a14104e01d0a4c05f62f04dde823e68ad08f8ac13e352b244a36220f460ef55061c3a84e40f5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722934, "uuid": "acbe527f-81f8-44ed-bf13-450fca8dace8", "value": "T1A7C40107F6E89473D9B4277025FA07C307357A615B38C39B274BBD5E08B26A0A6317A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722934, "uuid": "4f3b5684-0d0f-44a6-a0f1-d3881eae7960", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722934, "uuid": "73cb4bea-ade6-48e2-817c-b6436fa64622", "value": "12288:UMrBy90KtUU4PIaTmb2NaoQefM+ZSdZP0Zwf:1y/Z4PIemb+aoQsZSTRf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676722934, "uuid": "e4fade20-c965-4b46-9026-01592f1c5ca7", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676722934, "uuid": "c159b540-3852-4219-89f2-bdc1c6614f6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722934, "uuid": "dc4437f3-8e9f-42dd-aa0d-1b6fce55c373", "value": "8cbf81dcd01ce4daa8cd37f68890acc1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d3fd95a-af86-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676722633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722633, "uuid": "1303e07b-dfa8-4d35-ac1e-e0924b3d0ab2", "comment": "Malware payload (RedLineStealer)", "value": "5c60954cf167405132947a4d2d95a2b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722633, "uuid": "9e6196ab-82d2-430c-83e7-288ea32b773d", "comment": "Malware payload (RedLineStealer)", "value": "70cff91e4937f0ff6d65807344652dc3141d1626bcfc757e49f0c1d43b41bba1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722633, "uuid": "e33937b1-7d82-40dc-92a1-9228c2656bba", "comment": "Malware payload (RedLineStealer)", "value": "3fbc4d3083ab44f31618c0dc50ac0cd6ba51d023", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722633, "uuid": "79bc7813-dd0f-438f-b3cb-5f22e330c9df", "comment": "Malware payload (RedLineStealer)", "value": "366e0408c9c7c08b75e486ce65a5e7704ca03463e1737025afcbc7d04368a52577ac46ea0dca1a46cbacb2c09440da11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722633, "uuid": "89501200-f328-4e3a-bc84-330febef0697", "value": "T1AAF41207F7EC8032E8A667F158FB02C31531BFA15F74825A1B4AAC1A1DB25A4763176F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722633, "uuid": "c416f937-39a2-4f69-a221-e6e7c4d1b487", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722633, "uuid": "0fdf6254-559b-4325-a935-6e5ed9e65b0d", "value": "12288:tMrqy90gq+v0gV0BtvVNjOQfopCrnjiQpPjiqayN0ZyWY+0rEBe9p4ktW2:jyygV03nrQcLjiKXd+Op4kD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676722633, "uuid": "cbfe395a-1c01-4f8e-b1f7-b5adfd04e439", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676722633, "uuid": "da519d9e-556c-466c-bc0a-3c221ddcad95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722633, "uuid": "2d3d4ba2-07b6-438e-ac05-c1b6914c172e", "value": "70cff91e4937f0ff6d65807344652dc3141d1626bcfc7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "154c67cf-af68-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676709708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709708, "uuid": "af32be30-c600-4322-9159-a6ea233653c8", "comment": "Malware payload (Amadey)", "value": "fe20c935425096c82647f17b43ca9707", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709708, "uuid": "b51bd6c6-868a-4dbd-acc2-f4076b8d9d32", "comment": "Malware payload (Amadey)", "value": "70e77ed0137e2f8bc3031a6f545a000a700cf954917470102feb18008e1673b9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709708, "uuid": "e56c3c92-c817-4427-a781-95fa58688194", "comment": "Malware payload (Amadey)", "value": "16ffadf8ba932fb22f573db08a3520fd99767f92", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709708, "uuid": "27cfa8d2-4c32-4099-b5ec-7f1424ff067a", "comment": "Malware payload (Amadey)", "value": "0b78a3db0998806c9f924c915429c71bbb757efe50b25cd739216284378c54cde1d5dd06b943e31ed21d639e1232975e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709708, "uuid": "82583614-090a-41ee-81ad-b1e652d675e4", "value": "T181E53387E2E05431ED7817340CFB43D30A33B9B71BB846A6678E69D46EB74D0B620B95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709708, "uuid": "b459f35b-cd70-4289-b170-8394e25e869e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709708, "uuid": "7bc1c6bb-9447-41a8-90f5-880ecbaa6ac6", "value": "49152:62xYL5xcXtB4F8ozJVblB04u8z/b1G8JyMtNrIFJ/R5MW+ex+K:/YLTyWfXlBTlZyMhIHkLK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676709708, "uuid": "951d4d44-e306-4d4a-a5dd-3320d27bbb1d", "value": 3124224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676709708, "uuid": "0b5c64ef-505b-483f-87fb-0e687371eff9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709708, "uuid": "bef470bd-654c-42a0-86eb-175a128a8c18", "value": "fe20c935425096c82647f17b43ca9707.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffbe6118-af5f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1676706236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706236, "uuid": "77534a88-a5b6-4fe8-8507-fdfa49d26f5a", "comment": "Malware payload (RemcosRAT)", "value": "e6b3eb241507bd5a46a1b854f5ab8941", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706236, "uuid": "1dcf2dac-a37e-4028-a91d-d2fe0f606eba", "comment": "Malware payload (RemcosRAT)", "value": "71413583e55230a0a3a659cae17e5a23da5db0b660ed850b268c16680945995a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706236, "uuid": "3e5a7f80-f7cf-4563-a936-9e44c2f9ccfb", "comment": "Malware payload (RemcosRAT)", "value": "c8c31585e6ea8be494e32e8ec8612c15b7932926", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706236, "uuid": "d72eb6ab-6024-496a-b9a5-b446e14c1070", "comment": "Malware payload (RemcosRAT)", "value": "72105d5cfb8e13d1737794ccf1ba51f73b8f13ab42a76ec9dd304c48e3ad53356f3d8d5e9227016aa8b18315f17f5e2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706236, "uuid": "03794bd7-3af4-46a2-96d9-857fb153314b", "value": "T1B5C422C421B0C8AFE29507B57A6396629AF0DC8369B4076797503D03FD64923EB0EB23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706236, "uuid": "11709ec2-0864-48ac-956d-95b8ceab845e", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706236, "uuid": "28c665fe-3414-4344-b18f-d879ca8dc956", "value": "12288:+YWonBCpwvU26uMJYyhqWg3Z/zKpDh2mKb27HpndKS+w8J:+YWWjnC/1gJ/zKjzpndY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706236, "uuid": "cd2cbb47-f35f-41a3-9a5f-9ddb4fe88ab9", "value": 553924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706236, "uuid": "0e26058a-cab3-4e72-9d55-a3b08400de83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706236, "uuid": "49549fcf-f399-499d-8417-601e53ddfeab", "value": "doc2023021700999000001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6205981-af86-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676722970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722970, "uuid": "9ddf94fa-3fdc-4281-af23-8737bec11f16", "comment": "Malware payload (Amadey)", "value": "779e5b656d14cab3bd06afb3f0dda5ca", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722970, "uuid": "1cad1c8b-d16a-4338-80e1-048137d161fc", "comment": "Malware payload (Amadey)", "value": "71fb5cd015f4625cc17c4ad91086f622f48215ab1ede1aea685888adfbf69d31", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722970, "uuid": "b27f61a1-c667-4bc2-a0dc-eeb871daa93e", "comment": "Malware payload (Amadey)", "value": "b84f7aca829190b1beb024b0188c1b5907e69114", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722970, "uuid": "518a099d-6f8b-4a2b-8886-1d99fe8db787", "comment": "Malware payload (Amadey)", "value": "67f880da4c88beacb51b18e37af05a38c59b9dc0c384fddaadaab13f72ab868390281937575a4ec70c2719965861a30a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722970, "uuid": "2262b2e0-c1f8-4315-a843-f9a90374e35e", "value": "T1F2E53343B7F50423EA741B304DA70EF3A37F3865A6BA42D6774BDD5A2D721D2522022E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722970, "uuid": "97643064-ad36-4616-af13-17fdeb0a5a8f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722970, "uuid": "2f511091-ddac-43f8-8364-46bf4d1808a9", "value": "49152:l6wfG1Vt2pxb2pIeld808ZYg8bujyVYZWYMja55OKD6t04Zmolo9TVAg:8Jupxb2pIq+6cmVYBMeT4Xop6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676722970, "uuid": "a40c5fe8-ac09-4bb2-aae3-308a1f274a58", "value": 3153920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676722970, "uuid": "85c9390a-d361-4ab8-8abd-ff20e801da75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722970, "uuid": "a540ba2f-686d-41e1-a606-f7d4189ddeff", "value": "779e5b656d14cab3bd06afb3f0dda5ca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89945426-afca-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676751994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676751994, "uuid": "3aa05517-b9d4-44ae-b763-370106ab0e16", "comment": "Malware payload (Smoke Loader)", "value": "9df4bee6bb81ebe7e7fff1abf2ff5ae4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676751994, "uuid": "3ca48c21-f3a8-4ae3-8c9b-80406d6d95e4", "comment": "Malware payload (Smoke Loader)", "value": "7208178bb02eab02073ace2c7a3a7be128e1eb168d8d710367e60f1abf3eac2c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676751994, "uuid": "f7e1d53a-1f5d-4ad0-92b5-ae7a79e0144d", "comment": "Malware payload (Smoke Loader)", "value": "e8d4cce3f5b843eafc49f85f8584fdd87ac8715c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676751994, "uuid": "e791ce9e-92fb-4a8e-967c-ba8bea7bdab4", "comment": "Malware payload (Smoke Loader)", "value": "51907fe00984cd66ab447a31c13145ae1d55c5deb185cf9ac91c1a66f90d1747414e6a252581d6bf76373ddf2799f13f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676751994, "uuid": "e28e75f6-a047-4b09-8e1e-94cdef3d89f5", "value": "T1BA64AF03AAE57C50D91B4B729E2ED6E8760DF6B06F49372532194ADF49F03B2C263781", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676751994, "uuid": "eef3cdaf-6fd3-4b86-92ea-fbd06e01778f", "value": "8b23c6f110add61e2d6f38c3c2656d60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676751994, "uuid": "331fff91-4b86-4e89-aa21-19d80ca68127", "value": "3072:Jx2nLIYIOm2DkKksGbxd9hne5Gvf1rOf407Vuu2aJhoqxjcf5eZuysnBcZiZm:DQLVmIVAve5s1r5wH2aJSUj+eKS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676751994, "uuid": "43732f1b-5bba-4c29-ae54-6711989a908f", "value": 321536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676751994, "uuid": "03279ecd-957d-4b27-8657-c032281f8126", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676751994, "uuid": "62424dc0-9b04-4cab-b79a-023ecc014985", "value": "9df4bee6bb81ebe7e7fff1abf2ff5ae4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15ecca9c-af67-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676709280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709280, "uuid": "c05a363a-6b14-4b50-84e5-72d2156dc5b7", "comment": "Malware payload", "value": "34e8a1e9b59e98a53c0021c0d5042b69", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709280, "uuid": "2ffa7508-9234-45a9-a2b4-95b967af366e", "comment": "Malware payload", "value": "725914e9d2640f4841b454bd652df29d25a17524eb2ea1868a1f8445af22a500", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709280, "uuid": "76e3bcf4-1f53-4a6b-a3ce-2480537b7404", "comment": "Malware payload", "value": "6ce72b7c5d11fec855db8c082291ce0ca69e210a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709280, "uuid": "64ffadbc-12be-4924-bce1-10170abb6d0b", "comment": "Malware payload", "value": "9a5a4703804c1f8277006134cf2e2644ef09ad474b10935e318718da9b87db7e5e4104e36bdddaa3f6c2b20891d6571d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709280, "uuid": "c1d2fd85-9d1a-4864-8943-9dbf72f2ad1f", "value": "T1F65623B322A50055F4F6CC3DC12BFDF975F6436A87869C3A34F69EC128129E4D612A93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709280, "uuid": "9fc5ea25-2546-4595-9587-a46245069de5", "value": "895e5e6e037e9108574fb94ed614d804", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709280, "uuid": "5f2f1575-cf79-4010-a45c-b9cce0e8c5dd", "value": "98304:BE3bhhOPV1ciYh1W/p/Rup38nMFfdlTD38/050VX7Mei/2bS:2Qd1ciWI/p/Rup38MrZDH50x7M//QS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676709280, "uuid": "34146600-11f8-4afa-b66d-9df69abc064c", "value": 6387712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676709280, "uuid": "de9d0fe3-8621-444d-8e0e-fe6f571d2bc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709280, "uuid": "a1bc9877-8195-44e1-9976-f3431a11f7fe", "value": "34e8a1e9b59e98a53c0021c0d5042b69", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b88401a7-af64-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708264, "uuid": "60dac48d-f21c-4156-8339-9a8dfdc2e6ea", "comment": "Malware payload (RedLineStealer)", "value": "ec42b54f472e10ea6f62eb7dfd5e849b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708264, "uuid": "e4b8ec16-e81d-4e33-a8a3-646489d3af58", "comment": "Malware payload (RedLineStealer)", "value": "73613efd3be7cd67939dfd7a93e6157eafdb7f22b9e7cab690b99c34324552c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708264, "uuid": "78f65c50-84a2-48bc-87b6-e7afdec3ee4c", "comment": "Malware payload (RedLineStealer)", "value": "dae3a0c1cc45fbe28b0ae2c5388cedd93f4377f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708264, "uuid": "ba04209b-79bd-4de7-a736-bb183c4219d7", "comment": "Malware payload (RedLineStealer)", "value": "4152e09ec26cf8c2e87bf5bef3af6e955867c488f589308421ada11322c254c95628fc2e5d5e3f6d34daf982ef9bf1bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708264, "uuid": "e8b6dbdc-aaaa-42fa-8f36-460d046356cd", "value": "T108F4120BE7EC5432ED655774ACF602D31636BE705A79838B278AB85A0C711B0E63077B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708264, "uuid": "5af186b0-8f84-4795-99c2-67b70b3f7a25", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708264, "uuid": "83cb56a6-7844-45ea-8b07-c6a96dc5097a", "value": "12288:SMrgy90Wv8hxwXWWKd0g9WkXWfitEGoDWEi6y2yE08Nhy:myEfOWWKd0gUAWGqTfRRNA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708264, "uuid": "8c1fe377-b09b-4aec-aa06-1dd3172f2f75", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708264, "uuid": "818afe20-6357-4cba-a019-bb44aba11cbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708264, "uuid": "573c77e1-1903-483a-a140-67f5fd79c17c", "value": "ec42b54f472e10ea6f62eb7dfd5e849b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05cba258-af6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676711830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711830, "uuid": "9fffe66e-7815-4362-b897-94a86c59309a", "comment": "Malware payload (Amadey)", "value": "34dee99432b0f45e752925de7a2a07e0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711830, "uuid": "a5f26b49-ae39-475a-bebc-897c96a050bc", "comment": "Malware payload (Amadey)", "value": "7523701652e7ef0b765465f3fcffc807a1d87ee30040fb2215fe5b178248b9c6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711830, "uuid": "7f46d9a5-598d-4df3-b7f8-7a72d3238a91", "comment": "Malware payload (Amadey)", "value": "05ae0b359a6738a4c9dcd0758c58a4088edcf549", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711830, "uuid": "5782f0f7-06d7-412b-a103-13dece2c08e6", "comment": "Malware payload (Amadey)", "value": "a30ee2d5360fbf39013ee70276f9397234eee8ef48751e2874ecaf44abfcad5de5949ce95a8340a45ecb7ca0bc677879", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711830, "uuid": "cccd0813-6fb1-4262-a906-c8a7eb716bbd", "value": "T164F41213F7E95572E9E4837559F602C3063ABE915A798397338EAC1A1CB22B0913173F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711830, "uuid": "f995cd32-be27-4a67-a36d-176c37a9f43c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711830, "uuid": "35e56329-e8ff-4bf4-81fa-055b357ddcd7", "value": "12288:YMroy9027jzLjbB6HuzqsyhNJPPZW96ZvZGVbsXeBbZRx0CLDmuKFshY3QYOq+qz:gyLjD96Huzqsye6T0TJ0wgShCHdY61", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676711830, "uuid": "bd759b84-13d8-4e19-8162-9fc8a7917a62", "value": 762880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676711830, "uuid": "30bad6e5-13bf-4eae-8d6b-cd18edbf64ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711830, "uuid": "813655bd-00a9-4d68-8469-159df0acdd9e", "value": "34dee99432b0f45e752925de7a2a07e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91e38d21-af61-11ed-88f6-42010a9c006e", "comment": "Malware payload (ModiLoader)", "timestamp": 1676706911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706911, "uuid": "46a4c8a7-4dfc-4d27-a9ec-1bd52393863a", "comment": "Malware payload (ModiLoader)", "value": "a484c9ec54ffd544a95dfa92dd0a7bb4", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706911, "uuid": "07caf0b6-b4cc-4b83-98c9-0b3ec08935f4", "comment": "Malware payload (ModiLoader)", "value": "755a5deec10631248bd51f61fa083218d4357bd7aa1f168b41cd301ac7e42613", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706911, "uuid": "df828770-750b-4dc0-93fd-ecccb6828eac", "comment": "Malware payload (ModiLoader)", "value": "f6e25f9390e78ec07950a5145a77281c640b6319", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706911, "uuid": "7523f3d4-8fdd-4672-ba89-014224809564", "comment": "Malware payload (ModiLoader)", "value": "dd72e24d1515674d4ce11c06bd117bf62e8e35ad972640448eb7206cb95f0ba0ffe09b84c19c440d538f9f117031f193", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706911, "uuid": "a6314685-da8d-4532-aaea-7f7042ab11c8", "value": "T16A55C49D7A38423BCAF11E79440FA1E29825EDBCE415F443A6B73A196BF9D832D30135", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706911, "uuid": "0aa7b6d1-c3f7-4c27-882e-76d9631bfb1c", "value": "04e81d5a8fbd2c543fabcdad1b9b9f38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706911, "uuid": "e05884e0-0834-4297-b2f0-4cb8fd0d07da", "value": "12288:qG6bpHk8Sy5k/fyWUzCKlnwtZ0KOKyPVHGCZvOtcUcMe2ZASsKySOVgAiklqU:qGM3q/fy6BzOV1jAZA75Srklq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706911, "uuid": "902c02cc-bb2f-4b6b-89a4-c2cce2093932", "value": 1343488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706911, "uuid": "e8120121-725f-460e-ab06-b329de4a1370", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706911, "uuid": "9bf93841-f895-4e7e-9ab5-6ae4fa8d2dcb", "value": "dhl_express delivery .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f178ac8a-afa5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676736277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736277, "uuid": "42f4144f-a38a-4af1-b83f-bcbd2e31472f", "comment": "Malware payload", "value": "f1ca5155cc1d8b0c2278bb90d413089d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736277, "uuid": "843a15c9-cd06-47c6-bf1d-b5a2b63c735c", "comment": "Malware payload", "value": "77a180c1c98d92c2444e83a080b09182d23718670b230e5bd29e0a99562bdfc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736277, "uuid": "7e67504c-0e29-4804-a3d6-54bca5b6e408", "comment": "Malware payload", "value": "330795a1bcbf2aa2edb5f799e1af8ac7932dcc18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736277, "uuid": "f182cccd-2e79-4c8d-b2f3-94f78525c32d", "comment": "Malware payload", "value": "d39154457b21f4d832a2c50892b0790a4bfaef54fa70d03735426145017719fa190cdfad5675838a07b4aff565297f9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736277, "uuid": "b40eda8e-0628-41dd-9f35-1491cbf0acf6", "value": "T193B4D8532ACB0CB6C89227F495C72376A7389E748617CB6AA754CC36DFA36C0BD59301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736277, "uuid": "35a7f85a-217c-4c6e-8605-cfec21e93157", "value": "891fe60c432727a8055abf0ccc65235f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736277, "uuid": "7b62934d-7af8-4eaa-b145-87028be2a9d7", "value": "12288:UBS1chJKBPs0FJffkaOJgYAOlk1Ve17G193x50hD0FJcEiT/3IWVIvrxUcVJd:L1chJKBPsXhk1Ve18QWDvZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676736277, "uuid": "a425a412-58b5-4ace-ae8e-cab31dfa729d", "value": 513132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676736277, "uuid": "27ed687e-6563-4aed-9026-37b2f93a8685", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736277, "uuid": "84d63ac8-2968-4829-b7fa-eab581a1046d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c7de25d-af64-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708190, "uuid": "43c092b2-0ccd-481a-b7e9-ee77d77c3272", "comment": "Malware payload (RedLineStealer)", "value": "7df7481f9c308e334466af5342b22f14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708190, "uuid": "7905222f-4622-4994-a51a-3411c317c0f9", "comment": "Malware payload (RedLineStealer)", "value": "7a284ae827687d02c71846dd789f5961ca03b3466bdff2289e6904f89a3593b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708190, "uuid": "2888007a-9f73-42b8-a2f2-41c3c7bedb05", "comment": "Malware payload (RedLineStealer)", "value": "8ad06b83e0138bd9013e558d382f33017fc38db2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708190, "uuid": "a7dd4261-c402-4c8a-aff1-d7897dc1609f", "comment": "Malware payload (RedLineStealer)", "value": "2661c1016aa250258e9ff38c4787e5e7ea789de7b138e765b9a61b52b5bc3e4dd3a35cd29d9695367f3d545be0ac71f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708190, "uuid": "438e4b3e-c3f7-4798-aceb-667bd4f913df", "value": "T190E41247E7E84922D8B5037058F642D3163ABD625A34879B378F7C5E18B7270E63236B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708190, "uuid": "108fa5e8-7d82-4ad3-84a6-75b49ebf171c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708190, "uuid": "32256324-9f22-405d-9dc7-d6ccaf553cea", "value": "12288:RMrdy90W51o56u3SG+EfQshGGTuGu2pzJfFFKuJJ5MIxVtHfBWMT6mo6UqCp4Pvc:gy/26uC7LGTuBofFF7SIxV1u6hCgvc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708190, "uuid": "7a3af56c-8678-407e-b38d-ba70290267ff", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708190, "uuid": "36fe49b5-93a9-48ef-8c7c-ffe0ad6fab59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708190, "uuid": "63433ea7-8fec-4ba0-b748-ce56fa423f15", "value": "7df7481f9c308e334466af5342b22f14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ac0c5ad-af25-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1676681156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676681156, "uuid": "693ed956-ee4e-4957-b732-8ecccaca97ed", "comment": "Malware payload (DCRat)", "value": "6e5262e2a9a8f815809cd0d79e3202db", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676681156, "uuid": "443de00b-e6ee-44ae-a4fd-76496b5464ee", "comment": "Malware payload (DCRat)", "value": "7b94d3726b213db212d3f6d9095c6f73dc734995448d12d0564aae487b943166", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676681156, "uuid": "4df48114-ce6c-49bb-8bcc-7d3708075eb6", "comment": "Malware payload (DCRat)", "value": "4c18618ec4c92371092336e381645ebcc72b8a95", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676681156, "uuid": "3cb435ce-a900-48cf-945e-d4050cec4b77", "comment": "Malware payload (DCRat)", "value": "2cc4dcc8819a2cd81b5a94c9ee736b16f90154bb79a11e848a8ebbbe31833e0caee72903c17583f190428c819c19b391", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676681156, "uuid": "30356899-f6ed-4574-80bc-e7c0b201f450", "value": "T10B8633759CFCC793F96F585F2982FAF0458981C71D6B932D67449280CF280EAD8E6CA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676681156, "uuid": "3874f697-68ac-4a40-bab4-51b989958e38", "value": "140094f13383e9ae168c4b35b6af3356", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676681156, "uuid": "64ce19f7-7cee-44d1-8a82-b0316522829c", "value": "196608:qocJH8Ttf8txNVOyYMCJrjZfe7sTmFuTQ13oC4:fcG2tzVO+03ZftU1U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676681156, "uuid": "fe1bc1d2-6767-46d0-850e-7f1b7defce1a", "value": 7872000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676681156, "uuid": "4ef5b1ff-c9c4-4e15-8ba6-71c798d50ef1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676681156, "uuid": "439f0cbc-076d-43ae-8993-718933dded0e", "value": "6e5262e2a9a8f815809cd0d79e3202db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "222ad9bc-af6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1676711877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711877, "uuid": "d3f6141f-345b-42d6-b665-35ca4d71827d", "comment": "Malware payload (TeamBot)", "value": "f16b0526c3c7082918f6abf8fd944664", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711877, "uuid": "86d138f6-d0d0-4566-8684-aecaf8082796", "comment": "Malware payload (TeamBot)", "value": "7c42050d96a783c7e2afeeb41af469ef7ebeaffa86cccb4d3b7a247dcddc805f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711877, "uuid": "de882c13-fd43-4040-bcae-dc2fabbc07c0", "comment": "Malware payload (TeamBot)", "value": "8c6df4532d47296d62b5d935120a5d2e788978e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711877, "uuid": "6aab1362-8a56-4aa4-b194-35e73e620cd8", "comment": "Malware payload (TeamBot)", "value": "feb48982802ae8bdfacd713f31d88025d254155311669a64d8cb2ea74ebb9a5af04d5722f280e0b2d2f00863e016d9f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711877, "uuid": "aa98fb2f-a84c-48fc-a44c-5b32076be10d", "value": "T111447D03BAE87C40E9168B729E2ED6E8761DF6F06F09777612185A5F45F03B2C263381", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711877, "uuid": "3bc414a2-f4c7-4010-ac90-a5b9e560e61a", "value": "c300bf53760e8f2f60cd0361a9c25234", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711877, "uuid": "53b9d007-86a2-496d-a8d2-3a5d447c1edb", "value": "3072:ZSunRyL9j5cTgSuUDb7npNky1zUEfEsfwG0PkKbRtnKcpa+zQo/f:o+RyL9jNSuUTfkCXpwusRJFpamN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676711877, "uuid": "07568aa5-1143-491e-a13a-238587018b60", "value": 255488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676711877, "uuid": "8cef9123-05df-469d-9d29-eb0f7e8ce10c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711877, "uuid": "5e07e22c-d691-45bd-a657-80b7bf06f98a", "value": "f16b0526c3c7082918f6abf8fd944664.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e980134-af5d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1676705187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676705187, "uuid": "633f5723-8bbb-4da3-94cc-daa40320c978", "comment": "Malware payload (Guildma)", "value": "8db36a434ff7be550b7dc885fac0e162", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676705187, "uuid": "8062b930-9614-4d90-9969-0b99bba4be5c", "comment": "Malware payload (Guildma)", "value": "7d1e6be4cf4cea460959f9bc0b3e8085d1c6ad8635b79072fb263e7982ef0031", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676705187, "uuid": "82f9aaec-d161-4e3b-aa92-92d71371532a", "comment": "Malware payload (Guildma)", "value": "477c323ecb18f255d91302bc040041000ad8a266", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676705187, "uuid": "fd280577-516d-498d-a11b-5d92f169f7ec", "comment": "Malware payload (Guildma)", "value": "876c55bb67a64ba5cd6d50471e9ab5ed0e42b1024e3df2b5ab8528b3cdd183d1c72094ed14773823907893efd2ec5363", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676705187, "uuid": "00344741-fc38-477f-b203-2513e3e2898b", "value": "T151220F1C244C816FD339BADDE7750E51A1ED5EE11C629EE836811C20B670EF17BE9722", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676705187, "uuid": "42c1492e-647a-4eb0-b6ee-e0b6148f2f75", "value": "192:IuwXeDtC5BC7C0CElCd3vCxCgCvCvtCfCMCsCYvClCnCvCYCC7CUaVMmorQ+CwCN:IdQtC5BC7C0CElCd3vCxCgCvCvtCfCMz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676705187, "uuid": "3e54ae20-697e-4f13-a9e8-6d1df9f30933", "value": 10614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676705187, "uuid": "36a92eb8-0b84-4874-a747-9cad09fc9e74", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676705187, "uuid": "78bd211f-7ac1-4470-8428-fdbfc6024d58", "value": "payload.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d96f1908-af5f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676706172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706172, "uuid": "bab4b019-937e-44ac-ae58-ead10a57b603", "comment": "Malware payload (Loki)", "value": "c7f18e65d27dc500b5bbc71f540049f7", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706172, "uuid": "1b2c6b93-705c-4612-8b26-9768d7fed6ac", "comment": "Malware payload (Loki)", "value": "7d437966daa691b030d9b127ffd9be87d292411e4f08a98b7ea36a28db639d8d", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706172, "uuid": "78240dd5-e803-4ac3-90a0-e5d2d6403758", "comment": "Malware payload (Loki)", "value": "7d2df23770eb962390d464abf7661d9a39065e5b", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706172, "uuid": "f2acb151-a00e-4f3c-ac51-f4f31ba6292c", "comment": "Malware payload (Loki)", "value": "cf49726a8381bf4eee992796d3221bb58ca9f680e2665db63ed0a22564becfb0391be41589dc67b7a5392fda2657f857", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706172, "uuid": "4ec6e294-64ec-4c97-a825-df4e29db243d", "value": "T148A51217C175EE4BCE27C57CE8CF74A282029C38AC189A5E6087B71D62366F4167D6F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706172, "uuid": "ff3ed1ce-19dc-4cfe-b2d1-5057e60bd570", "value": "49152:NJljE+G2Tt6Ze6zKAZ2Tt6ZqRcrERQlZ9XgCDS4ZA/:NJO+Nt6Ze6zRGt6ZqvRQlZ9ggS/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706172, "uuid": "72bf5373-36a0-46e4-b4ea-9053e1e295be", "value": 2225152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706172, "uuid": "96dbc9ce-dfcf-4c6c-a420-f5d0dda271ed", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706172, "uuid": "c2ba0b77-98d6-459b-b841-a5f934f2f376", "value": "MV SKY GRACE.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4e49f9e-af92-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676728042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676728042, "uuid": "1baa19bf-98f3-47ad-b28c-0c3a5031a0e2", "comment": "Malware payload (RedLineStealer)", "value": "036ca12aa77431d35ad4b8760648abe6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676728042, "uuid": "68fc33a0-0785-4feb-b9e0-38e8bb77ce1b", "comment": "Malware payload (RedLineStealer)", "value": "7eafd8bc7dd24a15b1b93a62dff90ded9c704257fed9b7c73c42014153da2891", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676728042, "uuid": "e0def838-a86f-4f59-9597-de4fb1812f0f", "comment": "Malware payload (RedLineStealer)", "value": "d243c1946c1b654d274f4e88bf83eadd6b89afc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676728042, "uuid": "6713d2ca-ee86-4c70-ac0d-28f34608451b", "comment": "Malware payload (RedLineStealer)", "value": "632d12937561c159097203e7af582440fd140ad9367ecc60e7769b46e78cc97f7b3802312e1359d64d63b9917022d383", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676728042, "uuid": "8296d397-eaac-408a-b4bc-9eb484985cad", "value": "T1FFE4121BE7EC9432E9B0577159F607C30939BDA11B3887AA138E5C550CB36B5B63232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676728042, "uuid": "1049229b-8dc3-4e82-91b9-2d46c3e83bec", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676728042, "uuid": "e4af868c-49b3-4a9b-82cc-8cfe3960b24c", "value": "12288:5Mrey90GjCVbCSGxZJLA4fwfZCtXRQymw5K5n6EgM0/uHEDG6B/qgpy:rypCVOZFfwhmhn95K9mM0/ukDP9qv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676728042, "uuid": "7820bca0-2336-4ec5-bd16-f0b5f7a25b29", "value": 722432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676728042, "uuid": "ac8b60ee-3dc0-4e4b-b9cf-275c51b3ab8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676728042, "uuid": "39889c2e-2976-4626-8134-5bdce403bd3d", "value": "036ca12aa77431d35ad4b8760648abe6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd690d13-af63-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676707870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707870, "uuid": "1ae19d30-8aa4-4561-983f-11faf1e78d67", "comment": "Malware payload (RedLineStealer)", "value": "944c11453c6c5172388b2c0c6c863a7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707870, "uuid": "434620fd-7035-4cfc-bf24-e7a0c0f3edc5", "comment": "Malware payload (RedLineStealer)", "value": "801584f33f7518cd0c7520f94a2be9dae2cb899f9c5a20ae3c120bac75cf0ed6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707870, "uuid": "fe3433db-41ea-405d-84b5-a42e3b2a4478", "comment": "Malware payload (RedLineStealer)", "value": "e3c454eca5bdbfffee58de4ffb96d1ee9a9e5739", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707870, "uuid": "00f00bba-9123-4181-822f-ac90cd0c76bb", "comment": "Malware payload (RedLineStealer)", "value": "b605940463202aeb0a208295c459c9650350a68672832717ae6a3415a357b353ba641c10854abc9d5b544e2ac85da6d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707870, "uuid": "438109f6-5533-4e21-8fe3-4c284863d626", "value": "T13CB4020BF7FC8032E4A6577018F642D31636BDA51A78839E234EAC591CB31A4B63577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707870, "uuid": "9db729b4-37dc-4547-9ca3-f8db9e8aae64", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707870, "uuid": "5e1ccd36-ad8e-46db-b216-15a413306325", "value": "12288:yMrFy90aWDV/m/n0eKNqZyxj1y0T2VlV:7yBsVeA1yxVlV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676707870, "uuid": "2fe5944d-95f7-485c-acca-eea660a5778f", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676707870, "uuid": "6a6fbfd2-cf53-4891-8cd3-c0be9c1d8d2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707870, "uuid": "c9398d2c-4621-45ab-b1d8-3932877894fe", "value": "944c11453c6c5172388b2c0c6c863a7a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad902be2-af69-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676710393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710393, "uuid": "c08e2991-85b4-4b5d-9fd0-9c560917f4fb", "comment": "Malware payload (AgentTesla)", "value": "ff4d52fe86f01cd8aeba07c721cae931", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710393, "uuid": "b3201988-0168-4211-95f0-088ef35b6a0d", "comment": "Malware payload (AgentTesla)", "value": "81b7fcc8e23f93c056abbaf18a43b28925c43a2bf58ea6efa951cfc070796358", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710393, "uuid": "91038e45-85dc-4c6c-91fa-3daed27c71f1", "comment": "Malware payload (AgentTesla)", "value": "5d932874dd94d8f6c213a199c3cc288572cda559", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710393, "uuid": "f99ffb05-a6a2-488e-9f73-c5066ab847d3", "comment": "Malware payload (AgentTesla)", "value": "6155e2b5288a99311bdc4b2d42d760f78631892d249d655a9d3f46c7ddcd48ec51eb6786882c18c2f1d583f56f3a548f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710393, "uuid": "2514cedf-3d0a-4350-a7b4-6fe143821053", "value": "T1B6E48C8C81F1EA3EC7498EBA371035081FF056437A20D9E6E3A5FAD26F36623199D535", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710393, "uuid": "ef261be2-656f-442b-b301-cd70536fe388", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710393, "uuid": "428085bd-65c6-4805-ab3e-1a8469bfd459", "value": "12288:2dp+qDSuADsv9tQug/faIjGVD9TUzCVFxXNFKu9BuZ4W9n1p0mbDsv9t:2dp+qDSuMug9jGx9IzcN/9BOn1pp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676710393, "uuid": "35313407-b66e-408b-a046-f317cb1ca05d", "value": 698368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676710393, "uuid": "02888619-c690-4c1d-b13c-a49177e15a16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710393, "uuid": "8a541e05-e85a-4da9-b1ff-4c343ac1cce2", "value": "ff4d52fe86f01cd8aeba07c721cae931.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44d8f9cf-af65-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708499, "uuid": "6c33c3b8-a0b6-48d8-95fb-75e3fba94f8e", "comment": "Malware payload (RedLineStealer)", "value": "bb54e7930cd6f48f9fb231522aba73e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708499, "uuid": "62401d01-7744-41de-9805-f96d8331f2bb", "comment": "Malware payload (RedLineStealer)", "value": "8202838c2a6e8339dec66128b6c5e766a8e1cb7bc51702615344b665e8d99cdc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708499, "uuid": "eda96f7e-dd89-4198-a700-ae6fc6a313f6", "comment": "Malware payload (RedLineStealer)", "value": "28e44878696766844169b7b5bc1351860435e75e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708499, "uuid": "4dae2af7-5ea2-4fd5-98b6-e1135b3744e2", "comment": "Malware payload (RedLineStealer)", "value": "0427611f428ecdbb7dac892522aff66363902e8534421d889ad13b1042c975c6553e59b9781a5d135b94ae86ef3d7634", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708499, "uuid": "832c24f6-d535-4e4f-a4d4-a8c9dbd45665", "value": "T146B40207FAEC9462E8B56B7018F603D316367E901538434B674F6C4A18B3AB5BA3533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708499, "uuid": "1b36afde-0f0c-43d9-8bfb-c0d5a8a89f2a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708499, "uuid": "1f7643c6-8beb-4d93-93f2-4fb208f53017", "value": "12288:SMrjy90GMVBl8t6W7gn+1MVeLd+/4hQBJBx:ly2VItV7g+1MVeL4/e0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708499, "uuid": "941284a5-aab9-4745-ad88-2dc5a3d09f87", "value": 528384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708499, "uuid": "d2485475-1a40-476b-9b7b-3d2a6be11828", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708499, "uuid": "2be41125-26c2-4bef-9b80-561350e98ad0", "value": "bb54e7930cd6f48f9fb231522aba73e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b03b3269-af2a-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1676683339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676683339, "uuid": "4a1cad14-6f64-478d-be95-486a817fcc0a", "comment": "Malware payload (CoinMiner)", "value": "6accda40dde8db967c3e5abc704e8660", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676683339, "uuid": "72ffbb39-2a03-410b-989d-9074ef90b8aa", "comment": "Malware payload (CoinMiner)", "value": "8471b5f7a43880944bf850b8002e373921a3a286f69e60f9dbeb8b4ec4f1c695", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676683339, "uuid": "1adec0a8-be81-4bae-aa60-b66160aec4cb", "comment": "Malware payload (CoinMiner)", "value": "d800e2257e418651ee2e8885700c9c93a8bdbc58", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676683339, "uuid": "ffef0912-1d35-4ecc-a145-4fe4bb40b95d", "comment": "Malware payload (CoinMiner)", "value": "3643bcc89b94e77700c5c299e0d84ddf410e36ff4b5fcb4cdf26d112770cbe422db4f8217d01b8750cdbc7c0e35f3de7", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676683339, "uuid": "1652a918-7099-4772-90c6-4b0ca766b53c", "value": "T158061272DFD330BECF5D54BC5CE378B199C192C6446DB5A0FEDAB0AB0A145C128B19A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676683339, "uuid": "56ffe850-cd4d-43df-9dfb-180303c54065", "value": "df9a7bc1c6c6cd97d04c3762fdde6719", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676683339, "uuid": "cc69f4b4-4271-4aad-9cc4-cca1326ebfbd", "value": "98304:WqlRbJxhNHnAjNMtymCEFAwGNCjt6EN9GD:Db5tAkxFEkM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676683339, "uuid": "a2858249-86b4-4df0-a9de-3cc2b1dcc595", "value": 3785728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676683339, "uuid": "710b7f7b-59db-45fb-b3a7-ed918fd7b2a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676683339, "uuid": "f472fbf4-04d4-4212-961a-928a398ab876", "value": "chrome.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a8778dc-afa7-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1676736963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736963, "uuid": "a0fb5e7f-cfc2-4241-9419-b324185fe23f", "comment": "Malware payload (DCRat)", "value": "3ada30d1863df45942f4cb1b1e66d629", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736963, "uuid": "8acb25b3-4086-4929-a044-9b000653b948", "comment": "Malware payload (DCRat)", "value": "851002158949ced029014648030f1a6fa6de279b33d51bc0ed7a25c4e62d7360", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736963, "uuid": "3da2feda-833c-4c94-b724-db9ab63e49d7", "comment": "Malware payload (DCRat)", "value": "15e4faa5d795acceafe4859081688396ccc32ddf", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736963, "uuid": "c9d32ebe-d127-4483-b8d7-18d50f34bd1e", "comment": "Malware payload (DCRat)", "value": "c9a963fa77f8a0958d9520b3aba349d85513ab81e9fd4ce9cb9515765d6f4b79307b98d4f708d404235c606c7c651569", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736963, "uuid": "3c224c69-e1fb-4c92-a961-1301aa994873", "value": "T10E859D017E44CA11F0191633C3FF468857B4E921AAA6E71B7EBA3B6D55123A37C1C9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736963, "uuid": "a5da0cf2-b239-4390-82cd-ba53b8f59c6c", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736963, "uuid": "2a39a897-2252-42f2-96fe-a403381d7161", "value": "24576:K2G/nvxW3Wo7KZtnjMA+bZl27fqMwDlBl7bHBinWC+h1wuSdG1CZJfrF06V5cq8m:KbA3DK3QAIlUqn5eshKBdyAfpj5bf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676736963, "uuid": "9f340885-b267-4245-a183-5f46d23cacd4", "value": 1794768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676736963, "uuid": "47ecdda4-c323-4cd3-be4c-2d6c8873262c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736963, "uuid": "34b7999e-3f96-4d6b-9c34-91908257b4bd", "value": "3ada30d1863df45942f4cb1b1e66d629.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66d3a9e6-af65-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1676708557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708557, "uuid": "b97f2e8b-4a4d-4352-b26e-41b506cb8482", "comment": "Malware payload (TeamBot)", "value": "aea9faba1704c08cb0d23e11b1c544e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708557, "uuid": "537cd56a-a150-4b3c-802e-b70447717a7a", "comment": "Malware payload (TeamBot)", "value": "866e377f93346f311db72fe25c52b33db60bea8682a877500ea2ae6edd3bcb4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708557, "uuid": "59389ca4-eac8-4877-b73f-341eb5f88f58", "comment": "Malware payload (TeamBot)", "value": "e33ef351eb2bdbe83e3b231020324c38fc1191c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708557, "uuid": "f0d3b780-50c7-4fe4-abc4-4a91d4086ad7", "comment": "Malware payload (TeamBot)", "value": "3b5a978eae0f122176b77e34d5ca18c7b5302b8c3f41b6cc4d434c3cd5aa61ce6deba9ae598eb4ee6a5d7b1b166acd45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708557, "uuid": "b4ecbc0d-44f5-4e15-85b1-8b4d02c4ef45", "value": "T12BE3D01236E18072D06746306CA4D6A4777A7C629738DADB3B58036E1F706C29F79377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708557, "uuid": "0a9bfe05-3609-42e3-b2fe-1ec2f6e5a06a", "value": "5d842fb7215bce40485e598d67956fa7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708557, "uuid": "0ae45040-3347-462e-91fa-b9bef7eea187", "value": "3072:GFIcX08qahpFDCs0AP5/DKkG4t3wp6X+A9Fbd47r:rk0bahylc7DGOA6Xpfx47", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708557, "uuid": "f6ba1184-cdb4-44a3-be11-da74ed746138", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708557, "uuid": "a1f52b9b-fb76-419a-a109-94d24dfbf70a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708557, "uuid": "442a3c84-b0b9-4085-9647-cc007830186f", "value": "aea9faba1704c08cb0d23e11b1c544e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bdd9a5c-af65-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708484, "uuid": "8f4cc865-cdf2-4371-a3f7-5dee39c303bd", "comment": "Malware payload (RedLineStealer)", "value": "a1f3b06b80803eb8d6196e90bd801ce7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708484, "uuid": "860a8833-e279-460e-8e2e-3ab0b88dfc85", "comment": "Malware payload (RedLineStealer)", "value": "8719780859a900a4879394815dc3e07a37c34ebdac9fc9b4fbcc130d86293c91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708484, "uuid": "e4cd5add-f620-4966-80b7-1365510d60a8", "comment": "Malware payload (RedLineStealer)", "value": "193fcfe185637ff37d0258d721b27011bf340ef5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708484, "uuid": "7320dc6a-cdfb-40b7-929d-1e0d7593d273", "comment": "Malware payload (RedLineStealer)", "value": "f997813b0c4bef7203cf508f397f8aa6950d6d1d148f987333f571b4265f6d3ddf9dcbb75400a5e8ffb3b90dde99e18f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708484, "uuid": "bc079f77-7bd9-4221-90b0-795415af88cf", "value": "T1FCB4020BFAE94423E4B467B049F752C30A367D616A79839B334B5CAD1C726A0B13573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708484, "uuid": "d0b2941a-fec1-41d0-b4e1-12ee1cd5cc83", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708484, "uuid": "8aa32c53-f20c-425e-9b0f-9138e63cf995", "value": "12288:yMriy90IbdvIzmaqzeQpRUqy1daNTQQLAPOxJaA:8yvhIDH3dMTQQkPOGA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708484, "uuid": "c3c1b295-8a9e-448f-9306-3b49f68f68e5", "value": 539136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708484, "uuid": "d9821f49-973b-497a-98a7-e8e0a1261816", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708484, "uuid": "5e66bcfc-4852-4ecd-8d26-7b9c62a7649f", "value": "a1f3b06b80803eb8d6196e90bd801ce7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2c5ea9a-af69-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676710375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710375, "uuid": "2a0ceb41-c736-499d-b9a7-01f01b620843", "comment": "Malware payload (Loki)", "value": "3d866cef220b5e9fb4f93071ba4bc4eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710375, "uuid": "97a3c17c-d136-4351-b0b3-950a50b1a4e3", "comment": "Malware payload (Loki)", "value": "8724c6ed2bac3e8a3e4f6c607d2678dfcc69372bf0e7dd7d46e198dc79aa4d9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710375, "uuid": "8c5d19b1-aef1-4fbb-8f7e-6da1fdf68b32", "comment": "Malware payload (Loki)", "value": "6c92749846590d0f5df23cbb1d214aa2a5a4ed26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710375, "uuid": "c2b64f16-7ef3-41ac-bcad-e85daa1b1c9a", "comment": "Malware payload (Loki)", "value": "f8880dfcf01e8f2bec8c06bbc75ecd535b64a117e9d93b6861469ab353bd1ef2449b460b470b447d2d555407f24417e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710375, "uuid": "74eccc2b-fd6c-4429-a08e-8ec1ad674097", "value": "T180F44A8CB1F0F67FCA06CD76AB143D14ABE0614367268592E263B6D59F3D4638E1C4B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710375, "uuid": "71822ac9-470f-44cd-92b4-ac01225c5c73", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710375, "uuid": "350b7729-2361-4291-8bf5-f7d79aa9e1f3", "value": "12288:Wmj1UqDSueDsv9t77TeLFeMr5LguyK5Vvd1j2l+iDsv9t3LbNLH2n1OZEFD9xaVV:WqGqDSu9TeL8MtLZymdB2l+lS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676710375, "uuid": "9b04d0c1-d2a2-4266-adc1-4e3391c790bd", "value": 735744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676710375, "uuid": "fc1aff62-8974-4dfc-b8d1-c8789c4b2723", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710375, "uuid": "50acfd6d-7bd2-4ca4-ac0e-56f1338e49a2", "value": "3d866cef220b5e9fb4f93071ba4bc4eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "444471f7-af92-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676727826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676727826, "uuid": "d37d9df0-e2ba-42b9-bdb1-cce3aa989722", "comment": "Malware payload (Amadey)", "value": "f9f51a9a9ac81702e9d28fa48953c26d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676727826, "uuid": "5199c126-53cc-40d2-b7c2-020c2d6cb11f", "comment": "Malware payload (Amadey)", "value": "872f72451467871c25e25836dd034240a62645b6c878ea58eec74f08e5bc531a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676727826, "uuid": "8f760707-166c-440b-b9ee-7640d571c03d", "comment": "Malware payload (Amadey)", "value": "9c703cd47810ae24a544eebc70f90236acba3c02", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676727826, "uuid": "5b6aeced-03f0-4264-b214-3b1a8ef1dbb7", "comment": "Malware payload (Amadey)", "value": "99c9817920bd8341d88a4f4adde965fe5946237383cb2faa971a3d88952cd8ecd8e574573b89975bae49cb2c91f13ace", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676727826, "uuid": "baa5e1a0-5c55-40f7-bcbe-d62a7d7784af", "value": "T17AF41217B6ED9432E9B51BB119F607C3053ABE2227388347275A9C1E0CB22B4B971737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676727826, "uuid": "dbb97c32-d287-4eee-b40c-2680dcc65ea3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676727826, "uuid": "2b37d917-006d-47a7-b00d-5a763aa2cc9a", "value": "12288:cMrfy90PpJsjqfN8uzQr0k9ojRWWxG//mD2Wk6shRT067M0ZuSQ10dEiYjFQb5:7ypjqlFEwk9oF+myT6sBM0ZuSQtVjFQF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676727826, "uuid": "84ec15ca-3ca7-443c-865a-5f4273806dbc", "value": 765952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676727826, "uuid": "dad4f69a-2afd-4501-b985-43e1b33d82cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676727826, "uuid": "b55e6e61-4be4-4507-a920-136ed38bbc15", "value": "f9f51a9a9ac81702e9d28fa48953c26d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa1c074c-af8d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676725983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676725983, "uuid": "30b9e21d-80d6-4991-89ac-596316d1283d", "comment": "Malware payload (RedLineStealer)", "value": "38002f90b3471d0f97fe5660386e35c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676725983, "uuid": "8a787565-a690-4713-a00d-f215b1e95828", "comment": "Malware payload (RedLineStealer)", "value": "885683073b21082fb0815f18e038a9a82f6d76f5916a4f12678420174b538865", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676725983, "uuid": "a84d5f82-129e-456a-a180-082b10364532", "comment": "Malware payload (RedLineStealer)", "value": "a48e67a6259c551f2fdb2731ada5b017b50c417f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676725983, "uuid": "2c3db56c-ac38-4386-a518-4d14d167125e", "comment": "Malware payload (RedLineStealer)", "value": "28a65e6ddcf7daf6886f90c8a70f7474ce088a35e76d941151f1c6890bf087198f2f0a282c7a1dcbe6ff77562edaead4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676725983, "uuid": "82fe1aa8-321e-4348-a1c8-b52a2679351f", "value": "T146151207B7ED9023E8759B756DF227C31A35BE919B31434B254F684A18B29B0B632337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676725983, "uuid": "ee2e54e7-86e8-4c04-92fd-2983bdfcce5d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676725983, "uuid": "ce638cca-b297-45e2-9358-08a65b67e95d", "value": "12288:1Mrxy90H0VsU6CD4WC/lWNvkITUEVuqqlg+jrW2TM44uVv4zxuNztYuH6ucMPQrd:sy5VmJx/lWGEVuZlXjrTM44u/lHx4p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676725983, "uuid": "15a0facd-c683-45d8-b12c-ef9420faca43", "value": 906240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676725983, "uuid": "03ec6a9f-1f7e-4fef-86d5-609d68ad0e48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676725983, "uuid": "ae45a4b7-6c89-4220-95b3-a152ba66c34b", "value": "38002f90b3471d0f97fe5660386e35c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2113e8c-af6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676712119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676712119, "uuid": "52b93170-21e4-46bc-9b16-4231823b77ae", "comment": "Malware payload (RedLineStealer)", "value": "55c7c29883e219e34023bb41ef900bf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676712119, "uuid": "33cf1c19-e54b-4bcf-b248-5e3188767af7", "comment": "Malware payload (RedLineStealer)", "value": "890f90c9ee7ff3e184d491a5dbc2af215287171e10408129d855a4b0dc7167f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676712119, "uuid": "cc7b8d77-9c80-4ecc-a93c-a402c74decf6", "comment": "Malware payload (RedLineStealer)", "value": "6c6d301727d7b94902c279c22c6d4f881d1073a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676712119, "uuid": "7799c6fc-7e1c-4a27-8005-ba52a2f45ef3", "comment": "Malware payload (RedLineStealer)", "value": "c97b044844c2db895e789fb066751beea158241f058ccbdb3d219afe6aca63455ce3c31d9345d158f28ed6f17a40c772", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676712119, "uuid": "e28d4ad8-3a99-4b4a-8ce1-c71090bb7138", "value": "T167E40207F7EC4831E9B5537018F742C305377E625778829A2B8EA89D1CB22A4B63577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676712119, "uuid": "d9660196-1acb-418c-b03c-f087f8c8160d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676712119, "uuid": "09fc3150-3ae4-4101-86c0-4443c145eac5", "value": "12288:wMr+y90bBhQv11KlCgtCx/NBqJyCPLAGsMocjiNiZyeaVmGW0BP+:eyQ7gGxYNBpCPMVmGP+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676712119, "uuid": "2a24f47f-1407-4c4c-918f-5bfcff9e0cc9", "value": 687616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676712119, "uuid": "0a28bd49-1912-44b7-97c3-e81298a2b13c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676712119, "uuid": "ccb7c1d5-5023-40bf-ac1f-c06a807f47a5", "value": "890f90c9ee7ff3e184d491a5dbc2af215287171e10408.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67b704e5-af62-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676707270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707270, "uuid": "cd5613b7-2959-4f97-8be5-95359e2dd5c8", "comment": "Malware payload (RedLineStealer)", "value": "049f383876f875167c55f1063d3ce5fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707270, "uuid": "aa2e9d2f-4feb-4e41-9d27-0cba43db06a6", "comment": "Malware payload (RedLineStealer)", "value": "8a102a4db4038e413d863950c4904308382468c83fd1a6a8430b179d3c22f409", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707270, "uuid": "528e4273-5244-4164-9f5a-57864cbc0987", "comment": "Malware payload (RedLineStealer)", "value": "8ae226f4edd4f9e2e40e1843618ec261d23aee4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707270, "uuid": "6219f634-99a1-43a3-8a5e-d466785ee8f1", "comment": "Malware payload (RedLineStealer)", "value": "65b2eb93cc517f317c691589a6d2834d4e976f41ded19f1844c9a4c8b80f25fbfb32bda62fbf2a50a5a22640cab64d84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707270, "uuid": "ac0f0ac6-6281-4560-9c73-b3946093dd61", "value": "T16FB40207FAED8422E8B55BB004F743D31A37BD615A39479F238A6C494C729A0B53673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707270, "uuid": "4470a53d-505b-4790-a333-d4da9f2ad642", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707270, "uuid": "6277befb-ba13-43b7-9f3f-8241c20acf73", "value": "12288:iMr+y90N2gqLV1g5Bshs3NTQRcQPWXBIwkGBK8H7iy:oyabIVIWW9TQR3PCBIwkGhOy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676707270, "uuid": "5da7133f-7eea-4495-a710-53ea9edbcaa7", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676707270, "uuid": "7e22c385-4a36-4ef8-b158-c17cbd637b63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707270, "uuid": "b90a7598-cc72-4a6b-bce4-127140e593f7", "value": "049f383876f875167c55f1063d3ce5fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "464a5da0-af86-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676722675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722675, "uuid": "ab3628c2-80f9-4287-8727-d2bd6290af27", "comment": "Malware payload (Amadey)", "value": "228a43cdeedf5ef203bc77a9f35746be", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722675, "uuid": "8787c22b-2119-4b91-a1f2-ab50658f5504", "comment": "Malware payload (Amadey)", "value": "8b529b374a56c95d9ad3caacc62e189989cb61dabeff4afb1e0290c0707baa95", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722675, "uuid": "9e01ff3f-46f7-4f49-ac9a-80d4f4a1ef76", "comment": "Malware payload (Amadey)", "value": "2c06ffba8beb585dd9b8db408c308fad7186ce84", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722675, "uuid": "3f7faad2-24ea-4163-9871-227e06cae959", "comment": "Malware payload (Amadey)", "value": "5e5cd9d643af6b7bedaf7c948353a57bbda507b081fa7577d1d609cae5475a4ba051fd1dffa3b77de990ecd0383bb90a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722675, "uuid": "7b787539-6ebe-4990-8d60-8633278a8899", "value": "T1661512579AF58133E974AB3119F306C31A377DA15A32936B234E792B18726B0B53037B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722675, "uuid": "065c0fa9-949d-47f8-bf8a-d56e41c4b205", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722675, "uuid": "e3521d34-27be-4e1e-a3d0-fdae7c3f9456", "value": "24576:Cys2Idf8CtEbaC9xsque25fTFizqzGIW:pxkf8CtQ9PsmmTUzNI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676722675, "uuid": "7d2dec85-eed5-47f1-9538-1ac4ceb84068", "value": 910336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676722675, "uuid": "d2e169c1-7790-4106-a97d-e17fc972c2f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722675, "uuid": "b8a938eb-73ee-4fbc-9970-2c2b1ff65203", "value": "228a43cdeedf5ef203bc77a9f35746be.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e957dc84-af64-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676708346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708346, "uuid": "a954a912-ffd4-4746-9331-2dacc2f8d3c4", "comment": "Malware payload (SnakeKeylogger)", "value": "51c00e288eba5951b7afdd0e63c641f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708346, "uuid": "57cb3034-767f-4437-8601-f6bb98ed5570", "comment": "Malware payload (SnakeKeylogger)", "value": "8b6728299f54aba2e644ad87d86f378f46d48d835893f9654d8daba1cbcfa64f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708346, "uuid": "b973b023-3eb6-48ec-9a2b-035a30ab1b83", "comment": "Malware payload (SnakeKeylogger)", "value": "5693f1ef283e6c6f96aa40a0e476a17326066119", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708346, "uuid": "c6ea4467-dbac-4973-b048-6b2d2087f161", "comment": "Malware payload (SnakeKeylogger)", "value": "6d4436b24b32d29eaeac648f32e635bca1a726e1c83c750d82585b92df7da11605e73c1fda19ddd14f89f59c8e7c6b37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708346, "uuid": "baf3c352-442f-48fb-9ccb-ef5f39abba7c", "value": "T178F44A9CB1F0F6BECA46CC356B103C14ABE0655367268593E263B6D99F3D4638E1C4B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708346, "uuid": "7f9936d0-71fb-4bc5-aaca-e3fe5cde8821", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708346, "uuid": "cf3c369d-b797-4dfe-9492-4e7c9e41c1ef", "value": "12288:C5yqDSuyDsv9tlzbb4lIEAYceN6jsxlqMuXRstcjzN8rZ99Oq9UY/kZ79wXDsv9M:C5yqDSuTzb0lRahjJRhsfz9Oqb+96F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708346, "uuid": "4fc58f2b-072d-42d7-b23f-31109934a1c9", "value": 763392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708346, "uuid": "b21f5eaa-d01c-48dd-9f6c-de3209f3b43c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708346, "uuid": "645dec0e-63f6-45e0-9918-fbe6990671de", "value": "2023 SIEMENS Energy -PO- 216238068 DOCS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee3a5304-af2a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676683443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676683443, "uuid": "b92d7aec-b8f0-4df4-a81d-2a30e665b622", "comment": "Malware payload (RedLineStealer)", "value": "e22f8a6046ef301f7e57453537b44985", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676683443, "uuid": "d7b5a456-67df-444d-bfdf-01ec53453015", "comment": "Malware payload (RedLineStealer)", "value": "8be4a49e4a0cf13aa909d0aa371c52c2ca6de39e1d4bd61de194471418fbd0fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676683443, "uuid": "43a83c16-81df-430c-afd1-1052c985bd4f", "comment": "Malware payload (RedLineStealer)", "value": "ba95cc9147d315e9df03fab0850ccbaab8fbbf6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676683443, "uuid": "0fb409ea-340b-4685-b679-42f0f8d5decd", "comment": "Malware payload (RedLineStealer)", "value": "14ecd13b17e9468fea1edf56efb587d39698e62d0e4595a5d94d6bab7590a79072aa12b88893f2124047bec31e723d36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676683443, "uuid": "94c04399-d7dc-4656-aa60-62e99c19c574", "value": "T1B1F41207FBFC9032E8B4177428F716D71635BEA12A348397225F6D9908722E0B67572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676683443, "uuid": "2e26b414-302c-47e1-934b-059f7720ac0b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676683443, "uuid": "c57af223-0f6e-41a6-aad5-7bb0a83bcf22", "value": "12288:XMrry90RQbV2tcqwdKlk6It+bCrUNEpONdgUB32+NfbFCZkYnqIj2p4SAeb:IyeyV2C1U4AsUNE4HfBGSFTYqe2p4SAI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676683443, "uuid": "027c1835-a42d-498a-a0e5-b4ea5af6e934", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676683443, "uuid": "69c4807f-5dd6-498d-96ad-0c48137ccee5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676683443, "uuid": "6d702cc6-bfe6-4a54-bfb9-069a69b835bb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f8fb84e-af60-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676706397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706397, "uuid": "d625430f-d161-44d1-a876-06e9b3eeda5e", "comment": "Malware payload (SnakeKeylogger)", "value": "62f274b274e57882af6948a7ae1fcec5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706397, "uuid": "127de6f2-fe3f-4d42-a414-5d1f175d98cb", "comment": "Malware payload (SnakeKeylogger)", "value": "8e395be3af871eb7fdb84251645d3dde84ad4f292cba86558ee5a460492c9d5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706397, "uuid": "b96a0ce8-8643-4456-9bb8-3a73b13b80aa", "comment": "Malware payload (SnakeKeylogger)", "value": "29ae5f087f2e98b03e9cf9ad273f22f9d3839d35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706397, "uuid": "277193a5-3674-4589-9b4a-d64613a9726d", "comment": "Malware payload (SnakeKeylogger)", "value": "2c2163dec2597e35a0dd00f11e1610a1590075a583fa02d86596baab14db05caa50e1b156ccf0e7bd90321ffa8664d51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706397, "uuid": "f2bf80b5-54a4-40c3-a6dd-8e42246cb28e", "value": "T1F4F44ADCB1F0F67ECA0ACC76AB102C14ABE0655367168593E2A3B6D59F3D4538E1C4B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706397, "uuid": "90b6fb2e-afd1-479e-9dc0-1c1e15fa47f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706397, "uuid": "e3387772-6e67-47e9-ae2d-bf16a2769efe", "value": "12288:FzsZdqDSumDsv9t9S06yXs8FG56Jg9inGQhYELDsv9to1aDO77JxtuwNU6YBBrYq:FYvqDSuu0Do6FnnGEj2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706397, "uuid": "4748b171-f1ee-4ff4-8925-b124b83074c1", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706397, "uuid": "642557bc-ce09-489f-99af-11bffe6c74a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706397, "uuid": "a5c8a0e7-1314-4016-a1bd-a0912358353e", "value": "KW FAHAD Order 02 2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e16897a2-af86-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676722936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722936, "uuid": "e2e1ee06-fd2c-467b-8c2a-09f5562d59b9", "comment": "Malware payload (RedLineStealer)", "value": "befca0a470211e27e42c09f4b4907035", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722936, "uuid": "e8b8544e-fce4-4837-a81f-00631639c381", "comment": "Malware payload (RedLineStealer)", "value": "8e7f7bf4457e9fe9827c45e7976a7bdd3abe27df02e9a21ec25a7ea901ba665a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722936, "uuid": "7d0973f9-2639-48aa-84b8-114e3ff72eb2", "comment": "Malware payload (RedLineStealer)", "value": "14fb50032a0af613b33edb267be5cffd48407acc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722936, "uuid": "ab5f31a4-14b6-4ea7-a4c4-4ea0a9ee4f65", "comment": "Malware payload (RedLineStealer)", "value": "f348214ba85be60765894d58418bc564b4adc0eb7783b3e77edb5db1232fbc498f0e248bbab37b97fb60571525dfb00c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722936, "uuid": "fca54a4b-a908-4c93-9487-c41ca93cfe7f", "value": "T1DC74BF03AAE87C50E9164F729E3EC6E8770EF6606F09776652195B9F45F03B2E163380", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722936, "uuid": "3834020c-af20-463a-b9c0-a9a62f621674", "value": "8b23c6f110add61e2d6f38c3c2656d60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722936, "uuid": "354f15ed-a2ce-4270-928e-f5fbcd7fd5e2", "value": "6144:C/L+OfKnToCan4YZEUQGDye+Q2n9Vz83YtZTvugmgb:C/yOiUCCqNoyJQ2nltZTvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676722936, "uuid": "2b648d83-ae57-4435-83cb-a458fba82c9d", "value": 359424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676722936, "uuid": "e43a0a91-8ce1-4f56-a466-859fb91d05d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722936, "uuid": "b7a5cb63-9010-4ad6-a124-79cd908f1a19", "value": "befca0a470211e27e42c09f4b4907035.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2a7d11c-af4d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676698456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676698456, "uuid": "9b1ff832-b82e-4e57-a9b2-260641de2d50", "comment": "Malware payload", "value": "f3d25b1cedf39beee751eb9b2d8d2376", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT42", "colour": "#37A01A", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "PINEFLOWER", "colour": "#549EBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676698456, "uuid": "c12b5bd2-bb0e-41fb-adb2-0a5a18828d0d", "comment": "Malware payload", "value": "90e5fa3f382c5b15a85484c17c15338a6c8dbc2b0ca4fb73c521892bd853f226", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT42", "colour": "#37A01A", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "PINEFLOWER", "colour": "#549EBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676698456, "uuid": "fa7be6e7-f158-4d76-b781-e30336c71d3f", "comment": "Malware payload", "value": "dbb64b0202bb4da6796279b5fa88262a6e31787e", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT42", "colour": "#37A01A", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "PINEFLOWER", "colour": "#549EBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676698456, "uuid": "0b997934-e084-47ed-bc80-d3612f61a049", "comment": "Malware payload", "value": "a66c1c47abebf32a80571e39898cc7fd08e8de5df53dc42c22804eb87df1dd484fe4ed7c4bc4b950122a24f8cbdb449d", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT42", "colour": "#37A01A", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "PINEFLOWER", "colour": "#549EBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676698456, "uuid": "6e2b88b3-d178-45ab-98a1-a3ec32455448", "value": "T150631250C952644AE7D668FC2B83078E7721E66ADFDB7037066DEF9E4B13AD07290814", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676698456, "uuid": "75bc9313-a8e2-4278-9644-5f29cde74f75", "value": "1536:wDunpdcXBr5PJsogPF7ITBBWH+M+2YaWHw4CjzGTn0h+g:fpQr5yoEFGBrMfwcP4e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676698456, "uuid": "0bc14725-dac4-4346-8356-823b3c8f5fe8", "value": 72734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676698456, "uuid": "60cc90f8-a36b-4cb2-be6b-bbcbf316a139", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676698456, "uuid": "0bf64d96-2ab1-4e8d-88a5-4a6a79d9c4c1", "value": "90e5fa3f382c5b15a85484c17c15338a6c8dbc2b0ca4fb73c521892bd853f226", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e476c288-af8d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676725947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676725947, "uuid": "3dbefbcc-a8d4-422e-b29f-15c260d5b575", "comment": "Malware payload (RedLineStealer)", "value": "14be0dc09e33b0b52397b301d9c5d5e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676725947, "uuid": "72523fb7-ca18-47a2-b300-f9aa08f38fd7", "comment": "Malware payload (RedLineStealer)", "value": "9116c9364f50a5e9a6217052af6ced5664490230edced716bfd7979fb855d7a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676725947, "uuid": "33487206-8cfd-481a-9fa1-aa1cde7df42a", "comment": "Malware payload (RedLineStealer)", "value": "9a5fd5e21ee3375a66f93f5d7ab28ba166aeeca9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676725947, "uuid": "f0593155-ee5f-403d-91e2-e5bd20fc7ec8", "comment": "Malware payload (RedLineStealer)", "value": "67e7c63b89937f15434582e00cb580e2316a92f40c11d2ced3aa28c7c3b3cab34668dd8fa70552f116056d07f03b75f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676725947, "uuid": "96b1b4b3-d677-49c4-b63f-779d6be5fec2", "value": "T185E41217E7F88436EDB643B009FA47C31935BD615A3D879A234A6C860C736B0BA71336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676725947, "uuid": "2671c818-266d-4226-be1a-4843311f7ea3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676725947, "uuid": "8dd73651-3de8-41af-b0af-a2069f0a2994", "value": "12288:HMrgy90DsetqQrRGojS/cfzjpCxnG31h4K5n+wwM0Vu0EnudBdzp6b4q:Xy0vthljS/ejKeCK90M0VudnMzsb4q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676725947, "uuid": "9f0ccb30-89e2-46b5-a2eb-fe526349113f", "value": 722432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676725947, "uuid": "21e9741e-c5c9-4d63-8d37-2bc6ba5b34be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676725947, "uuid": "fd071022-25f2-40d1-be6a-dcf7615722b6", "value": "14be0dc09e33b0b52397b301d9c5d5e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bed9bdd-af60-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676706418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706418, "uuid": "7763a570-44fd-4e66-9d23-fa12d735d9a1", "comment": "Malware payload (SnakeKeylogger)", "value": "ad4b176c8981c8728fd2d47408a51276", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706418, "uuid": "c6384c2c-1822-42ac-bbb2-0cc82ef49435", "comment": "Malware payload (SnakeKeylogger)", "value": "91610b66796ef670692c7bb27a8cbe16a226bbb78de688dfc66b907a85db9f43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706418, "uuid": "706642e7-3f4a-4949-b3e5-b49c1669e572", "comment": "Malware payload (SnakeKeylogger)", "value": "b34fbb0b1e075d626a3eb87becec43fe9c91e6b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706418, "uuid": "1fa9f37f-90a9-430a-9561-7026c4b23de4", "comment": "Malware payload (SnakeKeylogger)", "value": "aa219e16119da4db36565ed464c97badf077972bef76cd1a9b0f82fff96272b5cbd1e1acaac47fd291e0cf408289ddf9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706418, "uuid": "7877d89f-615b-4c1a-b929-f85d14a5e47f", "value": "T1F8D48CCC91F1EA3ECB498EBA371035081FE056437920DAE6E3A5FAC22F36563195D935", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706418, "uuid": "58acb317-6591-4462-84fa-09b5171659ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706418, "uuid": "9c1fd703-2bdf-4820-893d-2b8bdd0f72c0", "value": "12288:uxuOqDSukDsv9tKck2oCk8AfZkWkQ9bC3Lb4rUOxeEXzojnV4Dsv9t:GuOqDSuyclgZ/kKMLNOxeE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706418, "uuid": "b926727d-e426-4acf-815e-58c6070e4862", "value": 653824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706418, "uuid": "5fc7f1f8-53ee-4250-9eed-9ae661fb39bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706418, "uuid": "b9695890-12c8-482c-a5eb-c9a209c983f9", "value": "ad4b176c8981c8728fd2d47408a51276.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "877d34f5-af61-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676706893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706893, "uuid": "ca99fe8a-20ba-499a-b34a-6167f07b13ad", "comment": "Malware payload (Formbook)", "value": "43039d26dd448ea27947f57535cc02fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706893, "uuid": "a956f09c-e9f8-4941-bcbc-88a0711dbcfa", "comment": "Malware payload (Formbook)", "value": "91e3c02cea291854baf00afaa7da60840030fe2b29b1f27ecf4230b648c076d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706893, "uuid": "a5122a05-e160-4004-9abd-0e3de9ba5157", "comment": "Malware payload (Formbook)", "value": "e66954bf8af4b6e8dd41e673d8729a7fd95f9a23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706893, "uuid": "863e9f9d-46b3-4037-adaf-a29fe916d656", "comment": "Malware payload (Formbook)", "value": "235b15e379241059aac86e297e51c7765298296e37e91a2d2d62c4e23d975ea65cc28a2fe97fd7dde0b21b5421c1899a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706893, "uuid": "41ac7e8e-b57a-44b2-8a83-12a02d3ca477", "value": "T1C984225C0A94D09BE8B21FB01B334AB35EF4B612261CC71537601E8CB56AB53E92E7F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706893, "uuid": "e445a3e7-c025-4f00-8998-755e5551b0fb", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706893, "uuid": "0b14e8a6-1463-412a-83f0-d6ef2c1d1e22", "value": "6144:/Ya6FpscdBl2tcRXDgQM016S/uS5JNL91a5GvObpUqACCCex4cs5j5kBJ/IW1:/Y3aLyXEQ5kS/V5JNJ10GelY4/dkBJAW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706893, "uuid": "c95c8261-8fb4-40eb-8328-cafcbbd04e3d", "value": 376564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706893, "uuid": "2749384e-6e99-4024-8a81-ff144d8400b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706893, "uuid": "0c6dfbe0-aadc-45f9-a7f9-3e439b39f2cc", "value": "odeme.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99babbb9-af9b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1676731835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676731835, "uuid": "4884b737-a20e-498d-8e0e-ad99f2f3db01", "comment": "Malware payload (Rhadamanthys)", "value": "d8eed9128b54ae4163256c8512f7cd4b", "object_relation": "md5", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676731835, "uuid": "b05dcea0-244c-40b4-a68f-7adf16adacc6", "comment": "Malware payload (Rhadamanthys)", "value": "9285ef8f3c452450a45c3715e53953edefd0f48460461eba62888e9a9c732049", "object_relation": "sha256", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676731835, "uuid": "366581c4-a05e-4086-87a4-29dca2c30c9a", "comment": "Malware payload (Rhadamanthys)", "value": "8a65ab81059d6f0fbf1844f24e01358992f76bbc", "object_relation": "sha1", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676731835, "uuid": "00e16847-3b6c-4ff0-a307-bddd8e1ae98d", "comment": "Malware payload (Rhadamanthys)", "value": "98706702896f75be92576af078f6c23c587c06703221d2c0a9ca642c2c739a68abc3ea95c701cff0001ab6efc79b9acb", "object_relation": "sha3-384", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676731835, "uuid": "2a6b4195-fd66-445c-8e40-ef8c984ecb0a", "value": "T1F62733DBB21343BA8C3B6E9FAA1A21D561FC131963D5B2FE092DC7A40C15C495DF42AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676731835, "uuid": "100c6b26-3e10-49c8-8523-099feb3bcc52", "value": "393216:fpQyXWNOAfIH6z+dn5fC0Ld5Qp2TqYi9GD2Wq4tY21Gxx1WwgbD+m2jIdWiTZk:Oyc2HNh5fC062XSGO2sdWwgb8Eoitk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676731835, "uuid": "6f36ef9e-c8c2-4484-a7ac-cb6f6d307aae", "value": 22207110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676731835, "uuid": "5284b27b-aa50-4090-a737-d48a14fe0655", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676731835, "uuid": "50ad78c1-a822-4e57-b7bd-6cd823b1531d", "value": "New_Soft.zipx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fed2706-af87-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676723228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676723228, "uuid": "96fd2e2a-6b6c-4a73-9423-ddf7da016c15", "comment": "Malware payload (RedLineStealer)", "value": "8bb36a0bb2461e6ed275774ba0ef0eb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676723228, "uuid": "345d17fb-db89-44ec-b7b7-997a1ebe909d", "comment": "Malware payload (RedLineStealer)", "value": "931d72ff6bc6ddd93a40d71444a30ba7ea938b51092b8a74050ce89b630633de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676723228, "uuid": "8f7ca7a9-d107-40c4-a898-34a3dd251e5d", "comment": "Malware payload (RedLineStealer)", "value": "dab86e723eccc0fcdd39a7c4e066f1099e3da24c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676723228, "uuid": "8b385abe-3cc6-47fb-93c2-3e40575b2c24", "comment": "Malware payload (RedLineStealer)", "value": "56313853d8eeda3cdadfec00dc0982fee47963b9e43a9507e9dcb97ba43d0e6e0aa4f72ba725dd6d0adf60b7d4ca7a70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676723228, "uuid": "15f173ee-b9d4-486d-b1d1-83d78b87af97", "value": "T10DE41203A2EC8432DDB057702CF642E30A3A7D91AB799297278D6C591D73BB4A731376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676723228, "uuid": "1fc05716-7847-43d0-a426-925650e68ad9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676723228, "uuid": "9a8d2f32-55fd-4fa0-96f9-6b00d08f40b3", "value": "12288:ZMrYy909GlQR1L6Sw+pyMlLBB04XEndu/jkUAf/BFuB6NPF1c:ly/loLhpf1GdFBFVTc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676723228, "uuid": "e271211e-e0a5-45a7-916d-440a75b6e13f", "value": 719360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676723228, "uuid": "19d9fa97-a2bf-4a73-a677-bff15c5e4b7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676723228, "uuid": "de451588-d7a5-41d0-9fee-acf6d6eb9bc5", "value": "8bb36a0bb2461e6ed275774ba0ef0eb9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57d88d05-af60-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676706384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706384, "uuid": "9d2a3694-f00a-4cc9-9afd-68a012399f98", "comment": "Malware payload", "value": "ae0b50bcc039728fee421e570fce42d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706384, "uuid": "48c62faa-8ba5-4377-86db-89c14ace68d5", "comment": "Malware payload", "value": "93abf364eebbc56542d8d71490bef79302f616ddd38959373aac309adf44ed87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706384, "uuid": "2752d828-cd1f-4956-960b-26478287ff28", "comment": "Malware payload", "value": "7ea35095b5ba6371b92a7f972c6c6eab74d29ba6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706384, "uuid": "fd6ce41a-d6ac-4687-9c46-0d2bb4d9b12c", "comment": "Malware payload", "value": "bf80da3ed1db06eb4ccaeb109443b9cd9e6efa9ca6d35909ca894630d9f05cc28559519c7baacf51eb372feab6e04e3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706384, "uuid": "409232a6-edd0-4e7c-8123-8220eb456a3a", "value": "T11946F004DCDE04E7D87ECC367DF2B68EF55A320B5E8A9D9D00242BAE64776D1C4A182D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706384, "uuid": "8afe413a-616e-4bbe-9787-339680b91d7b", "value": "98304:VDzinZs7KIlyWMCwpeIXcOwB/3BsBxw7BYzfm36dhdk6IwteV2FLlp4vt5436aDG:JzeZs7JgCwS/30xwGfBBIwwYlqvbi6aC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706384, "uuid": "59e88408-65a6-4632-a9a0-c677fff28414", "value": 5873033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706384, "uuid": "03f59e40-b99f-49ed-80a7-2d4924659416", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706384, "uuid": "c01ac508-dff2-4e49-8e9b-597424de561a", "value": "ae0b50bcc039728fee421e570fce42d8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff5adc90-af6c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676711819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711819, "uuid": "eb4b6d53-2eb8-42ce-90d8-6c3d64fb9971", "comment": "Malware payload (RedLineStealer)", "value": "49695f01d02501ed0f348d8552a6d85f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711819, "uuid": "9d2e38f1-f307-4907-94e0-d3b100cb3e1c", "comment": "Malware payload (RedLineStealer)", "value": "93afdf95025f723ca841c251a9189d52d9b0a04f8ba27e9a99cdac45e280db9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711819, "uuid": "bf268516-394d-43b9-a662-4243e4f5e371", "comment": "Malware payload (RedLineStealer)", "value": "0facf6bc070df919e29917c28b0c62f571a667b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711819, "uuid": "1a8589dd-f3a6-48de-841c-13f251b931c4", "comment": "Malware payload (RedLineStealer)", "value": "71af596d35a5fd70fa28847f86e76385dd6f6847498c2730ba21804a680546d5248c0664f40e945a486e4596c1e74f1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711819, "uuid": "c9a32428-9dc0-4e55-a140-c815b01d19f6", "value": "T1CE74C003ABA97C50D91B8B729E2EE6E8760DF5606F4A776612184A5F45F13F1C2F3380", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711819, "uuid": "c86b3c1b-4671-4e22-b604-6f9415f6a317", "value": "c300bf53760e8f2f60cd0361a9c25234", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711819, "uuid": "af0d34fa-5869-42ac-9b7c-365055ef03a2", "value": "6144:9j2hLzJVOiPBPLtBNYatDqFPWb7FFCFs2w8EQrajuZ4j:9QJVhZSatDaPVFs2w8BR4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676711819, "uuid": "e0ad8a16-fac8-4075-b0ec-f65b052fe637", "value": 358912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676711819, "uuid": "e2e98657-82b9-4965-b786-25d738e92d76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711819, "uuid": "3d9e411b-92e1-4b4e-9f54-040f03aad78e", "value": "49695f01d02501ed0f348d8552a6d85f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdb04eb6-af61-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1676706984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706984, "uuid": "efe4e792-35ff-4ef1-b496-e138d4edbd87", "comment": "Malware payload (GuLoader)", "value": "2a4b9e9ef7342a7f31ac20dcb4dba602", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706984, "uuid": "01df6211-817d-4dea-98cc-5d0bd1e5b3b1", "comment": "Malware payload (GuLoader)", "value": "93eb4a48ea010fe5e00b9be2aecd0ca4b03f8c6cedad193fab31b0395e439a3e", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706984, "uuid": "0a47086c-840f-43b8-87f3-c06f79357761", "comment": "Malware payload (GuLoader)", "value": "089c4abb46a45d29dd4134d233cb908eb2956a2a", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706984, "uuid": "9e1a222f-3223-471f-a60b-a75d85fde567", "comment": "Malware payload (GuLoader)", "value": "7b6f900f00421e16010076cade1b539430ff89ba00d962ab2598dd54eeb0af3e14d8e1b10b2442336fbba4495f1d5227", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706984, "uuid": "32943970-a48b-48be-8f91-f045ddbb1057", "value": "T143B39E61DF1A06154D0F2B5EEDD11E89807F852A25371578FDEE078D66032ACC3BEB2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706984, "uuid": "5343daba-e112-46d9-bf3e-43cfdbe0d942", "value": "3072:EkXFfSQxhN6/XiWDYxSKeIdE6Mo7cxTjj0gF1:EkXzhsXPMU6MowJj0gF1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706984, "uuid": "322494d6-be2d-46e4-b979-b6f0750a43ae", "value": 116637, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706984, "uuid": "c01719ae-043c-4655-a620-12ebd9d3a5ae", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706984, "uuid": "694176a6-1a24-49d6-adb3-95d6e05a292a", "value": "INV_234567890PL023.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b9d3a20-af62-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676707276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707276, "uuid": "7af33d41-78b5-4303-a88c-e035e71ac9f6", "comment": "Malware payload (Amadey)", "value": "3e35ecfa5d767e53b0da421aafd32861", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707276, "uuid": "c86a469e-f3c6-4d94-9f5f-b7912b5cbec3", "comment": "Malware payload (Amadey)", "value": "9427dc78f0f47ff549dd58d62dd7ce5c0dd54d297abe2f26d0407cb7d8f1c038", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707276, "uuid": "2c2fff9d-162e-4e8c-94f6-70ef10d52cc8", "comment": "Malware payload (Amadey)", "value": "49ddfbaeec2331a816fc273135eb2c785b0935f8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707276, "uuid": "7915337b-02fa-4cb8-8ee7-1fdcea94ed6c", "comment": "Malware payload (Amadey)", "value": "44678ac5de826491ca53bfc47ebe4291926e8ec6375ce8ce19b9d670b29c610a093e51e389741a56f8624872d1e8d3ea", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707276, "uuid": "74c9be60-655e-4afc-af73-757ae25b208c", "value": "T193E41217EBF89435E8B4937118F902C31A357E50873487AB334E684A1DB27A4E67637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707276, "uuid": "9c4163ea-ed6b-4087-9f83-6352936c123c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707276, "uuid": "c01c3d1e-ef80-4b26-926d-f354d402407a", "value": "12288:GMrcy90HqJWJtTBKBqyBD+oZjHyeP9VtH3BVJKl9swLF:OytWHTBKcyD+oZjHF9VYlZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676707276, "uuid": "e310859a-2b12-4489-a508-9bceeb8516f8", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676707276, "uuid": "dc54b45f-d42e-413f-9903-4883d7778c4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707276, "uuid": "56af450d-bf8b-460d-9659-549921db0902", "value": "3e35ecfa5d767e53b0da421aafd32861.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4614dace-af65-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708502, "uuid": "794d9523-8f7b-4895-beb6-bab556fb2786", "comment": "Malware payload (RedLineStealer)", "value": "ae3941d9e7fb2ea3b42104278cd005ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708502, "uuid": "de77c384-9862-45e3-8264-5199e8b7021b", "comment": "Malware payload (RedLineStealer)", "value": "944e32ef1f8fd23de6df398c48a5f19a8977937a9dede3e85d1d596f772c1270", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708502, "uuid": "3dcf34d4-4d3b-4fbc-8d9d-450c724cc0b9", "comment": "Malware payload (RedLineStealer)", "value": "ad197e7a2daee93670ff964e14a530c9f9f001ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708502, "uuid": "bd3535e3-cd59-41ba-93cb-3670b59e5858", "comment": "Malware payload (RedLineStealer)", "value": "5617ea0e90c20fe0b4c96e0970f2edf012d532ae53e53134b66bfdaec19e893e3a443520c3412b2b1a239ca6ba94dcee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708502, "uuid": "51ef05fd-fded-424f-82e2-586c91a1fbbd", "value": "T16DE4120BB7EC9476E8B517304CB503D316327DE15B3886A3234EAD5B18B2AB0963577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708502, "uuid": "f452f2a9-dd44-450b-90d7-f01c6b08a4d3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708502, "uuid": "c313020a-729a-4177-bd11-ef11a370feb8", "value": "12288:eMr6y90SjzRF+EU7/x/yAW6frhigIkx/qL5A7pMO/Q+2Sxy8hCJu:IyBz2EIaruRl/q67qkQJSsu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708502, "uuid": "0637ab21-99a4-4346-851e-e5eedc5a1971", "value": 688128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708502, "uuid": "cffa97a5-c4ae-4a9e-b419-8260f673658d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708502, "uuid": "afcfcfc6-15f7-429e-a581-432959db5138", "value": "ae3941d9e7fb2ea3b42104278cd005ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39858f7f-af60-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676706333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706333, "uuid": "deca4dd8-a28e-4d94-8d47-64e455614eb6", "comment": "Malware payload (SnakeKeylogger)", "value": "a6ef126c2cd644e96f946a69bf67fe7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706333, "uuid": "7a4f565e-79e6-4b68-90f4-72feceeb0227", "comment": "Malware payload (SnakeKeylogger)", "value": "94e4a9cb2b83d6fde93ffcd418188c43da9579f62ee6e83b19f50b6f9a0f6f1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706333, "uuid": "28c5ba36-65cf-424d-a404-4becc55b916c", "comment": "Malware payload (SnakeKeylogger)", "value": "e9f706d5334ed3506f018c979883f05dc41f1d60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706333, "uuid": "dfb358d0-8905-4371-adde-35faa189e10e", "comment": "Malware payload (SnakeKeylogger)", "value": "21ce787e0350a084b0747ef1b054834a558dbb738bfc868c048269dd7e4c2d9e4ab2e362a01ba17a36b621e107b9ef69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706333, "uuid": "3a3c2f9e-aef9-4e5d-8a10-96a9d7d0f8c5", "value": "T13EE3191D6BF88800E6FF8A7305B15116C776BC02192ACE1D56D2F5192B7DB908E1BFA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706333, "uuid": "7166c87e-c243-4db5-a1b8-4c65f0a19ed7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706333, "uuid": "d5d74365-5546-4763-9cc8-03789b2c0554", "value": "3072:JAgAEcCv/IgOYrvQXdtf444YCRb8wXrwBPO7FbY6:6FyI6ApCRboOhb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706333, "uuid": "344fb320-1366-4eba-8b1b-02d5d5d27b55", "value": 155648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706333, "uuid": "c0fdac38-5b89-4a80-8386-871c083209cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706333, "uuid": "cdfc844a-242a-41e2-bd79-52a1f6eb1d35", "value": "a6ef126c2cd644e96f946a69bf67fe7e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c8207e7-af6a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676710606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710606, "uuid": "46e940b7-040c-45b2-8c2e-90de7648c829", "comment": "Malware payload (RedLineStealer)", "value": "1fb91233edc4ba2de4ac21da5cb48f7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710606, "uuid": "ee74165a-13ed-4f31-818f-93fbe9ba4d71", "comment": "Malware payload (RedLineStealer)", "value": "960c3904aac45235db5c70f3b0999b6ea3e475d60b2a6b23a0612b1a59519d3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710606, "uuid": "b7de47be-3e82-4390-8ed6-d77a62db1922", "comment": "Malware payload (RedLineStealer)", "value": "dca181353c9155819e3d62a28dc5fa0fae95657a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710606, "uuid": "32b5210e-de50-4c1c-9d37-d0af52239956", "comment": "Malware payload (RedLineStealer)", "value": "95111eb3d54ec388e34f54b155e126f2f69d932ec054db75c13d974f6e49c19809444ad09c9f77ce594d18f8e155f606", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710606, "uuid": "801145c6-ff18-41dc-a3a6-a5ca0e3774bd", "value": "T172B40207EBD8C122E8B4977019F603C31A367E616B74825B278F9D5A18732B47A3536F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710606, "uuid": "e3b98893-e0a8-431c-b439-55697ec54440", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710606, "uuid": "51214520-815e-4897-93fa-fbb1c7d376a7", "value": "12288:+Mr0y90ouxFlr/Ebwd4h5uY+s6EZkEHHEq5LmcUJPJas:Gyxu9ETuY+FE5LsGs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676710606, "uuid": "53b01ae8-6691-47e8-b3a7-26307e98e5dc", "value": 528384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676710606, "uuid": "0f5bc576-3ad6-475e-a957-cd7546db76d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710606, "uuid": "ccd6c438-4958-4048-8042-6d063feaa37a", "value": "960c3904aac45235db5c70f3b0999b6ea3e475d60b2a6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68e41d23-af62-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676707271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707271, "uuid": "5db14c47-3880-4f3a-a972-9fa37a432e65", "comment": "Malware payload (RedLineStealer)", "value": "2e22d0b4f67fa141f787a0cae2616168", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707271, "uuid": "0a914787-9484-452b-b83a-6f988670f464", "comment": "Malware payload (RedLineStealer)", "value": "97626bf100427484a73158accec393e92f98a78ed326fc959f8c420b7368f9c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707271, "uuid": "7e89cdc3-51e3-41eb-a971-1d8c4c7546ad", "comment": "Malware payload (RedLineStealer)", "value": "2094b3f66b818c2a2b9a6c6f093d93a6f79db0f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707271, "uuid": "c7602533-b555-4053-800e-956cfc042dbd", "comment": "Malware payload (RedLineStealer)", "value": "7669221b172fa31929f82024a5e3ffd071a11bbd61b04373d03b480c15593df784e8572bdd9dcb8ec215cccbd844288d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707271, "uuid": "138a5da5-7782-4013-8748-f6466e8825ec", "value": "T1F24402123ED58071E0735B306868D195AB2D7C62B7784B8B3758133EDEB13D29F9435A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707271, "uuid": "31eb8f7d-ac43-43ac-a9b7-24aedd41fe00", "value": "8cdad4eae189848d90763fd3d82d253c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707271, "uuid": "4c3e8ffe-419a-498e-9561-750c9b4a97d6", "value": "3072:eMBzKwSYOlj0sB3veP5cIjobC5jFyKh4uJ7SkP4bVuhw+hZJxh6XmD16EUE8:eOzTlO10sB3vBe2mo2okCQhhhH0E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676707271, "uuid": "9598ac3a-aa9b-4d50-8735-748ce4e01239", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676707271, "uuid": "231cc1d0-9dfd-48d9-ad8d-a3e130ba7395", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707271, "uuid": "630efad5-7345-4785-97e5-b963db403177", "value": "2e22d0b4f67fa141f787a0cae2616168.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0af8acce-afa6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676736320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736320, "uuid": "0070a5cf-a624-4227-a184-1a382cd70295", "comment": "Malware payload", "value": "b9242c8c1b0d0beb00c9d67a20e85c73", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736320, "uuid": "426611dd-1202-4b64-953a-fab8e316c75b", "comment": "Malware payload", "value": "9778c6d49c3ab49c7fd8c4bbbffd5e16aeca9ee0074a9c0854a55adde768e03e", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736320, "uuid": "f7d74253-ff85-4636-8d19-f1cb049e0c53", "comment": "Malware payload", "value": "43592d357c784c64b4182f7d04f293738ea8e848", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736320, "uuid": "9829525d-9f20-4bbc-b47a-cce26b567289", "comment": "Malware payload", "value": "728764e351fdcf45c1c6c207eee650dc241ae835ee125f9329e25160156f13782a68cfbee85aece9e12dce1edfb22fb6", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736320, "uuid": "5175f660-a424-48d0-8080-382be39c0ec8", "value": "T1E6144BC57A0C9AA7FEC065305183AE0D2C6CBFC3B96D319F358EF2546877E189286D49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736320, "uuid": "10d86044-f10b-43ee-b766-ef410ec68016", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736320, "uuid": "f18bce60-787e-4569-a1e4-f45bc91587ef", "value": "1536:fLMoVToraIlrxCka52oXKsuWoZxX6zaTlz5vF:fLMoFsVK2OKsuWoZxqaz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676736320, "uuid": "55c8a496-b9aa-4a43-b46e-32f6661b01bd", "value": 200008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676736320, "uuid": "663a9d59-d3f2-4f42-9670-b99fad234fca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736320, "uuid": "96376413-17c9-4cbd-9335-72aad71874aa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a50596a-af64-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676708187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708187, "uuid": "dd88f72e-6754-4688-8811-0164369b8eac", "comment": "Malware payload (Amadey)", "value": "8a35b2931c0e7e2657e34ecf1fbf9a75", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708187, "uuid": "9bd4610e-b1ba-4e59-a35b-45217330337a", "comment": "Malware payload (Amadey)", "value": "9871c685b2348677d9710c4c024d48ba060d2872cedefa82c553e93e89b2ed88", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708187, "uuid": "57ce91ad-e007-4281-8675-b40642bf8420", "comment": "Malware payload (Amadey)", "value": "03a080f7b4365a3e73a98ed9d5e9da362b764916", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708187, "uuid": "0444323d-c546-4974-a5f5-c20b28d3a869", "comment": "Malware payload (Amadey)", "value": "995c921d3f42707410f0cd0657d1f34513cc87b47d2064ee4816bdf95b1a6e782ff8f62489f4a11293124c77abe43121", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708187, "uuid": "eac6562d-4011-4682-8576-a0d8669d2979", "value": "T1A3F41207E7F95166E97547700DF207D319367EA02E3887D7228AEDAE08B2874623537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708187, "uuid": "c7e5b59c-d36c-4978-912c-1fb417a0359a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708187, "uuid": "3374d6f9-7c94-4bbf-9195-d268098f0f55", "value": "12288:ZMray90aXV7FlgzMfS2L+g0YiS9rqL5aFp6cJRIeM5Ae4KIx6s4:TyFVh2dg0YFqAFocJ6x5Ae7Ixx4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708187, "uuid": "c6ee7b4f-6c49-4d22-aa09-695c916ce086", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708187, "uuid": "9fc7e7bc-25fc-4f90-a8a7-bc633f67f709", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708187, "uuid": "a95c2405-88ac-4864-a4ca-c33d5c9c5d50", "value": "8a35b2931c0e7e2657e34ecf1fbf9a75.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "411ab189-af75-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676715365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676715365, "uuid": "5273d017-1d8f-4aa8-b7e8-decccb9c6426", "comment": "Malware payload (Smoke Loader)", "value": "3c27ae3bba65d97ecbfd6f77ed787388", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676715365, "uuid": "7a95b5b8-2a14-490b-ab35-758b221fdaaa", "comment": "Malware payload (Smoke Loader)", "value": "9a58dd63b51866541d91a5bae6260c27aeec7a4135cd67a6fb686f549d3646a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676715365, "uuid": "b5780f58-638c-4276-b2bb-8aac61db99dc", "comment": "Malware payload (Smoke Loader)", "value": "7bff7a5ab4e43669db790d1003ac9c3679b46388", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676715365, "uuid": "17a752cc-9d40-4a49-9cb1-b7c997488672", "comment": "Malware payload (Smoke Loader)", "value": "2eee8b926b8425a9c792bf3b580fe00722e6714cf5b060800d9557e93c9671c8837638ca51c7beec8eb481af438b1cd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676715365, "uuid": "45da7592-3df2-4a13-8965-a96448f09580", "value": "T1EB540222BAA054B2C0638A3065B48671BE7E79226638CDCB775C065D4FF13C26F76367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676715365, "uuid": "334ebab4-a756-4562-90dc-784048315d90", "value": "5d842fb7215bce40485e598d67956fa7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676715365, "uuid": "fdb77f10-ae90-4ea3-9ba5-9c658fa1ce74", "value": "6144:ijyfb2BGoYo2zwi25BmYRe0hy+X5tN4dI0MUVA:ijJBF1q2/mYRe0V5vsaKA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676715365, "uuid": "16467399-ecd8-4905-9a0a-561e5185fce3", "value": 300792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676715365, "uuid": "7873c5de-5faf-4e52-9c90-916056560fe8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676715365, "uuid": "7a650d90-42a9-4682-8dea-c8cdb290c73b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ce1d729-af62-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676707278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707278, "uuid": "2f7d18d0-bc81-4561-bb7d-ea682f65e0c1", "comment": "Malware payload (Amadey)", "value": "2e73c00981f792d8393914d87e09e1d8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707278, "uuid": "4b75b986-92bf-485d-8cf6-81e9ca88a0bc", "comment": "Malware payload (Amadey)", "value": "9a877002927a36adc5f9788297e0bf32ce170a11ce1326c750c375e035d82e51", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707278, "uuid": "55409d4c-3814-448e-9110-d6e7f80f44f7", "comment": "Malware payload (Amadey)", "value": "2b9d79805cec081f0dc0463c936da27ef847d55c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707278, "uuid": "76223a1c-3753-4ff8-9938-7014cca99c09", "comment": "Malware payload (Amadey)", "value": "f5358f9b6d02ccea21b831b8fdf086e28ec82360267a0f6f4585169c4f22a4373af623c0abb0048695c32570c5e3a390", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707278, "uuid": "09ecb005-5208-4bf6-98c2-88365d5f328d", "value": "T149E5336BA6CC4033E8A467B00CFE0BE727337A873528465A374F14D16B65678B67137A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707278, "uuid": "943e23cb-0dd3-4fd6-8c2f-b391d0586532", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707278, "uuid": "554aa47a-02da-4ca5-bf35-4e2203dd6c40", "value": "49152:FM5sxgekN8ZISvLeLmfrEPN48ctUsXtVNQnm5eZ3G7zQTD+dI8xtLJCaIQnIO4:RxgekPSz2mwPTsDXtVR7MudI8fLJCTQp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676707278, "uuid": "500ba27a-493a-4e8a-b73b-45cbd1992cb6", "value": 3109888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676707278, "uuid": "a59761d3-3bea-46ab-9247-75e5c2f07c7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707278, "uuid": "05af6467-ba22-4870-912d-951bec4f3a42", "value": "2e73c00981f792d8393914d87e09e1d8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a60d9a94-afd0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676754619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676754619, "uuid": "c97c4df2-01e1-4bfe-ad70-56c7182915f1", "comment": "Malware payload (RedLineStealer)", "value": "1f10f12a467408eed8a74b40a5b3fe98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676754619, "uuid": "df7cd914-da4f-47d6-a26f-5aed20081a7b", "comment": "Malware payload (RedLineStealer)", "value": "9ab1ebd69467b55f55cf35b94c8403a569257784ef929c244649382aeadeee54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676754619, "uuid": "f0d62913-6554-42a3-b58c-e20cab7333e7", "comment": "Malware payload (RedLineStealer)", "value": "cc3f600f97f6ae116cb46c04ed08bea5b8cfe2dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676754619, "uuid": "7addb1f3-184b-4605-8325-6a3008cf617b", "comment": "Malware payload (RedLineStealer)", "value": "c9c440d236672b944e7161dbeb3199e1e02f301b3a1293aa31ef75e2bd2f757be512e22b5baf1a9da62d8920b63f6731", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676754619, "uuid": "742c83b5-6b80-4242-a306-29d5165356df", "value": "T161349D1272E07C51D92346729E1ECAE47D2EF5604E45A7661238DEEF0BF21B2C7A3781", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676754619, "uuid": "6094a781-c49f-42da-bb48-425f11bcff99", "value": "b13253f4369bf042858753b80eccf26a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676754619, "uuid": "6691c98a-2ea7-4531-8f73-b3b121395288", "value": "3072:JN21/4c5L88rOnVkYd81F+eh+c1zCAJI6JgljMpUawvrlKMdGWVroVUJVz:Du/f5L884kfAeoc1JuipyQMwW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676754619, "uuid": "5725a008-c67c-4c79-96a5-e9ee2a031270", "value": 252928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676754619, "uuid": "a8dd09f1-6ad7-4182-a6fe-17a5f69dd0c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676754619, "uuid": "3f5f4b3e-2d38-48ef-a980-0605392082bc", "value": "1f10f12a467408eed8a74b40a5b3fe98.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9721454-af65-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708802, "uuid": "9ea2ec69-8b5b-45b3-bfb8-0b849926f126", "comment": "Malware payload (RedLineStealer)", "value": "7ec08c05cfe84fa2bdd91c3d12429309", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708802, "uuid": "3641c946-def3-4906-8c6b-ea1a85ee1522", "comment": "Malware payload (RedLineStealer)", "value": "9ab621042d607cbd32de851e158f9069e38643adf4e1155d8f842e53b50bc9fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708802, "uuid": "3bcf49b1-86e8-4440-97fb-17bf53f43676", "comment": "Malware payload (RedLineStealer)", "value": "e4b8da66e33dd457bed7c91a1611e4409b09303e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708802, "uuid": "521133e8-327f-4e5c-ba2f-1a1db732d9ae", "comment": "Malware payload (RedLineStealer)", "value": "30e8682164659094b0a2b67acec1e2bcc33d0b3e81f9f7391c1fc30d650575f2b3cf015b3f0c533b78eed21ee2493965", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708802, "uuid": "ee10845c-844f-4c2b-aebf-37094febe060", "value": "T19CB4021BAAE88127E8B547701DF603C306367E616B78835B278FAD5E0C326F0657536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708802, "uuid": "8fc7d48a-cb1f-421e-9a5a-0b2e026642ad", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708802, "uuid": "3aa4d27d-7d9a-4045-b3a1-cd0f42db0c2a", "value": "12288:SMrUy90tEFdYylHOupVcvg3p9yke7HXr5Gih8pXa2rXd1P:6ykEFjuupVcvgZAGbZzrXdR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708802, "uuid": "591992f7-202d-4ae3-b90f-79fe6156572f", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708802, "uuid": "64802235-e8c5-4d65-951f-e3ca3f78632b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708802, "uuid": "74bedc18-c4b6-4a45-a0be-15e8390884f4", "value": "7ec08c05cfe84fa2bdd91c3d12429309.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "969cd700-af64-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676708207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708207, "uuid": "fcbfa8a1-8393-4c23-b9c4-2cbf2e3e00fd", "comment": "Malware payload (Amadey)", "value": "6ade23e18790185b6300393a022d36e5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708207, "uuid": "6897b661-a385-464d-a9f9-7a0ed9356511", "comment": "Malware payload (Amadey)", "value": "9b393aed5d854bfecf3c18afc03904b07cfe53b2a610257a1641735ca8bb62ed", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708207, "uuid": "a9230c64-2a98-486f-8daf-89ba9cbd2e43", "comment": "Malware payload (Amadey)", "value": "65be98c8648c6f5afd9910803759edcac1aabd0a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708207, "uuid": "177060da-22ed-4f13-b685-94497de6db9d", "comment": "Malware payload (Amadey)", "value": "90c9f50ade39254eb0e4d4cdb4ea7b4c0043f80434059472f45949db4d9313e245b61864bc5311d48e91cd538c0a36c3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708207, "uuid": "ce50ab34-cb6a-4f49-8e5f-e9c45fa5b69b", "value": "T179F41207B2EC9473E46017B099F702D31A35BD705AB8935A278AAD9E0C736B1F631727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708207, "uuid": "4b66f7d4-6b7e-4db0-a219-abe18c5b5e71", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708207, "uuid": "ec21dde0-7009-473e-9c6c-7acf2a3b08ba", "value": "12288:cMrmy90J2IgW8CbxMZXDHL/9Pxh9mxbqPJdhfdgIB0wwUoljvfUGr:KyI/sCqdHjFpmZqPJblDBPelbfvr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708207, "uuid": "7c1f291b-b658-46fc-814e-3818cba78504", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708207, "uuid": "acf4028d-2776-42d0-a158-537900fada19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708207, "uuid": "93ab672e-725e-4bc3-9ad0-4353f74acedf", "value": "6ade23e18790185b6300393a022d36e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b1bd2d4-af6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676711839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711839, "uuid": "a4fb837c-e565-4b90-9294-46e8bdd633f3", "comment": "Malware payload (RedLineStealer)", "value": "8e94a4457bebf487babf299e2cf6a028", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711839, "uuid": "3ca5441d-9692-4fe0-9700-3cdf77cdb27f", "comment": "Malware payload (RedLineStealer)", "value": "9c85f5482a1e67795fb5f8fbdb11d1fcd649999fd243eb802d69e54af547f76a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711839, "uuid": "bd6a8bd6-96a7-4e5e-a0d7-946e14a84339", "comment": "Malware payload (RedLineStealer)", "value": "250c4a7ebdaacf27aad6a47de074174093d464f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711839, "uuid": "cf081d7f-3edc-41f7-ab5e-0cfe24db1eb9", "comment": "Malware payload (RedLineStealer)", "value": "b21de7c32432427b5acd9daea480f55812212e3c42f4a0eba4ee096b43ec8ea5661d4822cd9cc47a629ccf920ec5c4f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711839, "uuid": "7845fdf4-88e4-439a-ae21-6ed3c8febbaf", "value": "T109C41257D7ED8125E8B46BB049F602C30633BD609B38835B668E6E1E08736E4E331767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711839, "uuid": "134c66f5-1e2d-4a29-b6e6-66d19949d221", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711839, "uuid": "e3d18436-0659-47f6-aa55-c0c99ee37db1", "value": "12288:sMrny902GqekgFb+d+EkXu25zaMnF42yA9MVlxdFw:DyOkgFb++EkXl3e2ynfa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676711839, "uuid": "bb9e34ac-7d3e-4ab3-8423-c85cb109f0c9", "value": 571392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676711839, "uuid": "3fbe05cd-cac3-40e8-8a32-09d7e6ecf710", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711839, "uuid": "4f3943a3-345b-4b28-8700-66ef6102e697", "value": "8e94a4457bebf487babf299e2cf6a028.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cf376bd-af60-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1676706258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706258, "uuid": "8f2893bd-3217-434c-9b02-7d274b5687db", "comment": "Malware payload (RemcosRAT)", "value": "561f6b0f40bc4a9352ab2262a4bb2abd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706258, "uuid": "a52aa0c1-1319-414e-9a33-1ad17abac000", "comment": "Malware payload (RemcosRAT)", "value": "9e04041dd5e56b2a13ff2128934b2c2e1f9d0c37bb0b96132c658d30d66a83d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706258, "uuid": "b6f5a065-3347-45bc-881a-4f5243d49934", "comment": "Malware payload (RemcosRAT)", "value": "e59ee97714cb5084fa5133ec0b6e665ddb89caee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706258, "uuid": "bc46851b-563e-44c4-b00e-05f7531d6ffe", "comment": "Malware payload (RemcosRAT)", "value": "de81b2bedac44c42686089bd969997686aa299af404f1210e4da3b847b33b0c4562de76c4b921d8fdb2bededafcde31a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706258, "uuid": "a0427dd0-1c22-4e49-8b43-4e360e83339a", "value": "T126D5A1243EFE901AF173EF7A5AE475D6CAAFF2633702645E109103864A23A41EDD153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706258, "uuid": "970abe0c-5889-4995-82cc-883f0f4dd256", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706258, "uuid": "d1c55aab-72c7-41f0-8787-332b3f46d8a5", "value": "24576:QOhAOymyj/GOYWfF5zurnghhup5oUrkNXjGl8RFoKEd:6j/GOYdrnGI3oFsd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706258, "uuid": "3b4c9811-7658-4937-89e1-a40cde19b73b", "value": 3005440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706258, "uuid": "33af69b6-324c-498e-912d-6b6a32270a08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706258, "uuid": "ee662ea4-9c8c-4ea6-ba76-2dda48d0bc2a", "value": "purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4cd1ad9-af69-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676710378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710378, "uuid": "34f941a6-5ba8-4eab-ba0b-d03f677b8096", "comment": "Malware payload (Loki)", "value": "cd88f7c90b39e572b933179748fb1070", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710378, "uuid": "56ee50e3-eb0e-4cba-b7bc-8f191e52edd8", "comment": "Malware payload (Loki)", "value": "9e0b361effefa25b4c44bfe40419f010d5db51fad24175180e47870a33949d1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710378, "uuid": "920f52ca-0bb6-4fbc-aa64-f6fa95b4a00b", "comment": "Malware payload (Loki)", "value": "6ad80cdccaea34c6e20afe5d75c9a2e9620a1dd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710378, "uuid": "d1ef3f8d-d219-4b94-ad82-a210332c417c", "comment": "Malware payload (Loki)", "value": "d72accbe58e58bd6056a991578691dc5523d36c6ab8e9e259af3f533b61bc55ce1ffbbad38030dc10fb00b2f078b47f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710378, "uuid": "ac4d52da-ef3f-49f7-9c06-bc470b02579f", "value": "T134D47BCC81F1EA3ECB498EBA371035081FE056437924D9E6E3A5FAC22F76523199D536", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710378, "uuid": "eb382aa2-d98a-4bc1-adf4-11353d45f90b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710378, "uuid": "3a0f4503-52dd-46c0-a755-be909b1f086c", "value": "12288:EMu7qDSumlhU8WlF1LVJIc0tbidita22teaxZVDsv9tQDsv9t:lu7qDSumlhfSFRIciAIa22tPx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676710378, "uuid": "0da60014-de39-4c44-b894-f8347b5d2567", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676710378, "uuid": "7e79678d-e7b2-4132-b888-3291b0be5a1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710378, "uuid": "c68ec1a9-82bb-4f7e-b9ae-1d3760945cf2", "value": "cd88f7c90b39e572b933179748fb1070.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5b74f60-af63-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676707884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707884, "uuid": "a50ca685-0a07-4681-8888-aa59eaf50a18", "comment": "Malware payload (RedLineStealer)", "value": "792c71d5b41dc84e43dab64f1814c025", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707884, "uuid": "0a9b7feb-02c8-4c68-9888-2211d21933ed", "comment": "Malware payload (RedLineStealer)", "value": "9f68cb3cb138b1d4a5d44f8d7a726cad0f006e1939aa4f44620d45c60a93412b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707884, "uuid": "99c03a6f-04fd-49b4-bc24-d7d5de121d11", "comment": "Malware payload (RedLineStealer)", "value": "cf8b763bd96df2730a15962a329e0acbd8ec72ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707884, "uuid": "649bddb2-0e5e-4151-afb6-82ab05d21853", "comment": "Malware payload (RedLineStealer)", "value": "4b2629c133ccd1762b84ba5e9e88104ee1a21d61bcd7e4c3e4ed3fad11b1f0b2d835ab09c74a087dffa9c706c0d2d9ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707884, "uuid": "3612b0a4-2fca-48cd-9da0-edaabfa4e7d5", "value": "T1E054012236D280B2C0A755345670E2A47EBFB4318978D6CF3768267E5E707C27B39366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707884, "uuid": "95f708af-fecb-402e-80db-19d42474655c", "value": "1189c0a2ecbe8fd35560b095ffebf6bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707884, "uuid": "83fe4541-9e14-4e18-adf5-036711f3290d", "value": "6144:x0ie/VCXhdr1ypZNVc7d9NTQQ9BYieerPwY+qOdIQJbWgqQOa:x0XNQdr1/NTQQsSPkqqVJbWnQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676707884, "uuid": "7a51cfba-4d09-4e95-8745-07987956ce1e", "value": 284672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676707884, "uuid": "04afaed8-8ac1-4f59-a364-c488e0899002", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707884, "uuid": "7e54e760-62af-4165-942a-774494834ef9", "value": "792c71d5b41dc84e43dab64f1814c025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85cccf2b-af61-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676706890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706890, "uuid": "fabf93f4-6e22-49b3-a114-c8460ce4794d", "comment": "Malware payload (Formbook)", "value": "3d415380ad91a34a494c137dd2fd0d6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706890, "uuid": "4b0e4eca-0b4f-4647-a3b3-51e17cbb1cb2", "comment": "Malware payload (Formbook)", "value": "9fcf42a3b170c6bcdd328c0c7d33bfa5c867a68c2a32c7a5bf8bbed7c029dbd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706890, "uuid": "63e50923-9fe4-4540-9480-034acec6029f", "comment": "Malware payload (Formbook)", "value": "a20794948e6e940b279b0768b076989ff32cafb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706890, "uuid": "8ec01566-05a6-4b23-85d9-9c0d120604e9", "comment": "Malware payload (Formbook)", "value": "cbeec8630b198f8223f6093fa5ad48fb73b74852bcd3fe31b530283e3d545087e914c3cf29674c1b9136c72b538bc254", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706890, "uuid": "d1b5f188-c46d-46e9-80b7-70bc7d9b878f", "value": "T1BD54121567E8C0FBD8A25D71593F2A895BEA5E7250682E1B13005E0E7F31275EC0FBA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706890, "uuid": "f88b6028-3c19-4d6f-9ebb-37117141e35e", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706890, "uuid": "8f229eae-e277-4a56-a435-357ca3faaa37", "value": "6144:/Ya6NuTGBjzmy8FyDc22k7raD+QOpachkeYq5XtiwT7vA5N7ELwuvsp:/Y/uTGkyeOaDJ6keYq5XjT7Y5mA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706890, "uuid": "f78a18db-001c-445e-a82c-afe6c3b0cee9", "value": 290959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706890, "uuid": "c1378c9c-37b7-449b-a48f-45762a9c5517", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706890, "uuid": "537cbb53-d285-4620-b23c-3197ffce136f", "value": "odeme.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a06639b-af62-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676707273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707273, "uuid": "79f2e77e-590d-4899-9de2-0a05fee42127", "comment": "Malware payload (RedLineStealer)", "value": "44582680c200278f7b6693a36a03a6cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707273, "uuid": "09724ad6-4ee8-43e1-8f22-e537cbf857e0", "comment": "Malware payload (RedLineStealer)", "value": "a0324053ae78f798bb5e886e50c6032c06eb6bc0d0d20880209320d308a9ed8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707273, "uuid": "bfee1189-d4a5-4853-8f1c-3d96515e2d07", "comment": "Malware payload (RedLineStealer)", "value": "5b09a89308d82b128a962f2e58695eea72f2970d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707273, "uuid": "e47fc9d8-f5b3-4812-9022-d6b880a50f84", "comment": "Malware payload (RedLineStealer)", "value": "473007a7e39da7c02cc7a3961a13ba69d8b63b8a89bfdef68464619a6744a6593c7fd825f710213ccb1bfec6e2bf007b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707273, "uuid": "c9b2ab71-990f-4e7d-bb57-d72e783ebe65", "value": "T121E4124BF3F98573E874577059F313D31A36BD619A38826F264F6E5908722E4A63032B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707273, "uuid": "a663a401-1f0a-42b5-94af-266d5c5520b2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707273, "uuid": "306faa2f-0a9c-4674-92b0-9cf6d43bfafd", "value": "12288:ZMr1y90M4A4USkGBp+Kiv13z7WKh+8yPrQn1grdgPB2cOgrSLAl0:Uyj+Bp+FSYFS0nCpcBdOgrMf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676707273, "uuid": "04361488-4cb3-4275-9d39-b32f855a5bd2", "value": 688128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676707273, "uuid": "ac7c9e65-e7c7-4930-ae2c-d530cf96bd8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707273, "uuid": "c80d91c5-cc79-47ef-bc42-b6b824d83113", "value": "44582680c200278f7b6693a36a03a6cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dba4f37d-afbd-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676746548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676746548, "uuid": "abe696c8-7d64-45f6-804c-1b0f63e78467", "comment": "Malware payload (RedLineStealer)", "value": "5a356abc02f463cbbc46679beedeec21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676746548, "uuid": "bc4302fb-e9a5-4287-9aab-203cc30d503e", "comment": "Malware payload (RedLineStealer)", "value": "a299d8327e99dbc5f1157f34bca620fd111c359855ba8953440f84a7c18525f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676746548, "uuid": "890fc7b3-3a2f-467e-bec5-59e398dde18e", "comment": "Malware payload (RedLineStealer)", "value": "b0f78bf00a7ba93aedc2b4af6ce286d988c4d00b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676746548, "uuid": "31f3131f-2dc9-4e3d-bf90-df2a4d406f28", "comment": "Malware payload (RedLineStealer)", "value": "7ddb516799a6946961271d23379774d7602c1abb096dcc03b473f1f951d1e37b1eca6e06058b2d8f7ac8c43c9c92626b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676746548, "uuid": "a72f22ee-49f6-4af9-a8ac-c28b19b1be65", "value": "T14236233323604496D0D88C354E37FED172FAAE664A416C7AB5CB7ECB26714E5BA03847", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676746548, "uuid": "63be0887-b149-4985-8dcf-81a46199b099", "value": "b0a438491df559e2ae875aca71787ff8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676746548, "uuid": "28da2d96-a050-4131-a973-e806a5a69a90", "value": "98304:Q8oWxwps1WA2WOSt6iRDfUQ5oMlO5bOLy5w4uYV/u7zJYAEiwS/a:Q8BwuJL0iNx5j5mWJYAEiw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676746548, "uuid": "a190fbcb-a004-44f3-8ca9-5cbc15dbd93e", "value": 5212160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676746548, "uuid": "5cd3e19d-4b23-46fb-9c3f-6254731f0cfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676746548, "uuid": "52b24ab4-56c5-42bd-8ac3-b8779f40ff8c", "value": "5a356abc02f463cbbc46679beedeec21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d42c410c-af5f-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676706163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706163, "uuid": "41e07b7e-7652-4d92-b1b8-33ca865e4557", "comment": "Malware payload (AgentTesla)", "value": "e299fd34a1bc1300879c4a585efcf4df", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706163, "uuid": "0be31de4-b0b3-4b7e-854c-b4f90d3d0215", "comment": "Malware payload (AgentTesla)", "value": "a3d1a5a7a396cd835b178c4deb2bacfd9ef4f38a4c861e231d44a4ba27bd4f96", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706163, "uuid": "aea5d632-416c-49c1-9ed5-5580e8092ce1", "comment": "Malware payload (AgentTesla)", "value": "617844664069afa29518ccea52108c6451ad4789", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706163, "uuid": "e740f688-c425-42e8-9bfe-40380d4f241a", "comment": "Malware payload (AgentTesla)", "value": "00db337069294bedbf4c25b4b352c4a1ffeff24203d0da1904ef341d014255b699ca7ca635fbfe5330a5e86d9ddfacc3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706163, "uuid": "3f0d458b-e815-4339-8f2e-e2f3af0a4a58", "value": "T188A51217D032EE1ACE27C57CD8CF74524203AC38AD18950A64A7B72D66357F8167EABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706163, "uuid": "079bba53-d120-4af2-8867-1ce63fcbb4bc", "value": "49152:4enEh2Tt6Zxw2efAa2Tt6ZRtZACkKO99x5W81Vo:4eEet6Zxw2eoJt6ZRtC9x5WoVo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706163, "uuid": "edc89966-4387-4108-a44c-c693663ecf7a", "value": 2225664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706163, "uuid": "22c89dad-c967-4260-9d8d-a253a52e0270", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706163, "uuid": "d073ee42-a0b1-4704-b081-aa06084bf7f2", "value": "REQUEST FOR QUOTATION.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acaa0073-af64-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1676708244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708244, "uuid": "0191e890-4d8c-4710-93c3-e66b9fab3b67", "comment": "Malware payload (TeamBot)", "value": "dd4a3a35173ca0767e92dddd47d581d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708244, "uuid": "fb56917a-e939-49c0-bf67-71a7d1f0b81d", "comment": "Malware payload (TeamBot)", "value": "a559b805cab2dc2200a823b4243cb98624fb2d9fa7fc7d5690414649d2a7e353", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708244, "uuid": "f95f1dbe-d43f-4d9c-b96c-66f673b3be71", "comment": "Malware payload (TeamBot)", "value": "59b26a04278e701441f2068cdc67dd3c8d29c7a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708244, "uuid": "a4826a13-5bec-402e-8b09-789b25c6dad8", "comment": "Malware payload (TeamBot)", "value": "1c248683428c53cbbd816e17c60f3e2343eefca76dd588e4853fdf2faad8d95b907ca3a56538b15837317fdb8210ee59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708244, "uuid": "0e9db286-4ece-4b89-a1d3-94638e7411fb", "value": "T115F3D02335D1C073C157173014B5D9A167BABD625974A98B37A8133EAEB07C1BB38397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708244, "uuid": "08058b32-f447-4f04-8c4f-fa4697eda7f3", "value": "1189c0a2ecbe8fd35560b095ffebf6bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708244, "uuid": "629a16b2-4cd2-45d6-bec7-1d107007b753", "value": "3072:/NT7MKuES03kNW6i22QoiKMAewCss7Z/Ipod:l/ru032W6dHois5A9Ipo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708244, "uuid": "b5745458-e2fd-4935-a672-3740f14208d1", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708244, "uuid": "052bdfb4-e4a8-430c-ac5f-e40e8aa250b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708244, "uuid": "ae7d272f-1604-49c4-8938-8591587bbd41", "value": "dd4a3a35173ca0767e92dddd47d581d7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc40b659-af63-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676707868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707868, "uuid": "ed8ccc35-e584-435e-819d-77c2d6152ba1", "comment": "Malware payload (RedLineStealer)", "value": "3c4c68c2ca410b88e07d2de53ded3973", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707868, "uuid": "d4a8939f-4188-449c-9eee-43a3c4d22032", "comment": "Malware payload (RedLineStealer)", "value": "a58d702acf3da7be2deaeffa4d2d58e4aa7959f5edcb81c2af77311bf8c8609e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707868, "uuid": "4c4611f9-7425-4004-83b9-f0103541e310", "comment": "Malware payload (RedLineStealer)", "value": "37b9f28716a0f62e5e697cd24e94d6bf91fd602d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707868, "uuid": "53fdb1a8-1a67-4997-bf59-63947f497709", "comment": "Malware payload (RedLineStealer)", "value": "3f16d05b747b1c208de81c38fef1027e304c3403fb2ea0963320c00e678770261e196a12e6f4f0ac9d69bed388c6d4bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707868, "uuid": "aaa2e259-9aa6-46c4-a27e-5a729841e27b", "value": "T1ABB4024BA6EC9032E9B547710DF642C30B36FD606B3483D7678EAD4908B26B5A634737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707868, "uuid": "9d099796-d8cf-4a8e-88d0-e2709b82ecc1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707868, "uuid": "dbefb2d1-d1e4-4d3d-a714-c3ea57bda2dc", "value": "12288:8Mrpy90uvYv04MVvlbBmWXdHMOwZF6sxasY6wm3MqTFyx:lyP4aVLKSsxFdwCMWFQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676707868, "uuid": "b26cba01-89fd-46d7-8d31-167bd0784028", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676707868, "uuid": "e5942d53-4cfe-45a3-8560-163b2f21fab1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707868, "uuid": "6bafb8b4-7b5d-44f2-8fe2-2948688af665", "value": "3c4c68c2ca410b88e07d2de53ded3973.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cd82b6c-af61-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1676706902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706902, "uuid": "c84b8196-881c-4fb3-accf-f03bd8757997", "comment": "Malware payload (GuLoader)", "value": "bd0fad5df7e4f13f4a6c1a373b0331aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706902, "uuid": "01283d1d-0e68-47ea-aaea-28b2173d2eef", "comment": "Malware payload (GuLoader)", "value": "a6614340f418b134cc51a9d12f5dabec9359064d650ef891ebf196e69c90d9ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706902, "uuid": "a5c05563-7940-41d8-aa45-4fece8d2dc85", "comment": "Malware payload (GuLoader)", "value": "3683dc2f036e3a5be200498ddbf0b5aa20b14ec2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706902, "uuid": "719b45e6-80ba-4aad-942e-855a8ec4148d", "comment": "Malware payload (GuLoader)", "value": "133d101451bf58c8245293138b73ce9d79e986a77492db61c4014b51e1e4d1c02c2ae438c88eac35d62a28bdda37e88c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706902, "uuid": "09ac6c5c-2a4b-4a78-a3b3-d8f4f8e6417c", "value": "T1B18412287BF8E427D4690E341D91FB3993762E146E2A56437BA13FAB3C714C3882525F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706902, "uuid": "945d23d8-f4b2-408f-beec-e9438ca25309", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706902, "uuid": "229d0fa0-8ade-4e94-8f47-6d0238996607", "value": "6144:fC2+8+wtYTeBb4DoUP1BgVK91AcSecSIqSIyI5WDEENcNxMMDy0Q4Y3Shib:fYTeB4MUtH1WJI0JNMxMH0Q429", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706902, "uuid": "74c6be66-915e-45b7-9d72-beea0ecc7a1a", "value": 386845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706902, "uuid": "b2e3a027-333f-492f-b925-e88c3ba74c5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706902, "uuid": "46393a09-4ead-4cd7-90e2-7d32c6d5f080", "value": "42131007530_20230217_09111964_HesapOzeti.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b697755-af63-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676707571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707571, "uuid": "b6042c89-c8bc-4fdc-aad2-395d7c6a74e7", "comment": "Malware payload (RedLineStealer)", "value": "5b522c1ca8bac9e286fb71b1a6f04280", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707571, "uuid": "5e0784a7-004e-4066-84f2-dceda3f5083a", "comment": "Malware payload (RedLineStealer)", "value": "a66f5babbd0c32c187e73ad6d3c0b4c01a51ba73e19ad3b250b1c5f733b781da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707571, "uuid": "527e6cac-1fea-4047-aaa2-2af71277616c", "comment": "Malware payload (RedLineStealer)", "value": "763032e4794d2670ab9919f9cbfbb24989106db0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707571, "uuid": "3f5bfaff-0ef9-42e2-b694-268cb6aa39d5", "comment": "Malware payload (RedLineStealer)", "value": "019f2a3a460fdb311917360a46bccef64e222f449a6c4c3a47fd89605a815295575738ce12d0edf5687ab158263fe168", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707571, "uuid": "df9bfc4c-5a9c-4568-8037-23b01e0f30b0", "value": "T1E1B40247ABE89432DCB607704DF217D31532BDA16E38D39B239FAD1A18721E066353A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707571, "uuid": "8c1ebce9-ac61-497a-9062-e5ff769e024b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707571, "uuid": "285e72dc-d8f5-4b8c-ab62-17b5fcbb5ab9", "value": "12288:YMr5y902MY8VKf4uCaIruaLqL5irp/GV2pCKzxlDq:BycVK7ytLq0rNegpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676707571, "uuid": "27d92cef-3054-4fda-abcd-a58603dbcee5", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676707571, "uuid": "98eaef5f-1131-495f-b4a6-01ffded746fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707571, "uuid": "4fd4b4b9-a2d1-45a7-b977-19eb88a3b8e4", "value": "5b522c1ca8bac9e286fb71b1a6f04280.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "096f1816-af60-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1676706252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706252, "uuid": "9fc05ab1-1650-466d-8485-66a5e0589146", "comment": "Malware payload (RemcosRAT)", "value": "08196440a5c20745a0520d36f8839b1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706252, "uuid": "01ff4d02-df8a-4b22-be2c-74d928f46bfd", "comment": "Malware payload (RemcosRAT)", "value": "a7b85993bb6145e1a3afcfea61b6a07c5faddc9124dd395d08ad168bdf7cff6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706252, "uuid": "e1a3c7e6-4b37-41ec-85e6-66c61207a549", "comment": "Malware payload (RemcosRAT)", "value": "4c8246c94c6240fc77829faffb855b3ce14aebd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706252, "uuid": "c8487edd-e9bd-4b39-ba34-420cf1a98811", "comment": "Malware payload (RemcosRAT)", "value": "69ff67f9df9fec2e6ba7f07de5923317072e8fe722659fc5811d1cbcd8e3a4b70697d2597240a543d81538c34bde85e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706252, "uuid": "a23683d6-83b1-41aa-b317-095f0c4e8807", "value": "T11145ADF121633F8C97BB0FB9E96027734C6471536354825CFDC80EA86691779AE788B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706252, "uuid": "c0239cf7-eedb-4996-9767-4b47f2f89150", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706252, "uuid": "06cade36-7528-47cd-8072-5c1d271e9540", "value": "24576:NlhPaUwhyplaAcKuNcwPlRtzp+pQTIPy8xdYqIdLu7N3O+GmCdNQqsOwOy66k4m+:Kh6Gxd+HOR2N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706252, "uuid": "e516d9c3-7ef9-4ea8-9657-12c11ef6f63e", "value": 1230336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706252, "uuid": "ba30b49c-d744-4cd0-bcb6-c4decf4597aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706252, "uuid": "73957385-e08e-4e1d-9891-e986c52c9d62", "value": "Embargo_36172519835341144133478006431159938603900405952740067349145858052.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "241fcb9c-af60-11ed-88f6-42010a9c006e", "comment": "Malware payload (SystemBC)", "timestamp": 1676706297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706297, "uuid": "ef57472a-684e-4e02-aba6-14fbb0a9506a", "comment": "Malware payload (SystemBC)", "value": "d87be573a26e97c5b4b8959aab27d931", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706297, "uuid": "fee1b09f-ab34-491a-9232-3e4500b040f2", "comment": "Malware payload (SystemBC)", "value": "a809d7c791aa2a091554cae7ec1ef8321a2a818c134ec81fb2b53ca2cff7aa34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706297, "uuid": "e8aa24a9-0741-4013-89d4-5a81ba8bf896", "comment": "Malware payload (SystemBC)", "value": "0953751d891c051e74bbbb974edc89a29fa88e7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706297, "uuid": "ce4cbfd8-4c99-4713-a187-4792d6dc928c", "comment": "Malware payload (SystemBC)", "value": "c16ce1fb6e747c68df2c560362409f7b8d54c3d8083cd1e0bb451abc4af774538760c3694412f70039d96df48ab3c2b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706297, "uuid": "8d15d66c-106b-41c3-9a97-2c1b28bf0a20", "value": "T10EF39D1236D1C4B3E16654718C66CBB19A7AFC700975D9837FD4036D5F3A2E2EE2A382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706297, "uuid": "4eb2602c-8bfe-4248-af79-cdbc8e7a9498", "value": "f3f44f29591e4034b2372bcb04b7c25b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706297, "uuid": "27c4bf93-c33e-418c-909d-72d8762207f7", "value": "3072:O0O9ibCRpHnL972hGbVl2nES48tezHem:XwlRpHLl2vESMim", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706297, "uuid": "192aa281-4010-40e6-b0ef-d7435a4cd693", "value": 171008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706297, "uuid": "f631af5a-4a7c-45de-ac86-78c8595ecaa6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706297, "uuid": "06dba216-5b55-4a10-be17-84b8bb66bd1c", "value": "d87be573a26e97c5b4b8959aab27d931.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cddeef6-af61-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1676706929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706929, "uuid": "56e94b0f-9af9-4eb6-b646-a04917724f33", "comment": "Malware payload (NanoCore)", "value": "89e0ceb9e96314e102f8f5bf8a351b6b", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706929, "uuid": "3d9cc55f-3c04-44c1-8bfe-2d9d32f7305e", "comment": "Malware payload (NanoCore)", "value": "a80e50e9f99ad55a64a39a046aa5da243687f60e912f6f23eaeb3bd8f38f60f7", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706929, "uuid": "782114e1-7e5b-4310-a063-79cedbb9de47", "comment": "Malware payload (NanoCore)", "value": "b4374cb23abe0467b271a65200b1a71d653518db", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706929, "uuid": "6ba34054-84db-4baf-9524-74fc9ca7335c", "comment": "Malware payload (NanoCore)", "value": "9d3e039b9add221823fedf5ee7009c2fb81b12efcfe97b3d570149a669df75da31560026f1d9c6c98fbe927456f54f04", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706929, "uuid": "e7aa11d0-1949-4957-bd30-f28d18ce3d8d", "value": "T1F95423E7A171B517A696AB8B31C34A00B52785CDE07E2C39FB1D752C352D22C2E8F80D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706929, "uuid": "e002ebe9-5288-41ca-a930-c7c5951c029e", "value": "6144:KZ5WIA3r9aRnpu8QNLsOMxaPqjMvi7uF1ULzbiw3TjPrTtptyAb6Qj7GJdQpII0l:KZkPBSpu8QBslxzyF1ECyDrTtpUAb9jS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706929, "uuid": "0523b317-2773-4efe-a25e-d357116b0067", "value": 290868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706929, "uuid": "684d35f5-78a9-40a7-8b14-8b86ff54271c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706929, "uuid": "0c67e41b-2523-42e4-ae02-cd64ade043d0", "value": "210879409-120645-sanlccjavap0004\u00b7pdf.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5d4c10a-af69-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676710380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710380, "uuid": "1a06e6bf-8608-46b8-8d72-005e06f4f09d", "comment": "Malware payload (Loki)", "value": "4da5587dcb58d2267eda7da4439fad22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710380, "uuid": "e1e3bb6f-41ca-45e3-9dc0-f470577b6b9a", "comment": "Malware payload (Loki)", "value": "a8baf23ad89c7b3aad3df0de3d5998ffe609dbf06a9aa07fa3280717bb9cdca5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710380, "uuid": "76aa1bd1-1598-4390-a4f1-92e4883a2164", "comment": "Malware payload (Loki)", "value": "b74b8d9df6326e9d4eee0cfe568742290dd9161f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710380, "uuid": "82459a0d-8569-4f88-b9e3-e631b4e2c90b", "comment": "Malware payload (Loki)", "value": "56e7827e1bd77381ca744cdeec0ab3405eac8bf85d8f8e15f95bb0388816fc1b1179caa93a5a01063ee540b495a7175b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710380, "uuid": "029fdc08-848a-40cc-8745-d0350f4db5fe", "value": "T1E5D48BCC91F1EA3ECB498EB9371031081FE05643B920D9E6E3A5FAC26F36563199D935", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710380, "uuid": "7de5d261-55f3-474e-8d22-aaab3180f695", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710380, "uuid": "9deb4d5f-1997-4a2f-990e-ba2e998421cc", "value": "12288:7vW2qDSuqDsv9tQOc3KUhgcrXwJSQ1U8K4nnPHZA2T2mQqyDsv9t:bW2qDSuil3KKKS2PHZ/T28", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676710380, "uuid": "4988cb15-8ca6-450d-b241-7125c30a014f", "value": 625664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676710380, "uuid": "751cb428-bdc5-46a2-99a5-c89a5442d807", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710380, "uuid": "9ee3800f-e79e-4aa2-99dd-d207be7b1828", "value": "4da5587dcb58d2267eda7da4439fad22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a6fbc3f-af65-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708509, "uuid": "46f8957e-6fed-4307-b728-4169770f3d99", "comment": "Malware payload (RedLineStealer)", "value": "bc7151d0a34f98fbef84947e9ad0aa68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708509, "uuid": "dbae65c5-2658-4784-baa1-0445efb2c642", "comment": "Malware payload (RedLineStealer)", "value": "a8c292be3f86e4d693b20d0523d11be803e4df91e5290b800e81865585ae852e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708509, "uuid": "a42499e8-111a-4fc2-b0ac-f27fc27adbea", "comment": "Malware payload (RedLineStealer)", "value": "ad030c255a3b8f09add92a237363ce9e74eab900", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708509, "uuid": "0d0f699d-b0f2-464f-90df-cc1e12dc6ff0", "comment": "Malware payload (RedLineStealer)", "value": "6b46093fef25792e814b034f276b5946011d8815be535859ce9c9bd938fe296ca35a55ce214f69bc7dfdde08918e9893", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708509, "uuid": "76aa6733-17c6-4f25-8e64-a2133dd3a8f2", "value": "T10DE41247AADD8063EDB1537018F617C3093A7D915F388397078B6CA909736B4B1367AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708509, "uuid": "6eab5995-4665-4f73-b824-395e7c5e3654", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708509, "uuid": "2426aa71-47dd-4801-a1a6-3ef87f2a3d98", "value": "12288:6Mr1y90uOHkpxJBWPCGSDwq5VqxuVdDrmfin/4pvPyGEgg1:3yzOEpxJ1ZwtOrEiMvPi1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708509, "uuid": "cd65bea2-b94a-484e-aca2-a9bb5fc19f1e", "value": 676864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708509, "uuid": "1fa1bacb-2016-4881-b585-316a466c2187", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708509, "uuid": "fb19ffb7-5a91-4d5e-abd8-4a0100c4e50d", "value": "bc7151d0a34f98fbef84947e9ad0aa68.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b2e1ed0-afa3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1676735193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676735193, "uuid": "c811ada1-5a87-4d89-8385-4c628ea70cda", "comment": "Malware payload (RecordBreaker)", "value": "ea5799b2c2847cf03e91cdce4ca625b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676735193, "uuid": "f9b7def8-402b-4a32-814e-d687995f4ca5", "comment": "Malware payload (RecordBreaker)", "value": "aa4ebbd38ad2aa5a12d999f6880f4053f676fbabc00a8b26c68bf212a6a2c3b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676735193, "uuid": "493b6c92-3cec-43c9-9ad9-a09ff81a5578", "comment": "Malware payload (RecordBreaker)", "value": "bc6fb1315cdc45a15cadf96d93838be8bb4fb191", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676735193, "uuid": "d41bf990-b2eb-4e21-8b42-eab9ff22dce7", "comment": "Malware payload (RecordBreaker)", "value": "c08e12bb4037f0bcfe718858f2edce04ccc1218875e487edfba8a5d81fcf58bbc4645d9c8118e1e7b63bb228558d993f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676735193, "uuid": "773a1efe-845c-45cb-aca5-ec4b5ea2249e", "value": "T197663373175510D6E5EACC31A627BDB832F5136B4AC3EC30B9DB7DC628124A4F226987", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676735193, "uuid": "dbc5fbc1-726d-433a-bc2e-70c0044ea30a", "value": "161839a78ef6f07a30d3f07895f6fe23", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676735193, "uuid": "6e41766b-519a-43c7-93dc-badbe3350a11", "value": "196608:HHufqiT4XHY6qZaLpYy0i6lSgZGPYYkwAU:nR/460Uqi6Y23Q9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676735193, "uuid": "23f7c114-a263-4610-818f-c84223157c9b", "value": 6549504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676735193, "uuid": "92fc02fa-e6e3-472b-bafd-73a48e8d7fb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676735193, "uuid": "2e96fbfa-fd85-4512-89f3-f9a2300e86d6", "value": "Set-up.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93271b08-af64-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708201, "uuid": "cefd4570-8ed5-47a0-ab1c-66a384a746cc", "comment": "Malware payload (RedLineStealer)", "value": "9414b62f18a8e174284ba0cdbf2f2407", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708201, "uuid": "d76e35f1-28c7-41d9-86c1-3616780aa758", "comment": "Malware payload (RedLineStealer)", "value": "ab911b5cfcafb2fdc1f49a8cffcc43c69d5e9139b33cf6aa4a38c963a8d8ae6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708201, "uuid": "c0d6f4e1-86e1-4e4c-bd8b-ec4184362b40", "comment": "Malware payload (RedLineStealer)", "value": "8e90598418898524ef27b517a9cb4356f824794b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708201, "uuid": "4a7432ec-ba19-4fb8-970d-a0b709893be2", "comment": "Malware payload (RedLineStealer)", "value": "dd2a78cd449641c921f45a5b4b88ab10e3db4812cc1660abe207817f96da1f2684922e1b89baed92a2963089881ee746", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708201, "uuid": "1425ea31-4529-4d37-9212-b7f0cc4c13ab", "value": "T103B4020BFBED4032F9B5677018F602C31A32BD615B78839A164EAD590DB22B4B53536F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708201, "uuid": "485f369f-6e7f-47a9-b085-51a9ee239bcd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708201, "uuid": "988679c0-c94b-4847-ab74-e39e5b0de7c6", "value": "12288:1Mr5y906U+VNAPPozRgAaNNZyhu1EA80:0y9V4ouh1EA80", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708201, "uuid": "14b748ae-277f-4105-8e6e-7c3d8b0adefa", "value": 539136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708201, "uuid": "03cc36ae-4159-462e-8c53-36a48ebba865", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708201, "uuid": "ebf48d3f-f333-4b06-ad80-fc5c87917554", "value": "9414b62f18a8e174284ba0cdbf2f2407.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d4e605a-af65-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708487, "uuid": "2d5d006c-93f5-4ada-be3a-76854b5de8f7", "comment": "Malware payload (RedLineStealer)", "value": "a42c81e5adf9d5a96cfb69b747c9afbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708487, "uuid": "dc5e0036-44ef-44b0-a318-b94eb4aa830e", "comment": "Malware payload (RedLineStealer)", "value": "ac1f34b312ed3c907e60ab5998d571c5d7eb5320404c7b7d466a65a4656437f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708487, "uuid": "3591507b-0629-4285-a42e-f60ad94b37f6", "comment": "Malware payload (RedLineStealer)", "value": "22d162b013e39681a37d06da9191bb439d743a4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708487, "uuid": "bc268b20-7505-47e2-ac20-76a88f070997", "comment": "Malware payload (RedLineStealer)", "value": "86be993877aefabc43ec05a4d13f70017548e85c4314651478096723a63c2b6f68e76352dd4a4a2eeecf4baf91181ee2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708487, "uuid": "0c645915-93d4-4acd-8600-7db9381ceb10", "value": "T1E0C4021BB7F84171E8B057B048F643D31637BE606A35869B274E6C5B0C726F4AA36327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708487, "uuid": "656aca34-1f79-466f-925e-672880a30b34", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708487, "uuid": "4b498ae2-c39b-49f8-9e1d-e4b88040435a", "value": "12288:hMr8y90kVc4I3rumYYHSaYBzVfyBp4c2vd7p:Vye4VdYHgaJsp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708487, "uuid": "08e7f379-4d68-48a9-811a-d116770f27c0", "value": 544256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708487, "uuid": "c1f85df1-ce55-4bf3-b0b1-f78ef88f8016", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708487, "uuid": "15a6abff-0525-43cc-8cd6-4ac9be67dec4", "value": "a42c81e5adf9d5a96cfb69b747c9afbf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36a11e0c-af98-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676730380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676730380, "uuid": "41b15dd8-0d45-4a6f-b555-8c5950563498", "comment": "Malware payload (RedLineStealer)", "value": "9818a052aabf57af9fefa8ae63dfc8e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676730380, "uuid": "1e93a617-9a71-4df4-a4f5-fc9318a35a88", "comment": "Malware payload (RedLineStealer)", "value": "ac93715ea793fde24eaeb4bbe82e08997f9e9bd96320e19d2b81207796a001ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676730380, "uuid": "08ba5cb6-9fd6-4ef8-b00c-f8bd07dda0c4", "comment": "Malware payload (RedLineStealer)", "value": "7a92046cd610c824235e447b884315e7a25091b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676730380, "uuid": "7e32cbdf-a924-4816-a0eb-15042c61caed", "comment": "Malware payload (RedLineStealer)", "value": "ede3379cb04508eb18b45001ace9165e5dc4341f5c8ea65da28e6ac6e65a831acbebdafd5b9a17d7f54cf80195e0ec5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676730380, "uuid": "4d034616-408c-42cd-b03f-d12fb64c3bfa", "value": "T14BF41217F7EC4012D8B163311CFB03C72636BAA20A748767278B6D5919725B4A73637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676730380, "uuid": "36a96613-1228-4a53-8e32-80bfae816a4f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676730380, "uuid": "ad36eb63-6ae5-4201-953d-69bf19424ad7", "value": "12288:/Mr+y90d4ZieNavwT5yDxzcWh2oXGT53EmJBEMFsX4wrMRCKMkMKM6U:ByWM6nxzcoXGT53EkBLC4SMkHoY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676730380, "uuid": "deb6016d-045d-4525-8497-8a0874f3f0b1", "value": 764928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676730380, "uuid": "070f46a3-6f96-47ac-aa6a-872b5d96929e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676730380, "uuid": "7ade4c91-c86a-47af-a35e-45140869f92c", "value": "9818a052aabf57af9fefa8ae63dfc8e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53afb2c0-af69-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676710242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710242, "uuid": "fdbf9eed-2847-43b0-a499-8a7c3a062622", "comment": "Malware payload (AgentTesla)", "value": "377a1065a7e24b2fc75875c7b828610a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710242, "uuid": "cd088112-59d1-41d2-a63c-29c494ccb5fc", "comment": "Malware payload (AgentTesla)", "value": "acec9cba576448399a9e351526c7daeff1dfe09ff2203cad80c28b05acbf0aa6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710242, "uuid": "d2948745-3e7a-477e-8358-c94cc825abfa", "comment": "Malware payload (AgentTesla)", "value": "4dc153723f52ea93361e32f6b834397c0c95a71e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710242, "uuid": "e1ddff33-a19e-4fc4-9abf-161d55ef0ace", "comment": "Malware payload (AgentTesla)", "value": "29e987e3c9daae7db043e02681b71ea8a8dc2015b36fdb4fce34925b801c405f1777c4bc451a311aa818223a8816657d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710242, "uuid": "32f8deb2-ab68-40a4-b8e0-486530a6c3c7", "value": "T111E49CDC81F1EA3ECB498EB9371035081FE056437920DAE6E3A6FAC22F36563199D535", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710242, "uuid": "8be8d552-0c74-4017-a685-295abdf296a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710242, "uuid": "16f91120-89fa-4afd-9f9e-8df63776eee5", "value": "12288:VG6qDSuzDsv9tadmBIM2EwF9KW3JAyB4M1EBDQgluNh5Dsv9t:VG6qDSurhH4uCQgkN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676710242, "uuid": "852f6123-82b0-4d21-876a-e78691f9f376", "value": 699904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676710242, "uuid": "5a7dc094-5e5f-47b3-a347-4a19ebc3a354", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710242, "uuid": "fdd70f79-454e-40b5-a192-53c5c18e25b4", "value": "377a1065a7e24b2fc75875c7b828610a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9111ce12-afa9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Chaos)", "timestamp": 1676737833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676737833, "uuid": "2a109332-b444-4d13-9986-af5e2597ceb8", "comment": "Malware payload (Chaos)", "value": "45f6effd67ff42b7285c6852ac84089e", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676737833, "uuid": "761f291a-48d4-4ae9-9c11-89be5e31fb56", "comment": "Malware payload (Chaos)", "value": "acee150694aa266cef7eb98fcd14c7935cefefc55e8c03f3f41a359eef8efe9f", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676737833, "uuid": "78584ac5-3179-4231-89bc-af75f0b26c81", "comment": "Malware payload (Chaos)", "value": "98a8ff6114b65bf0d88fe62ec5faa32c5c4dfa9b", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676737833, "uuid": "064671b9-c368-44c2-8319-f93c4744ff9e", "comment": "Malware payload (Chaos)", "value": "2289f92edb16f6c2e7d15baee1371a3bb67c0f011c1bb4211f7362f6ddcae8395f19d8aaa51da1ae846ab10f1d8e3e7e", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676737833, "uuid": "7f757570-2014-4304-ae70-8eaea29ac265", "value": "T100B2D51867FB4A39F7FB1E7C6DB261405B74BD53EC3DC74D188A404E0822B9C8961B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676737833, "uuid": "7bf163ca-a485-4b74-97c0-b48f849cc511", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676737833, "uuid": "d8740ddf-e179-4c23-8f86-a156b741bf24", "value": "384:X3Mg/bqo21g40+6YZ6lL8d4pXviOjrJXr91Cu8qbD9e4:Bqo2240+6Yc84paOjdXr9YqbJe4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676737833, "uuid": "db2c5c01-8b23-4096-aec1-b5f47f21a80e", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676737833, "uuid": "c6e3a38b-a16e-4589-bcec-580f1dbed421", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676737833, "uuid": "83292afc-1b63-416d-8e55-968028a76f6b", "value": "2023-02-16_45f6effd67ff42b7285c6852ac84089e_destroyer_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29adcec0-afd4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676756128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676756128, "uuid": "c0957230-ab06-4f38-8c7b-eda660c57e80", "comment": "Malware payload (Mirai)", "value": "f91f99279ac493862857b11f495f04e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676756128, "uuid": "220e752d-993e-4ea5-b273-148cad5561e8", "comment": "Malware payload (Mirai)", "value": "ad39fd41d0217f96a79d3c1e83e9dd3d7f02365a3e02d01c8783d04cf58fc96c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676756128, "uuid": "8b491aef-ead1-434f-bc44-112d67f99058", "comment": "Malware payload (Mirai)", "value": "03c3f0e5b9da0a9a102eb509a96496645016aece", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676756128, "uuid": "7e43d701-e8b5-441a-bbe1-3b9998b77413", "comment": "Malware payload (Mirai)", "value": "626949e0155b518498dfca033d7bf158a6c30b62c6b33a1d29c965f7c55b48473d55561bfe824897a640ce7ff1bd1dbb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676756128, "uuid": "09345f2d-3dc1-47bc-8b2f-128314c054bf", "value": "T11D631953B74151FEC2D9C030126BBA3BE86371FD137CB2926BD8AE262C4AD611E1DD85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676756128, "uuid": "5ee10f8a-f3b6-4882-8c4a-9358a47a4ad2", "value": "1536:8+6zzKwI6qnaYhI6130Z+2vBn5JeMDq8hBTdU8aZkZI:qzzKn6+aYyY33g5J/2CTdUFmS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676756128, "uuid": "7ada408e-3ef7-4475-b7e9-16075cf83240", "value": 66816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676756128, "uuid": "641e0eec-4677-4bb5-b652-045874adb802", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676756128, "uuid": "e509bb21-0b2f-4cd3-90e6-230cccdb0b93", "value": "tokyo.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33d00f6d-af86-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676722644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722644, "uuid": "8ca51008-69b6-4bdd-b554-fe5604c88d23", "comment": "Malware payload (RedLineStealer)", "value": "15471616a00a98c46563ae78e0e39f6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722644, "uuid": "0864e3ba-e273-4f02-ba92-5ba59ebfff2b", "comment": "Malware payload (RedLineStealer)", "value": "ae18ef500de766c88a9ed7f1da89fed136a4e235918dfaae0e74ee5d158a8928", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722644, "uuid": "0d56ca26-54f4-4dcd-88fa-7214b9d4c24a", "comment": "Malware payload (RedLineStealer)", "value": "e1cb0d24e3d98762918eccc3497efe09e6dbcd93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722644, "uuid": "5d4e61c1-6a35-432d-a24a-83ccfbf6ad11", "comment": "Malware payload (RedLineStealer)", "value": "0c1ee20686e4e3d7688c2f9df9c39e129368306d1a0e705e35d8e2bcf719ba246f57718a84a78c1b9415700d55d53ba5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722644, "uuid": "cff2c493-ba66-4188-b4f4-63ad707df3f5", "value": "T18774AF036BE87C40D9164B729E2EC6E87E1DF5606E49776512185AEF47F23B2C273B80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722644, "uuid": "421bf8af-5121-4775-92b9-dbad87139351", "value": "8b23c6f110add61e2d6f38c3c2656d60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722644, "uuid": "987f9a51-85a8-41b8-8794-ca9d351c55d1", "value": "6144:hMLmOvBjy4PigzxtahYDBYLe4cutpzKarSdZ0Fg3:hMyOLigP3WefMRVSdZo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676722644, "uuid": "3555c11c-ec2c-4ec4-bf55-49237031b130", "value": 359424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676722644, "uuid": "d93afede-6656-462b-a91c-e932af6ceeb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722644, "uuid": "4ab4174c-4302-4e1f-af8e-188ab17aaa57", "value": "15471616a00a98c46563ae78e0e39f6c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aafb87c-af65-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708482, "uuid": "1d80454b-d4bd-4640-bfe4-c2b914f72fa2", "comment": "Malware payload (RedLineStealer)", "value": "20389af005d4760c8521278325e77ae1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708482, "uuid": "0d02e920-e0a0-4287-b905-1129d6bdaad5", "comment": "Malware payload (RedLineStealer)", "value": "aead3211ec364534b370cdb6dfa3a209cbcf9bc996e380148c03eb44a6bb28f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708482, "uuid": "635e1b12-3fd8-4cd8-8e61-3160b275fc70", "comment": "Malware payload (RedLineStealer)", "value": "fa278e6c817a44fa23119d55655fb56cedb1eacf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708482, "uuid": "279eae1a-6cb3-4f83-bcdc-01c7cac4aaa6", "comment": "Malware payload (RedLineStealer)", "value": "66d170a44edfdeed727f38f6a705c3318a7f23f8a1d8d9ea53cdc90029e49a14dbd6a18aceb14a335e210bd57e8a1927", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708482, "uuid": "e0e19c9f-8014-4622-a5fe-b5612628ee8d", "value": "T138B40247A7E84022E8B557701DF603C30B367D616F38839B274FAD5A0CB26B4A67176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708482, "uuid": "ce92087c-c9d2-4d12-a0f0-24a0aa5df3a0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708482, "uuid": "97fb62cb-2bbf-4548-9090-11bdbea82416", "value": "12288:0MrCy901/RPXeXYAQJ8b/1LYEVQA//j0pKU:+yo/xeYrO7CKQC/jgp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708482, "uuid": "4cee7927-00d4-416c-8d78-83cedbf35afb", "value": 530432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708482, "uuid": "dcde0b7b-ad11-4b45-9316-59f57d2b1b4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708482, "uuid": "37909fcd-20ec-440f-b9de-331dcaf5a38d", "value": "20389af005d4760c8521278325e77ae1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02ddb8d1-afc8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676750909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676750909, "uuid": "84ef856b-db7f-483b-9a3e-d0f9e70ed0ff", "comment": "Malware payload (RedLineStealer)", "value": "f01cd8c3ab0505f2e8e85401809090f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676750909, "uuid": "2048e92e-3be3-4ada-8efd-be204c5c293e", "comment": "Malware payload (RedLineStealer)", "value": "af89252bd9cfbb817ff0823b911862c905756b4eef3783c8a78c79ead8381ff1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676750909, "uuid": "df519513-c363-48ab-b821-ad49152ae7b7", "comment": "Malware payload (RedLineStealer)", "value": "2544c947356f12c4c6600736d69b51e7f7093be8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676750909, "uuid": "0ae667d6-1688-4220-9f87-a19574074e6c", "comment": "Malware payload (RedLineStealer)", "value": "369d9189c6880d826e21fa0fe17bf0ae189aa6f0df87db4881f76f7c77ecfefc2c532aa36d1e933bb348db758f5c5ce4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676750909, "uuid": "c57c1f9f-441d-49f3-acfe-4744d97e27d9", "value": "T10C952324B6D2C737C471963080D6C3746B7724665F3A98AF2ABC1FB97F012E662391C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676750909, "uuid": "af7b6d2d-91d7-4f58-a335-810f26e7743f", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676750909, "uuid": "3c601f03-0666-4812-bd61-34b872d2d2d7", "value": "49152:UkQTAYWc93qe63WzCq89zxeFmIQepIP89FKfA1d:UaTc93GW4xTIQG2ob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676750909, "uuid": "0d7ee9ed-7140-4aed-a173-954655947909", "value": 2017280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676750909, "uuid": "73934a8e-783c-4787-9fe0-1f5512f4d86b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676750909, "uuid": "ed292c38-7aef-48fa-8833-4b77650fc4cb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5ac3fc1-afa1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676734539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676734539, "uuid": "d89cde3b-cda4-4db3-b59f-db1b82eabdfe", "comment": "Malware payload (RedLineStealer)", "value": "3f7d32c925afee64335a73be4d7f19d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676734539, "uuid": "6cf46b37-07d2-4df6-bb5d-ff12f61bbd8b", "comment": "Malware payload (RedLineStealer)", "value": "b100674e9e7bbfae672f4e3f3742b74db7f0db9717036c9b7b54535aeaeeaefe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676734539, "uuid": "abef5d9e-f0c8-45f4-a910-e1930e58e9ea", "comment": "Malware payload (RedLineStealer)", "value": "2da96c5d5a4dfb54072b0e340b6449d84f49c09b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676734539, "uuid": "7b871eb2-e2a6-40f2-9855-3a6c2370b84c", "comment": "Malware payload (RedLineStealer)", "value": "c6083b5002c09e8423333448ba56fc2fcc4dcc6db11fdf611486f44f18e75eacf6a4db2467fb1c49a79bddc8ca36d068", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676734539, "uuid": "5eab6c43-bc33-4f1b-907d-f10080ce35a0", "value": "T1B5151247E2F88126DC75577029F602E30732BEA15A39C297238E6C1A1DB2B61F271777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676734539, "uuid": "81220d04-f6a7-4047-b734-d48b117c7128", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676734539, "uuid": "aa7e7675-af29-47a2-8bab-ccc9687f2405", "value": "24576:Yyg1Zn0XcnPOxrv2z6Gi2ucoo/ioEdDDv/kQjQPPAJ:fc0KP02z64C+io0DjQPP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676734539, "uuid": "fdc1cdd2-d22f-4c3a-890e-804e7333d4eb", "value": 913408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676734539, "uuid": "87f24d91-4850-4ea7-8a18-75efa31dabbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676734539, "uuid": "ef0a2ecc-230d-4867-9fb7-5bd6ab342321", "value": "3f7d32c925afee64335a73be4d7f19d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32beeb5b-af86-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676722643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722643, "uuid": "b485f0ab-d497-426d-8a81-8574bf76512f", "comment": "Malware payload (RedLineStealer)", "value": "b52d1fbfa1240d0b049f97cd75bc4259", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722643, "uuid": "2cb08c55-e031-4e7b-b9bd-a8a000d08158", "comment": "Malware payload (RedLineStealer)", "value": "b1cb3aa77150740c5202d01b80d6411e2998b96b3762042a4938bc17d16ecc14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722643, "uuid": "74469e5e-6d9c-4141-a463-8c1b91637024", "comment": "Malware payload (RedLineStealer)", "value": "ebfd30b2f4f2cc0bb7356875189584bd944668a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722643, "uuid": "348ab791-eff8-4601-b295-376076cb2314", "comment": "Malware payload (RedLineStealer)", "value": "ea2631bf91c2799b33c599a217674e78c970512eddaf38217337ee25f395af6e90b87e73cd7a8fb2ab6e25a512f4fed2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722643, "uuid": "92250af3-175f-4b1e-bfb5-867340d53345", "value": "T186E41217B7E84176E9B6637028F207C31A36BEA16B34D35B264BAD1E0C721B1B171367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722643, "uuid": "f2b4c396-f793-4de2-905f-54f67b54ebb2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722643, "uuid": "31bcb6a3-2739-416d-9a8c-0c932c9ed5f1", "value": "12288:aMrry90Swv8+0AbSDLrYbgggReUfySAQXFtezeDMoUTdNW8ZUZr8GoCPv:lyMBvBbggIeLSA6tcyU/WHZrJomv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676722643, "uuid": "f9f97311-d769-42d2-980b-efcaf47f6c5e", "value": 717824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676722643, "uuid": "9e24f25d-700d-4720-94a2-886a35843582", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722643, "uuid": "1e0eaea4-7a72-4fe0-ab6b-2589f8127fc9", "value": "b52d1fbfa1240d0b049f97cd75bc4259.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faef9e25-af60-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mekotio)", "timestamp": 1676706658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706658, "uuid": "bb62078c-5efa-4d58-bf58-511b6f1e62c0", "comment": "Malware payload (Mekotio)", "value": "7687b26ec22309b02afb93bcea64c30c", "object_relation": "md5", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706658, "uuid": "1233d9f6-1b3e-4ba8-8f2d-a446639f25e7", "comment": "Malware payload (Mekotio)", "value": "b28a176fb0b1449351016166dcc13fe75687e7e3c0e7adc01ac5c38aaf0229ab", "object_relation": "sha256", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706658, "uuid": "6a424614-05b4-44a0-8989-8e4049086e73", "comment": "Malware payload (Mekotio)", "value": "27294aaf3b8c3b36e06065339bbf7416084c2e36", "object_relation": "sha1", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706658, "uuid": "0c1f454b-8952-44e0-9707-becad8480051", "comment": "Malware payload (Mekotio)", "value": "9ce94a126083c8edfe16a0f7bf1f54fd4641048958a6187ce5766f6cb5e6cfdf9db80b95cb24c9f820b59092b5c44d69", "object_relation": "sha3-384", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706658, "uuid": "8cd5100b-8e8d-450b-bf4a-d87417917195", "value": "T1B196232372974112D0FE86754A27BFE525B1172887B2507BB6C46ACB34F27E0A772D83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706658, "uuid": "74a464ce-44d1-41cb-b258-b022b79413e6", "value": "196608:d65S95FZIy8ZSR4qN+QgakvYKoVtfPsolggWIwpa:d6PKR44+oVtsoRPCa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706658, "uuid": "748ed66f-506a-4355-9e2c-9056ee671608", "value": 8974848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706658, "uuid": "6a033ebe-3410-4ad5-9265-4fb3b213ca37", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706658, "uuid": "b364c0b0-d300-4199-b648-c637ba18e107", "value": "FACT63ee7.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "319a98f6-af86-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676722641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722641, "uuid": "533bffda-e29b-47c1-a149-a07d408c8b31", "comment": "Malware payload (Amadey)", "value": "0ba259e50dbbaceb504515c0986d8c7b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722641, "uuid": "d8960033-08c5-4a7a-89c5-b05b3a2a647e", "comment": "Malware payload (Amadey)", "value": "b31a9637af42d70ee7020539c960950ff5bafe5cf57a3742b4f1481f867b022e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722641, "uuid": "ded92f56-0434-412d-8e0e-e331ccd6dff7", "comment": "Malware payload (Amadey)", "value": "360ec5dbe90db72e8990bcbf972ca736773b0481", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722641, "uuid": "f4dc9da0-0d5d-4b3e-9ced-bb5e92877eef", "comment": "Malware payload (Amadey)", "value": "1360db9cb98f976bba4665b7e8e888703fbaf935d8aa51e2b0fadf264c4b791c94b9d3c08aff1d156b7e0eae568688fa", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722641, "uuid": "c4c56e0c-e777-4539-80f0-d033603e134e", "value": "T15AF4120BA7EC9022E9B5A7700CF607D32A357EA15735C39B374E5D1E08B25A1A73132B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722641, "uuid": "005f0731-aa75-4716-b1ba-2c839f6f0ab4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722641, "uuid": "0365d3c3-d4b0-4a25-aba4-bc8322ae373d", "value": "12288:qMrky9060zEwqE+j9ViOHs8zT/1MNJvWij6WsfuysvNeaMkc3dZVI+uEdhq:OyJ0zEbEGTq8zjONPOW3yCxc3hHuEO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676722641, "uuid": "eb45395f-7f80-4e38-9721-548a4c687c95", "value": 761856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676722641, "uuid": "cd19258a-db32-4ffc-b74b-dbfa05c67e21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722641, "uuid": "32c8a2b4-4cfd-490e-9ca2-ac361b2d7b6c", "value": "0ba259e50dbbaceb504515c0986d8c7b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "478051aa-af60-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676706356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706356, "uuid": "bc8d3d98-7b6d-42d0-999f-7df91f6220e8", "comment": "Malware payload (SnakeKeylogger)", "value": "941dad657ffa5c18be715d47bd2ed005", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706356, "uuid": "edf54d9e-12df-44cd-89d8-830d2adb8d52", "comment": "Malware payload (SnakeKeylogger)", "value": "b34653673bd6c8406c3aa551a0f2585612b4cef631c0f4c860d7d56750d639a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706356, "uuid": "dab1b937-9e60-4383-8133-0f8a7afdd702", "comment": "Malware payload (SnakeKeylogger)", "value": "23040511b25ea2e8dcfb5d959e8a7e499284e01e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706356, "uuid": "3f5ca723-6c8a-4c90-8f57-8826132fa303", "comment": "Malware payload (SnakeKeylogger)", "value": "1c4aeb1155b70944483856b0faf73d95bf994d3619e1e8d5903dc763fe06671b96c4972ac2e497c6c5e95f6fbb121bcd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706356, "uuid": "6e66d42c-e6e9-410c-bcaa-e192df72c882", "value": "T158E3191D6BF88800E5FF8A7305B15112C776BC52192ACE1D5AD2F5192A3DB90CE1BFA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706356, "uuid": "135431c4-2605-4d28-a7bb-3a6408d754f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706356, "uuid": "b524e19d-caa2-4412-8d5f-95ede81e989d", "value": "3072:VAgAEcCv/IgOYrvQ0PQ4b8woGwBWjOvFbY:+FyI6tPQ4bhOdb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706356, "uuid": "4f116ca8-30d9-4788-ac5f-db6a3a0b3ed9", "value": 155648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706356, "uuid": "a1d10442-517d-4d1a-956d-21358a682550", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706356, "uuid": "e7daa07c-c70b-425e-86af-908d62ddf08b", "value": "941dad657ffa5c18be715d47bd2ed005.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "857d9eae-af64-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708178, "uuid": "cca26e8a-4b07-4444-9a2b-12a7f69a1189", "comment": "Malware payload (RedLineStealer)", "value": "6f4cbbdf02cd603da826593b0172177d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708178, "uuid": "ed48b00d-5b69-4f9c-aff2-2a88092e02e9", "comment": "Malware payload (RedLineStealer)", "value": "b36b6fc419766c89d4ed581eb5f490858147e6a6020786f788053143ec1aa53c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708178, "uuid": "6bbf8c99-cb04-4103-b247-5b144d417bf7", "comment": "Malware payload (RedLineStealer)", "value": "63374232e75a2a4d1aec533c4305e464caa3a947", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708178, "uuid": "083173e6-6d22-4411-b27e-f04accd33ab9", "comment": "Malware payload (RedLineStealer)", "value": "69439546da4ddb37710526abc26340bb80f2e26b279c5c9009d5b8a5e8ea8342d28646ebf784b326d18b965890671fd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708178, "uuid": "23bc7d7e-8aea-4ba0-a809-440e8376ea27", "value": "T127B4010BE7EC8132E8B16B7019F702C30A35BEA05B748357664E6C5E1C736B4A63576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708178, "uuid": "d0336b80-c129-4522-9209-019b6b3e5802", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708178, "uuid": "89ec005f-2a08-41f3-bada-b8ada9c54c67", "value": "12288:sMrly90Yokk8e3sSpXOAGLE4AoQkmOGVtHEBf7U6RG6:By6kLk5p+JLENkKVOBRG6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708178, "uuid": "f6e4d631-7fea-4fb4-902e-160b0bedf699", "value": 527872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708178, "uuid": "533e9e61-56ce-4b35-9b48-93d64c155d8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708178, "uuid": "54b38070-1ee7-4f6a-8337-c3b6168b48df", "value": "6f4cbbdf02cd603da826593b0172177d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4dcf4d3-af65-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708795, "uuid": "0e70d24c-e1e4-42bc-a62a-eb5dc041d4c7", "comment": "Malware payload (RedLineStealer)", "value": "ba9ad5442efdfcbb902215e0b7fd4448", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708795, "uuid": "ce403591-3957-42e5-920f-790a7669fb8b", "comment": "Malware payload (RedLineStealer)", "value": "b3c27f3d4e2517d9b7ba380187da4076ea7a498e9409fc2ca313427180f5c0fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708795, "uuid": "c6ea4e9d-242e-4fd5-bf94-095c5a9b4940", "comment": "Malware payload (RedLineStealer)", "value": "a403ce86964e009ed2895f1c21b7c9618a2adb0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708795, "uuid": "f7575078-8759-411c-b8d3-6763d103d03d", "comment": "Malware payload (RedLineStealer)", "value": "d8b80a2a040cce277f87108e3db7c91116a9103ea774475d0f232b159fc907c7b14214ea3062dfc5bfa7322d09d84a48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708795, "uuid": "e55894fd-9e2c-4b74-b94c-e81e7a13c3eb", "value": "T125C4024FE6F89135ECB46BB049F202D31637BD605A34865B378E6C5A18722F4B232767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708795, "uuid": "aedaf080-1758-46d5-8d45-a6f9aeff6be1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708795, "uuid": "64ad35c2-83ca-4f22-b87a-107fa1eafc60", "value": "12288:QMrEy90m8lfmhRxDEvtVQMSaYBzlhY3R4c3j9YS+c25+:Eyh+mvWtSMgkBT9YS+rc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708795, "uuid": "a6289880-de6f-4d58-8521-d3bf2212edb1", "value": 544256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708795, "uuid": "6837b774-e489-413f-8959-1f5238c272cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708795, "uuid": "048db86d-8fae-42a6-9b66-c8938130888d", "value": "ba9ad5442efdfcbb902215e0b7fd4448.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8a91799-af61-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676706949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706949, "uuid": "92741537-aaeb-41e0-96ee-ba11371123bb", "comment": "Malware payload (RedLineStealer)", "value": "01e9bc0b8f61ef896f7cea712a659396", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706949, "uuid": "0e03e8e6-7859-46c5-a832-f485bae703bc", "comment": "Malware payload (RedLineStealer)", "value": "b5bc62957ff56b210c1f31c10a0392e1949a3941fbd82657b77747e70e88a8a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706949, "uuid": "ad732b3f-28b8-4156-af84-06b0f0c0e236", "comment": "Malware payload (RedLineStealer)", "value": "63a544694d71d4f6f162f180098c96f441369366", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706949, "uuid": "99b4171b-3123-476a-9a3f-5347375781de", "comment": "Malware payload (RedLineStealer)", "value": "0fd882099191cd3978d5b18080ec209ba098c276cfed13a626492e2f732ef4491452ff2411b5227392ca82f7846b4cfe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706949, "uuid": "cd0b88bb-cb98-4600-b7bb-4e5f626c70ea", "value": "T1C2F41207E7EC8076ECB457701AF242D31A3ABD212B75538A624E5D6E0CB36B4A43177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706949, "uuid": "05c982a0-ba5e-4e1d-977e-21a72dc1bd62", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706949, "uuid": "e17792f9-59f0-43bb-9f5a-6191744618ee", "value": "12288:uMr8y90hQpuSSKpjNkwL8KcgouYjNYOZpOH/dn14vXF4Z5MLUe2uIzJsOob0paEA:OyBpuSSKpjNnpcrNYOZk0FaTsrApjA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706949, "uuid": "9d88391c-1e30-4c87-a99e-4bd8c4389672", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706949, "uuid": "5213f998-8614-439d-b444-f2ee1bcd3600", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706949, "uuid": "22ba278b-293a-4a92-9cba-07476fdb3048", "value": "01e9bc0b8f61ef896f7cea712a659396.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71fa0fd4-af62-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676707287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707287, "uuid": "edca861c-6705-4f68-b44a-2c477b6f3854", "comment": "Malware payload (RedLineStealer)", "value": "33a52fc0c3eb218fde1b039334e5f850", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707287, "uuid": "312b26f2-6f9c-4ad2-b8a9-e2d09b37966c", "comment": "Malware payload (RedLineStealer)", "value": "b652cde92a34f384214d605514ce2977fcaa8d7a336bf7c605e78fdfc023b2f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707287, "uuid": "f38bac14-e263-4080-b05d-2a6f57e609a2", "comment": "Malware payload (RedLineStealer)", "value": "875b45e528e1c682257ba199db7f235f185a71a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707287, "uuid": "c8c61428-683e-4da4-b83a-86962c28a8eb", "comment": "Malware payload (RedLineStealer)", "value": "441edb62feb1aa36cff1be25cec320e636c8445b444bf8e521c721b543953d41e556cf880effdceb472e95d8b246c13e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707287, "uuid": "421bc4d3-e037-4cb1-9d48-0b63ae728e76", "value": "T10A4401823AD0C072E47756312D70C2C06A2F7D259678899BFBD8066E0F792D19EBD367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707287, "uuid": "f7c1c451-bc72-41c9-9d43-76de5cfa1757", "value": "5d842fb7215bce40485e598d67956fa7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707287, "uuid": "18697191-8764-4c63-a084-6e820c185987", "value": "6144:UwlRQj/6EjgwLkIFVxCC4auG5ylg7cyO/RAg8JAQMht:Uw8j/6Evk4HH4q5Lw9AgpQMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676707287, "uuid": "b5531ece-cf10-496a-9947-cc1cc905cd65", "value": 265728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676707287, "uuid": "07bd8ed1-ad4a-4dea-b84d-3c108b256232", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707287, "uuid": "ab2fa8af-415b-463c-a853-161296a61940", "value": "33a52fc0c3eb218fde1b039334e5f850.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0deb01d3-af6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676711843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711843, "uuid": "f2578c8b-ee7c-436c-9e36-9d8375b3227f", "comment": "Malware payload (RedLineStealer)", "value": "d45b58229af5005ac025a34e8db8e4ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711843, "uuid": "e58e4cc6-88bc-40a7-bc40-d98676defccd", "comment": "Malware payload (RedLineStealer)", "value": "b7263f686f36057e0be30de5794360e79c0bebbe77a63bdf0af44fb7fbfcb4fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711843, "uuid": "6b762756-fbcc-404b-892e-821a8c724aa7", "comment": "Malware payload (RedLineStealer)", "value": "23d65fd7d15d30740343b27110a673553781e465", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711843, "uuid": "dd8ca77e-bac1-440e-bc06-ae9d60312081", "comment": "Malware payload (RedLineStealer)", "value": "cfc0cf74328a9f91a4c83614530985d98e46bc609cf19b4374ea7cc96a41d808d180eceb4349693be72b99fb6868c3b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711843, "uuid": "c776652f-59ce-41eb-96f9-fba687b21c69", "value": "T15DE5335B76E90522D99163B11CFD02D31C31FB73BA4C16922F8A566B04F036CBDB47AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711843, "uuid": "55f685c3-b54c-4de5-9cfa-56297eae4b49", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711843, "uuid": "c5c33f01-acae-467a-b82b-51c0f1d48e4a", "value": "49152:TMHDRYlDAIhEkBWKeQpZcFLkASVTbVxNgPYnxTjnjXXIBYdj3JcXlVBuUxyP+sf6:wHelD5hrBnpZhASVP1ggnxTjnjX4BKzS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676711843, "uuid": "513b3765-8dcc-4c58-973a-72b27c166dbe", "value": 3123200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676711843, "uuid": "10934a0f-b7fc-448e-b3e6-f0edb425c678", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711843, "uuid": "5c738b3e-da39-4010-b644-d8b166d78e8b", "value": "d45b58229af5005ac025a34e8db8e4ee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cb7d4ef-af65-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708513, "uuid": "23c638b6-fa3e-4d39-9237-fc051f9f84f9", "comment": "Malware payload (RedLineStealer)", "value": "62410e0e6ef409850f33164c5d72560e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708513, "uuid": "a63c402e-f901-43c9-8e0c-5a7171ee4b72", "comment": "Malware payload (RedLineStealer)", "value": "b7815413451c983c73d263da603598bd47011bcd2cf7f0baffe9bf1231a3d3e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708513, "uuid": "041b521b-9812-4198-b51e-74f4ab537335", "comment": "Malware payload (RedLineStealer)", "value": "6878bc3b97f164c4d971749dcb77dfece91326e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708513, "uuid": "2f6a8ee0-61c5-4042-bf0c-8a2c8b7866a3", "comment": "Malware payload (RedLineStealer)", "value": "1cad86803e1e575d769041fcd0d775bbf266c27ec4f05f6a851b2c75de910681b424f2fde4a55d2742ce38d6e6b64c16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708513, "uuid": "c476edc1-8457-4fd6-8f61-d3d0f483126f", "value": "T148B40207F6EC9422D865577058F242D30A357EA06B3883AB178EBD5E18736B0B63573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708513, "uuid": "f038774b-b5f7-4ba1-bd42-79def6d6edcc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708513, "uuid": "41b2489e-51f2-4ef4-bb09-f5cf2b1471b5", "value": "12288:UMrJy902/i+Fd+6ChajU6ao6WENFy1VgNsTl:ty9/iNJXtTOmw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708513, "uuid": "52eba025-9a20-4dfa-abce-c969d33dc33f", "value": 539648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708513, "uuid": "4a873ee7-92ad-4ef1-9787-8f33778a4fa3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708513, "uuid": "d98e254a-c043-4be6-b598-77f0b38090c9", "value": "62410e0e6ef409850f33164c5d72560e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "944f63c9-af64-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708203, "uuid": "76a75ec0-719a-4c08-b262-7a0bb51b0bde", "comment": "Malware payload (RedLineStealer)", "value": "e47a4fa33100a46ecd93497622d6e8c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708203, "uuid": "8af32d4d-1038-4c33-8ab8-7bdbd7054130", "comment": "Malware payload (RedLineStealer)", "value": "b7886a5bd6366edf1e4d1c480cf99a764a4aff006a3f7df990c4707dac9363ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708203, "uuid": "cb454032-029f-40d7-9d87-f0fcdff5007a", "comment": "Malware payload (RedLineStealer)", "value": "c72977f078beff797c5bc3030703036d03ea775b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708203, "uuid": "b0b4dc98-10af-44bd-a5ca-64a9dccd98da", "comment": "Malware payload (RedLineStealer)", "value": "037c550a52e1a8b95bee97dc1681888ab02bfc6b5d8d332863b5abad7bbb2a769eaa0188d1d55c881d059678cf815bb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708203, "uuid": "19eefe46-eaf7-477d-b5fa-0589b03d8cd6", "value": "T15FE41207EBEC8831E972977009F603C31A39BD616A34875B335EAC1A1973574A7353AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708203, "uuid": "f2e870c4-15ca-4275-a4f7-6293be421f70", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708203, "uuid": "4f2c0251-2db7-4542-954b-c947efd8c978", "value": "12288:FMr0y903tn1RVSoqJVKsq6oIG4vI8HqPoeUmOnVtHjBKD580EfkTA37wW:lyu/VS99q0Y8Hq7UbVKEfkaR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708203, "uuid": "16eb4613-3a06-4f8f-b58e-74ab64a58500", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708203, "uuid": "13b72cad-dfbf-4db8-8a40-29ede742a293", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708203, "uuid": "22b5d65e-8a38-4779-bdd7-4b60460671e2", "value": "e47a4fa33100a46ecd93497622d6e8c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "262078cd-af60-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676706300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706300, "uuid": "f11eff02-6adc-446e-bbf0-3f82fb3a2300", "comment": "Malware payload (SnakeKeylogger)", "value": "3a08a29d57e7a283320929ab2ba19efa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706300, "uuid": "e3915836-57ba-469f-a9c8-e5fe3844a3fe", "comment": "Malware payload (SnakeKeylogger)", "value": "b8208e83d1b83690605ad2dea2dc633597775b94e1ddab9a7bffbc2e4cc055c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706300, "uuid": "aae2947b-88c8-430e-a2e8-c3c3810a4819", "comment": "Malware payload (SnakeKeylogger)", "value": "7d0d0cdbd92858599fdb73eaa0e8260673e55060", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706300, "uuid": "bbb3a7eb-920b-456f-ba32-a44f99159178", "comment": "Malware payload (SnakeKeylogger)", "value": "a472a2fad24c7b1e2d5bc7d4135c21591c0d6514ff5f234a1616b2ffa5cbec1e75688ee71e50af08b3dcd3ccc99787bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706300, "uuid": "97dd7146-5f0c-4498-a384-9a5ac37f156f", "value": "T1C7D47DDCA0F0FA3FCA498CF8B700368417E052032D69D6E9D7A6F6C557763A3285E526", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706300, "uuid": "7915b757-7666-4f89-b237-83b26ec16f37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706300, "uuid": "cd5bcb07-d03c-464c-9230-06371f34da16", "value": "12288:8u1MKARqDSuNRrAORghxwkA2exl1SE1Z5bJ3eRag2T+PVYC:8cBAqDSuNRrAORgckAzxlvZnOm+tYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706300, "uuid": "13a023af-552a-4748-83b3-0a43dc694d2a", "value": 646656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706300, "uuid": "c326b982-5411-4866-9d7f-1ea10897268a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706300, "uuid": "73d91a65-6566-4fd7-8024-8f3727aeae50", "value": "PT No 0021 Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06fc3827-af6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676711832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711832, "uuid": "d849a675-efbe-42a8-bb6e-62a1d300550a", "comment": "Malware payload (RedLineStealer)", "value": "2aa85282e23659b8189004cbd30e9a26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711832, "uuid": "85ab8bcf-404d-476d-a185-7cecf08e6f8b", "comment": "Malware payload (RedLineStealer)", "value": "b84b20a523ff669075b2374e3329d304ffa42aa5ad60669359ff5517f0a77adf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711832, "uuid": "55cfa6e3-2a10-4a93-9fb2-4d2959a29aff", "comment": "Malware payload (RedLineStealer)", "value": "ad5f635b569ddbec8787c8692de67702d72fdae6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711832, "uuid": "d0b0add4-f464-4377-9f2d-41cef122cb36", "comment": "Malware payload (RedLineStealer)", "value": "7cbd8a4348e3da6fdf23b108eae8273ab0e3476ee85ab1034a942b10a3f2b2aa7b6c4b847917e8c2aaa0434bd54cedd5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711832, "uuid": "c56d4ba7-78d4-4d55-a746-4963b7acc186", "value": "T1DCE41247B2EC8067E5F957B018FA03D30637BEA14B348793664E6D461CB26A0A73573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711832, "uuid": "c962a0d0-205a-4c7e-8325-802935a653f3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711832, "uuid": "d8b922ce-78c3-4d12-876d-dc482a0c2571", "value": "12288:OMrty90Ir0+1+nC8FLxSyid/3cdov6xIyeFjPOKRDKudFsmEZpkQkNVHg4gFW:Xy1l1wC8BxG/r6eLLjSmERkVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676711832, "uuid": "de06d516-7525-43f6-87f5-878828dadab9", "value": 718336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676711832, "uuid": "49767038-5239-4d11-ab1c-69de6791b561", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711832, "uuid": "0a280c06-eb36-4bae-b52f-86577a077314", "value": "2aa85282e23659b8189004cbd30e9a26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "574cdb2c-afa9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Chaos)", "timestamp": 1676737736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676737736, "uuid": "d629bc99-3a33-46d6-aa88-71df50d74ed6", "comment": "Malware payload (Chaos)", "value": "40d3bd592cbeefff05b530ad8450c960", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676737736, "uuid": "1786762a-433f-4907-9a72-14d7028d0fce", "comment": "Malware payload (Chaos)", "value": "b8a277a731485717c01a7d20fb6af795fa823a219b9b01ee2f476889610a28da", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676737736, "uuid": "ac503abc-1083-467e-b0fb-c070186df1c0", "comment": "Malware payload (Chaos)", "value": "1f61dc040fc2a830028060b8ba7f23a180e5a51f", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676737736, "uuid": "bf987be8-0d8e-4093-96ae-e0c002aa4fda", "comment": "Malware payload (Chaos)", "value": "b480e5b7f9fc797459230d0084fe968008bb0a31d52f257903f2341df4270380394a19da324719f3d5a5e68d42578006", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676737736, "uuid": "027aac57-2e11-42b0-ad59-527bc6018b66", "value": "T1B2D52D3839EA9019F1B3EF7A6FD4B9D7DA9FB7733A0294191081034B4623A81DD9153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676737736, "uuid": "1b2bd5fe-35dd-40da-ab55-7182c6deb0cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676737736, "uuid": "5c4044d1-2e5f-4fe5-9500-bbac8f86a6be", "value": "24576:oKS4lQMNWi3VesNY8106qPN4K3P0QcejoMZLyiTtiFfkOfE:oKSy6PX3PpM+P5Id", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676737736, "uuid": "50dcda30-9354-4a77-beae-2d100d7d1174", "value": 2843136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676737736, "uuid": "55bac51b-824c-43f8-8b25-aee4fb968b19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676737736, "uuid": "450bbac3-61a6-437b-a173-9f4f58bfeabe", "value": "2023-02-17_40d3bd592cbeefff05b530ad8450c960_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2088efad-af63-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676707580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707580, "uuid": "2cdb6b36-eda8-415d-9e47-df08191482d6", "comment": "Malware payload (Amadey)", "value": "56510701d3c349d66ba6567d6619feaa", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707580, "uuid": "228ed0f7-8a6d-4732-96f7-b61815c77f35", "comment": "Malware payload (Amadey)", "value": "b8d21ee6c0ac5d4ff963886913ab37a4a83600d20a6c9273b75c196739fb5f3d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707580, "uuid": "3323e4b4-7f3d-4fee-833a-d7b060d20e46", "comment": "Malware payload (Amadey)", "value": "29ae51de6a1c7667718f5e737835f76d30f5fb77", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707580, "uuid": "28aafb35-607e-4ede-abdc-1b6bd679ade7", "comment": "Malware payload (Amadey)", "value": "49924285442436483990b65e14302e7c29fb5b03044669b28e458deaef64fe00cb30e926e328d86424bf102c7f7b4450", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707580, "uuid": "81c6cf1b-0674-4ae6-b866-4c5d4a22fe42", "value": "T1FEF4121BF6F89522D8A023B028F243831B353D605739C397278E6D6619B36B4B935B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707580, "uuid": "4423b6cd-2b3c-4d14-8951-1144cf1821d3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707580, "uuid": "98396a97-9dbe-41b3-a9db-dd99d4c14a02", "value": "12288:3MrSy90ACq0+1mVPxhrvl2Pmk5tNH0xo3WE7oyE1cIjqp63XT:FydCq0+1mVPvcekL5RTmckqmT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676707580, "uuid": "b67c9a30-0bbe-4ab1-8d43-eaa1ac5e53d8", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676707580, "uuid": "89f74e89-c359-418f-9910-910af9e76dd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707580, "uuid": "2ce2bf25-894b-4614-b7f5-30c365fb1963", "value": "56510701d3c349d66ba6567d6619feaa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b35c2d46-af60-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676706537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706537, "uuid": "a273f2e0-3f29-4cfa-a9d9-694c2ef2c0ee", "comment": "Malware payload", "value": "e8dac3997fdeaa30c0f847d83511e359", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706537, "uuid": "055dcad0-0a23-45d2-b046-7158ec1d82f1", "comment": "Malware payload", "value": "b9b22dda662fc4bd7a9d17dd6035c0086ef4a662d6d39467dbcf233ab5f12853", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706537, "uuid": "147348f6-7f84-483e-b27e-263c3a90a280", "comment": "Malware payload", "value": "e8c2f642a59794f0eea9255a5ade9d0ea6a374f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706537, "uuid": "8f2b7bd2-3630-47c1-a373-f69787f6b92f", "comment": "Malware payload", "value": "621ec1ab96e746369d6bef1cc73dff831cd160240adad87f4a030ab270eb1941aa651146945b408e5da7be1f2d9fb3e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706537, "uuid": "8549ca4d-6fae-4eab-9356-8ae0b5a6e635", "value": "T1DC56232323A01959F091CC31D52BBEE972F6076BDFC0F8391DCA9EC428625F5E652927", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706537, "uuid": "9f4226bc-8f99-415e-b3a8-0e414c8f11f8", "value": "895e5e6e037e9108574fb94ed614d804", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706537, "uuid": "e98611c8-ee0f-4355-a5e0-00cf178a871c", "value": "196608:cxbtq/CXbqykFma8Ti5NCQty41mU/AaJWIS:cVt+EW4apNCQdTnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706537, "uuid": "807a8354-8168-40f0-94a7-de7cdce8a8e3", "value": 6388736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706537, "uuid": "d5e72563-fd57-44d3-832f-6884ecb5e500", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706537, "uuid": "b3170c83-2dc9-420e-ae40-3bb6ff3106e5", "value": "e8dac3997fdeaa30c0f847d83511e359.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88dfc50b-af64-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708184, "uuid": "95328d49-9315-4d94-9a6c-b4a1180767fd", "comment": "Malware payload (RedLineStealer)", "value": "da34925a5a9e4665f496a5e95eaeb022", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708184, "uuid": "f8dd4355-ef35-4813-9e6a-1e3560479955", "comment": "Malware payload (RedLineStealer)", "value": "ba9b8dd31763548a5fe839c1911b3a6ec913f10f76ab5d7843aa89a0b9413b84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708184, "uuid": "029bb6d1-33b7-4317-b81f-dda4488bf4e8", "comment": "Malware payload (RedLineStealer)", "value": "5dfcbd15d3a119339d93c6e4018fc8c0b49858f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708184, "uuid": "1e21e835-590f-4b8a-a597-daf08be79e2f", "comment": "Malware payload (RedLineStealer)", "value": "558a81852dc17e9683031790f524ccf96f1abe7ffe369a8f83aa9a308c62d7fe6917d19684a1a3789cfc01ecf3f0cd51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708184, "uuid": "203a8151-c63b-4e09-9e9f-f4b8f2955b3c", "value": "T1D7B40117EBF88022D8B557B018F603C30A36BD614A789397278A7D5B18736A1F63437B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708184, "uuid": "59c5c1d5-09d9-4190-8425-cc339dfb94c5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708184, "uuid": "b7c1c1c8-7461-41f1-b415-d71a7d182746", "value": "12288:0Mr7y908jqzz6t2NXBgRx7BRtHfLBFAB3IEj2d:3y2zmtQXix7BRyB4Eid", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708184, "uuid": "2cb489e9-27dc-46f1-be66-38d41f3a7d69", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708184, "uuid": "1dd9f2ed-e7b5-4a79-ad4d-1b804fa76357", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708184, "uuid": "ceb0e405-27bc-4438-a2c0-29d190bfe75d", "value": "da34925a5a9e4665f496a5e95eaeb022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "051ab6c5-af60-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1676706245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706245, "uuid": "21ce602c-ceec-432c-9cb5-6717a4831522", "comment": "Malware payload (RemcosRAT)", "value": "0ef4e560fb53155a2887c5b9ef0ef19a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706245, "uuid": "7e242191-ab47-4b4a-a764-5263cd502c3e", "comment": "Malware payload (RemcosRAT)", "value": "bc560f1b389e01878838e3d66f72c275e2d30c95b9a3e5b68af4ee8e71f0008e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706245, "uuid": "39ccf34b-d272-4708-ac0d-de8c53fa2e2d", "comment": "Malware payload (RemcosRAT)", "value": "240dee21d45369e45b97b2412ad018581586eef2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706245, "uuid": "fc67f68b-d966-4cdb-933a-316bb96cea3e", "comment": "Malware payload (RemcosRAT)", "value": "cd46ea787c4d3cabf08866714c7e267b4514350b1311664f58fa4300bf6dd8fd5e675ac7cce7e20aae14e03682300254", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706245, "uuid": "66a0f967-2781-4d49-b201-6f5127d71f76", "value": "T1F645AD7202437F8EE3A70CF5E54037B34CB465676795A058FDC80FB9A5EA924ED248B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706245, "uuid": "42c7642d-049a-4fb1-bdf3-e3c6864020a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706245, "uuid": "e77d6b23-c71c-4866-a516-d2a9d0dbcbc5", "value": "24576:QgK/AU2ZRLjIAriOmBKaxpZ3hboWZaVOxjk/NaSIouAYfQKhOdVPwGLhEUDNt8Nd:TaxBtfhodLOAAd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706245, "uuid": "bde5089b-7204-43f1-bf1c-547b82ee7963", "value": 1214976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706245, "uuid": "c67ddb56-21fb-486e-9305-abe5579ede57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706245, "uuid": "1d86fec2-89ec-43d9-b9fa-4151392f5db3", "value": "Notificacion_29033230134604236815975768607023511236960372299956320782461629001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6bbba8d-af6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676712207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676712207, "uuid": "970acf26-6054-4912-9302-938105d8cc47", "comment": "Malware payload (Loki)", "value": "c0b1c3fbb46a37c556fad5d2ee13bf38", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676712207, "uuid": "6b216e8b-b85a-45cf-bfd6-0a3277008b95", "comment": "Malware payload (Loki)", "value": "bd6d05a0b508e5bfc4c8d4a2c9bd7b307638986e460c160378bd5d98cd5850aa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676712207, "uuid": "0bd959d4-dde5-46a4-8749-d61ca474cfb8", "comment": "Malware payload (Loki)", "value": "ee63027bbc7fb43b51f859a9a454a5910c446f39", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676712207, "uuid": "59603ed9-5590-4048-b86a-e7209c920c2e", "comment": "Malware payload (Loki)", "value": "dcb55e542042484be9bdcc69a7b5b8d85f508fd4a073e4df48f7cb38046349b4260adde704c9f61cdc698c1b6a79b439", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676712207, "uuid": "cd75ffe3-aa4d-4ba1-8ca9-1811012639c0", "value": "T155445B1392A27D50E5968A729E1EC7F8761EF5604F4B776E12199B3F24B02B3C3A3710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676712207, "uuid": "327d4156-3edf-405a-bd99-d70e34a5408d", "value": "e04960f092e2c265d9974e72e467f4d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676712207, "uuid": "9e9effd2-0161-433c-bda4-f33aeb9c31e7", "value": "3072:GbtnW2XHLXpELuqboo4g+ZvyNAK7UvlwwlTf3bHPV8dv:olW23LsucvyVdTrHw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676712207, "uuid": "179fabfd-19fc-403b-b7e5-0f5fd90ff537", "value": 259072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676712207, "uuid": "9de2c095-5424-4b03-9627-985805bd964e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676712207, "uuid": "59409294-bd75-48ac-b847-fa485dc6988f", "value": "c0b1c3fbb46a37c556fad5d2ee13bf38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80f56813-af5d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1676705164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676705164, "uuid": "d31b6385-d9bd-4e31-ba0a-552687f643aa", "comment": "Malware payload (Guildma)", "value": "5871aff0157619a864d337cacecfb1fe", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676705164, "uuid": "c3d77187-27ac-4f99-81b9-47fc7c1d99dd", "comment": "Malware payload (Guildma)", "value": "bdd7f44f8f1a8b962f5eea74b609c06e792bbf9def807bb7b5bcc81d6aef4533", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676705164, "uuid": "8aaa7d31-6442-4034-b781-695e8bcec4e0", "comment": "Malware payload (Guildma)", "value": "314b26f3b5d168381e6b7639757c63e141254ef2", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676705164, "uuid": "25c7d192-6822-4283-b78c-1a279599d217", "comment": "Malware payload (Guildma)", "value": "1f20a256141dd944c4d5ca3262954f9505e1cef336985f594c6baf9baf849c0a431446257104a93ae96f79752aaf8a92", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676705164, "uuid": "5aabbf68-a053-421c-9ce1-8a9e4865b875", "value": "T1E2F0AB4CB2221F61EA3E203B894217550CCC78431F180623A90E0640A5B15C93F0E6F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676705164, "uuid": "3dab89e8-8020-40a8-957d-955ccd6aeecc", "value": "12:8rflM8OBE6ZGxgkmpCQSjdhLkOm/m7BihMb/vyx8ZRpEqLw:8loGxFy8DLkO0m7IhMbXwU0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676705164, "uuid": "ee84a48d-15b5-4b57-8235-0372b0ac7862", "value": 497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676705164, "uuid": "d9c50402-18ef-4c86-93c7-30e17618a8d9", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676705164, "uuid": "e7cb4fa2-eae9-4797-be72-d46a0fa39e0d", "value": "5871aff0157619a864d337cacecfb1fe.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b92c67a3-af68-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptOne)", "timestamp": 1676709983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709983, "uuid": "e64c4cae-8626-404c-b9be-da82e6e9c631", "comment": "Malware payload (CryptOne)", "value": "3c946978783129685732cbac93cc633e", "object_relation": "md5", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709983, "uuid": "54822a77-d1af-4beb-be21-d24892dfd8d5", "comment": "Malware payload (CryptOne)", "value": "be15602eb67ae71bba0dd98c4bca1e9e3afccbf6cc1eb90bed6dda268253be69", "object_relation": "sha256", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709983, "uuid": "e1e76524-d5fd-4457-8604-f62c171b8223", "comment": "Malware payload (CryptOne)", "value": "95ba3d42a0974bea920967d440151b313b764aae", "object_relation": "sha1", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709983, "uuid": "fbe869fe-6663-4a96-942b-1079e19a18d1", "comment": "Malware payload (CryptOne)", "value": "93bfff34886d17c63711090c1b668bc422ff082856efe4c6eff090e033091918ac9ed1442ec8ced6489dd6873f71a020", "object_relation": "sha3-384", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709983, "uuid": "12ca5438-1079-4204-a8cc-d2beef8509d4", "value": "T12E552212BAC55870D57129341EF69A70BA3D7C210B75CEEF63883A5EAD300C1A936B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709983, "uuid": "31504cc8-91a7-4d23-bec2-5e35232209ac", "value": "e92b2275a730f59940462780c383a1b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709983, "uuid": "0c7b9180-cad9-4b8b-977a-4976ba70a544", "value": "24576:VLeTtjJF5HrKPDxICb0yTRZe2xYjQyaSWrXxD0Lj3teRcULiM22n4u3:VLYgPmCIYZe7jQAWrhQrIWKg2nF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676709983, "uuid": "2ae0fa47-bedd-46b6-8ff6-65b1a17f021e", "value": 1359864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676709983, "uuid": "93490c9e-8606-4405-bb02-d8724dd6fdff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709983, "uuid": "e5e08826-6eb7-40b8-9c31-e519fda85cdd", "value": "3c946978783129685732cbac93cc633e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89278264-af59-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676703460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676703460, "uuid": "1e6c664e-1369-4035-b929-2a15ee26f255", "comment": "Malware payload (Amadey)", "value": "eff1ce4e3c7459a8061b91c5b55e0504", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676703460, "uuid": "51a609b6-bb0d-42e6-aa3f-1378f2a63a5e", "comment": "Malware payload (Amadey)", "value": "bfa2c6b2a0303482dd77f02dc34fa0df450f46debd87b8d6a8473ac7889b605a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676703460, "uuid": "d7c8b068-cd8d-41f7-802d-a78a25b9efc7", "comment": "Malware payload (Amadey)", "value": "b790e43dae923d673aadf9e11a4f904a4c44a3f4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676703460, "uuid": "d8bf4fc2-c94e-4adf-a7c7-cd0afb383a1f", "comment": "Malware payload (Amadey)", "value": "16e18c53d82044276a0d77f5dfe6bb654ab35772e9bcedfc0b4700199b1a27b1ac5ef56446ce7e8fe0c982763cb51e58", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676703460, "uuid": "6846d665-67ad-4e8a-9aab-74512b2ab27b", "value": "T188936B1030D2C071D97E55351878EAB68B7DB914CFE08EEF27551A7A8E702D1AE32D3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676703460, "uuid": "f93f1196-9847-444f-af29-5ccac6f096bf", "value": "52982bbab8b9d5eafbb4ec438626f86a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676703460, "uuid": "349573ec-bdc4-4e13-b58b-ddc1cefefefb", "value": "1536:Ho4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJUE5aB89p:HoUCWbBNpplToUs1uNhj25LJUoaB89p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676703460, "uuid": "b07c8ab2-7efe-48c2-94df-ca368ce227e0", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676703460, "uuid": "8a637f47-9b21-4841-ac5a-9bb097324408", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676703460, "uuid": "3665bcba-d3b9-4063-ba24-9dc091897138", "value": "eff1ce4e3c7459a8061b91c5b55e0504", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e36547c4-af8d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676725945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676725945, "uuid": "743b448b-112d-4345-b002-7c673669d9ca", "comment": "Malware payload (RedLineStealer)", "value": "f58472d755f0a5c9eb3a63788140c04e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676725945, "uuid": "8b9be025-2ff3-401a-b1cc-ffc5774f767d", "comment": "Malware payload (RedLineStealer)", "value": "c0c26b9c542cfb2ba3789ca21e62f63cf2064a236ed3c93daa455ab5f3ead2d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676725945, "uuid": "3bb9d429-c2f1-43bf-91d2-a54a882f1422", "comment": "Malware payload (RedLineStealer)", "value": "82199479bb3cfe26f51273a3b449f63872dbfe97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676725945, "uuid": "796bc519-e4c9-48a0-a7fe-8203be797e19", "comment": "Malware payload (RedLineStealer)", "value": "c7a7baca805ba1637ee0d88e33ab6c334d01351ab45507a53487768accdf2674bd6a57c162ffb20163e581cdbcb987a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676725945, "uuid": "77c9efde-d4d9-44f0-bc2b-c6bad0efa40f", "value": "T1C9E4121BF6ECD072D8B0A7B008F71BD317327DA15A348286268E585A08B3B75B635727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676725945, "uuid": "24fc377a-a9f9-44ae-8914-ecfc310ff94b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676725945, "uuid": "2ea89ad6-6d43-40cf-91cf-5b9e41b78498", "value": "12288:xMr8y906QR44qqyWxDXvebl28ioe66mqEQicMxotcoU4M0IuJ5SBCQRtf9P:ly9b4qIDXmbl4oe66jE7cNtc8M0IusCs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676725945, "uuid": "6292bfbb-e2a2-425a-bdfc-073c5952d716", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676725945, "uuid": "4d420cf8-534a-427e-ba86-76948f1329e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676725945, "uuid": "c1bdede0-60bf-4bf4-ab98-4187363402fc", "value": "f58472d755f0a5c9eb3a63788140c04e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36dc5471-afe5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Chaos)", "timestamp": 1676763452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676763452, "uuid": "adbf7c38-03cf-4736-87d9-563b06db2f32", "comment": "Malware payload (Chaos)", "value": "2cc124d89d5b1c74359cce4b39605755", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676763452, "uuid": "046c306f-6fc9-4263-9fc3-37fb890bd563", "comment": "Malware payload (Chaos)", "value": "c16fa75611d1250ca43155621f20929b32e9a6c82a91097c51a6d9248fd32481", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676763452, "uuid": "4c09c3a1-b3b1-4cc0-b52e-82c9fe85c84f", "comment": "Malware payload (Chaos)", "value": "3b5850a9eda313a9396fcf54e9e882c0edfbe14c", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676763452, "uuid": "c4a1ef0a-3f1d-45de-9ac6-dbe0bfed4dd2", "comment": "Malware payload (Chaos)", "value": "15da9451523c892c7979511a3a17dac4986fd1e0b4259614254ee2a0e73abc6192fa37c692a44c615a030042cb3a38c6", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676763452, "uuid": "0b372652-2d80-4635-86a5-8967afd30e09", "value": "T13B32BF1325D5C85AC2687BA4A4CD4D47EEFB02E5271E7D33B81DC9CC4B0A414EE1265F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676763452, "uuid": "a89e2ce1-775b-413b-aeb2-385392a385eb", "value": "192:YiJ9MSihdrgzb7YvInKfA+8Ky9tFVz5KmnghKDewTjL8uRO1pMTQ:59divkfcAnKMKo5AhOP86OX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676763452, "uuid": "a8e8409c-c923-4391-abf0-5e033145c755", "value": 10994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676763452, "uuid": "84a2132d-963a-44c4-a355-90e66ef01aee", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676763452, "uuid": "28c19f23-b247-49ae-a7de-0fdc55eff8e1", "value": "crypt.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f48dae5-af93-11ed-88f6-42010a9c006e", "comment": "Malware payload (BumbleBee)", "timestamp": 1676728220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676728220, "uuid": "0d29fa97-b222-4c64-bd04-9a69ba2fa25a", "comment": "Malware payload (BumbleBee)", "value": "fb98aec6e04559be2d5ff6e1b7dc5260", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676728220, "uuid": "747103d9-0b15-4582-8387-5dcc297177e9", "comment": "Malware payload (BumbleBee)", "value": "c181c20d4efe8312d3d6a4de770febe8f48c92e78a4f7dfa7d011bba58ad8b67", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676728220, "uuid": "d1ebd03c-c1e4-4863-bb1e-c1977d09e00d", "comment": "Malware payload (BumbleBee)", "value": "b83066ae84db1df91ede9fc323ca696085f378f2", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676728220, "uuid": "48032247-ff7a-482e-9d6a-8b691082ecbe", "comment": "Malware payload (BumbleBee)", "value": "4666b275e5b5efc117f480cb060db2fa678158449e454d8dd27413de2b6826d0d2ba18d43fc661b2a00c9ad27e0106cd", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676728220, "uuid": "bb57804c-e605-458b-ac0f-4b779878e7ac", "value": "T15A35F103F76E0B7BC4329A36C8E702C2EB7072A3E712476B465891293D973915E67739", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676728220, "uuid": "d4a28bf1-8495-4ce2-8c1c-fd24c1d416b5", "value": "25b5edb4cd709316692ebfcfaca9f949", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676728220, "uuid": "66f0c1a1-d507-4522-9321-356946b41432", "value": "24576:ZgqqFfeeOby7LSjsfIMLkC8Jsc0Q+8VC7skZ:NqFVLIsActoC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676728220, "uuid": "43bd1eb4-8443-493c-9e4f-74097e55e4e3", "value": 1081344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676728220, "uuid": "2fe9931f-580c-4428-b007-13f80b8bb52e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676728220, "uuid": "ac125288-67d0-4436-b94d-54cd041349ce", "value": "network.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ea23838-af65-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708489, "uuid": "5763d962-62bd-4651-be98-a9e3f8354597", "comment": "Malware payload (RedLineStealer)", "value": "9818b7b1a6d5a01c926d775fa0bc237d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708489, "uuid": "eb10a929-df29-4089-83f6-da5dac135ae1", "comment": "Malware payload (RedLineStealer)", "value": "c2400ff0db9c8705af0225ae397a3c7048717a7857d7a929cc8d80e4668ebe25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708489, "uuid": "3545554c-a8c9-4d5d-9239-f7aa8eba06f2", "comment": "Malware payload (RedLineStealer)", "value": "111edbc4e0a0a6a3071c63a5d97fa8908b9bb269", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708489, "uuid": "b1542a1f-ef29-4c56-9480-8e182a7ff48b", "comment": "Malware payload (RedLineStealer)", "value": "dc01d00fbc3b5bc452d88f77a3bcf8b19a92dbeff6a5dcccca528448b13009fd90e068b53a2d02d8955e7058d83c8f55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708489, "uuid": "9f5a0ef2-62ba-474c-af0f-551aa3861b15", "value": "T16C54021277D2C072E0D7513154A1D5A4FA7BB8631AB485BB3BA4273E1FB02C16E783DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708489, "uuid": "65745015-07f8-4655-a9b9-f80e97d74980", "value": "1189c0a2ecbe8fd35560b095ffebf6bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708489, "uuid": "3f8e6465-40d0-4113-8150-c278e726ff43", "value": "6144:wsnfVMgVRhR1IPE6xRXdfZHSVP/YldBzFOtHWz:wsntTRhR1OvNfZyhg1Fe2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708489, "uuid": "5c9ca512-caff-4aa3-a463-0d73975d032d", "value": 284672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708489, "uuid": "7d181bc4-9f39-473c-b81c-982f53298d48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708489, "uuid": "6cf60a8d-5b3c-4416-aa89-3c917ea47d86", "value": "9818b7b1a6d5a01c926d775fa0bc237d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4430a23a-af69-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676710216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710216, "uuid": "5940d67d-4982-4fcf-adfe-66d566062ebf", "comment": "Malware payload (RedLineStealer)", "value": "eb4cd780c9715a5625d963fec8748a63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710216, "uuid": "b88c61bc-8eca-4073-a5a4-1029e03f4629", "comment": "Malware payload (RedLineStealer)", "value": "c2de600e3712f6ed91496878fa9e0048fa736757282030b8892b58b457157d05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710216, "uuid": "98499126-17ed-4738-827e-7c611345af06", "comment": "Malware payload (RedLineStealer)", "value": "5aaff569b377c24cfa63bd08f9cee858ab694472", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710216, "uuid": "e10a6ba9-1dbd-4b36-aafa-99ddb6721caf", "comment": "Malware payload (RedLineStealer)", "value": "5cbbf44390f81656e46f4d3de1da51badc479f8030a18a6088fc88be3f101f55406fdba4fd083911c477bfc8e77e57ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710216, "uuid": "03d23a39-b4fd-43e2-b30b-4f255303a5e1", "value": "T1C315124BE6E88476E4B06BB01DF707C316727D113779865BA24EAC2E0C734A4B535B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710216, "uuid": "484e0625-4bbe-4757-a25e-d97da3b3fb39", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710216, "uuid": "08e4ff8d-cb93-46a2-8059-4a490b19f80e", "value": "24576:4ypLEjKyRECHOvxdyqbEp/P8sKh8YXyjT8C:/xeKyGCufBbe/eWR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676710216, "uuid": "de00c004-4293-41fa-bde1-201a1cda644c", "value": 955904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676710216, "uuid": "6c9d0493-a7db-44be-b868-2ec080114b0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710216, "uuid": "6de53353-21ba-4be9-a503-8e1bae806bb2", "value": "eb4cd780c9715a5625d963fec8748a63.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c355545d-af67-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676709571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709571, "uuid": "521904f9-335b-4911-a0eb-9282da94ec6e", "comment": "Malware payload (AgentTesla)", "value": "4bcde1b6f4113a255713c091ee311058", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709571, "uuid": "c4e7d4cb-2b77-4779-a27c-62fb973b8d0f", "comment": "Malware payload (AgentTesla)", "value": "c4a313a6d301b83f26b859de2a4254fbaf6b2f0d38ca3f20f1f17c05497d945f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709571, "uuid": "57dbba87-e965-454d-8302-bda4ebd003ec", "comment": "Malware payload (AgentTesla)", "value": "a15da3f2b471bf0c067c17f2d32f91b1528916ac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709571, "uuid": "26d78935-bee5-490c-8045-70d7fe376f41", "comment": "Malware payload (AgentTesla)", "value": "2c48e301c1c18a5d34c58a1feef6df424ac39be506b88a53d4d58591a4cda84af2f64eb4de289a432c831f72054d1ffb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709571, "uuid": "b8d700d4-f56b-41e0-b46c-4b300202f1d2", "value": "T1F7055B9CB1F0F67EC60ACC76AB103D14ABE06553671A8593E263B6D95F3D4638E1C0B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709571, "uuid": "69404302-ce4a-4bb6-8134-52c627cb7a16", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709571, "uuid": "51fda43a-524e-4ea3-bb67-22356a1634cc", "value": "12288:UH7V+ISqDSu/Dsv9t0xzSdHL1J3HOyhVD6JYmJFRkDfbRhyGKJVADsv9tFQawnXY:itSqDSuv4dHLf3ug6JVJvkDths5Xu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676709571, "uuid": "dcde5b94-e1b6-426e-9b44-768e9bf657de", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676709571, "uuid": "b93a438c-5dbd-4b43-828c-10630a1fa8e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709571, "uuid": "a54fb345-d5b2-40b8-a0e4-9f2f61c7c8ed", "value": "4bcde1b6f4113a255713c091ee311058.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb0040d0-af66-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676709127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709127, "uuid": "e50f9e01-bbdc-49c3-b64c-54c1dd68d4de", "comment": "Malware payload (RedLineStealer)", "value": "646aab936745e94d7727666cf5e09a6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709127, "uuid": "e3719884-a307-4cbe-93b3-52173f16f118", "comment": "Malware payload (RedLineStealer)", "value": "c4a7b4f3961973dab3e835f35dd154cf4c71e02ded9f3196420ab5e3b6dd4966", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709127, "uuid": "ca9ee4c3-0e69-4893-a107-b35191723697", "comment": "Malware payload (RedLineStealer)", "value": "d254535f0cbcbb01820f5a10159562de59e487a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709127, "uuid": "be69a22e-e575-444e-be69-03d098f50154", "comment": "Malware payload (RedLineStealer)", "value": "dece50e19789e34249ed7c0214ef4c39479dd795980bec87edc65601d2c9a42565207a855223e256a0507dd52c089b74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709127, "uuid": "227d9e95-5b84-42ae-8e4f-1fbfbf1e056a", "value": "T18AB4020BE7E88132D4A457B058F243D30A367EA05779836B278FBE5A1C72560B63573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709127, "uuid": "0f4f248b-f94b-493b-884e-0f0048b3f562", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709127, "uuid": "02007bac-3930-428b-8774-6ef90f58cd1c", "value": "12288:jMrby90pFSAv+ifix5bbQyEmooqWEN/ymEBsHtid:QyovTTLEBsH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676709127, "uuid": "9a02a1f8-1ec7-4bb1-b882-3152dd48a8d1", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676709127, "uuid": "c0dd9d37-6e0a-487a-9ebe-7085faa1f173", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709127, "uuid": "79b57437-554c-40bc-ba85-1a6aeb02bf59", "value": "646aab936745e94d7727666cf5e09a6c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02b9ce87-af66-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708818, "uuid": "c1938e68-a870-407b-ab51-6957048cb820", "comment": "Malware payload (RedLineStealer)", "value": "2e226593bec05f32575e94fb0048cb3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708818, "uuid": "f64e3e07-01bb-4c00-914c-c27ddc0d9175", "comment": "Malware payload (RedLineStealer)", "value": "c61e47adb5dd3cd4914fb5a59be85e143adada6991b956ef33b5693f4f59c284", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708818, "uuid": "10029e9a-62b6-4c2a-9567-f355aebbc5c4", "comment": "Malware payload (RedLineStealer)", "value": "cb4816fd37138a641f480ce4deb7e6d5153fc55a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708818, "uuid": "36703197-f2b9-431c-9130-a22fb9133a68", "comment": "Malware payload (RedLineStealer)", "value": "8c49b0f142d4361097dd19493f8cb46afd7f3c493d4a0426fba050840d5685d3d21c4a5cb4485b5c5c6a7109fe019830", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708818, "uuid": "7dfd63e9-509e-406d-8dd1-36988da67cd7", "value": "T116B40217E6E88272D8B4277019F503C3063A7E61AB78879B274F6D5E1C722B4763532B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708818, "uuid": "4391e7ce-ef1d-4c33-a6db-92161f759de9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708818, "uuid": "9d7a2e72-daf9-4f22-8a6e-b8002d98acd5", "value": "12288:PMrFy90o2I/Um1AoX7K3eEkejHX95Gih9pXa20XF0SWuAgl:6yjsGAoLCXGKZz0XJtAgl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708818, "uuid": "d818244e-33e6-422c-a2e0-5b5d95d9915d", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708818, "uuid": "f26442ba-a97c-4705-ac87-9daf541bedb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708818, "uuid": "303c73fb-36c4-40ca-9674-0b3d4a29b990", "value": "c61e47adb5dd3cd4914fb5a59be85e143adada6991b95.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f600eeed-af65-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708797, "uuid": "66366864-7832-4da7-be9e-0e50cf51029e", "comment": "Malware payload (RedLineStealer)", "value": "3e00f4d5241a0c2a55fb05cd74ca365b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708797, "uuid": "b73a3c07-dc55-4d5a-b195-6115a25e2b01", "comment": "Malware payload (RedLineStealer)", "value": "c68b078b23cdf835b3fd89d048ba1db522ebad6efaa84e9db2823a711a91d187", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708797, "uuid": "396b5047-aa78-46bb-9934-61acb8edb8e2", "comment": "Malware payload (RedLineStealer)", "value": "dd445f852061a191176a9ff609dbeebb66045b72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708797, "uuid": "25abc5a3-8d52-42d4-a2af-ad675c877fc8", "comment": "Malware payload (RedLineStealer)", "value": "da6c8f17c3366051b9b75bb006ebc16f4726ac5c669b3ccf3121c38d5ee9320535703952f0559e1af38d2806c9498427", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708797, "uuid": "5f1ad20f-8933-4f64-8a58-c4615f6509a9", "value": "T1BAB40207BAEC8023ECB15B7018F647D31A76BE615B798397134E6D591C732A8B23172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708797, "uuid": "58c46d25-db28-486c-8ec0-65595a45f01d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708797, "uuid": "6fb9a26d-f715-4ce7-a5f7-1f9c8863e6ad", "value": "12288:1Mrny90T44r1ledjjns9J+HrWKq8P1SV:6y14pIs9cWKJPwV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708797, "uuid": "72d5d239-bf51-4068-9a5a-9b53bf075620", "value": 528384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708797, "uuid": "72bf3ab7-2117-4aeb-8ae8-abf9ec0cc2b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708797, "uuid": "d0966de4-c95a-48aa-a4f5-fd31f05b16a3", "value": "3e00f4d5241a0c2a55fb05cd74ca365b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c45092c-af64-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708217, "uuid": "719893f3-39c6-4b16-92fe-3022c1f31520", "comment": "Malware payload (RedLineStealer)", "value": "fd475bc8647d22e5bce5c3bad5e5ec06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708217, "uuid": "065c935d-9efd-45b6-831f-aab5d44639d5", "comment": "Malware payload (RedLineStealer)", "value": "c69e55bd35f8f6efbc6d4ca665edf41fab0a60a96a66f7bd022596dc85b612c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708217, "uuid": "0c2ab825-1087-4fc0-9455-e1c299147065", "comment": "Malware payload (RedLineStealer)", "value": "437da1c36ecf0b99e60af3b5d4ded1c1590facb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708217, "uuid": "2d4c5fd7-3db5-49ff-909d-e51d95b870e1", "comment": "Malware payload (RedLineStealer)", "value": "5d733d5151e597071d5dcea06132601d0867748bc65c461b33929e086d73667e44c627211591ebf4b064d9d4b9461c55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708217, "uuid": "4a93467d-422a-43de-bb5b-5ae5c0cc6c70", "value": "T1CBE41287E7FC8072E9B49B7019F352D31A76BDB15A3C8396238EAD4A0871170B635376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708217, "uuid": "6e2bd6dd-e0c5-4ed9-9b88-a025e1e2e852", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708217, "uuid": "1a2f9fc2-cae7-459f-a15e-ce998c780f78", "value": "12288:HMrLy90d+FkVQHd89+eCcrN/4bbo7gKI1xYtaZEi7C22Yqwf9jHVjhntht8dY:MyTeVAo+nY43KDSxGq7CjCjDtf8dY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708217, "uuid": "436e7772-00d5-444b-bc7f-edf5a678293d", "value": 676352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708217, "uuid": "0fe16bcb-14eb-4af5-8fc9-46b5a569e6d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708217, "uuid": "3cc7bf9c-77e4-47c6-a8e9-89d403381f3e", "value": "fd475bc8647d22e5bce5c3bad5e5ec06.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ed82519-af60-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676706369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706369, "uuid": "64f8f5e7-8cbc-4b8c-82ae-967929bdd843", "comment": "Malware payload (SnakeKeylogger)", "value": "4ebdd6b323679a06c5f616d5fec387bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706369, "uuid": "1b838208-b3c6-4e22-9249-ad5122f1c7f0", "comment": "Malware payload (SnakeKeylogger)", "value": "c7fbb44d4bab0581d67b17f37224cc5727db48b14012af00e2fc686ba91046b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706369, "uuid": "dd168773-7cbb-4432-bf21-0eb47e9c2c85", "comment": "Malware payload (SnakeKeylogger)", "value": "b6a08a31a32af701722444b6af4715f1c42384d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706369, "uuid": "2096253a-8528-43c8-ab82-d4df4015c382", "comment": "Malware payload (SnakeKeylogger)", "value": "bebe17d130e50bef9c77674fde6bfd21ccca891caf0ff39deb41156d273a6d289528581b3ab0b3f84467b53b2bc24164", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706369, "uuid": "33b80700-b07a-4e31-af99-73f4cc330200", "value": "T11B243A5A7BE48410E5FF593304B09561CB3AFC521A2ACE1F57D1A52A1F3C690CE1AFA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706369, "uuid": "f0d89cfc-0e1e-4f83-9b66-f4bbcf3a6beb", "value": "12115494f2c86ccfa8a7bf3471dfac33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706369, "uuid": "1925fc78-483c-47ee-bf45-45417196f566", "value": "3072:iqqaM97eOTPiK3DruiiF/XbKjPc18lzAgAEcCv/IgOYrvQ0PQ4b8woGwBWjOvFba:xCteODDmzK5AFyI6tPQ4bhOdba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706369, "uuid": "afeed932-01e7-4875-b3e1-bf085a27607c", "value": 210432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706369, "uuid": "39574a80-1863-4896-b4cd-9101c3fb6b3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706369, "uuid": "b7fa3097-fccd-4bde-95a3-0e770e582ff6", "value": "4ebdd6b323679a06c5f616d5fec387bc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b74015c2-af66-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676709121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709121, "uuid": "1e3b3e47-720f-4bc2-bc10-68442ac7392f", "comment": "Malware payload (RedLineStealer)", "value": "99b0f7e7cda510b54c1a177c8747e583", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709121, "uuid": "c883b308-f5f0-4840-82c1-cac2e3224082", "comment": "Malware payload (RedLineStealer)", "value": "c80206e03b85595d9d0495df023c7f15b4b93dd0b9aae2805d2e2f084f861d7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709121, "uuid": "56ebf235-5387-4a0b-80c1-dd098f447577", "comment": "Malware payload (RedLineStealer)", "value": "fffd55031a3defe1c08d7aabebe76e08a2d8c23d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709121, "uuid": "474894d0-bb6b-4bf8-8b01-4104f670e823", "comment": "Malware payload (RedLineStealer)", "value": "2809d893e4e74e1fc0fb46bbd7b2784e671fa0309852114f557853ab3d40901a828c89f96406dbe91565ec0179fd0c79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709121, "uuid": "a1e947d5-a14c-4c58-8071-2131e1a606cb", "value": "T1D4E41207E7E89022E8B567B05CF607D319367D601A78838B268FAC5A18735B0F636777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709121, "uuid": "73031f95-31a9-46b3-9e59-71f9a7270647", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709121, "uuid": "d7603eae-b4de-40f3-a9e4-e57a57f08855", "value": "12288:WMrTy90sWicVn9jJaG8kkGrbFgluXU60rPAeSi8qqdoyWEEQyN3xn3aB7G:xysVnLPfbpXYtSiRKTE3xnKRG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676709121, "uuid": "a7929da2-3d99-4d62-a203-b2bf2934ff6d", "value": 687104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676709121, "uuid": "c13f6069-3b83-4e6c-8635-c0d79315108a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709121, "uuid": "e235da73-c98f-4c12-af92-c166e3974d29", "value": "99b0f7e7cda510b54c1a177c8747e583.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b19e6ad-af60-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676706443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706443, "uuid": "998f461c-d4f1-4d78-8ff1-0f855644b608", "comment": "Malware payload", "value": "f8f699cce10b965f6ff8f551642b6da3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706443, "uuid": "b35fa767-f455-4ca1-ae25-def764e7a1dd", "comment": "Malware payload", "value": "c83b06f4ed006bfd18bc12c0626fee4f3b34b61139a11bb9c69a537421293128", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706443, "uuid": "ead77eb5-ae9b-4846-bc7b-f6295c821777", "comment": "Malware payload", "value": "ba35430ffa52f6b240a32bd0e4dad3a1282e13b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706443, "uuid": "ff0c39a6-7a5a-4323-9010-65f249b48625", "comment": "Malware payload", "value": "f352fbca223b0d3fe385036923c2ff20d4c9a9b21545e71e0049348d673f57360f159873dedfc1626291fdbb5d2cc930", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706443, "uuid": "0fbac75d-cf85-4068-af17-ed995a2db4ce", "value": "T14DA52313BDD28DB1C5A21D735625AB12A63D7E202F098BFF23C96D6DD9311C0E73126A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706443, "uuid": "309ecce2-6890-45fd-a15f-f6944aab3638", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706443, "uuid": "804eab94-9205-4c61-b577-a992ae963383", "value": "24576:+TbBv5rUlIhUBNth5X/dIfnVFiso0D9Is5drJBZhBw7lf8V7mcT1IigY9/L6PEuA:ABRQTCfV6s13GAOi5tsEu80k1vATGD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706443, "uuid": "4ddec60a-59d5-4257-8740-c347168e5625", "value": 2172073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706443, "uuid": "2731fcb9-60cf-40da-974d-b94c421ac8d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706443, "uuid": "2f94e719-7ef0-4cc1-8a8e-12c6d9c1051f", "value": "f8f699cce10b965f6ff8f551642b6da3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "711576b2-af60-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676706426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706426, "uuid": "51b0d95c-fee3-4409-a6fa-adf09e382001", "comment": "Malware payload (SnakeKeylogger)", "value": "acee7b5c10dee6122522f28bea26cd81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706426, "uuid": "4cd351b0-bd9c-4ba0-8294-17e3afe5cecd", "comment": "Malware payload (SnakeKeylogger)", "value": "c928197d88ec8fcca11cc96cfdaa1721a8df584437b417b4d22938a326dca341", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706426, "uuid": "d2ee7363-69b6-49d9-ac4c-6ebff9a173e2", "comment": "Malware payload (SnakeKeylogger)", "value": "a619f95daf81dadf00565e6070e585df60c10749", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706426, "uuid": "dea3eeb0-0789-4068-ab7d-f6b5af5f93d7", "comment": "Malware payload (SnakeKeylogger)", "value": "41baad713ee3ed5d8e21bfd4578eecc5ab7040730f1d1a57a6ffe34cd9bab4a6bdc836783db5e7f2c0f789ed854c5c38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706426, "uuid": "89a74d0a-b3a2-44f6-b064-4cc435d717f3", "value": "T1F8E47B8C84F1EA3EEA898DBD331436081FE059436B22D5F1E3E5F6C16B36263585D636", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706426, "uuid": "679434d6-ab35-43f8-88e2-be1278766847", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706426, "uuid": "a17186e1-d9eb-4554-9f62-979717f76572", "value": "12288:NqzGPrulhDGs5L9FWYxewSdOfnPl4+eK/qpGeVpLqDSugDs+9t:TOhbzHEOReaVeVJqDSu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706426, "uuid": "1ccb7186-448d-4c8a-a13c-78fc584f7d9e", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706426, "uuid": "4d8f7f77-b68c-400d-8d05-e226d7c718d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706426, "uuid": "afc6c17b-76fe-42dd-af0c-6589e3e76862", "value": "Payment Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01e89cdb-af6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676711823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711823, "uuid": "44e75f9b-e515-43d8-88ce-9b3c2253b2ec", "comment": "Malware payload (RedLineStealer)", "value": "956e5bf4fe303ff44f5ffca04cf0da74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711823, "uuid": "8d118031-a7ef-4c77-ae84-e1e5ec5aa7d7", "comment": "Malware payload (RedLineStealer)", "value": "ca2ad72ab481171c39a14c048e26d4b8cdb6e3229f24f29c25ae3e072f22f1ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711823, "uuid": "afa2a0db-2bd1-45f1-a057-5a640a75cb19", "comment": "Malware payload (RedLineStealer)", "value": "bc232e935df1f7e59690f5859a43f3ec58a80a25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711823, "uuid": "dca2cbb9-cbc7-49f8-bb12-ea4648eec82c", "comment": "Malware payload (RedLineStealer)", "value": "236225968ef2cd67899a865b5a362c609032de897b236e4a98edb5c50508eca6ce6890b981651c7d6d6e2c3c55d68a7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711823, "uuid": "4d23a8ab-f8fe-41c2-b3f2-d047cbc310d6", "value": "T183F41243F7FE8472E5E517B058FB02D31A35BD622A3842FA178F681909B2174B5317AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711823, "uuid": "676be121-8abf-45ac-a26c-54f305022e52", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711823, "uuid": "7c1042f2-c44f-45b1-a409-4a08f8c08826", "value": "12288:TMrIy90Uj4ol3WqNaJxJdzwZ5pNFZd/MrlCkAA2ee7dYcK:7yDj4A8JxvzugraRu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676711823, "uuid": "c8411cd9-3f8f-4d01-8b88-442644f2a37e", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676711823, "uuid": "b748edf5-d98e-4136-9d5a-f2b656f80f69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711823, "uuid": "993b0b9b-251d-4771-a150-2e7825b11b7c", "value": "956e5bf4fe303ff44f5ffca04cf0da74.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3984d35d-af65-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708480, "uuid": "01ac19d6-bff4-474c-8154-934993b4e649", "comment": "Malware payload (RedLineStealer)", "value": "6f01bd53b4e6462efeae549f3604d17a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708480, "uuid": "30cbbbdb-aee7-4f76-abf0-6cd02647ffaf", "comment": "Malware payload (RedLineStealer)", "value": "cac11ccc8fc08bc8cfee45d22a4d5f06f86e963e8711696fa43813d1b77b45fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708480, "uuid": "92ffad28-85b6-44d2-b1a1-21635f755b19", "comment": "Malware payload (RedLineStealer)", "value": "9f5a6f3c6863a51a36becb14c55b212532cac5b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708480, "uuid": "df294eb7-13c0-499d-aab4-6233cff47678", "comment": "Malware payload (RedLineStealer)", "value": "6d6b9b0b8bfe4ae0c11c514df6b481660ed17daed55c7919309e9bf7aec32056326ea7a0a3a3cd1994b51537b3efe8cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708480, "uuid": "10829aef-115f-4643-86cb-554ad4aad0d1", "value": "T145B4024BF6EC9021ECB5673019F702C30631BD709B38836B679E6C6A1CB2664663577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708480, "uuid": "a759c949-4799-4f52-8f95-86f73e484c84", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708480, "uuid": "5d5d0f93-197c-435d-bd50-2c8909ec9627", "value": "12288:fMrLy90qpi9l+MwAsMCpnkl0bKNGD27YJY0gkntw:cyhpi9lZwAInkWbKNGDuOtw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708480, "uuid": "16d1855a-b5f0-4662-8af4-54c6583dbab5", "value": 527872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708480, "uuid": "d450a422-3386-406b-859f-39adc5d6a8f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708480, "uuid": "9d1eabed-c17c-4a43-9203-79edaa6fad9c", "value": "6f01bd53b4e6462efeae549f3604d17a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9ccc641-afd7-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676757658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676757658, "uuid": "5a5f3372-c144-4206-a1d2-884b0e5d6773", "comment": "Malware payload (RedLineStealer)", "value": "5c87fe9e1b5635fc09a8eccab26d541c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676757658, "uuid": "623de49c-758b-4f11-8d5e-5ef0ef213537", "comment": "Malware payload (RedLineStealer)", "value": "cb718fdef9f0bb0e6f2955b6344a32dcf268ce4816ecd86aef74ba92cfa4c2c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676757658, "uuid": "d1d35835-14fd-4311-a5d7-3a5e49ed1381", "comment": "Malware payload (RedLineStealer)", "value": "b22e68213313ea41de785ed808a4dacacafba208", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676757658, "uuid": "55efe194-6fbd-4d9b-a7de-e66cb2fad691", "comment": "Malware payload (RedLineStealer)", "value": "d010e33fd93d1f1528967417e30daefab647bf7ae44f66c200a87f3921693bffffeeab3077f9ee64d7e209b4a6fcac97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676757658, "uuid": "e88fe191-222d-4d60-ae0b-d6e2750d7b64", "value": "T199F41207F7EC5023E8755B7028F742C30A367E519B3852AF164EAD564C73AB4AA3172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676757658, "uuid": "2e32b96a-5bc6-4013-bc79-f1c5fa5357a7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676757658, "uuid": "e4bb71d1-2964-40aa-85c8-b920545df0d4", "value": "12288:PMrTy902hcCjxs9VuPzR8hXFkDLw0uj/3KwZ4gPABLdg9mG68RDJWrW8JE3H76tG:Mytjxs9VuPzR8h1kwIwZxPAgmG6+MrWR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676757658, "uuid": "6b577460-c222-4b8d-a004-b865d3a3a7ee", "value": 764928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676757658, "uuid": "1f982675-4a06-47ae-848b-42b22a861b66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676757658, "uuid": "42cdd0e2-33a9-42da-bb94-6abf625001bd", "value": "5c87fe9e1b5635fc09a8eccab26d541c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd125c40-af65-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708809, "uuid": "424d549e-1f4c-437c-9ca4-0476bdaf0d77", "comment": "Malware payload (RedLineStealer)", "value": "80c7b12c006187d5386669fb18d374a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708809, "uuid": "02bfe9c3-e2ac-48fa-887c-68eb5ec6780e", "comment": "Malware payload (RedLineStealer)", "value": "cbc43f8eecdd9a3f63a4397b87d299280335306f23fcbc4abd457d78ccf37cd9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708809, "uuid": "320025ff-5597-4f95-927a-babc0e512e9b", "comment": "Malware payload (RedLineStealer)", "value": "df603142d10964faf90cc32c692b396687ab5e80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708809, "uuid": "551d7aaf-b8e4-4f33-975a-8cb0f1f99e72", "comment": "Malware payload (RedLineStealer)", "value": "b16ad4b86731d03b2fee1af1c98ce935fb97927097b1d9709f373c522cf22540c9b6e2adc2c84dffb0a3c96a49019735", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708809, "uuid": "feee28b1-c27e-40f9-878a-7ea8cbc69070", "value": "T191E53383B3FCC02ED8A997749EFE20A31D38F9105674C64B750F6CEA59B60E26519336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708809, "uuid": "828e9a3a-d4cb-48df-8619-1ae5149c1d9f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708809, "uuid": "0384cba9-79d6-453e-8df1-02057af7571c", "value": "49152:1czM9ROGsIE72/ZSf9NnzQFh3eVyZQZa64bfq3unZXIvhU3hW9tr1bw37RUpt91:pEhzIAFNnzQ/uVyH6uvXXhWZbwLWt9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708809, "uuid": "ae053a16-032b-47f9-b155-a426a79cf76b", "value": 3113984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708809, "uuid": "4fdffe1c-fca9-454f-892c-6cfea0899470", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708809, "uuid": "3da07f99-a9c8-42a3-a779-0dcaeb9f91ca", "value": "80c7b12c006187d5386669fb18d374a1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23b4a917-af69-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676710162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710162, "uuid": "1f67f6a9-bb96-4bb2-ad65-4e3713e0670d", "comment": "Malware payload", "value": "2a4bc433dcd5168759e8a60a0e0117e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710162, "uuid": "5fe0fbe3-34a0-457f-98fc-8b88d784adfd", "comment": "Malware payload", "value": "cce0bbfcb040009fcac3347a851403fb736794034bdb1756b48d09b61b8b3c14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710162, "uuid": "0639d41c-01d3-49cd-858f-8bc89fffbb0d", "comment": "Malware payload", "value": "61d7ff5aabc7a9056d09a3bce0d9734be6401a65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710162, "uuid": "9963dfd0-df93-436f-8b77-0a82440cd582", "comment": "Malware payload", "value": "be6a638b2ee89c936510862ccea70d2e66c93dbf9246382f27a43564c19aae03b97e70e8f08cca6eba44ad7e00073592", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710162, "uuid": "d538dc12-c6e8-44a1-a0a4-181c086e97e9", "value": "T1DC856B21744848A6C7131E32BE59F57DF2AC527003B904EF53A6AE107E67983B728D6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710162, "uuid": "4c44f871-3196-491d-a0d5-c088ae1acf22", "value": "49152:ZgfYCj3AI5NFMIuxuMWIdMtiZZi/r+Kz3+ULkNVAjbOPe:ZgfYCLAUHwuMbis3i/fz3+ULkNGjbOPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676710162, "uuid": "064d7b01-9c62-44f0-b59c-d708080ae0eb", "value": 1750077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676710162, "uuid": "82e51cef-0b01-4812-8f4d-e505df8cf5ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710162, "uuid": "e88eff02-d471-4c6e-a434-562fc8930a29", "value": "2a4bc433dcd5168759e8a60a0e0117e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a104129-af64-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708213, "uuid": "c6c56de9-64ed-43c0-ba0f-eb4d336d45da", "comment": "Malware payload (RedLineStealer)", "value": "f8b11342c7791561dc1c56244542cfc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708213, "uuid": "e44362c9-1f50-4868-989e-5e1ef8c9659e", "comment": "Malware payload (RedLineStealer)", "value": "cd3c049af0d0c0ba468db6e9545755483f9355fbce0affd6afb955dd3889dc34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708213, "uuid": "41a75e84-cdbd-4b2f-9897-d741af15bfc8", "comment": "Malware payload (RedLineStealer)", "value": "70aed8b5f0d5571f79ac7f5ec5727671680e134a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708213, "uuid": "a8ac6f54-d2e9-43e0-afc3-b42f0737ab72", "comment": "Malware payload (RedLineStealer)", "value": "d058e5155e88c52a49a134111c35e55edde14d688979331a21caf8a114f8d644cf349d8b635c7c6553119de052a2bc61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708213, "uuid": "f5f944b1-4ddd-4ab3-baa0-7f1f66195efd", "value": "T1A2E41247F3E88063E878177418F607C30A36BDA15A788297778EAD6F0873661967137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708213, "uuid": "45210e55-af48-43d3-893b-08705810a4c8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708213, "uuid": "d097d4e9-9602-4f84-9b1c-4a8ccb26d430", "value": "12288:JMrXy9007b+vvFmdnFeG9hPiJaVUvoLWpfzCYtsZEJoX2AYKDcsNWcrJpmw:myvblNFBhPiJa9WNzCGPoXt0sNdX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708213, "uuid": "86e28663-f5be-4a20-9dde-491a134108a8", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708213, "uuid": "11a057d7-9705-4427-a5f0-52c6f4f27897", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708213, "uuid": "3da25d23-2ede-4f11-9ece-a4c55043fa76", "value": "f8b11342c7791561dc1c56244542cfc5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "391c01cd-af42-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1676693447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676693447, "uuid": "b1e25329-ff8b-463b-960f-0b339ad543d1", "comment": "Malware payload (AveMariaRAT)", "value": "90020ac38b717cfc0325690e36d6ed1c", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676693447, "uuid": "dce16a31-a232-43a7-95f7-fd3a99d09c98", "comment": "Malware payload (AveMariaRAT)", "value": "ce810345b5e3d5641b2ee88ce17e6f2ddd04995739306d85b18ab0f20f662399", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676693447, "uuid": "b195fde7-27a1-4427-a66f-8afeae1e02dd", "comment": "Malware payload (AveMariaRAT)", "value": "87d7f64cb4b03b49e7d7bd8174cdbceadb77dccd", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676693447, "uuid": "bf60a980-d78b-4615-b81b-026eaa64a0b1", "comment": "Malware payload (AveMariaRAT)", "value": "4563d77c9a7ba6bbca0d338e867ff89a0bedcc0db5ad19228a336421ecdcdfdac3217b1eb8a03613cf9228ae15d2469a", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676693447, "uuid": "ac0b021d-bdfe-47d3-99a6-fb1156cd9430", "value": "T1B8D4A22AC9BA17E7C139F16282A54824F8ED8553331FCD5AADD317D50F81600AFCA9ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676693447, "uuid": "8ce35ad1-1f31-4bd4-999a-f8546b4b26f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676693447, "uuid": "54204539-a0cb-4d47-a3ff-2734ef5ead9d", "value": "12288:Afl+BTQiOyemi1bFsOX6NTnrtOXA+/0Chjx/b1k0rpTd2aJ:Afl+BkjsOX6NTnrtOXA+/0Ch51k090Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676693447, "uuid": "43cd7f32-1fa3-4f67-bcde-626770c4f357", "value": 648704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676693447, "uuid": "7931cc6c-2006-49d9-8cf2-37ceef9ba33a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676693447, "uuid": "af71b952-b773-4fe1-a97f-10ad56c92381", "value": "90020ac38b717cfc0325690e36d6ed1c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3583bb1f-afa7-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676736821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736821, "uuid": "b090f47d-ac11-4442-ba74-37622f1a7958", "comment": "Malware payload (AgentTesla)", "value": "88d1527458742f7e2c88b92bc6fd2453", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736821, "uuid": "f170dc1c-3603-47fd-9534-f80c4570981a", "comment": "Malware payload (AgentTesla)", "value": "cf8abe8ee8e73685dbb96495d8c3428f70537febddc5ae97af55a203ec4772bc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736821, "uuid": "c831c39a-7002-444a-a65a-2cb4c0b882c8", "comment": "Malware payload (AgentTesla)", "value": "c79f6afca8f7d390b73f5dadf4718a66ca1f7e32", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736821, "uuid": "ac74ee63-ef0b-4216-bdeb-b11f89f6ed67", "comment": "Malware payload (AgentTesla)", "value": "d55680b4a02802fbe2b45701d32f4f557d4c5a62a355c5cdd4dee82bfdd9cf374fb3114ca1ebf0f4220f843ee8c17717", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736821, "uuid": "a5eeae5d-5ff0-47f5-a96d-bb4715c15cf7", "value": "T106E49CCC81F2EA3ECB498EB9370035081BE05643B924D9E6E3E5FAC22F36563599D535", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736821, "uuid": "7c88d1e2-979e-466a-8235-24324c099388", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736821, "uuid": "952b2ec3-0f39-4036-9f02-5ce465fb78a0", "value": "12288:KxucqDSu5Dsv9t5WH4sustv6A/uEHf+65ueQ5+Rp01D+GQUwwFDsv9t:KucqDSu0O4sRz/18eQ5YqDPQU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676736821, "uuid": "d614f65d-89a5-4e8d-b9f3-83b40a3d3947", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676736821, "uuid": "33b07ef9-12ec-4c58-b447-868d361036c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736821, "uuid": "03094ba8-ca52-42fb-bf2c-af1ed0239cba", "value": "Copia de remesa_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dfe9872-af8d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676725668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676725668, "uuid": "e1d8c3f6-a504-49df-9e89-a31a75c6db54", "comment": "Malware payload (RedLineStealer)", "value": "25eddfc6ffaad368c0d7150ae07b86ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676725668, "uuid": "a9370fc9-2eec-4e94-8b0b-401b330dc4ab", "comment": "Malware payload (RedLineStealer)", "value": "cfbe3d196180b4414a2041378aaa59b626f6d6acde5caef78176896f0636dee1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676725668, "uuid": "471e21ca-bed2-4686-a231-d83824fadbc2", "comment": "Malware payload (RedLineStealer)", "value": "3f12e3473c66a6afa7e65fc8ba20cb53dab7ed3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676725668, "uuid": "2e5ea759-6a83-437f-88e4-3b81e76e371c", "comment": "Malware payload (RedLineStealer)", "value": "c6f18254324ce63c576293a4fc3bb60d1a4891317a604dc67124aef8ede9ac3ac5d6e58bbc06ecf1b1642b02d8c32704", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676725668, "uuid": "d8fd363e-e3d7-4bbf-9104-7446fdc85944", "value": "T1D1E4124BA6E89032E97167B009F7039319367EB05B39831A274E2C5A4973AB4F771377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676725668, "uuid": "baa8ef26-babd-40db-bc50-305320100d80", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676725668, "uuid": "0ff7b687-10b1-4fb2-a00b-ffa7c6231af4", "value": "12288:tMrZy90JToy0QWXDPg7Pfpul5Skm3yqWK5n42WM0tuqERlrDDgP9M1v:Iy+sfQWXkjfwXHmiVK9qM0tu7RxDMP94", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676725668, "uuid": "a3c1ea8b-ec53-4f6e-ba85-bc20580bf04e", "value": 722432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676725668, "uuid": "04ad63e2-325b-4445-a10b-78d1f90fc39b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676725668, "uuid": "83e24b3a-317a-40cc-b33e-64279e905f74", "value": "25eddfc6ffaad368c0d7150ae07b86ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6c7a09f-af69-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676710382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710382, "uuid": "39c95e9e-441e-4288-940e-a6a7055c17db", "comment": "Malware payload (Loki)", "value": "732068aa68ecb78d18963af823668637", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710382, "uuid": "3352ef0a-f089-40a5-b001-efe7d0898164", "comment": "Malware payload (Loki)", "value": "d01d4d39fc024afaa3f2f512b0be98db7e00079eeb40ff206ac0bc8f015a74ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710382, "uuid": "ec25a7ab-a5cc-4440-b46b-93ee247ea60b", "comment": "Malware payload (Loki)", "value": "04246b3eab3dff62e4eaaf03c9f9d397d68428c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710382, "uuid": "62457a33-ba6d-4a13-ae9a-556616016406", "comment": "Malware payload (Loki)", "value": "4c77ff424193828f5218cd0006a168146f0d46e2ad6566f5200b68871481a52e7aeb7e99a2323897c557e86db55a6d45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710382, "uuid": "84ace799-b513-426f-a9aa-35e9cfc32312", "value": "T145D48CDC91F1EA3ECB498EB9371031081FE056437920DAE6E3A5FAC26F3652319AD535", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710382, "uuid": "fe50c67a-bf10-4708-87fa-98dcf900452d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710382, "uuid": "9660a227-81cb-42d6-bab9-605b42475cba", "value": "12288:TRwqDSuNDsv9tWJCZ0KRhzazCNgOBan85klF5M+H3KzJLDsv9t:TRwqDSuPJCZ7/+zCiOcCkOY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676710382, "uuid": "8288bdc4-23e0-4921-aed7-c65a54b72d10", "value": 627200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676710382, "uuid": "0ce778a1-93de-4600-ae0a-0df4a57535f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710382, "uuid": "7bcc17e7-576d-4ab4-87d2-a5c0e6693334", "value": "732068aa68ecb78d18963af823668637.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8818fd8a-af60-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676706465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706465, "uuid": "ade3e2fd-ae28-45e3-b481-d6bbb1c5e30c", "comment": "Malware payload (Smoke Loader)", "value": "d8b7511172b547f03239787dfa421b0c", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706465, "uuid": "d008375b-3557-4562-95b3-beb68a740e1a", "comment": "Malware payload (Smoke Loader)", "value": "d17f888c333bda95a3ced58ab0abc8b3a238bca5035855afaf3a2d7dfc977312", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706465, "uuid": "98c7f979-b397-4f4a-aec0-84d08c533cd6", "comment": "Malware payload (Smoke Loader)", "value": "60d2d2532f7c2ebc404667246c7bfde70a0c22cc", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706465, "uuid": "9cc41c02-38ad-4fa9-8cb4-67b7fde36125", "comment": "Malware payload (Smoke Loader)", "value": "09a8fc3358bdf6be798a3c63dd5ffec5b7792fd10a31d4675d4307805597a7d3e9b378c8b7d759107c5b06c3892b87e0", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706465, "uuid": "8974c721-6bdc-4ce2-b0b5-c2760f0a0f32", "value": "T159446C13A2A17C55D9164B729E1EC7E8761EF6A04FC9776E321C9A3F0AB01B2C363711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706465, "uuid": "4a6593d5-e063-4310-be68-c9863d34bc17", "value": "84dc6e6219363c02153241783e4708b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706465, "uuid": "e8e5e940-39f2-41f8-94be-586b1f592413", "value": "3072:vZpOeLD5USHym5urlTJM+UI9Ghqo1PIpmM82Mn6RISZ7QKf18JHPVYAy8E:BHLFHQrDtUxk2QSnBSZUKfyJHhJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706465, "uuid": "2958b0ed-a4d7-4fb3-b43c-f6b4cdeacc4b", "value": 259584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706465, "uuid": "0b76ffaf-4214-4ffa-bd0f-bdc814bf53a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706465, "uuid": "d4c247c2-cbc1-4f28-81f5-11f225516edd", "value": "d8b7511172b547f03239787dfa421b0c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b760f54f-af64-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708262, "uuid": "be33e29b-3872-48d8-a7e4-c8518c1acb13", "comment": "Malware payload (RedLineStealer)", "value": "215b92884492d0aa9eeb57d353a4bad7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708262, "uuid": "79c1b77e-6352-4531-8dda-e0a12ddc3916", "comment": "Malware payload (RedLineStealer)", "value": "d26b5010f02df1a64d66e57ba2cbf0ec9334b9c07fde67fbfd6a6841136185f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708262, "uuid": "3245492a-a56b-4736-ab9e-b5f3145a8efd", "comment": "Malware payload (RedLineStealer)", "value": "79d16aa850ce0110d3a3041fd0fdf7da6f18d42d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708262, "uuid": "346c1483-6ae9-4af6-b2d7-a1586c500802", "comment": "Malware payload (RedLineStealer)", "value": "665d86cadefb070d26d691880003904ea92931b99ae2b835bef9575ff1d6f0adf2d9b1fe8ce30d7b9b2bd1afb03c96b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708262, "uuid": "faf926b7-2ff5-4c60-8cab-50a4c4943aac", "value": "T146E41203F7F85423E9B55B7569F602D32E377D521E38926B235B8C1A08B19B0A5313BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708262, "uuid": "a0fe450d-0c99-4336-9716-3ac1776dede3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708262, "uuid": "8102a662-5ce2-4d23-8922-86ec383bee2d", "value": "12288:HMrDy90oAV2M6zVvD2lM1yz4ZCBOs2NIE2G+j1Ugyv7:kywV2vVSlMeACBOI1Gd5v7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708262, "uuid": "6aa52f49-1a74-460c-9801-3b63f168adbf", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708262, "uuid": "5ced8e13-0f91-42d9-af22-b6afa27cdf86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708262, "uuid": "d819499e-6c52-4ee6-b58e-24c290dcdb67", "value": "215b92884492d0aa9eeb57d353a4bad7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50a8bfd2-af60-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676706372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706372, "uuid": "b98ecbc2-ba05-4962-8236-9811be92a78d", "comment": "Malware payload (SnakeKeylogger)", "value": "a5fe5bad3f1377c078698077e4783f07", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706372, "uuid": "a9e96944-9475-49d2-ab81-1cbcf3bd8fb9", "comment": "Malware payload (SnakeKeylogger)", "value": "d2c1dc0832f21d13b47193d5521a124b87026422e11bb0f99ee8d07a9f16be50", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706372, "uuid": "32e8393a-149f-4cb6-9667-77e2fe744f77", "comment": "Malware payload (SnakeKeylogger)", "value": "4d66630bf545a26f212b0b5183e9f0ca7fa7a1a7", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706372, "uuid": "ac770c46-b95b-4c62-9221-98d651ede27c", "comment": "Malware payload (SnakeKeylogger)", "value": "751da90c8389aab4238fa8cd842cac248d4ca8ba60b3fd81e56ff31ccade85efc41a8d351df0cc63875ab9f7dec6f869", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706372, "uuid": "d17c7d82-9531-4a17-a882-1d84a91e6d80", "value": "T1F56402A3BE80818BD81506362E7F8D115E37BF256D4A760F6700FB1E3A773C16A0A791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706372, "uuid": "a2e901e9-6201-45e2-9b72-6c3638084c5f", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706372, "uuid": "1ead0138-df4e-46be-9abf-6a3f9bdb58c2", "value": "6144:MYa6qjAcu/FV7hgx90DVZiCrq4a8F/NTTlQTER8USLaXXw8jhh3:MYAjAcu/FV7bTiYq4a8FVThM0hh3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706372, "uuid": "7ffc8761-17fa-45f4-939e-9d8e2ae35cc7", "value": 331393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706372, "uuid": "948ef6a3-141d-4c23-9f5a-c964c5910a5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706372, "uuid": "54bfcbd9-7fcd-4f9c-b7b9-109174eb3ad8", "value": "DHL_WayBill_35009389000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03120610-af6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676711825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711825, "uuid": "66ceb93c-a24e-47c6-9b51-3ac78f68933a", "comment": "Malware payload (RedLineStealer)", "value": "891083ace14e5355ff9aeb28e3e29e2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711825, "uuid": "fefcbf52-05ec-4904-9855-5048054a7cd8", "comment": "Malware payload (RedLineStealer)", "value": "d35ebd2fd680891b7ce4268c5606b28b7f092f190bd7c1f722f159b30a4c5ff4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711825, "uuid": "e5b36767-130a-4b41-924c-0e093bf76323", "comment": "Malware payload (RedLineStealer)", "value": "fd254f114df658267eb00fe4381ba0073b30a2f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711825, "uuid": "3838bce2-4dcd-487e-a495-d366d22866f9", "comment": "Malware payload (RedLineStealer)", "value": "01af58b9c081fe447b6b07070c09db73083b4e155dbe95c51e9bc2ef0e4881c7368467a5dad247bb8f217bac62ac8a9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711825, "uuid": "6378605d-31ac-46e5-b8b2-ed2d954f2343", "value": "T157B40207BBFD9432E5A2977018F643C319367E914A38839A27CEAD4E0C735A0B53576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711825, "uuid": "2ca9115c-1bf2-4e17-bc5c-466df0ac3e66", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711825, "uuid": "9cfc2da8-6629-4661-a1c8-779922839009", "value": "12288:vMrFy90uT0V0OEKWNoEh08N7ZyhO16V+9:my2VLEKtCt16U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676711825, "uuid": "b7ef479e-a01a-48a5-8255-b0a52740f54e", "value": 539136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676711825, "uuid": "023a1702-d690-4f0b-9667-1487831593a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711825, "uuid": "55673d1d-6c9b-4b2a-87a9-a3563891aa50", "value": "d35ebd2fd680891b7ce4268c5606b28b7f092f190bd7c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "920d2089-af64-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708200, "uuid": "87475906-66f3-4cb4-b50d-c9147f83fa5d", "comment": "Malware payload (RedLineStealer)", "value": "744b04cc4a2bf5d8755a8f094f69bd48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708200, "uuid": "08e71dfe-b09d-4fa1-bf23-6fb91b6c5692", "comment": "Malware payload (RedLineStealer)", "value": "d3cb7ec0a3ad5abe44e87d36243bbe2c15e544f6a0c6d94f928897351e7fb9e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708200, "uuid": "4501d890-0c99-4ea3-9315-42bc8965be7d", "comment": "Malware payload (RedLineStealer)", "value": "b336dc8d9254828a130ed29a38f079fce8d449c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708200, "uuid": "394568bb-91f3-4a9d-898f-9c405cfa34f4", "comment": "Malware payload (RedLineStealer)", "value": "2856415f2bf626a8678b7e5def77f936ba918b1ed462e3defc50be4e6d56f5c6df36b45614d53799e2b40151ae59fc39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708200, "uuid": "b707f106-6040-4e81-b2f3-da692d0a095e", "value": "T1FAB40107F7FD8021E4B6577028F302D31636BD912A79C39A234EAC5A0D726B46A3537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708200, "uuid": "775f900d-9fd8-4649-b8ba-f04bc51a8b17", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708200, "uuid": "6dfb5116-0d7f-4afe-a1a5-57fdc167abee", "value": "12288:LMrWy90DvuVAjpOD9mpKN6Zy5j1sG/2UV5RC:5ybVAMDM01sPUV5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708200, "uuid": "cd057208-b8bd-4d2d-bd31-aee76ecc18ca", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708200, "uuid": "0cfea6dd-1861-41eb-803e-00f77897e832", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708200, "uuid": "46f71b04-5f2d-4f04-893c-2edce0fb1f1b", "value": "744b04cc4a2bf5d8755a8f094f69bd48.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe438194-af65-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708811, "uuid": "b17cf542-e31c-4235-8258-c5c065d3f082", "comment": "Malware payload (RedLineStealer)", "value": "d23a570898f59669b4a4786e4a6e03b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708811, "uuid": "c45d7109-d673-4e4b-8138-66c5977c4aa6", "comment": "Malware payload (RedLineStealer)", "value": "d5009a93bdbfcf3f4475a634cba5d2452add0959e31d51d75c238a06c5d1ad53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708811, "uuid": "a29d3cdb-45a5-41e8-864f-01390b16423d", "comment": "Malware payload (RedLineStealer)", "value": "343261d104cb493c2e3aa587a75cb0e9b2fa20cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708811, "uuid": "50b44680-d8a5-4862-b750-986b0e5cb32e", "comment": "Malware payload (RedLineStealer)", "value": "b66606f7598e9dfd582d456679c378b314733f7bee4770dd730b8b4a25afa5a027a055b55dcde2239b3cd2e260744b1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708811, "uuid": "6986050f-9342-45fd-9318-bebd23718aee", "value": "T195E53313AEF86023C9E15B300EB517D315357D666B7C461A3B8F596E3B92121BBB03B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708811, "uuid": "f8766e0c-2444-415d-95bc-6a514bc59310", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708811, "uuid": "acabbca4-cda7-4873-90dc-2b7d40cd04ab", "value": "49152:+tpj4UedtSL1WcncE87OWirjvkdjxJk5rGIrpL2NWMWJi8keAgzzlrB5919XkjlY:CpjBedtSL17D8yWWjstxENjMtIp5VYtB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708811, "uuid": "2634fd20-064a-40e3-b0c3-f02aa081f702", "value": 3110912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708811, "uuid": "7aaf71e6-4c4d-4b88-90f3-06e5b96c923c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708811, "uuid": "d9761aaa-52e3-4355-89bc-37f3a79e3638", "value": "d23a570898f59669b4a4786e4a6e03b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d51c5a1-af67-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676709292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709292, "uuid": "cd036548-a730-4040-bed3-558f93dad35e", "comment": "Malware payload (AgentTesla)", "value": "d5c73e724c39bedafd9c0d3e36d8b914", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709292, "uuid": "771156cb-9fae-42b4-b62e-3ed32e218748", "comment": "Malware payload (AgentTesla)", "value": "d501f6fe659d055290dcaac1a548b51c36a1ecdf3b61d781761441c510b99471", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709292, "uuid": "09d94807-1f7d-4026-94c5-04ec2ce7b174", "comment": "Malware payload (AgentTesla)", "value": "eb84562d233750f9b728a45a96af88a204942557", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709292, "uuid": "3dc080b0-f5e1-47e0-86b2-f1f335e74ae4", "comment": "Malware payload (AgentTesla)", "value": "0c84afe039e8ef4ff9b57b4d7ff6bef0651235058a791fbe50207eda34d5c57efd26f1a3d9e7f286e9b3acfe95046551", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709292, "uuid": "da83e8ba-ffde-4d89-82d7-9448a796ac32", "value": "T167E48D9C91F0FB3EC949CEFA731036081BF452033925D6E9C7A6F2C51B36762199DA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709292, "uuid": "f778102a-a070-4c70-91f6-ce88dc18e2a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709292, "uuid": "7ab453a8-1c14-49d7-a409-f38b2e594e66", "value": "12288:qTO0WfqDSu0vhvoxODtKI56RXvHv8sOTCY:eO0WfqDSuEhzJe/HvZOeY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676709292, "uuid": "b2bf2281-77a5-4bd3-bbf9-a7bb633bf4bc", "value": 700928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676709292, "uuid": "c4d5e851-5f9a-4b64-8e44-68c5f6a910b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709292, "uuid": "288ccc32-82b0-438d-96bb-39f3dc94a5ab", "value": "d5c73e724c39bedafd9c0d3e36d8b914", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbe21cfe-af65-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708807, "uuid": "c5913d73-b2a6-45cb-ac41-90792915d83b", "comment": "Malware payload (RedLineStealer)", "value": "8b850fe8fbadbf20c44c1759137bc867", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708807, "uuid": "ed8a3111-7748-4030-9d97-929ac2d9c90a", "comment": "Malware payload (RedLineStealer)", "value": "d51b529b848157008ae7495b156b6a47462e98d3b2e77354cb15768c63ef3ff7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708807, "uuid": "1fceea11-338d-48d8-a124-56e0774c90d8", "comment": "Malware payload (RedLineStealer)", "value": "deff4ba584928fd7cd29b12c480c190d93bbf730", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708807, "uuid": "0ead4430-eab1-4090-b56e-b6578a612569", "comment": "Malware payload (RedLineStealer)", "value": "f51df4c3801405b5ec4baa036c9440250c410ae81f523158b7d129412b4d01c36d21e98ea33d954813e3b9b2ef37deac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708807, "uuid": "924b2505-ed5e-4ce2-b728-cf61dda2e3f1", "value": "T154B40207F7EC4432D9B517B40AF746C31A357D905A38879B628F6C5E1CB2AA0B63136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708807, "uuid": "d77084e7-ad95-4850-9796-11016a74fd16", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708807, "uuid": "6b055aa4-1542-4df0-a647-4b41a5da9aaa", "value": "12288:7Mr1y90rgS3pVaaDldGy7UAd4mB82lqdvaXx1Nuo0E:yyegS5Vfn4INBvl+vQbF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708807, "uuid": "0de1e9a5-e875-4660-84a2-3d08e2316de7", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708807, "uuid": "95a6698e-b96c-4ea5-ac6b-1a4cdbfbf3e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708807, "uuid": "f013dc8c-933e-4aea-8597-9e0299c74654", "value": "8b850fe8fbadbf20c44c1759137bc867.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03cf5355-af66-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708820, "uuid": "38bbdc59-6425-4e48-9d40-ff50ea8b9582", "comment": "Malware payload (RedLineStealer)", "value": "ba9888b285eab7c711b27b99ab1ba415", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708820, "uuid": "90911d45-45b5-4227-a04a-a7c9167c3a9d", "comment": "Malware payload (RedLineStealer)", "value": "d5c35c8ed9e5215266859bef02c9de1aaf2f68b610690206e66912ac356eef45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708820, "uuid": "3f103e11-eef9-4022-92a6-ebcd684ae056", "comment": "Malware payload (RedLineStealer)", "value": "548e5b9d5be8a1f560b33d247bf64b717dc4037a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708820, "uuid": "23d893d5-d2bb-4ec5-8e52-7bd5be8859a7", "comment": "Malware payload (RedLineStealer)", "value": "165ccfe36ee6c092553fc3ba1ae6f6cef844c43f851f06e8a0e34f8de4d641581ccd365b5dd3355a752b13857c9cd7b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708820, "uuid": "59ff5fb5-cca8-48d3-b2f8-dbc0ce09b530", "value": "T125B4020B9BF85033E8B467301CF306C31E36BE619B74879B274F6D960872560A67676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708820, "uuid": "e30dbb5c-5aba-4904-b12b-276ccfc20f74", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708820, "uuid": "41943198-81cb-4043-94bc-81a201ed68bf", "value": "12288:nMrUy90VdMmzpJJ2mBKhrw6KXVtHEBAn9TJP:TyWBbJ2cKCXVF1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708820, "uuid": "92bf5e55-2f8f-4b7c-a2e3-f68ed5fcfce0", "value": 528384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708820, "uuid": "7a033630-efe7-4b70-abdd-928fdc6683b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708820, "uuid": "fe91874b-2449-4ff9-92e1-5b61290345fa", "value": "ba9888b285eab7c711b27b99ab1ba415.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c32c5323-af8b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676725032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676725032, "uuid": "4ba76189-d113-44f3-b468-57bc01a8e48e", "comment": "Malware payload (RedLineStealer)", "value": "c36bf6b8a4fe13c1102182e3d851b28f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676725032, "uuid": "02fd68ff-2d32-4670-b1a1-419410a6963b", "comment": "Malware payload (RedLineStealer)", "value": "d654c363b8f320c5fd2d544804afffe3ee33c20afc694c42887d5c7a36ea7ac4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676725032, "uuid": "6c69c90f-6821-4bc6-a41b-e97df03638f1", "comment": "Malware payload (RedLineStealer)", "value": "c040e9bad5da099ea90e48c7e6b10730beb4aa76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676725032, "uuid": "93d89271-05b2-45fc-b7d3-210173deacee", "comment": "Malware payload (RedLineStealer)", "value": "5949ca5c836b458955738fcd6d351f5ad8d3e13a4c7e2d9bbb9c2e92c20210745103dc5e06c0cd80031b7c04bd0e0632", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676725032, "uuid": "fbbd770d-2a3c-4143-a06e-14f314704f73", "value": "T1F6E4124BA7EC5473E9B01B7058F606C30632BE111739C36B674E9D5929722F4B2327AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676725032, "uuid": "8fa87c2a-fe11-4df3-b7f6-3a2d319dceb6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676725032, "uuid": "97481cb2-edad-4417-8927-a38e33b3b90a", "value": "12288:JMrAy90IxpsFpp8dS61J7VePht/MH+Tq8XhWECwlUTOcTpT:xytxpsFv9+VePht/MH+vhWzTOGT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676725032, "uuid": "050a939c-db2e-4703-bd0e-6839aec5be30", "value": 719360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676725032, "uuid": "721d6d83-e271-454f-9c30-ecb71cfaf7b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676725032, "uuid": "d883968b-bf90-4a0e-aa14-0174ec467bd0", "value": "c36bf6b8a4fe13c1102182e3d851b28f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71961d96-af91-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676727472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676727472, "uuid": "7742d98d-3bea-471f-be9f-4eb44537adf4", "comment": "Malware payload (RedLineStealer)", "value": "ac382b11e0ed373f8f79904827e8bbf5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676727472, "uuid": "31e08c3f-9611-404d-b8d5-7f5bdc94779b", "comment": "Malware payload (RedLineStealer)", "value": "d7877f1142f60ec06b5ef5ed225e618c4f041bb0a92b3acc392db7c75323b997", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676727472, "uuid": "49f72e8d-71d5-45e0-a1f5-614ce6c6b0b3", "comment": "Malware payload (RedLineStealer)", "value": "d3fc52616eaeedec246a0987ba13b00650a67d7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676727472, "uuid": "4b1cdbfc-f442-4989-b2f5-53ee333cf5bd", "comment": "Malware payload (RedLineStealer)", "value": "59bbe6bc5b1cc8e0bc67933aa388b5424a62c0d6d77e89527204d5fccc7d0b3a03893750ac8e72113bcb82a489478862", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676727472, "uuid": "39cc4486-019c-4514-954e-c534e7cbe079", "value": "T10FE41257E1EC9036E825837008F606D30675BDA26A3C939B268F685E4CB36F0B935777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676727472, "uuid": "0cf0efc4-3b51-44a4-8ac1-aca4b4ac77ab", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676727472, "uuid": "9b9ed7f0-1009-4241-b23f-136c1fc93eb2", "value": "12288:LMrgy90dbduZo0GS1fzhs473gK2dX/MbBwMGQavtc7ZuM0cuTyp2GB0tK:ry0bduZvjGdEbadQstcIM0cuep2ZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676727472, "uuid": "fe73554e-864e-44ce-ab41-6136c6d0c260", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676727472, "uuid": "c734bcca-ed62-49bc-a834-160e751f259b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676727472, "uuid": "152381f3-09dd-43ae-9b57-860a36141f7f", "value": "ac382b11e0ed373f8f79904827e8bbf5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17666a45-af66-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676708853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708853, "uuid": "690512b8-a872-43e7-b6d4-a62d7f485dbd", "comment": "Malware payload (Amadey)", "value": "c69687806d8bf69c42ca5d50deadf4e1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708853, "uuid": "b14b6352-5441-4853-ba8e-580d4555e51f", "comment": "Malware payload (Amadey)", "value": "d7a0ac59ddc73f7c2f038461d1042ce28b38ff3d7dad183be9af6b69c20b3102", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708853, "uuid": "e6037415-02fc-45d6-a7e6-0dfb66b26725", "comment": "Malware payload (Amadey)", "value": "b711c30837d948256e251f1326648d0763497d55", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708853, "uuid": "ec9466b8-554c-43ed-8e62-c3d3124b72c7", "comment": "Malware payload (Amadey)", "value": "e50879e8856716d79cf85c0a757be72d2e877bb55b863b9c7bd5715d56ee6771c48d1e156578c98c9357aba114771f92", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708853, "uuid": "9639d7fe-840f-402c-be81-4391ce5d100e", "value": "T190E5330787E9E033F8E6573428FE43D30632FEB3972897A663998DAE189043451657DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708853, "uuid": "8cf28e0a-8d1a-400a-81c0-b47fbe5d7eef", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708853, "uuid": "2e4ca658-4c6a-4fab-a21c-92f8e5cac6be", "value": "49152:hdU+W7Uv8PBh6LNWnft1KsHaBTsGNpod7R/RI4R0o7n6O9YUnlDCXRGaealX9:JVqBh6Lgftv6BQGNqd7BRnyo7n6O2ec9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708853, "uuid": "4393acb1-9f55-4e45-9a90-d7f3d4c767cd", "value": 3127808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708853, "uuid": "d66cb061-044e-48ae-9a20-e08cf6157502", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708853, "uuid": "708538fe-05bd-4e41-902c-de2d1b0d112f", "value": "c69687806d8bf69c42ca5d50deadf4e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00c35f60-af6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676711821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711821, "uuid": "c44668a9-d303-45c6-8224-f65e5a3ec29a", "comment": "Malware payload (RedLineStealer)", "value": "bcee52a806038ef88660487eb8d7707d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711821, "uuid": "a58c54e0-5d0d-49b1-9adc-99a451791c0b", "comment": "Malware payload (RedLineStealer)", "value": "da2681a7d23362d701d02379fe56948a2fdbe6eb373bfbeed29e0c2eba2411b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711821, "uuid": "8c8680c1-02be-42eb-8a75-9a562da8d459", "comment": "Malware payload (RedLineStealer)", "value": "0bb64f2d3ba6ab3f0680043b0c6589447b4def2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676711821, "uuid": "783fd250-bb9d-4911-9eb7-784e53f1fd13", "comment": "Malware payload (RedLineStealer)", "value": "896b767dc3ef273b10f32d2dea792b56af07e418fcf8905d2219cc504e8da640b9c2915e61a2a6e11c500b4fe2f0486f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711821, "uuid": "90593f81-3b4d-432b-aed9-2a0f490c00d5", "value": "T158E41287E7FC4063E5B51B700DF502E316397EA06A3083EB2B4B6D4A05726B4A53537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711821, "uuid": "904ea456-1342-4823-ab44-461d57ea2374", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711821, "uuid": "6530096c-2a40-4026-afde-8b9a642108a4", "value": "12288:XMrSy90xKA4k5VgwTJq6agtg8K5F1YiCmv0tZpa553+iDGcZADDoH:ly4KRYVgOqFg68o7Pv0tKLleq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676711821, "uuid": "5bb2254f-c16d-45f2-9a40-df175a806e9e", "value": 718336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676711821, "uuid": "78d17a1a-e7a0-4e05-bc06-ee8c24ca0a25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676711821, "uuid": "d5cbb201-730a-4521-9c89-94a755dfe3af", "value": "bcee52a806038ef88660487eb8d7707d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fdc20bc-af64-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708196, "uuid": "10226914-17ad-41e5-a9ae-fcfbaa5b8958", "comment": "Malware payload (RedLineStealer)", "value": "a7dac1c3bf26445afce5934a11f5ae40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708196, "uuid": "c937d5d0-4913-4a27-a9a2-64f14f8e4677", "comment": "Malware payload (RedLineStealer)", "value": "da29bab8d2c694dc0905b99461a1ed56ef49c3070a4f7e4d765fddd846dc8c41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708196, "uuid": "c5bb4dfc-d6ab-463d-854c-9f87374b2f32", "comment": "Malware payload (RedLineStealer)", "value": "74400baa9012a8f08f57565fd08b7fee770a2947", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708196, "uuid": "e95b6c59-223f-4faa-af14-59d8a096af75", "comment": "Malware payload (RedLineStealer)", "value": "76e78dd05a30f7af9147407d01dfa1ffcfa18d07a72c1fdec1bf8effd781b454dc04ffff960e7b5083a02666cd20f771", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708196, "uuid": "9551c536-7257-4702-93a1-1ff3876e31d1", "value": "T196B4020BA7F88031E9B55B7019F742C30A357D965F78439B229E6C9E0CB25B4A63437B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708196, "uuid": "c963141e-eb5e-4c91-a084-516891732a5c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708196, "uuid": "810e2d21-0980-4385-9241-a8ee7e6a54f3", "value": "12288:DMrwy90fhySqjYV3JdrPgMGJbg3xNBEpeSZavo2c+JqyUH:fy6hySHVXP7kbICplZaHc+O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708196, "uuid": "199b0b5c-b8fb-47ac-b41f-9e1e159cd139", "value": 528896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708196, "uuid": "cee1e1f2-956a-4979-90d5-03836ff2a35d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708196, "uuid": "7731ceb6-e0c8-42f3-a84e-2fe1d7d1e151", "value": "a7dac1c3bf26445afce5934a11f5ae40.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f72c915e-af65-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708799, "uuid": "c5dbf88c-c0d2-4706-806e-1d2915dedcdf", "comment": "Malware payload (RedLineStealer)", "value": "acc5f8629176792a044928ce40063172", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708799, "uuid": "9b433810-5230-42f8-9368-aeca7f50e10a", "comment": "Malware payload (RedLineStealer)", "value": "db3b63b74d18e26ece81dd88be494382026191d510cdef9ff2108e41009545dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708799, "uuid": "8f7e2a2d-daa8-4ea1-a0eb-6a3fba4d0bbd", "comment": "Malware payload (RedLineStealer)", "value": "1be6d3ce8c23e554cda0629900ffb3df622cb454", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708799, "uuid": "766b214e-ac90-4d82-825f-a219bcdb78b1", "comment": "Malware payload (RedLineStealer)", "value": "3834642e7c48dfa9bdb8cc9619d685400fb662044aa84e67d28ed95b613ec52bf533b32ab63a959cffa7d57501a1df81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708799, "uuid": "ee0c8e29-c6a2-4569-af3c-0a3be6dc28cf", "value": "T143B40217E7E88123D8B563702CF203C707367E616774836B278EAD9A1C726B4A57532B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708799, "uuid": "53bc13da-5c46-48dc-bff3-5164c940eb66", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708799, "uuid": "e22e86ef-83a6-4d24-aa73-5b8a66bc46da", "value": "12288:8MrDy90W0DaG6Ngrf7ruBkejHX95GihvpXa2kX/CaO:PyJ0y4PuxGsZzkX/bO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708799, "uuid": "5da0a8fd-9a48-4e10-bdc4-bf60f789b866", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708799, "uuid": "62efbca9-db7c-4954-9ae7-63892d388c5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708799, "uuid": "c09e8e29-a705-4dc8-914c-eaca897f0619", "value": "acc5f8629176792a044928ce40063172.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9795860-af87-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676723298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676723298, "uuid": "51e6e184-05ef-4108-9257-db24119a39d4", "comment": "Malware payload (RedLineStealer)", "value": "ca3f5716af8591726b9aeb06ba1a3eff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676723298, "uuid": "2d7eb8d0-b333-485d-a5d4-6dab6bc3dbab", "comment": "Malware payload (RedLineStealer)", "value": "dd060a0b69b1b4caf82f6b45b70a6475ce25682ed247099d797b8232b42e0e7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676723298, "uuid": "d8f713cf-5cd6-45cb-9036-5ecfb6d0d28d", "comment": "Malware payload (RedLineStealer)", "value": "572cbc71317f14639842cec67f159c616bcd1380", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676723298, "uuid": "95938f62-8526-4c91-9f20-4ebc3c256a71", "comment": "Malware payload (RedLineStealer)", "value": "f966fd3c500c8c94fd11552224b5335c2bd8847664b92d9f1657fdd758b2e3ad7791aa4c93df720a37200a58e5985dfd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676723298, "uuid": "3589b28e-1420-433f-8a66-44b33656a8fc", "value": "T1C944D876F39C8402F3A6F43091F62E56153A70757D4F4DCBC7BAA51212CA9E2697CE08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676723298, "uuid": "282a10a2-8b92-40f7-8ba8-8234f08fba35", "value": "1b58743aa6d3922ef077981e7514edd8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676723298, "uuid": "689cf3e3-3b33-4da0-8160-fccefe3a3aa9", "value": "3072:hFzF/1LSucgwmYU8C+yjTllqdsWR5z73isrUAyuwmJnW95nKNRKjdc9YZVn:rZNLMmz8K9WRBiuZyuwunmRSIjdD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676723298, "uuid": "1888dfe2-7132-4054-b5d2-7ee26ab02394", "value": 268224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676723298, "uuid": "06d29dc0-22be-4f83-8e24-503d0da27926", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676723298, "uuid": "eba8c732-b430-47e8-9ea3-cc261f0f0c89", "value": "ca3f5716af8591726b9aeb06ba1a3eff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "171b2614-af60-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1676706275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706275, "uuid": "1db670b8-2fc9-4613-8ef4-280ab35d7ff1", "comment": "Malware payload (GuLoader)", "value": "1bd73caa236cdbc420e475d9e83412b1", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706275, "uuid": "23c04635-ea67-4ecd-8638-b035437388d1", "comment": "Malware payload (GuLoader)", "value": "dd576517a8c9c342f85cce5eed8dc46e7cc0291cfa5497135a27a3b517caa72d", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706275, "uuid": "e98e4bc5-1089-4ad0-bbd3-875a644f25d5", "comment": "Malware payload (GuLoader)", "value": "7422bf3c7ac8bb6eee0a805cd8d2e97769f5536b", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706275, "uuid": "417bd945-806a-44e5-9a10-1fb8668117a3", "comment": "Malware payload (GuLoader)", "value": "e9bf965dd8449adf42f5adf4aed22dd6b7d3900fe5684538aed73a71c1028b2ed132456cfc3d517d71fd8a14d17db7e8", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706275, "uuid": "33aa9167-47c7-4ea4-8484-4dc4ac866aff", "value": "T12F2328BC695E0348C9CA1DF79CC63BB8FF6B03D79C2EF4366C644B4A5116359827A122", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706275, "uuid": "caca0f01-ac7b-4bb4-9bb3-9384640ed88c", "value": "768:hfyYlVjHhH1ptdXg6MQ2zdZ9IJYaP1Qd/bT93pMuAfn8bUdBSL:5yAVbF/tNaaJYbB3pDOjSL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706275, "uuid": "77cd406d-8c18-47fe-9424-dcd10620852e", "value": 49533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706275, "uuid": "95d01555-e04c-435f-ae6e-a40dbf185b59", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706275, "uuid": "0435e4b4-907c-40f2-b49d-4e74b80e4f90", "value": "Transfer kan\u0131t\u0131.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "494403db-af65-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708507, "uuid": "f23160a1-ef67-4502-bc5c-deccf8a70a8d", "comment": "Malware payload (RedLineStealer)", "value": "8605555c98c0ac1f6a6c59705fde7dce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708507, "uuid": "89db085e-53d2-4706-b2be-06d6e817306d", "comment": "Malware payload (RedLineStealer)", "value": "e07cc3cb302f5c5b2bac243de31e3e837d1018595756db3a9a044b8b5fbd463e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708507, "uuid": "d0939a74-c7b4-4cab-aa54-ac155e88dcd2", "comment": "Malware payload (RedLineStealer)", "value": "462a1ab5dcfc54426cda72e7f929faef98cfd87f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708507, "uuid": "03cb4bdf-4485-4efe-ac6b-5378e2cc9706", "comment": "Malware payload (RedLineStealer)", "value": "4fc5e96ad3cdbf4a42b9bfd5d534ee515ea188d15e17287818b48e992d98094a3a9675060f3ce559427c716e72b1c2d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708507, "uuid": "af4c57bb-c9f9-487e-9215-b8d6eb42cb6c", "value": "T122E5334357E85422D5F0537014FB83C31A3ABE5B1B384A9B1E8949FC0EB1964E6F276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708507, "uuid": "8ff103f8-cbf7-4d7e-a268-ad873745455d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708507, "uuid": "4d5b1fbf-ded9-4185-b764-85b2ada4ddfb", "value": "49152:2dUN7OxAz9LfT87WP2hXCAxvVC5GKq4yYnEvYGLh/cOu6JqT7InsBJ:4UNY2P877XCAxq1HEV/c36JqTUsBJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708507, "uuid": "1350d80f-b8b0-4d5d-af1f-8f92dacc76d5", "value": 3121664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708507, "uuid": "8553693e-51e7-4a5d-9085-deeea1a99baa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708507, "uuid": "33be2c12-d474-419f-9ec8-00827d7d4f92", "value": "8605555c98c0ac1f6a6c59705fde7dce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fc17307-afa6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Adware.Generic)", "timestamp": 1676736328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736328, "uuid": "ed61fe1c-903e-4348-9021-999c53a8477d", "comment": "Malware payload (Adware.Generic)", "value": "dd25c5e92cf14e2fb5555f407e5e4187", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736328, "uuid": "9a8bab66-cc69-4d6d-b35a-65e89f7f95d6", "comment": "Malware payload (Adware.Generic)", "value": "e09f0bd79308d5a35381b2921ca5f0f609225120157de3d093554eb4b611839e", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736328, "uuid": "17bc3b6e-3516-4f7d-b08b-340f3f95b11d", "comment": "Malware payload (Adware.Generic)", "value": "ee559e298c6c666ada4438a47116c17ae901abd7", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736328, "uuid": "bfb69ae0-bd16-4f24-bcca-2dc5c753a337", "comment": "Malware payload (Adware.Generic)", "value": "71c4fa4cf2331d0dbfdcd19434dda9139b8f53d1d4c2e3b1f4eac1ee711727f0a509b505835b81ed4993dc1e4866b81d", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736328, "uuid": "739364e2-a631-476c-9246-37bce2191636", "value": "T1D67502A6B7405624C7462239E0DFC37E45F9BFC5EE880DAE27C16B106D8D8E28E3C645", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736328, "uuid": "6b9afd60-c988-442a-a9c5-4673c083fcde", "value": "90aa300f8b98c30a131430c7f96d8b4f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736328, "uuid": "7e8e16fe-79e8-4fa6-91a7-0fbb768dae5e", "value": "49152:EFej4NDYWQZ/0xWfdvvhFachIdrN3SE0R:EFeEuWQZsQd3hFaGuSEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676736328, "uuid": "546aac45-8ab7-4d99-aacf-0501d2152db7", "value": 1630240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676736328, "uuid": "a6bbf054-9369-428d-9347-e32b7f615009", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736328, "uuid": "39da6f93-dc02-4ef1-bec0-f71aac5680e3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "971856e8-af69-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1676710355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710355, "uuid": "110d5904-3898-4bb3-817f-5384d95d329e", "comment": "Malware payload (NanoCore)", "value": "9d8c3a5a6b55228d57f3d37b56c06f12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710355, "uuid": "286b73bc-6110-4415-a58d-981463ea15d0", "comment": "Malware payload (NanoCore)", "value": "e1160ebcd74712803f5f28fd179885715d63b39a24766d787e63ef63976083aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710355, "uuid": "1b7f7e2d-01a4-4cf9-a8da-5ee811cdddf3", "comment": "Malware payload (NanoCore)", "value": "1b6607cf23d71d7f76650c67af4800f9fbac41d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710355, "uuid": "dd829c88-4efd-4254-b53b-11753cd51b21", "comment": "Malware payload (NanoCore)", "value": "9916c3e848584f14990e034c0b285feece90eea95b382d3ca8eb4652566c6cb9d281b335989bd3dcbaf19093a5d8dd9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710355, "uuid": "1a8ffb4e-7748-4c54-aa59-148b3bd4cbd4", "value": "T110056BDCB1F0F67ECA0ACC75AB103D14ABE0655367268593E263B6D95B3D4638E1C0B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710355, "uuid": "5b437ec9-4401-4667-bc9a-967fb61da4f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710355, "uuid": "19453e53-c5c9-4897-9f3a-e713da19acac", "value": "24576:70qDSugAZ6f+3OnC55ghR+SPglcAoOOq:N6f+SCrg3glL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676710355, "uuid": "9ee955cd-a7fd-4980-a5e5-bf54731adf90", "value": 850944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676710355, "uuid": "bed212f5-bc23-4f5f-a08c-070dabdd302e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710355, "uuid": "7d27d862-667c-4c41-8713-c8037de0c707", "value": "9d8c3a5a6b55228d57f3d37b56c06f12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ae7d7b5-afb0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676740776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676740776, "uuid": "c7a81d0c-091e-4b7c-acf0-3b8b724a372e", "comment": "Malware payload (Mirai)", "value": "c8a1cb2bf1482ec74d9db830317e2be5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676740776, "uuid": "055885a1-02aa-4d48-aa67-fd2a6a8f6a5d", "comment": "Malware payload (Mirai)", "value": "e154fc900469fd31b1baa58d143f1a91136dc5f3024d58e49b004792108450d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676740776, "uuid": "7489e515-76b1-4815-9acc-1798ad0c9d02", "comment": "Malware payload (Mirai)", "value": "d3b65cbec74470c9e8d16b9c12dca867b3749140", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676740776, "uuid": "7022e5df-e95d-4ee0-b9cb-d4dc90e3f655", "comment": "Malware payload (Mirai)", "value": "b305a9c7a354eea3c5538d3af3762232d00eb3c6f7f6ba312db304a0531cc2e6ab5f6717f6794ec7015248b614dbe697", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676740776, "uuid": "912708d6-f388-4f26-bc7b-db4ad2de5ff6", "value": "T16013524D2E725FADFBAD463057B39E21974833A636E0D6C4D29CE9041E7030E641FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676740776, "uuid": "308548a9-00e1-42f5-be0d-fa592af18239", "value": "768:L3JYZUNcEnkBu6SAFYg2o7q8y9C4SMc5Z+uSQUBUADseGvZEkyqeiA4nmo0:9luE2nYg2om8yMBJSQUBUAQe2zNA4nt0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676740776, "uuid": "aa7c546b-5ac3-4ac5-8e35-7628b3a1042e", "value": 44192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676740776, "uuid": "d0e09b6b-ecf9-4603-8f78-faa98feda99c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676740776, "uuid": "9f67b4f7-65d0-4778-a18b-78a4bedbbc9d", "value": "c8a1cb2bf1482ec74d9db830317e2be5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc8f61f-afa5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676736269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736269, "uuid": "c8fda6a0-7a20-47cf-bb59-4b883c68f770", "comment": "Malware payload (RedLineStealer)", "value": "8c99c9b37f6861c09009990795d86314", "object_relation": "md5", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-netsoft", "colour": "#9BDC49", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736269, "uuid": "1bddc4fb-35a8-4593-b9ca-f6fe4f5263ae", "comment": "Malware payload (RedLineStealer)", "value": "e2ce6e01a2344bf76d3c832b579c5be8d5ed4b07d9a80f955427081ea4c158f4", "object_relation": "sha256", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-netsoft", "colour": "#9BDC49", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736269, "uuid": "abe9c442-f332-4613-aa76-b612e8199312", "comment": "Malware payload (RedLineStealer)", "value": "e52b20d3619e7eaba78ae6a8036c7c99f6d8f4dd", "object_relation": "sha1", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-netsoft", "colour": "#9BDC49", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736269, "uuid": "507c63e8-d4fa-4ff5-8d3d-6fb3b5b8968e", "comment": "Malware payload (RedLineStealer)", "value": "ee35c84820816e6cab49b8c5868ccd474c6553d0f019f552819d43bc6d0d902f84fd8d535865e329fd19dffe89cb62f6", "object_relation": "sha3-384", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-netsoft", "colour": "#9BDC49", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736269, "uuid": "12d9c456-c5be-4333-adce-8eacf8dee6fd", "value": "T14FA6332D4F31B12D6E805642F83948729DEAB9B6A8063E39CFD63720C0F855D6B76D43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736269, "uuid": "08b42be4-d2b5-4776-8da8-379fa6ddfd54", "value": "196608:5hHU5KiOeJGIoS4BoHgMV23fy9uIGAhaGpezB6Vg1u0QsUNw:5hUDlJxK22vyEAoGpIBOgTjkw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676736269, "uuid": "e45fc59c-4cb7-49b2-8a5d-d7c8ba157425", "value": 9972142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676736269, "uuid": "bef29582-da74-4434-ab4f-a8d3fdec85cf", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736269, "uuid": "5b9b0561-4a4e-4862-abcb-c0e18f1a20da", "value": "Installer.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc2f4d80-afa5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676736295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736295, "uuid": "45ed8e4c-1b59-46f1-9283-94b6ffb362a1", "comment": "Malware payload", "value": "8769230a373e4f21779278da22191642", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736295, "uuid": "ddd7c24f-2f59-47ab-bc9e-9fd34fc4250f", "comment": "Malware payload", "value": "e390d6e193c5d42632c920a7e57002b6f54b80ccfafd0a75c86738fa47e4a737", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736295, "uuid": "f1755b36-ce1a-46be-b289-2d6fa07bde24", "comment": "Malware payload", "value": "cca94ec219ac4321b80a6dc0d9b678420483ecb6", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736295, "uuid": "dc75e81f-3182-4cd2-901b-830c4ae0f28c", "comment": "Malware payload", "value": "f15583a04bb01ffc7aca88006d6a849df529b38547a851978a3db04eec3347dbf01571c598249c5d2cfa1a96c94867b7", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736295, "uuid": "c5a16c34-006b-47cd-8d2e-473d899da8f7", "value": "T18913E13CCF898D34DA5F9074581F77B181969D929281CFA70E9CEA4E1189CD0132BDAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736295, "uuid": "e84e9f23-ef1f-4d99-9bbb-c1cb355ba1b6", "value": "768:8PvT8yvmssnSOBIJYfTH+niSp6vDHDZv+nW80FFiKk/fTqtN5/tRp+nIzdJm:ovHvmTSOG1B6TDZv+CFFi3/LqD1tyIza", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676736295, "uuid": "d519c1dc-6b61-452d-b960-1ca7d5d1a2db", "value": 43145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676736295, "uuid": "b21ab6b4-7856-41d6-af93-a39c4bb62719", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736295, "uuid": "666b6253-7ed9-4384-8faf-af8ef0aac1e8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2bf1b5d-af85-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676722401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722401, "uuid": "d8cb09f2-3f3e-4d65-84fc-25510fbb344d", "comment": "Malware payload (Amadey)", "value": "47257f3a46c8be7ec1346599691d05fc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722401, "uuid": "fedfad31-1b5d-4cfa-9ce9-2cd1b8dd2d4d", "comment": "Malware payload (Amadey)", "value": "e3ba996599ea2f83ae1f6a9fbe12d5435cfafc5e040f2bff9e65fb5120e04064", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722401, "uuid": "46a0d2f8-67cb-44e0-aa62-896b03e28638", "comment": "Malware payload (Amadey)", "value": "4e9bf0dd8b8899973fcd3b3062cc4ccc94e3cdb5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722401, "uuid": "bbc03d7b-27da-47b9-9c86-b3a96e190fff", "comment": "Malware payload (Amadey)", "value": "b2693452ef411a354a806a7407a9fb513378bafc4108ff1d423f860038ee9954f5d3214f09f607d47dd79d41d4a2170f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722401, "uuid": "30d32aab-8b65-4234-aa36-8fd968fb8809", "value": "T132F4121BE1E89122E8796B7058F747C31735BE609B3AD39B325F6C4A1833664723436B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722401, "uuid": "4688b56a-3535-4d8b-a31c-debfb20579d1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722401, "uuid": "49d05007-d4db-4058-9b4b-91856e3ee562", "value": "12288:rMrcy90VZKbLg5spIviSX6YwoUPGDF7+3NuRgGoyaQ2m9tPTvSOUtbbJ0RML:fyGZKvg5Uc9QGDw3NuRgGj5dfbS3fRL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676722401, "uuid": "6ea6d074-06e5-43ca-b999-949275ffa224", "value": 762368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676722401, "uuid": "2fdc918f-a4fe-4b88-bcff-00d3520b69d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722401, "uuid": "4ffe6bdb-3d8f-4d19-ac81-4b7b5af26872", "value": "47257f3a46c8be7ec1346599691d05fc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abc74f4b-af69-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676710390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710390, "uuid": "74a8dc63-6d79-4466-9c0a-d72d6922a159", "comment": "Malware payload (AgentTesla)", "value": "d8860b51ef77013e6627a607ddf8c28c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710390, "uuid": "565d9fe2-62f4-4ca0-adee-b4c0a5f1afef", "comment": "Malware payload (AgentTesla)", "value": "e50bd96ec8fe3f4096d04708d7bd157efbbee6b79094dbe3be6a5fb9a1f64395", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710390, "uuid": "80dcbce1-5a7b-4b9d-902e-93cd8b514d61", "comment": "Malware payload (AgentTesla)", "value": "6752a683bac0914135d7bc669598ba84e8330b36", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710390, "uuid": "d80b23d2-279a-436e-b458-1b7209bfcb0b", "comment": "Malware payload (AgentTesla)", "value": "7d083bf7c3a27141a6499571444fb897a036eb5b1d31859f15bd7330ecc87ba4b3a60204ed60dcaae0bfb3203d3dc9e0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710390, "uuid": "e8c4b1dc-c548-480e-9e92-391a128dcb2a", "value": "T1EA156B8CB5B1EA3DD6098A7A27302C182BE15D07682CD6A5D3D1B7C31BFE25E3C5C925", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710390, "uuid": "9b3928e5-a486-40d3-99d6-454a629237f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710390, "uuid": "84c1250f-c298-404b-bf05-cff961e6bceb", "value": "12288:ZXySqDSuJDsv9tTyULP+DHK6/5TVmQcm7q8sDzLXTrpNjKRk2Zd0Dsv9tpRYcJbJ:VySqDSuULP+jTlcmG/JN2vjRBo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676710390, "uuid": "99650031-2c05-47c6-a35b-d59bab39feaa", "value": 893440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676710390, "uuid": "e4c63ff2-cce3-4ccb-871f-378e2ce14d80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710390, "uuid": "1c21a3ba-9bb5-432b-b110-68c664d71392", "value": "d8860b51ef77013e6627a607ddf8c28c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16174d4e-af66-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708851, "uuid": "b176f85e-7c77-4bc7-a360-0dcbc31e8171", "comment": "Malware payload (RedLineStealer)", "value": "c52e74a05849405a0fb2db010496b5de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708851, "uuid": "b49094a3-0665-4edb-8b00-6bcbf519bf9e", "comment": "Malware payload (RedLineStealer)", "value": "e5b5f12dec1f3937310dad1e00e4603dd67b646fb155e5856a80d3226e22e1d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708851, "uuid": "b302f65d-8b03-474b-a86f-b143b7feadda", "comment": "Malware payload (RedLineStealer)", "value": "13d4920be090dd73b80b8ca64176ef7e2d9425e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708851, "uuid": "72d981fe-ec79-4cc2-86c0-d74020f1ee2f", "comment": "Malware payload (RedLineStealer)", "value": "a4e40bfaadd7b893bef0012733f20b2c33ff1d13841ec6f8a0c3d1b99c7f6e3d1fa09bf533060948c6800e992762cf64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708851, "uuid": "1d5911b4-1292-4c8a-bd88-dea75c8f67fc", "value": "T1FFE53353AAF90037E964137840FA43E30A32BE537D2C1E2E665E58061E76671B6F07BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708851, "uuid": "f34379d4-23f4-4720-ba8a-ea5cc12d7509", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708851, "uuid": "0017b9fb-437c-4767-8fc9-0d8d488f25d5", "value": "49152:uGy5LuEPi6Ws3MAT8CS28sXTI+iQ5cxn1CguAs+f05MP2q9sOMX54Ct9d:XiuEa6z8AT7S2ZXTl72nIgnYG+xJ4e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708851, "uuid": "c2bc6e99-ae1e-476c-9123-bfce5c35ee7e", "value": 3110400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708851, "uuid": "7dfd81d8-221b-4577-92ed-558b885284a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708851, "uuid": "a2adbca3-3270-41fb-b1e6-4cf33b4276f0", "value": "c52e74a05849405a0fb2db010496b5de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5dc8e34-afa5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676736257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736257, "uuid": "1bcd6154-2450-4e15-a242-cafff6b7a0f7", "comment": "Malware payload (Smoke Loader)", "value": "c35e41bdd4b69c97ca980e3073c2bda8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736257, "uuid": "a4e21c89-19d8-4e73-9283-dfcf36555743", "comment": "Malware payload (Smoke Loader)", "value": "e7123ab8a3fae25a15b8f602a564d9434adcc115ff3a746dab92558e33d0b288", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736257, "uuid": "bda46bfc-9277-4a47-8d9a-f4beb8ec737a", "comment": "Malware payload (Smoke Loader)", "value": "3ca6fe08b382ad1084ce41305229849e0281d03a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736257, "uuid": "d3f67422-46aa-4758-bb09-296e6aa3f852", "comment": "Malware payload (Smoke Loader)", "value": "2eeeaabe148a6dbc44bd7333b5ef09be63783d2463b63c869fa3f07a9c74dc08e947f599369144812093df1d60dfd8dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736257, "uuid": "45915c7d-b47a-435a-ad95-c3c127ce88d9", "value": "T13F449ED272A17C51E922CB728E1AC6F4761DF9604E49A76A12385F9F08F01F3C7A3791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736257, "uuid": "1811b814-9971-4536-aa61-6292532a90be", "value": "81831dbd0bb62ee86f0858d78363b4f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736257, "uuid": "98532df6-e8f2-43ea-b858-8272b853e4a9", "value": "3072:w62pAohQcLIVHynSoeAjFIT3DT/YkwaXmoOnCREMtd/jeu8kTX61ORvUkP1gljVy:X9NcLIVXoTe3CnCRLje+TX61ORv6g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676736257, "uuid": "86e769ec-924f-45ba-b96e-0f96b85ec07d", "value": 253952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676736257, "uuid": "122e35c3-9731-478e-8eee-dd292ebd63b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736257, "uuid": "c172b925-5b59-40bf-a5dc-918ceacafd13", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb63b268-af60-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676706551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706551, "uuid": "08f68897-a08c-4630-911e-191bb756ebbd", "comment": "Malware payload (Smoke Loader)", "value": "6a2df4c7ab9ee878f159d6f6137f7c8d", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706551, "uuid": "0d0805fa-287a-4102-8e71-f24954a50813", "comment": "Malware payload (Smoke Loader)", "value": "e7d5602c5cf9c13c2dcae7dca51bbcfcba3366066e7a31e007d7e3c28e1819db", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706551, "uuid": "37a702f8-1937-4e71-b3f4-d12b1657652a", "comment": "Malware payload (Smoke Loader)", "value": "91c93a13f4260ee4e8ebe6792745c3d943592f51", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706551, "uuid": "c1a680eb-b6d5-4c45-8416-71f58853b024", "comment": "Malware payload (Smoke Loader)", "value": "25643c666784a5409c4ca870ed3c87a5601911c0f85361c7c06a580922df7caa3364e415778c3c1f34dd6da8205c9aa8", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706551, "uuid": "1c8f4ce3-9377-4828-842d-794861984a54", "value": "T1FF445B13A2A17DD0F516CB729E1ED6E8BB1DF6608E49777622189A2F05B01F2C273F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706551, "uuid": "4d873540-c83d-4862-b6d0-df97994a9098", "value": "613fbf9e2bd5ffef7427bd1f4e55d242", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706551, "uuid": "5560711e-1d78-4df7-8934-4bd8df3bb705", "value": "3072:Osb1ee8oELohBRfqWR46y5Fr2mBqn57budmjCUgxSlQHK25b:XbLJEL8dCvr2dxudpVxYw1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706551, "uuid": "5098c6cf-6b3f-441e-b005-b27145d4bef1", "value": 259072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706551, "uuid": "e32940be-0c04-4522-a4ea-d23f678476aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706551, "uuid": "a5dd5b64-4fed-430a-a7a4-8f58775491e8", "value": "6a2df4c7ab9ee878f159d6f6137f7c8d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7049383a-af62-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676707284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707284, "uuid": "de604735-fb18-42a8-81ac-b1d3d348730d", "comment": "Malware payload (RedLineStealer)", "value": "47e2a095219537d33ca4c8a9d5dd6d28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707284, "uuid": "920e7948-04fd-4627-b55e-8e5ce69e2242", "comment": "Malware payload (RedLineStealer)", "value": "e848385ea29a99abd693190385ee23c99b4b2c099fd2a05d4d7d4b4ab8b37d06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707284, "uuid": "7e227872-044b-4327-8db4-b91bae53e860", "comment": "Malware payload (RedLineStealer)", "value": "602c6bad7e82c1e7b174939a55d93cb504557e32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707284, "uuid": "1d52716d-2fd3-4bb4-94ab-237f83f43fe8", "comment": "Malware payload (RedLineStealer)", "value": "23fc764a0c094c706d9ac3ea709f13da73c2c02a4ce9b00a209488130179bd86baaac409f356597b4bfccaa103fabc5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707284, "uuid": "7e1de6c2-d1e2-45b8-ac4f-d737f233f06e", "value": "T16BB4022BE6F89426E8B547301DF603D306367D719A38839B278EAD5E4C71AB091353B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707284, "uuid": "b8c6de6f-abc2-44de-8140-6a58979d3ccb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707284, "uuid": "bdeb7fbe-f4cf-473c-830e-d51d847c52a0", "value": "12288:TMr5y906OEDMdNXJ4tWqvCqL5MBptWsQW3:uyPMdN+tYqaBDDQW3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676707284, "uuid": "4acc3979-ca6b-4dd2-953a-1d96dbd4bb19", "value": 539136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676707284, "uuid": "a0515e04-7b6a-4bfe-ac7e-583c68db8970", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707284, "uuid": "617feb41-5659-4b6c-8ac6-a0789935540b", "value": "47e2a095219537d33ca4c8a9d5dd6d28.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2802a4a-afc6-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1676750425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676750425, "uuid": "167196e3-082d-4f8f-8826-4b1c2d3970f7", "comment": "Malware payload (TeamBot)", "value": "747eea1cbc8b8a498508807a41a4424b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676750425, "uuid": "9c850270-39dd-4d96-a5d6-e01a31cef6e3", "comment": "Malware payload (TeamBot)", "value": "e98e282471580c18e1d16b4272d02128acd7ed961f9a7321b98df3b52e5b6563", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676750425, "uuid": "8ac7ab55-9d17-485e-89f5-ad41afa61de3", "comment": "Malware payload (TeamBot)", "value": "d104137508c56796482869ab7f375c54e07ef797", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676750425, "uuid": "8dc0fdf9-c40b-4fd0-a8b1-435d6337dcee", "comment": "Malware payload (TeamBot)", "value": "9648fb9a648fca418e43aa2a0225dfa47276ad9ff9117fe4352c437fec4d79232df52a230ad0ee3f7b54ff9f0311f6d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676750425, "uuid": "09a145b5-ac6a-4a6c-9541-c39d9eec7a59", "value": "T1CC449E1372A07C51DA2747729D2EDEE87A1EF5604F49A76A13385EAF08F01F1C6A3781", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676750425, "uuid": "25a5e8a8-0c05-423f-bf18-946e1ef055c5", "value": "81831dbd0bb62ee86f0858d78363b4f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676750425, "uuid": "9800aaa6-78bd-4d6e-bd0f-ac9792dee0a0", "value": "3072:bV2J63oALpySynBikVAjFWV1t3p8N7z2mQRQS9na6Sp9zl4A2tTQmW07xVUmig:pCFALpy7FsWV1xy7z2mQiotSrJktIK7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676750425, "uuid": "f38022c5-43c2-4476-8949-8ee3dfd1b9f1", "value": 253440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676750425, "uuid": "dcd18a23-5664-42a4-9bbb-7ef31c8aa194", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676750425, "uuid": "09d54160-04a4-4038-9500-12ea08921733", "value": "747eea1cbc8b8a498508807a41a4424b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4df503f5-af65-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676708515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708515, "uuid": "1a0bd7e6-fae8-4300-8b7c-62e19e36e006", "comment": "Malware payload (Amadey)", "value": "648d56765a70cf6df571b92454916334", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708515, "uuid": "fb0c749a-fa9e-4ec7-8dc0-27a853bbeabc", "comment": "Malware payload (Amadey)", "value": "ea84334449a542f025f0573963fb822bd1ac8e2d9a7b2566a436cd826171c958", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708515, "uuid": "09f676b3-43e7-45f8-9b95-e751661fe6fa", "comment": "Malware payload (Amadey)", "value": "22bcec8c32b504501c03602debe047270e14f66b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708515, "uuid": "9d3db613-07f4-4ecf-a971-a535f677ac7c", "comment": "Malware payload (Amadey)", "value": "4f57fce85096e8a1b04fced3dcfbc3c153e53827531547c984cc7902f4926ea0f43497ba0465ecb4ca74bbcb9e14b6f1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708515, "uuid": "a2274322-d38d-4719-ad8a-767e3872bc08", "value": "T123E5338776E65422F875673018BB4ED31A317FF12A348FA7538E68B50E71438E2B4366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708515, "uuid": "2f760f96-9d14-4645-8a56-d568cfeea054", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708515, "uuid": "609079da-eccb-4ec6-9e24-244e81cd1daa", "value": "49152:djKGW5sAjQIf93T17eWWjus4CFJZwe2a9oNDAKvT5chMq2OUyQeAFKu92wg:dHEl1BVWjX4wx29AKl/+UaAwuUx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708515, "uuid": "1496de97-1bcc-4e26-8a48-c2ab5db81642", "value": 3118080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708515, "uuid": "52cdcafc-f54b-4a55-aa24-9b60be80af27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708515, "uuid": "75199239-ab49-47ef-9646-763d13dd8368", "value": "648d56765a70cf6df571b92454916334.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3900e5c3-af69-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676710198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710198, "uuid": "218cbf4d-6d7e-49ab-baf8-5b776ad983fa", "comment": "Malware payload (AgentTesla)", "value": "c113807b6af725e6ff3611ab9f39311f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710198, "uuid": "2efa8415-681e-45a3-8c1c-42bf2c9812e1", "comment": "Malware payload (AgentTesla)", "value": "eacc1b5d6c31bce1b1a606c891c1f53214ee957bc6b66092fae704cd4075cb47", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710198, "uuid": "d04d7b54-f5d7-4742-ba64-4ff90c6314ec", "comment": "Malware payload (AgentTesla)", "value": "db92b5d53a5a0666f7755924283115059ee8d912", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710198, "uuid": "0f8e0804-fdef-44f3-9c62-54bf291f3a5f", "comment": "Malware payload (AgentTesla)", "value": "dc759555576c51ef4d93fb597141a3ba3cbbc3371d24ba711b5823b4658716803e9c2a3b4f88796918a58b9f8c85a894", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710198, "uuid": "368de4d4-027f-4103-94ec-3979ce5316c8", "value": "T125055A9CB1F0F67ECA0AC976AB103C18ABE061536B16C593E253B6D55F3D4638E1C4B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710198, "uuid": "dc8759ac-51e3-4123-968a-9e00b54c2d92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710198, "uuid": "4725c483-1ddc-4254-847e-ee794992b985", "value": "12288:wpyWqDSugDsv9tJSpqEmqOxkqzMAtznEkyuCqpJw4Ns0OAkDsv9taCG/QPO4B7f6:wPqDSuRoOxksMWznGRqpJ8ACr/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676710198, "uuid": "bd3a0450-6704-43f2-b332-e952d64ddb2d", "value": 805376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676710198, "uuid": "c99149c0-2177-483f-a019-1c7bb2b3e35d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710198, "uuid": "e495b5e8-a023-4124-a0e2-f2916818cb81", "value": "c113807b6af725e6ff3611ab9f39311f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "825ce1a3-af26-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676681544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676681544, "uuid": "a96ac9b3-aedb-4df9-b93b-d22a2f833ffc", "comment": "Malware payload (Amadey)", "value": "6fddb7000ee88bcf383a1aabf820cd2a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676681544, "uuid": "f122dd6e-9330-41af-9b9e-2e5878ce50d1", "comment": "Malware payload (Amadey)", "value": "ec455089514a7594f40640bc85c68ea44bc36d9baa88584e7f8c1d878ececf2e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676681544, "uuid": "d71994fa-e029-4a14-b32f-ca0d9a815c45", "comment": "Malware payload (Amadey)", "value": "c8e9c6a67479fc9f136cfec143e9ca136108da95", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676681544, "uuid": "80fcd7d0-b692-4986-a404-9925973b00f3", "comment": "Malware payload (Amadey)", "value": "b63610193836229a5eebceb7d33fb1127dfde46949a7879fa4ba02b4603210d74602e890640bd875bacfe92edeba6ca8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676681544, "uuid": "09479fa8-7817-4314-ad84-f110cb70cf01", "value": "T151F41257FAED8025F4F547B008F302C30B37BD616B79939A124EADA52C725A0A275B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676681544, "uuid": "659933d2-12ac-4fc7-8a31-b981355bebdc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676681544, "uuid": "da33f6e1-bba2-4ca5-addd-5d1d22a945da", "value": "12288:EMrUy90NvI4/T38HZKK4jg6BuZf4LHnCRNTQvVvPec2VxdVG6:wygDwZgg69HCzTQvRPePdVG6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676681544, "uuid": "3100ca8d-f146-475f-ba0c-8e8663dc3449", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676681544, "uuid": "eaf3a3b1-238b-4ce4-bae6-d6ffc9df8671", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676681544, "uuid": "aa577e9d-8668-4f6c-9ee2-4a48d46c7de4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f62c1b7-afa6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676736327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736327, "uuid": "12b01f5b-0ef1-44f8-b3db-b6be11ee335d", "comment": "Malware payload", "value": "8219cf79a105ecdd2250dc76cd091423", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736327, "uuid": "d7bb47f1-34e9-47db-b0e5-3d0e443dcaba", "comment": "Malware payload", "value": "ec7ca241abdc7b12dd870aee6feb00f0d5faaf714074246c39c7891f1c8d7149", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736327, "uuid": "f1618197-ebc4-4108-a0f1-026b1b862c0b", "comment": "Malware payload", "value": "ff10eaeabe81cc08b3040cd88474237ceff79626", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676736327, "uuid": "7acf92f0-9e9d-461a-a256-9cc154620824", "comment": "Malware payload", "value": "59aa848ed9b52afa3f71d1d6a0df58ac02db143f6525631cd0dc71b3506b0bd7e4541621287d3387755602cbe69ef755", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736327, "uuid": "172e0cd1-1307-4d16-ae3c-fa5997554706", "value": "T121144DC57A0C9AA7FEC065305183AE0D2C6CBFC3B96D319F358EF2546877E589286D09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736327, "uuid": "ef32e7fa-1a09-452a-a70c-554beef036eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736327, "uuid": "338f819d-7aa7-426e-a415-7d2418d48394", "value": "1536:WuI0RP3VoraIlrxCka52oXKsuWoZLO6zaTlz5vF:WutRvVsVK2OKsuWoZLnaz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676736327, "uuid": "8670dab8-8cb5-41d1-9623-a2205fba343b", "value": 199496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676736327, "uuid": "f82826e3-c6f6-4759-8157-e9018c95cc3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676736327, "uuid": "882fb388-55d5-42c8-8bdd-5670bb6d5f24", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "414688da-af65-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708494, "uuid": "ad4f86fe-1e32-42a2-b523-2752cb5ac790", "comment": "Malware payload (RedLineStealer)", "value": "7762075059779b890a86140bd8d1522e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708494, "uuid": "e881fa66-387a-4d90-907f-314f6cdab232", "comment": "Malware payload (RedLineStealer)", "value": "edc279531ed4e6d39b3f6eebba927b2f5740fbd92ca503ab92ce6eab9d330ff7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708494, "uuid": "391a24f9-8c23-44d9-a8ac-86b68e5ca447", "comment": "Malware payload (RedLineStealer)", "value": "fcc7ffa93db4e355e36543b94b1f7076faaf9fa9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708494, "uuid": "f7d2247a-b0fd-41ab-902e-d696b39be25e", "comment": "Malware payload (RedLineStealer)", "value": "822908731e734abe87976264deb80ecdb91aabc1883de1afeefd7d1575bad7e29efbd94c0baa03b83c8f2488f8281d64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708494, "uuid": "e4f1019c-4667-4e98-840e-9628180e03c8", "value": "T106E53303BBDA8561F19197B025FF03D30F35BF93266D87E41A0AADC90CB16B87A90756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708494, "uuid": "91fc709f-b7cc-44a1-a37f-1f71930f3087", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708494, "uuid": "3bad7229-ff99-4f89-a48b-57f015f7ca6e", "value": "49152:6snemegFygTtqY6LL0x98rj93v06nswfsGSg+R5+cMVrL6aWHtMjIeLDx9JwBBvs:XfTtILLo8l3FnxsDg2RM56VNAhK5B9H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708494, "uuid": "7bc4346d-09fe-4ccb-a681-6a66f71eb764", "value": 3120128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708494, "uuid": "be0ed9a6-6e66-4742-9385-2b42d427189d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708494, "uuid": "b0bee4c6-a78f-406f-ac6e-21069e06971a", "value": "7762075059779b890a86140bd8d1522e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2fd85a5-af63-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676707879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707879, "uuid": "2b6bab92-b8ed-4b11-8e15-d58af8a968cb", "comment": "Malware payload (RedLineStealer)", "value": "931d76ba40851b91b7058f1434329e24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707879, "uuid": "2371e41f-6e01-4541-861f-e24b3e240079", "comment": "Malware payload (RedLineStealer)", "value": "ee5af9be96b7b0bf6c72b094c5eb7624f12b47fbb34e100ebd9a19b51871c23d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707879, "uuid": "52eaeb2e-e9ab-49ae-b35d-45cc7ce1ea3e", "comment": "Malware payload (RedLineStealer)", "value": "79c85e01165fc485f9a750519ec6bf0c2890e8ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707879, "uuid": "137d3f5f-60e3-4257-9e67-4b1e94ee7272", "comment": "Malware payload (RedLineStealer)", "value": "8cd5c00eeb302ea1f22dc30642e7a5f046e13505c15f82f1d8de69d419c2e7a3c69fff04680500b5b7c8c717e350d0c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707879, "uuid": "c4b166ac-8f63-43a7-9dbd-f503d4ecb7bc", "value": "T145B4025BA6FC8422E8B527B409F603C31A3ABD255F74875B224E6C9E1CB3564B13137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707879, "uuid": "bf067ad1-f363-44ee-9aaa-c17040aa26fd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707879, "uuid": "bc961007-bf90-46a4-880d-9f9b49402727", "value": "12288:6Mroy90xLSCBz3am7Z0VzgIm7zoq7FgZkMhgZdu4u4Q:Oy0LSCBNFxFRruV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676707879, "uuid": "04c34484-37ae-4cdf-bb72-6454f0b13976", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676707879, "uuid": "423eb5bc-f9f8-4b14-b59c-16277d64c57f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707879, "uuid": "e6484972-42ed-40ad-8048-6103d9af3edf", "value": "931d76ba40851b91b7058f1434329e24.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b63635cb-af22-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676679913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676679913, "uuid": "3a033c5a-6486-4e2a-9819-7f3e52688209", "comment": "Malware payload (Amadey)", "value": "6d78d3778afd4afdf068801251894649", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676679913, "uuid": "4788d7ca-fa19-43b5-a301-ccfa9ca4230b", "comment": "Malware payload (Amadey)", "value": "ef4f6c2aa8c7b4637e6401659d869c1dc3e6a1358fb31f5442c7ed7e1bdec85d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676679913, "uuid": "96cd5e65-84e2-4569-9e7f-7e5092095b7d", "comment": "Malware payload (Amadey)", "value": "63e8ba99926349c02e1fdcff9fefdb4dc57ec309", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676679913, "uuid": "154a5c04-1ff7-4e5d-a8ac-bb22a3ea99d3", "comment": "Malware payload (Amadey)", "value": "797bf40a9e7c8ccb2cf070e05fcf450d70fe03183b90f3a5903d4944a94ae49bc51a8cc2dc29caefe1a60c4a6b06705b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676679913, "uuid": "767f6015-2f92-4eef-84d9-6e9cf9645a74", "value": "T19FF41247F6E98022F87413B059F752D31A37BE611E3C839A225E6D0D18B26B5763273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676679913, "uuid": "946c8f70-f574-4647-bc68-adba89036c69", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676679913, "uuid": "a4c9269f-c2ee-4693-b7ff-70e94dd50e84", "value": "12288:oMrEy908gAFHJ+BBxx2c0A6NTQaCOP9gtevYeQ1:syzvFUBrx2/TQabPTvYeQ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676679913, "uuid": "fd792433-9628-48f9-8d5d-39338d668a90", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676679913, "uuid": "775ed973-af5c-4c72-b6e8-7494c40b2598", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676679913, "uuid": "a1e57b6f-007a-4143-881a-3cc15f39dc1f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18eb0d1b-af90-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676726894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676726894, "uuid": "1f223f24-58ea-4900-bba1-92d8325bec2a", "comment": "Malware payload", "value": "8ac4ed115562301f814f5ab1b46fa42a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676726894, "uuid": "0003974c-7329-407b-9c62-6c0a58c5b485", "comment": "Malware payload", "value": "ef6a2bf769a956ab5f942451867691cc68e440dc8bca9c55525f710d736c1f00", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676726894, "uuid": "97f466bd-2928-48ce-b48e-1b103360735e", "comment": "Malware payload", "value": "e88e4bc5ba81d56bb4c756eb93aa23b83e8f39be", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676726894, "uuid": "7b690462-d699-41b1-ad5d-aba25cc99010", "comment": "Malware payload", "value": "b7c48866491c2152b8fccbaa4c61092555699bad1539aa04173549e9ca9ce7ae8b7a762b27ee3e26f30fa9bdd4e217e9", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676726894, "uuid": "087924a5-60d5-471f-b4df-e760daf058ba", "value": "T1DC8423FDEAC8EE45C0096BFA6AF941FA331101360532B077B90A851E19A1DE74797F4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676726894, "uuid": "f9ff8554-4602-46c7-9ee9-98587281cc9a", "value": "6144:tyFQrRIXB3gyCMtO6u+GGcRA7umhOLwPZuUg9G0uuOPazw1LpUpaIqKnUB:ty+tIXB3n94dGc0lmRLI0P5zw1LpUph6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676726894, "uuid": "c1738db3-1da4-49ff-876e-66dad376442a", "value": 386934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676726894, "uuid": "d98e09c7-adbe-43fd-8b8f-deaa240d320d", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676726894, "uuid": "29967d0e-6212-4e72-a643-c8e271eae030", "value": "Reservas Details.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "307978a7-af86-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676722639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722639, "uuid": "88813b41-a823-4d2c-a563-13fd9fd57d7e", "comment": "Malware payload (RedLineStealer)", "value": "430b33ea9c675a005e582e8ad8a5e38f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722639, "uuid": "9df51d63-e3e0-4158-b928-7d8812de8193", "comment": "Malware payload (RedLineStealer)", "value": "f0ad28865ec8da62516529fe801a58f819059a4b14f4e1c4584c4eabaee4a160", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722639, "uuid": "6a0ef2e4-8201-4ccc-89d5-45012f103a4b", "comment": "Malware payload (RedLineStealer)", "value": "a43c8eeb0ce3750650e2e10d26aa59c2ca19f1ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722639, "uuid": "acf16b2f-d395-49f3-a8fc-efab66de97b6", "comment": "Malware payload (RedLineStealer)", "value": "bbc4bbe9d56aec646df10295546f8a65e041197f1001c37217a7e4aa9914982f5a6c08db7313afc9aad66ec0289f8bff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722639, "uuid": "c2e9d9be-f344-469a-b226-d77aba4ebee4", "value": "T1A5E41207B6FC8062E9F65B701CF647C316327EA05A788757274FAC4A18725B272353AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722639, "uuid": "0e8647e3-1231-436f-a35a-7ec30aac5c3d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722639, "uuid": "e0c73605-313f-40db-ba70-46e78f7aca32", "value": "12288:LMrgy90wUIVL2yXVVJaVWquw6xybleGeGoyDQ23ytNTvEUfwmxh:PyzVdF3Kuw62leGeGjss0bEUYmv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676722639, "uuid": "4d563811-d51d-434f-b37b-be1104925db2", "value": 717312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676722639, "uuid": "6a1535b6-6c95-43d6-ab7c-0ae3a964c55c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722639, "uuid": "9ddaa650-3614-402f-b5ec-d44873487be6", "value": "430b33ea9c675a005e582e8ad8a5e38f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "425c876a-af65-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708495, "uuid": "0b03ae81-f3a3-4444-adc4-a1b19967bd76", "comment": "Malware payload (RedLineStealer)", "value": "2c2ac166f34d31c8fb1a0b3785a2e2ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708495, "uuid": "b9cff00e-a4ea-436d-81ea-5f5bef6a2ae0", "comment": "Malware payload (RedLineStealer)", "value": "f0de95ce126151d1ea32a246ca91789a0efaa766f4dea18bc294301f0bbd36e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708495, "uuid": "6a0c6e2c-313e-4c8e-9b5e-a28a8a9579b1", "comment": "Malware payload (RedLineStealer)", "value": "2c4b9c22c69094530286bba47d5038cd296bf957", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708495, "uuid": "316178ba-9eec-4ac2-b3ab-0985fd27a749", "comment": "Malware payload (RedLineStealer)", "value": "acf93cf30360713ec55b9facf8001f4f5c94fc95bd48fd7a68eae8f5f8549bff05fd026d4865b92b1706e7f9741287dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708495, "uuid": "1eb331a3-7b5a-4e67-9fcd-109733fcf5cf", "value": "T12C5402263AD1E0B5D49717304830DBB5667BB9A15A74868B37B8233F5EA03C14B7D387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708495, "uuid": "6903b6c7-0a28-4c0b-9a11-4aa506dda175", "value": "1189c0a2ecbe8fd35560b095ffebf6bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708495, "uuid": "85fbad30-1fe2-4540-ba27-f0b01323162c", "value": "6144:jCeUCHdhLPcwsaLL5hWRnrp6qOqpHGAc0Of:jCk9hjczqL5hYp+Y1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708495, "uuid": "e59b21c2-5633-4113-8372-7b6b30960cc0", "value": 284672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708495, "uuid": "78360b08-b82b-4d11-a5f7-599505ba0a4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708495, "uuid": "6c71a833-a6f2-4f69-9444-ceba8e38f04b", "value": "2c2ac166f34d31c8fb1a0b3785a2e2ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a295550-af67-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676709287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709287, "uuid": "85c8a572-7a8f-4e88-a61f-b469c941c286", "comment": "Malware payload (Amadey)", "value": "937b902b8ad05afb922313d2341143f4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709287, "uuid": "8fe280c6-3506-4ff7-9968-ed28667baaf8", "comment": "Malware payload (Amadey)", "value": "f0f0e7ab301101e6473f1dbcadd2272468af036195685c0ae51c9d90c40f0849", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709287, "uuid": "a6651f1f-b7e5-42d2-a46d-91d9ba339a12", "comment": "Malware payload (Amadey)", "value": "b48d5579e01000cdb3c3ef4e1ad1b97d2056a8b1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709287, "uuid": "ef096997-348b-4fbe-bd3a-7fd5f64b1629", "comment": "Malware payload (Amadey)", "value": "cfc7b8b37d29018a9cb0a2dd817f70f394ffb49dde7a496ecfe9fc92157e87caf89462645fe6ab2ea9ab19c824274cba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709287, "uuid": "5eebe417-2f17-47d7-acf0-8a941a227189", "value": "T1E2936C1030D2C071D97E55351878EAB68B7CB914CFE08EEF27551A7A8E702D1AE32D3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709287, "uuid": "bcaeae42-9a20-4f84-a10f-95e7f90ecb54", "value": "52982bbab8b9d5eafbb4ec438626f86a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709287, "uuid": "112d22a0-0562-4ee4-9d0f-9834a238bfaf", "value": "1536:eo4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJUnEaB89p:eoUCWbBNpplToUs1uNhj25LJUEaB89p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676709287, "uuid": "9a851548-4e25-4deb-bda9-c116b077e113", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676709287, "uuid": "cdb4931d-4b50-4b6b-acd2-57ddd7351963", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709287, "uuid": "10aa25b6-de41-4e23-b91d-65d8ffe8f5e8", "value": "937b902b8ad05afb922313d2341143f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5b478dc-af68-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptOne)", "timestamp": 1676709950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709950, "uuid": "4d48a7e5-a264-49e3-ba25-b5cdf7318610", "comment": "Malware payload (CryptOne)", "value": "0ca56eb8f4cf19674d5bf4175aa340f7", "object_relation": "md5", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709950, "uuid": "5a9a6ab4-dcd0-419c-a4eb-e03f0a35b42a", "comment": "Malware payload (CryptOne)", "value": "f0fe2595be5afe285d9b8d2d906c9ef9b11ea2905193ef1d6e252c9ccf2c2cf2", "object_relation": "sha256", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709950, "uuid": "d49cc931-098e-4ebc-aee2-b8f4b252be05", "comment": "Malware payload (CryptOne)", "value": "aacd94ecb3ff11127a3d7d3be439b0391c3ab65c", "object_relation": "sha1", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709950, "uuid": "f0ec24ea-11bf-47a7-a73c-13523222e0e0", "comment": "Malware payload (CryptOne)", "value": "0be3079884a79093db5356e91a5806648824853cfe6279c87c430acf75343705baec2776f1e44f1a2e8db4821cccafe2", "object_relation": "sha3-384", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709950, "uuid": "8e84aafd-e2d8-47d8-ad26-9e0281b6afa7", "value": "T1AD552312BDC48471C9762A3915F362317A7DBC205B76CEDFA7547B2E5A300D08A3AB63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709950, "uuid": "0f07225d-e847-4a01-b561-0d13a15f5b00", "value": "e92b2275a730f59940462780c383a1b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709950, "uuid": "f65d14ab-626d-4e8e-8047-f685f0ae9e3c", "value": "24576:YLeTtjJFtHrKFQGyx4+Hqvp6TXz6CI27+nKUDCIyppovVOOEwDKiS0uiZHo8qjbK:YLYkFQ64z6D27qTDt8povAHzYH8/K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676709950, "uuid": "ab0a30ed-0e21-4a50-8813-cb27f3afc157", "value": 1383103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676709950, "uuid": "85c81eb2-af1e-4abf-9c8b-f063dfe508f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709950, "uuid": "b778747b-fd33-47d5-a4e6-373f05118856", "value": "0ca56eb8f4cf19674d5bf4175aa340f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "167196fd-af68-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676709710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709710, "uuid": "24f68e1f-401b-45fa-afdd-94c698a698b7", "comment": "Malware payload (AgentTesla)", "value": "0d1c9592109eef209edc002e83fdcf92", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709710, "uuid": "629d5a8c-0f83-4a77-8819-a5811d272f5a", "comment": "Malware payload (AgentTesla)", "value": "f11e728dc458288d88eff83accc1f9ce10b8b208be4a9fe0abc3e1a9ba23f059", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709710, "uuid": "a460e821-2308-4388-9e25-e15a344e48de", "comment": "Malware payload (AgentTesla)", "value": "0027df4e87f9cc27cbb7ab8e8a8c0c223a22108b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709710, "uuid": "4d9e30e5-7cdd-4e4f-b688-ebe70251456c", "comment": "Malware payload (AgentTesla)", "value": "2d353078cde800d785781d2ecb6e76439b2e4e9b8391f7cbf205521f0689a5e759476c4c607a34214cac6024942e094a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709710, "uuid": "95e2684e-2788-4a58-87aa-b89f350e9678", "value": "T1A1055BCCB1F0F6BFCA06C876AB102D146BE06553672AC592E253B6D99F3D4538E1C4B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709710, "uuid": "d7aa1df6-1760-4ad6-bd17-a0b87ea61cc5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709710, "uuid": "5bad8763-b52d-4a85-9089-fdcd7ba2566f", "value": "12288:4uEDqDSudDsv9tlBo7c24ZwqXKKfOZ+sw7X5S3mgr0ULuay7FRKUDsv9t11Hym5b:45qDSuYwRJZtWsu7cSb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676709710, "uuid": "bbc54faf-0c43-4a81-885d-9f1213d2fae4", "value": 808448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676709710, "uuid": "ac3199a1-19fc-4cd6-bc50-0eee75648cf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709710, "uuid": "08e31ad3-ce8f-4683-aefd-1b7aeb7af086", "value": "0d1c9592109eef209edc002e83fdcf92.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4856c923-af60-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676706358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706358, "uuid": "61192be0-4522-44c5-b8c2-adb0493f8e14", "comment": "Malware payload (SnakeKeylogger)", "value": "882a239c212bfbe935978c4986fde5af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706358, "uuid": "bd2e5373-6017-496c-8915-2cd1c565cea1", "comment": "Malware payload (SnakeKeylogger)", "value": "f19382f73afea13e667e2e39aa0017ee8d3976038fd549c2f2d6b4be4d241cc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706358, "uuid": "0eefcb0d-678a-46dc-b213-2cf4c25cac37", "comment": "Malware payload (SnakeKeylogger)", "value": "8d183c199f6ce460abe4d5e312d858a11a8091f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706358, "uuid": "366fd9f4-7725-43c4-9270-926b7507a202", "comment": "Malware payload (SnakeKeylogger)", "value": "0e9a3818aaef68940cc6e6efd9cb232fc7d8137693de8c669258cf7e46552ab9459c20062785416f925126358ff9717d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706358, "uuid": "8ebce3e4-697c-44f0-b000-4f3877f36903", "value": "T1B1E3191D6BF88800E6FF8A7705B15112C736BC52192ACE1D16E2F5191A7D7A0CE1BFA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706358, "uuid": "dd286e00-38f4-4948-8e60-d42044fc4104", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706358, "uuid": "755158e0-3c99-4426-9c86-bd6f3d0a354c", "value": "3072:hAgAEcCv/IgOYrvQoLRDb8mYwBWjOzFbYGY:CFyI6jRDbkOpb9Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706358, "uuid": "b02cceb7-1156-4e71-bb69-fd84299f1c5a", "value": 155648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706358, "uuid": "61bdac10-2d8e-4b1f-99ff-2d961e164c22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706358, "uuid": "3b2b35a6-0a28-475b-8dfa-ce01ffb8ca03", "value": "882a239c212bfbe935978c4986fde5af.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9e2ca67-af66-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676709125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709125, "uuid": "32b44e93-2ffd-436e-a3e3-b253083d7154", "comment": "Malware payload (RedLineStealer)", "value": "9849ef509ec4d1b4654eedb7e00ee8b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709125, "uuid": "e35e1216-028b-4495-9ee4-5dc0c10f8e9d", "comment": "Malware payload (RedLineStealer)", "value": "f3361f6712110a54eafa4efd8c5478f69fc669346100b245b94a2b33f57d08f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709125, "uuid": "6436b75e-e4d8-4f62-9695-30a2ffc01708", "comment": "Malware payload (RedLineStealer)", "value": "b53fe02404a4e5734dd6b6572ff0eba0938ae485", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709125, "uuid": "7f51cac3-0f38-4156-af33-8c981dd0e0a8", "comment": "Malware payload (RedLineStealer)", "value": "f6ef23f8bf5c4faa8f8d3a99f09f503d553707ba25f38b1a7fdb5718683effa0b87cbb5479ae817d6e31946c966fa56b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709125, "uuid": "a27ac35a-6899-40a3-8b53-ac8655594817", "value": "T1E7E4120BF6F99062D8B127B01DF503C316367DA1A724825B17CFAC6A08736F4A63576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709125, "uuid": "12bfab68-6e57-4e4e-9993-3ae45d52e40b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709125, "uuid": "796d6c88-9367-4534-9fe3-f8d977119568", "value": "12288:EMrvy90brWAySKyeMcEzfiiRPhaFwEvn+/OGHEwkldHTN5L94LXyG8xE:rynSFeMVzhR5IqjEjLWAxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676709125, "uuid": "a797b27b-c491-43e2-bf4c-2efcdc41c065", "value": 676864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676709125, "uuid": "9e4d21ab-6415-40af-bb63-f61209cf87bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709125, "uuid": "04580a20-0080-4028-9812-039aea29f169", "value": "9849ef509ec4d1b4654eedb7e00ee8b7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1924d168-af6e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1676712292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676712292, "uuid": "9649d813-be73-454a-89ce-7b66c275b985", "comment": "Malware payload (AsyncRAT)", "value": "2a9a5a63b1654baeb3bdb40b5312194f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676712292, "uuid": "18416eb8-fabb-480e-addb-fcc3559b9e5d", "comment": "Malware payload (AsyncRAT)", "value": "f3da52b9630c266b9c950883aa522dbfc5b5b06a009ce8e21754c886aaf54993", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676712292, "uuid": "1fd88f36-d9d3-4211-8eb0-c7cb8b026a76", "comment": "Malware payload (AsyncRAT)", "value": "3b0059dc531aa7ea30b179be82710cd8b74fc06b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676712292, "uuid": "c1c8b66f-6f96-4c71-a04e-9c1ebe0ace2e", "comment": "Malware payload (AsyncRAT)", "value": "f660316f17b557bc2979c2bd0063e6c54519c37bd8e530de3be3f147dae59c03d52a600601e7453bf30d324be44197ee", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676712292, "uuid": "dd04eea3-31a7-4b03-ba8c-55ac82e2fbe7", "value": "T178155AF151437F8DD7BB0DF9E94026724CA86157A365C21CFDC80EB866AF230AD658B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676712292, "uuid": "46b68c55-de15-4681-a6bc-72c0dd62068d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676712292, "uuid": "83a53c66-bdb3-4f32-abb0-f62addca7a04", "value": "24576:25+mLsClAjfOaWSWgW95QEyF7qG+nsvkX2zyYZzle4rsboe+es:LFW9YXUs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676712292, "uuid": "8ead18c1-7cb4-421d-9258-1aaa1d6e60d7", "value": 924808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676712292, "uuid": "fa8aaf12-dd85-40e6-959b-31b56c424137", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676712292, "uuid": "6037e393-cd2b-48eb-925c-c26766c8b8fa", "value": "FACTURA_ELECTRONICA_DE_VENTA_GENERADA_AUTOMATICAMENTE_SOFWARE_DE_FACTURACION_EN_NUBE_SIESA_PROVEEDOR_DE_SERVICIOS_TECNOLOGICOS_AUTORIZADOpdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0c39af3-af8e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676726263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676726263, "uuid": "895ae8bf-99fd-4cd4-95d4-4494ff6ace56", "comment": "Malware payload (RedLineStealer)", "value": "5aa6e9bac1bee1dca3b7a5d420766c2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676726263, "uuid": "bbfe46af-462b-448f-9aee-8de8eeee867e", "comment": "Malware payload (RedLineStealer)", "value": "f4565199231418a4e651250524064d521d249ea5fe006f66c29f4f765877b47c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676726263, "uuid": "884b7195-3751-4869-8502-8711a0928fb7", "comment": "Malware payload (RedLineStealer)", "value": "88f97330ccd57f3c960ea564fc7ab8a260ce9aef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676726263, "uuid": "0ce297e2-d9c5-4dac-9103-aad60397d036", "comment": "Malware payload (RedLineStealer)", "value": "c5f08b945ca0fc5f46d32b5bec226133dcc1926d39a4d7e8b025999a9282870c5aa4eec342607c1e3416c381c297d7b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676726263, "uuid": "81fe270e-c718-4bc7-bdbc-72a5cb87a162", "value": "T13574D00272E0BC65EE1387729E3EDAE47B2DF5604F55975612388E9F08F01B1DAA3781", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676726263, "uuid": "105878eb-3775-4b81-b706-b12d6c63158b", "value": "7a00f8b37dcaacef0b587f3f169176ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676726263, "uuid": "47d50c15-68f0-410a-b388-cfd28669804c", "value": "6144:KqaLA6Hpb/rAGKkFNuYgF50SJu1yc3R1qdtK0CZ:Kqak6Jb/0FqNBM0yuUk1qdI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676726263, "uuid": "d364b7e3-bbff-42f5-9f02-a4786836fd96", "value": 357376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676726263, "uuid": "7a649199-517b-4d39-ae0c-9c887df46e13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676726263, "uuid": "b193a075-ca21-4d77-b33b-b5c8d610ba32", "value": "5aa6e9bac1bee1dca3b7a5d420766c2d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce7c4379-af63-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676707871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707871, "uuid": "1a757268-6522-4c5c-a254-a2b65c76d294", "comment": "Malware payload (RedLineStealer)", "value": "a772611f2b51a1f6c58120e49465d10c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707871, "uuid": "bf20decb-5940-4c15-89aa-c8f4782ed2f7", "comment": "Malware payload (RedLineStealer)", "value": "f52f24aebb085a83cfbd03e635127391e7e55862930ba9f1b3c2315c6b91c60b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707871, "uuid": "0c61000f-5266-4307-a9fb-d749214c55bf", "comment": "Malware payload (RedLineStealer)", "value": "3c611eab3bb741b341c391a566b7489ec4db406a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707871, "uuid": "ef844ee8-e2a5-48a0-ae23-44ca5b288636", "comment": "Malware payload (RedLineStealer)", "value": "c4582a8d56d29c2970aefabbd3d667375e12778f6cad4b1915783e30ffba9924559b33129471decc4d8051a95da17c8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707871, "uuid": "67a24f00-fc7b-40e0-8e59-a7dbfbe6e255", "value": "T12AF41247A7E88433E566537068F307C30A37BEA15A7443AB278E9C4A08B35B4B53576F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707871, "uuid": "1ad1184a-1a83-4eb6-bf3e-9f0f73987766", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707871, "uuid": "960ef5e4-6b3f-4c2f-8b09-27c35c29dd50", "value": "12288:3Mrqy90LLVsR3GjEkEiMbycIPUyRNfZyXogqRqBGLaRL41dNBG5k:VyqVNjENbbTQgq/C45I5k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676707871, "uuid": "60d739e5-18dc-4d91-9f55-24c50526263a", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676707871, "uuid": "ac8b5664-b0ba-4fc9-a073-8d04d4cb1762", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707871, "uuid": "514a36e8-d30c-4ae4-b8ed-d8e4c8768861", "value": "a772611f2b51a1f6c58120e49465d10c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52b4bac1-af65-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676708523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708523, "uuid": "fbdf834e-51b4-4989-8f80-516c00b03fc7", "comment": "Malware payload (RedLineStealer)", "value": "f008fb62bd89b24c2ad54e8c38d83144", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708523, "uuid": "f354b311-635e-407a-8bfd-ee3c6c0d3258", "comment": "Malware payload (RedLineStealer)", "value": "f633e28ce40ed247db95d755e89a8e136eda4edbce4654f929d697700160342f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708523, "uuid": "f8424678-ee0f-401d-9a86-b8a2d4c234c9", "comment": "Malware payload (RedLineStealer)", "value": "e1f737fa15abf96c96972176481f386fdd91d0fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676708523, "uuid": "bec9197c-18a5-41ad-8374-388935fbb801", "comment": "Malware payload (RedLineStealer)", "value": "8d14b98a23c6fd9c1d83638704258b48250accd3e6063fa1bf73f1bdc9b2f906ca95f3be24d1212a793a85eb84aa927e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708523, "uuid": "5248cc24-fdd3-4ff8-9fc0-6f2a4817ac13", "value": "T183B4021BB6FC9073E8B4633009F503C31A36BD911A788297778E6D161CB26B1A53576F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708523, "uuid": "4b873d50-dbf3-4d87-a0fb-c5b3a2161364", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708523, "uuid": "964c7a4f-5790-4628-af1e-417b4395ebd5", "value": "12288:+MrFy90ta+3A+u0ild2+ZQVeLa+EZ26XYl:/y8vg0ild2+ZQVeLvEg6m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676708523, "uuid": "fc65e6bd-d517-4413-93e7-1a57eee3b0c6", "value": 528384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676708523, "uuid": "15b6ba3a-fdc0-4b60-9492-389c816eb28c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676708523, "uuid": "7c9849db-2595-4d99-bc42-138ba66403cc", "value": "f008fb62bd89b24c2ad54e8c38d83144.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e4cf4e0-af60-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676706422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706422, "uuid": "c3002904-dd15-43c9-885b-a1b8d68c1a23", "comment": "Malware payload (SnakeKeylogger)", "value": "e2968e095857de7804c87ef2b007b317", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706422, "uuid": "506f6f18-f0e5-42d4-b6fd-df5e81a26326", "comment": "Malware payload (SnakeKeylogger)", "value": "f633f0484b4c98c0943ba12e1ae9741b5001e09116d7ea953163020316747302", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706422, "uuid": "e48bd2a1-8f35-4067-a000-4b7cc94c923a", "comment": "Malware payload (SnakeKeylogger)", "value": "8e6001034aea8fad64443132e1d150d6bac5dad3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706422, "uuid": "cd6e2994-fd77-412f-a976-4a5a975f238f", "comment": "Malware payload (SnakeKeylogger)", "value": "79ce569a60cbe9aa13400d6ca381d3ef6b5dc11f890d84a1918a08774de59a70133ac92c202ae3d48fc881039c7df1c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706422, "uuid": "e06c39a8-7af2-453e-b402-e0c51e4508df", "value": "T1CFD48C8C90F2EA3ECB498EB9371035081FE056437924D9E6E3E5F6C26F36523199D936", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706422, "uuid": "6e4f7ed1-ea50-425e-8885-b5334feaf13a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706422, "uuid": "404c4224-623f-47e3-a765-46ed9576d1d3", "value": "12288:xr9hqDSuwDsv9t39OV627ectU7tndjAA1jUKhTptwCAlDsv9t:19hqDSub0BXtU9dk5KBy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706422, "uuid": "2ff3b9a3-c3cb-4ed8-a45e-1382f74f2c4a", "value": 653312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706422, "uuid": "a7bd5dfc-60dd-4c63-a1ca-59b2511c816e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706422, "uuid": "6bfd2bbd-93de-4802-bef9-886506d8e2f2", "value": "EQ 62725-NA001-0223 , Request for Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4938686a-af81-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676720533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676720533, "uuid": "63ffa414-794b-469c-91ed-9fff6aee1a06", "comment": "Malware payload (RedLineStealer)", "value": "f3cd2d77973d6afe358c0cd5bec8f0ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676720533, "uuid": "549d34ac-3059-46a5-942b-91d5231ebacc", "comment": "Malware payload (RedLineStealer)", "value": "f6762e02a1ddc9b4e50b5defb7dae96ddb67c73141dbdb12f27c61136fb84f71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676720533, "uuid": "0c634062-b963-4e45-b3b2-d695c486d1d8", "comment": "Malware payload (RedLineStealer)", "value": "418a3092f7460619fd75da01dd05b4fe54327d81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676720533, "uuid": "959c2e04-4bd2-4750-8454-c656f5ae0893", "comment": "Malware payload (RedLineStealer)", "value": "0b4ef25dfc6318d93cb41db19b32136d11debe0e3689a7c52487444c5077cc958493512f33ea578ee71e915e20e32b3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676720533, "uuid": "c4111869-598c-45b1-bb1b-ea140f09d048", "value": "T132E4124BBBE88575E8B197F015F342C31A3ABDA15A3883D6270DAD5C1872260F631B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676720533, "uuid": "bc0336c1-fb5c-4d9f-9106-4806941fb31c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676720533, "uuid": "5c3db679-dc5d-40f3-a930-5f1eb7aa40f7", "value": "12288:xMrwy90x1HdAyJ+SYA1/6WVTvaQNQXfphNTQl1WP1quQja3:tyAHuyAS76WgvxTQloP14W3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676720533, "uuid": "194c0971-b87a-4ab2-993b-9aa9cdd89fcf", "value": 688128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676720533, "uuid": "213c6850-5044-411f-86a9-bf61f14b7bfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676720533, "uuid": "dccdd1a6-2fb3-4d1b-97c6-fa7205aaccf1", "value": "f6762e02a1ddc9b4e50b5defb7dae96ddb67c73141dbd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57933ede-af69-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676710249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710249, "uuid": "f746a716-70c2-43a4-a4ea-32c3ba4e406c", "comment": "Malware payload (Formbook)", "value": "e9af911edfa6b461868bbc06034cea2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710249, "uuid": "cbcc2e79-4174-4055-876e-aef7f33e8ae5", "comment": "Malware payload (Formbook)", "value": "f8942728742c053d4ea847b57494bc495dbe64d2aad58633fa7334d5538e1860", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710249, "uuid": "15ac1e7e-81b9-4514-b3f6-0d01d4b626e4", "comment": "Malware payload (Formbook)", "value": "30c76cc4b6af66064970d186299ba0feb5f31d5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710249, "uuid": "a65240da-0c9b-4048-a3ee-5c569747a7c5", "comment": "Malware payload (Formbook)", "value": "5b56c5356fe3d4db03e0875a318713ee6923a12e5092ffe179522a1736d78028ec56ee0716d67a0dc96f8e773f297286", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710249, "uuid": "880c78c4-f58e-4aae-8d38-68cf8d6a0ae4", "value": "T14C055A8CB1F0F67ECA06CC76AB102D14ABE065536726C593E263B6D59F3D4638E1C4B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710249, "uuid": "d6689284-9a02-4242-a1a2-f18bf9f10f0c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710249, "uuid": "b8d63b58-a000-4032-86c7-62415002d37f", "value": "24576:2ZJlqDSu3Yx4bCA/QFeHoM4ZwMztUDsRw:2TcZ+aOeHodWGUA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676710249, "uuid": "e210bf8d-a45b-43aa-9966-9dee95ec7a4c", "value": 830464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676710249, "uuid": "e9112906-64b0-4384-8840-cb9cbec44d1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710249, "uuid": "7a9dab7a-968f-4e54-bdd8-6de96bb22126", "value": "e9af911edfa6b461868bbc06034cea2b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69f82b75-af69-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676710280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710280, "uuid": "8faba86f-1bba-4bc8-ad3f-8931d793132f", "comment": "Malware payload", "value": "346ed038fe58dbe26ca82862412f3041", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710280, "uuid": "ef39a290-90a2-40a7-9b72-815a6ef25553", "comment": "Malware payload", "value": "f8de4e808ec90d8bb6ccccd1f35a3fb6835e68676a084407b12a26af625cbd07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710280, "uuid": "82a2e2e3-3f79-43a0-928e-18c86dba8f8d", "comment": "Malware payload", "value": "ecc8fa3d0b9a018e5668fcfb64d06351ffefca23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710280, "uuid": "6ed79aaa-65ee-47cd-86dc-c5b30bb5be44", "comment": "Malware payload", "value": "ce9a7b29d343ab89b5322338a1f635ddc86c292d886e30603f7a2e3d7f302aaf5d80a283a995b2be79f3af564e34fc07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710280, "uuid": "38dcf18a-792b-4366-8db4-a7fc024d9255", "value": "T1BB62F705FC618EB6D52747F485A88B868EA769B807F0C093093DC59EDEDB3D00B36366", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710280, "uuid": "c5f401af-3ba7-4baa-911e-e7cfccb4937a", "value": "192:d33cnIzHU8v2HI/KPnnnnnnnnnnLuqulMBTgHWA8:d39zHTv2HiQuquG88", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676710280, "uuid": "0be5eb87-31f9-4877-b5ed-156f1ddf64a0", "value": 15257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676710280, "uuid": "ef22e49f-d30a-446a-a000-e85b5498e992", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710280, "uuid": "e8793b70-c33e-4223-936c-f9d527d30b7b", "value": "346ed038fe58dbe26ca82862412f3041.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8ba4baf-af9b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1676731994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676731994, "uuid": "9afb25bf-6c89-48f3-be7d-7618127de1d8", "comment": "Malware payload (RecordBreaker)", "value": "f20a273a55256b38b517b943afb1d763", "object_relation": "md5", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1375", "colour": "#49C45B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676731994, "uuid": "40e707bc-30ee-4344-a1d6-15616cc076ce", "comment": "Malware payload (RecordBreaker)", "value": "f986e5d6688fbfb8587d24afc87b9c5e134fa559922fd9458788d8e10e3ad2f9", "object_relation": "sha256", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1375", "colour": "#49C45B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676731994, "uuid": "896dc9ac-b459-464e-a306-693f6bc5eb04", "comment": "Malware payload (RecordBreaker)", "value": "c8efa04090c74cbef18a0a85a236e2ad04c85001", "object_relation": "sha1", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1375", "colour": "#49C45B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676731994, "uuid": "3cea799d-1eb3-447d-983f-a8bb55762ccb", "comment": "Malware payload (RecordBreaker)", "value": "8c14f91a689a4dd29d0a8d0b7a6136bdad01cc4d9ff2c92734e77798b003489f91fa827e27ede2f83bb6136dea75c4f1", "object_relation": "sha3-384", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1375", "colour": "#49C45B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676731994, "uuid": "d0a61cfb-606e-4463-a7d9-220e95d11678", "value": "T15766338603D665605ACCC6856E752643F3502D0CA6EE7E70FD00592BE239E74C2BBEED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676731994, "uuid": "33551ee5-0a3b-4847-95fb-fb8ab2cf9265", "value": "98304:wf/bD5h0cmirq/TqVlVjbTlBl7cmfYuzx1n5qbDmmGlwgglc5HwXDvvI1GnHiWH:wP0j2nbKuzxzqbDy8c8D3I1FWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676731994, "uuid": "5b770156-ad93-488f-9f94-2d65ac5e49ef", "value": 6750820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676731994, "uuid": "13027a4b-353a-4b0f-b95a-1d2891d52519", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676731994, "uuid": "e812ed72-b612-4e5e-8336-2202d1f37946", "value": "IIlustrator_v27.1.1.196.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b388ac6-af23-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676680083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676680083, "uuid": "486bcc15-8a4f-498b-b773-911ad06e97a7", "comment": "Malware payload (Amadey)", "value": "6e2cc2b336cc52baae482ae2202865e2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676680083, "uuid": "b96d1f86-5285-4ab3-b41c-c96dd0c37926", "comment": "Malware payload (Amadey)", "value": "f9b11cfc2e6839485057071f99d006e536f6275a3e48729c34c6629b8751bddb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676680083, "uuid": "a34dc16e-4d1d-45d2-8a02-5cdc73f013fa", "comment": "Malware payload (Amadey)", "value": "45148a8b75233a01a8993ac3c029269e0fc63d11", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676680083, "uuid": "07914374-7175-41a7-b6d8-cde67eeb57ee", "comment": "Malware payload (Amadey)", "value": "caa72a770d74526839489141b584a4c152850610c84fed33278e265d5ec3b76368a87bc74b92a1ba5863f603a77cd23a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676680083, "uuid": "4005d9b3-0385-40f6-a1cf-56542fdce56b", "value": "T1E1F4120BF6FD4062EC7057B059F642C31E367D625ABD838A234E9D692C72664B2313B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676680083, "uuid": "32468506-f763-4cb8-9ff6-e920adbb3ae6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676680083, "uuid": "2546f05b-c938-4c67-b0a8-5a56e965be88", "value": "12288:TMr2y90sIvN0NPr6UhbEPH3H0I9NJlNTQU6XPCV9vtg:Zy1K0NWUVgH30+NTQUiPCVxtg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676680083, "uuid": "94016cb0-ad81-4310-8bf5-3dbdebbba6fd", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676680083, "uuid": "dedea322-c0dc-43ef-a120-979676bc45f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676680083, "uuid": "4e155f16-f330-400b-a369-8ef608903ea2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ed77e16-af61-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676706906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706906, "uuid": "c62466af-5f09-4f08-8192-e45c3b619808", "comment": "Malware payload (Formbook)", "value": "a4bf9c0b98bb6c36ad34ed7f3a07d152", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706906, "uuid": "7515c574-c452-4fd9-9372-678a9b8c41f7", "comment": "Malware payload (Formbook)", "value": "f9f4fd4f5d3061c13a6e3cb727e5076207957ff2c0990c2ae8c842a23a4af7de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706906, "uuid": "fcb2b7f1-401c-48d7-9286-734c6b2d071e", "comment": "Malware payload (Formbook)", "value": "c9aa6524c371ce30736d9c36c350c8ef2f46fc7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706906, "uuid": "e36cb2c5-e4b8-47c3-8933-bfe070ad1779", "comment": "Malware payload (Formbook)", "value": "b16ee7bef480cee836885fe8f5068a18e71f14f24716b0039e2acd9fb7f979097d60ccaaafa59a2bf99c656780afeeb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706906, "uuid": "4b28d81f-8903-4c4f-ab50-fb5594e7872d", "value": "T1D1D41247759A6352D29C48BC6EF6D44F32F162C36722EA1EF66426132F2131A4D27ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706906, "uuid": "162d605c-755c-40ac-94e1-d9dc1f82fc29", "value": "12288:25yo/t3qGhHsu5nlTDMC9Mofh2LOQ+wTfo9zFBF:2ntDMu5lye2LOQXLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706906, "uuid": "9aa27a34-140d-4ecc-9012-a398e12dfaaa", "value": 654848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706906, "uuid": "1ea59fa1-4a97-49a2-99a2-bb92c044c79a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706906, "uuid": "24867a0b-ec7b-498a-9ca3-d9ab64c89a1e", "value": "FedEx Express AWB#5305323204643.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a73f6fac-af61-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676706947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706947, "uuid": "a8d9ce2b-bc88-4daa-8e7a-754655e3f143", "comment": "Malware payload (RedLineStealer)", "value": "02d66837a796fab23cdb600e168a6594", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706947, "uuid": "43f51341-a550-468b-97d8-0f2ffdf846a0", "comment": "Malware payload (RedLineStealer)", "value": "fa1894cae66e526e056ca8733144a079b1e49eccd72d1e1a71d395884c11b765", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706947, "uuid": "7d060b5c-e009-46e8-8161-7977b55aa683", "comment": "Malware payload (RedLineStealer)", "value": "071b6c798aff86fb6d1d11e4ccf2514e8922d912", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706947, "uuid": "306e1db7-e767-4eca-b2c8-782db5f2cab4", "comment": "Malware payload (RedLineStealer)", "value": "4a5c28f25399bc044a7b2557e09872d6a2ed3c3609879745ef858c85dac3956dd342f81de9f78293bd26520cad682381", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706947, "uuid": "b8c4f7d5-3961-4ecc-999c-4cbfecf1f4e5", "value": "T1D24401027ED1C076E763D671DC70C668AB7A3C524BB289933794036D5EA13D1AF3632A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706947, "uuid": "74857601-497f-434b-b8b8-7db783d74124", "value": "8cdad4eae189848d90763fd3d82d253c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706947, "uuid": "e2b9b130-5f83-48a6-a332-0a9c66d7a97a", "value": "3072:3g0tYU15EQN+43mvKyYEpOPFMvDxxQmfuY8Z0CYJar08/VYE6Jb89B/6xSc3bqJx:3ntB15EIJ+JDwK9KWPbAVIb8binGuh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706947, "uuid": "6e967243-9a9c-42bb-a810-095c0167f529", "value": 265728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706947, "uuid": "ed8f8ceb-1fac-4eeb-8328-b38617654b41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706947, "uuid": "05664664-9e6b-4a4a-ba8d-98da0badc020", "value": "02d66837a796fab23cdb600e168a6594.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f68d041-af68-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676709698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709698, "uuid": "f991c9c3-8242-4129-bf64-bb917accf7e0", "comment": "Malware payload (AgentTesla)", "value": "69ac3bd7730143c4de8d0c45aae21c14", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709698, "uuid": "b36501a9-dae2-4b29-9886-2f16f309f4ef", "comment": "Malware payload (AgentTesla)", "value": "fa327eb414f52ebc86e3f0180ec1befaa76c4d6818afcdd83a22a992cf764468", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709698, "uuid": "f526b708-9886-4701-8fec-1adbbbc8d027", "comment": "Malware payload (AgentTesla)", "value": "69278e6ca3395b762e8a83a27deb0d87e92d8292", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709698, "uuid": "4b8de66b-9c93-4a35-bddc-3f6904d73254", "comment": "Malware payload (AgentTesla)", "value": "cc3bda959926fc99f5c9d3786e45f70e3379ce1e25f51cedd6ee3f0f656783303f434ef073ba3ab4fd6685ce6d244dc4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709698, "uuid": "36132160-4622-454c-849c-b68e8c33caeb", "value": "T1F4E48D9D90F0FB3ED9098EF9731036441BF092032E25D5E9C7A5F2C55B3A363199DA2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709698, "uuid": "2d3a3125-6a13-4900-b399-372a44d5ba4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709698, "uuid": "59a63a7c-68c6-4830-8afb-39275b7927dd", "value": "12288:TTyLWaqDSu2GCPQaOjuPexWxlpZMxwkC7zQu+mb5g6n:/yLWaqDSu2v9Su8WT8XC7Z+AH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676709698, "uuid": "04702a55-4bb8-482e-b9de-803db1688aff", "value": 699392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676709698, "uuid": "0afa8810-1eff-4c4b-b10f-aab75d0a872b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709698, "uuid": "7e6b34e4-c2b0-4703-a3df-9b203464f5d8", "value": "69ac3bd7730143c4de8d0c45aae21c14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a0115d3-af60-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676706361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706361, "uuid": "5d294250-95ae-4b3a-9688-3808104f4d96", "comment": "Malware payload (SnakeKeylogger)", "value": "16c1a7d33b753abb81cc676188156e0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706361, "uuid": "6320719e-5e33-4b76-a0ef-046913bc7cf6", "comment": "Malware payload (SnakeKeylogger)", "value": "fa818886b9089f413d7f157105d8343bde485e7023c3127dcbc6a1a123dddee8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706361, "uuid": "aaf2c79b-1a12-4da5-9fe9-db0f7bfcc1dd", "comment": "Malware payload (SnakeKeylogger)", "value": "3a217b90955cce590039ad4d4e49aa53c6560a37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706361, "uuid": "57cc23d1-eb5d-42ac-b53f-311dec7bf0b0", "comment": "Malware payload (SnakeKeylogger)", "value": "180a5d9b6b06846b7934c34d1f9192b98bdf93393b13174b37912b4fe159f24e3405194c88badacfffbecbb8df3c6b31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706361, "uuid": "a77043f0-4d17-413f-a581-c9c1445ab444", "value": "T1EBF45A8CB1F0F6BECA06CC76AB103C14ABE0655367268593E267B6D95F3D4538E1C4B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706361, "uuid": "2cbb797a-be34-486e-bfb9-d21386bf0236", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706361, "uuid": "21bfcf94-d95f-4270-9ca6-d9e0ba67bffd", "value": "12288:FtqDSujDsv9tEIIg8MoK0ZWBQGoihezej01g2BZmg14hBt3Dsv9tX/pMtoRn1n3K:FtqDSu3ooKwWCV6462vmnhOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706361, "uuid": "cc82166a-28a4-4cfe-a9c8-b35e02f9d025", "value": 763904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706361, "uuid": "144a0178-3b00-42c1-95a0-42b7535f7e45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706361, "uuid": "bb1de404-3388-4886-a180-a15d7ab4903e", "value": "PAYMENT ADVICE.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1874641a-af6e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676712290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676712290, "uuid": "e8fcd41e-9809-4b68-88bb-1eda0bae4067", "comment": "Malware payload (Formbook)", "value": "758832b759363ef7cede25938706a993", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676712290, "uuid": "ca09d79f-99c8-4f59-9861-a4ab1bcb5148", "comment": "Malware payload (Formbook)", "value": "fcb81b7e03763011975b1381444933c091ed58d8bbe4741b68f994dbe288d72a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676712290, "uuid": "0e86a8df-2163-4408-94fb-7a540b5484a5", "comment": "Malware payload (Formbook)", "value": "de880b21096c0b7338f8302c998d6faf29b18d5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676712290, "uuid": "5620e336-74e2-4952-a1d9-02eaf77f024f", "comment": "Malware payload (Formbook)", "value": "7f2dd453ef09d72855f336549e481b4ecae1d26df444d2c32da2d69682ce3dd6598eadc504958defc1abec8e865ea2f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676712290, "uuid": "e924924e-b4aa-46e0-9923-82974a305e07", "value": "T13D75BE5ED5B35F8FD2694A38940E0E023026C3C699BDDB496A9BED3C319458FE379231", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676712290, "uuid": "50b53b7a-229a-41b8-9af9-0a024b2d637d", "value": "49152:6bUutV0yQAP+exa6P9xICuZKnJ6CV6ZRwA015Tdy+:6b3tG3AP+Ia6P9xICsUkCV2wAK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676712290, "uuid": "86bc466e-3843-4a5c-8108-53f3cbfc2dc4", "value": 1587200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676712290, "uuid": "8e01b22a-d289-48ab-b8bf-e015005bc9ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676712290, "uuid": "821e2db7-1c98-4d47-9b8b-da9232bbeb3b", "value": "ZOuafc421V.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8995c061-af69-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1676710333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710333, "uuid": "55c42780-2d09-47e3-a0bc-86f4fb06b103", "comment": "Malware payload (Rhadamanthys)", "value": "2c4dd405bfea890ebac5995c194e54cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710333, "uuid": "cedd0cc3-77d2-4235-a529-3ad1aa3cf1dd", "comment": "Malware payload (Rhadamanthys)", "value": "fd77a789e1cdaee10a146bb935c8a29515a009316f1dbb9e99789eede43e3189", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710333, "uuid": "9a791d41-7767-4c51-b589-78807e0785c5", "comment": "Malware payload (Rhadamanthys)", "value": "594e12bdda0bff6799c29dc46dcbc6e8e24032bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710333, "uuid": "bd1a6d8a-78c4-48d6-acf3-619816d5227a", "comment": "Malware payload (Rhadamanthys)", "value": "37d07dfa604a28d38ad1cef8a7cc5e9b59ad5c8018f80383272000e118790b23f625dd2c70f469f5e061909ddabbeb99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710333, "uuid": "c09539bd-86d2-4121-a04e-61a0a79caff6", "value": "T18044D01376D190B5F12246358E66C7E5AA3BFCA18E796AEB3784453F0E742D3C722312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710333, "uuid": "6d22793a-7c77-4bd6-8826-048601a7f672", "value": "29a62d14d89b432fd6115525abce5c2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710333, "uuid": "4de5d5a4-66bd-4681-a534-e1fe721162e9", "value": "6144:i7ZG0VVOcCJUd+DUG2DDbW1bgAbFKhoFJFOxvre5:+ZNkJUdpvv2blbFPFfOxvC5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676710333, "uuid": "e1f9eae4-b274-490b-b58d-bd6753094520", "value": 267264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676710333, "uuid": "7c768de6-62e4-4dc9-a804-f1ce982eb9ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710333, "uuid": "8c254899-3e1a-4774-9be2-33c29a8b9feb", "value": "2c4dd405bfea890ebac5995c194e54cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34e6ee78-af86-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676722646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722646, "uuid": "0964d286-16ae-4e88-a0e0-1fdc2c983719", "comment": "Malware payload (RedLineStealer)", "value": "b8bf46852fb879ff294e00dac6b661a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722646, "uuid": "99ae00c8-725e-4d59-b591-f668d4c468ed", "comment": "Malware payload (RedLineStealer)", "value": "fe0387444350daadf8239f1e7507068c517e0eb9d821ce3fbf1ba61221ea5fa5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722646, "uuid": "74500300-93dc-4b2c-bcc7-fbfcced07f15", "comment": "Malware payload (RedLineStealer)", "value": "6f6581c7fb728aaecad6a1e74f5d5381f7b333e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676722646, "uuid": "ad9ff2b2-da8a-48a2-8361-cfb42a223f89", "comment": "Malware payload (RedLineStealer)", "value": "25f2134aad32f6a5eabb178abdad5301bbfd04126cc007b1b8fe3293c981f93221a0891443e2800befe6a9afbc21296b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722646, "uuid": "c48ee474-6de7-446c-bec3-cd1a6a32cc1f", "value": "T151C41207E2E89422E8B5277019F707D30636BDA26A3457A7678F3D590C73924F6313AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722646, "uuid": "2985e43c-1b28-40a1-a84f-f2fac52042d3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722646, "uuid": "6c0c56cc-89ef-4b55-a1c3-7668c8cca405", "value": "12288:EMrBy90D38aUzfaqYgjntpbD75QfkTkGoyJQ2EM06W:FyWUgoFzTkGj+LM0L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676722646, "uuid": "63bea5b8-4772-4a2c-9812-0a281a4e036c", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676722646, "uuid": "1c23c6bf-8a6d-41d5-8764-2f34f33b73cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676722646, "uuid": "72423679-b9d9-4539-b71f-2415762cac97", "value": "b8bf46852fb879ff294e00dac6b661a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b41740a3-af61-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1676706968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706968, "uuid": "fb397206-c9d5-4bb6-ad81-d89d3cd10588", "comment": "Malware payload (GuLoader)", "value": "6a0adf0c138bfd7c14e96af316833273", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706968, "uuid": "bf49210f-e37b-4d1d-8e81-79e082b07942", "comment": "Malware payload (GuLoader)", "value": "fe436f5ba9dac240c57881c7b5a93ce1f0d32aa3539f8942beacb529ed7e30db", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706968, "uuid": "adfad584-d801-44ff-8e36-b773f2c54b78", "comment": "Malware payload (GuLoader)", "value": "d531e7503bd267a125081fc01e0e6dce462f1d4c", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706968, "uuid": "0c72d8fe-d7c9-483e-86e4-42f6cc2400a3", "comment": "Malware payload (GuLoader)", "value": "fc3181bf0c0ad02738cf79bc8a1c53a9d4db88fe47162bdcd96896822b24b8148c61c3c51ffe0c499b07d0e4f9600b00", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706968, "uuid": "2147f60a-774c-455d-baea-b6d34fcd56c1", "value": "T191338D9598420C7B48CA6EBDCC91ACD4C495143CE423342E7B597B4EA2151E8FEEB1EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706968, "uuid": "c403298e-1ed3-4f96-acc7-5fb04f42e61c", "value": "768:hfDplVlHhH1cfAqsFHuBX9gSqv/uJ6fYR0pMuAfn8cUddSX:5D7V9F1cfu/vjTpDTbSX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706968, "uuid": "d5235917-b258-4be4-a66e-fa1f251df1c6", "value": 50139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706968, "uuid": "a26f388f-80bc-41f4-bdbe-b40c3ce8cd5e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706968, "uuid": "4dac001e-d51d-4fdb-8930-39cf95b02849", "value": "Excel_9912202816310TD01_20230228_17311 XLS.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90a91448-af69-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1676710345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710345, "uuid": "ef7157d7-46c6-4eb1-8286-1821c38dc08d", "comment": "Malware payload (NanoCore)", "value": "7d3cb083ed0a645e0b251f5629563da9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710345, "uuid": "614a4248-4fd6-4eb8-8819-88471ca9e234", "comment": "Malware payload (NanoCore)", "value": "fe5177bffbd98100bece2b8e96344b26a7c39b33dc919c6841b0f95e802e0438", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710345, "uuid": "5cac70f9-4cad-4ab0-bc0a-e70ed144c1f5", "comment": "Malware payload (NanoCore)", "value": "ebe9a4c7cc10453b3afaada802104fcdedc3739b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676710345, "uuid": "ec153a74-928d-40b0-879b-68f65737bf9e", "comment": "Malware payload (NanoCore)", "value": "65021678e33832703a8f24c9fd58f06ad316802879c7e1f66fc2d986e971d81ea70007cd391b1e07243efdc208fd0d45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710345, "uuid": "5783c367-0466-4624-9be5-2bcb345d1349", "value": "T1EFF48C8CC4F1EA3EE6898EBD231436081FE059432B22C9F5D3E9FAC15B36663495D635", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710345, "uuid": "b25da3c1-20f9-443b-aded-a6217500d05e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710345, "uuid": "462b66d7-f93f-4191-a251-1a2c18b3833c", "value": "12288:6qzGPmNJXYiH2nM79xn6+dkgUdaRElQs/HaSML643OU++LmDJymqDSugDs+9t:/8iWnMnddkgUdaCQs/tV7VDJymqDSu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676710345, "uuid": "eb86b32c-f03e-4377-b3a6-af3ca5dcdfe1", "value": 760320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676710345, "uuid": "0cab2052-5934-42bb-9493-c559fdbc0753", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676710345, "uuid": "47236b55-75a7-4964-82cf-f3cb3bef1d84", "value": "7d3cb083ed0a645e0b251f5629563da9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "154f488e-af68-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676709708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709708, "uuid": "13c79a58-60b7-4e59-8da2-56d8a15c308b", "comment": "Malware payload (AgentTesla)", "value": "db3768fa07b6e3f673b962644fd3bea2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709708, "uuid": "fcdb4513-d7b7-4dec-84d9-99edd6af3b0d", "comment": "Malware payload (AgentTesla)", "value": "fe8ad5aefb473a10223ebc4f1a2be102a064519a09137f173562f0491b4dc2aa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709708, "uuid": "d0dcbdab-dcd7-4c5d-8843-b4c35ba1a957", "comment": "Malware payload (AgentTesla)", "value": "beb242722ee48fade0eb54fe2509aaf1cebd88dd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676709708, "uuid": "f5d90898-eeb2-45de-a4f0-af3ac99b87c7", "comment": "Malware payload (AgentTesla)", "value": "c40c9e28dd86b6345c9745d1991823f0ccefc8102fe1077448ea8b5aa543febaddcd503b640a49e2bfc8d64495e0390c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709708, "uuid": "292b0bd9-1f30-43d9-9984-ab344911e2bb", "value": "T1E3E49DCC80F1EA3ECB498EB9371031081FE05643A920D9E6E3E6FAD26F36563599D535", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709708, "uuid": "c91e10be-6169-4b66-ae85-73e1a6ba91c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709708, "uuid": "050cd9ee-db01-42fc-85a0-aa9824bfa8f9", "value": "12288:ubDOqDSuNDsv9tHKScMOAK/g+fOHm7JDsv9t:ubDOqDSukXnjK/pfOG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676709708, "uuid": "983bbe7c-f952-41f0-ac9d-1043f8cbf77d", "value": 697856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676709708, "uuid": "02ed0d6a-5903-4d4a-af01-ff771398b38f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676709708, "uuid": "dba2c5e9-11b6-4299-b100-6ed70643d985", "value": "db3768fa07b6e3f673b962644fd3bea2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89547e32-af61-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676706896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706896, "uuid": "2ff7295a-ca00-4bed-9f87-e1d5c90d75db", "comment": "Malware payload (Formbook)", "value": "180354551d5e53f352dcec84947b768e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706896, "uuid": "1e69aae4-59e7-4c92-b0ce-30c94fd0fab6", "comment": "Malware payload (Formbook)", "value": "fe9d0f0d6763e8c4ba37980718f150dd682fa75bb1a186a364504a6a7e8e4aef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706896, "uuid": "160f2f3a-f452-4bfc-9271-7af8b6ea97e9", "comment": "Malware payload (Formbook)", "value": "445fa17b0ccf2c64b146aa5438c346e067a647e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706896, "uuid": "13eb66c5-e267-4ddf-a26e-0b9f9f901220", "comment": "Malware payload (Formbook)", "value": "01201e3a5cc546ea2bb17bd4b36fee920c794641f92931965caa1d87431bd8563818ca79d48bed14b90c226d8b9eed2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706896, "uuid": "a10c43ad-b75a-4b39-9d37-527b1e99c6bf", "value": "T1AC64126476A0C4B7D5730A314E35778B5FA46C22682AD20F3B247E8D7E716C0DA2F762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706896, "uuid": "1bf1de8c-726c-4c59-bcff-857f40f3a904", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706896, "uuid": "e88b0d24-612e-4aee-b8e6-f2033165d0b6", "value": "6144:tYa6rOWj4BhRA43ZtCtpCOr78smz8jJJ241gHPioi4wtYF4hoq+F:tYVrYU43ZqYOpJJJ24IiN4p4ml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706896, "uuid": "97495caa-0078-4c6a-9bdb-c35abe1c9785", "value": 309005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706896, "uuid": "fe643fb9-e961-4399-8e66-362362819200", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706896, "uuid": "ebe1fa10-81a8-4f9e-93fc-40cce847ae3a", "value": "Hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1d4aeaf-af63-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676707877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707877, "uuid": "a19ea64d-9e94-42fb-a7e1-a96cce76d4e5", "comment": "Malware payload (RedLineStealer)", "value": "8e26b29c24a3e4c2f7a1f19824a9b75f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707877, "uuid": "bc5fae1a-0fc4-4a63-99b4-0fbbd14ee6cf", "comment": "Malware payload (RedLineStealer)", "value": "fea3ac5418f1219759ecc070e557db9a823dcce64a3bd7d24a0efb4cd8203112", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707877, "uuid": "7e3e0afa-5d37-4d57-9a5c-92674d96ca6c", "comment": "Malware payload (RedLineStealer)", "value": "1e37c552238192bd272d3f0a6091ef16a1b660a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676707877, "uuid": "c01725ea-17f5-4886-94af-f753cd8e9658", "comment": "Malware payload (RedLineStealer)", "value": "a9c0a1cb1da696d98c01535d224eb8e061e242495e42b57a1697a3742a00d77afc913b6cfbb96dd59846819568e91303", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707877, "uuid": "4ad1472f-3fa4-47b3-99a5-2571a3e472bb", "value": "T1C1E4121BA7FC8421E9B5577518F603C30A39BE615B35839B179E6C1E08B36B062353BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707877, "uuid": "098607e7-1258-4177-b79d-16df0d1df082", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707877, "uuid": "b4148ea8-2fae-45c1-a5b1-e9c2f69b5139", "value": "12288:kMrRy90GZ5PFVkE0hWF5XnHabdKxF3z2oigmOjVtHNBPnVNRt4SHZ:dyRdVkNWF5Xn6gxpCg/VlRtV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676707877, "uuid": "d102f65b-b44d-4a1d-ab82-5b4d0d5f5807", "value": 676352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676707877, "uuid": "28a52b32-4968-41e7-8e6c-23227a5f5ace", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676707877, "uuid": "ce8dbf7c-824c-46a3-8011-701644f2abaf", "value": "8e26b29c24a3e4c2f7a1f19824a9b75f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d73a46a5-af5f-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676706168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706168, "uuid": "dc48ba84-e358-4f37-bea8-0e014119516e", "comment": "Malware payload (AgentTesla)", "value": "aa4a552ad62a3a6f44f3682f399edadc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706168, "uuid": "b8ac1ce5-f3ba-4373-87d5-8f27feefb398", "comment": "Malware payload (AgentTesla)", "value": "feb28503309c731d3ba4fdb70a6995558110b92151460258b9ecb9425ec8e9dd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706168, "uuid": "02769808-45cf-46b3-9f93-4206dc26b263", "comment": "Malware payload (AgentTesla)", "value": "ed01996b1f6ae82750b62bc223b24e0301789943", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706168, "uuid": "c7276143-5be4-4b21-a190-8aff8abe4bf6", "comment": "Malware payload (AgentTesla)", "value": "32f43e379c91d9c3b0b682cb53f243fc5e899cbaadd00eebcf904873b8ea387f94c44931579962de3675817827a07cc7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706168, "uuid": "2c3b877b-e6bc-4f07-b98b-4a65387c1769", "value": "T13B55020BE172EE2BCF17C67CCC5F348282169CB89E69870D3156B3195A353E1217EA79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706168, "uuid": "2f9d755e-86f6-42ae-89b4-6063ae89d82d", "value": "24576:cFeFIoAXZSgc5IFeZ3k/5hwmAXZSEbxWcPHR09i/bsnXeb2Pqkc:AuUEn2k3kreEkVp08/bOFqkc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706168, "uuid": "8a13c858-ba8c-4a24-9d95-ff822fa6295c", "value": 1312768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706168, "uuid": "d8a599fd-fcdb-4beb-a609-ccb56cd3d0d1", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706168, "uuid": "1bf00035-2786-4493-b387-4c6b4c334f93", "value": "COMPROBANTE DE PAGO.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c65c22bc-af5f-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1676706140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706140, "uuid": "5070e751-7565-4d09-bd98-91c080ce461a", "comment": "Malware payload (NanoCore)", "value": "46b24f5953890be086d7f16a7f37283c", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706140, "uuid": "31671ece-3e71-4140-9d77-17b8e2cddca0", "comment": "Malware payload (NanoCore)", "value": "ff3e16e6d69d65ef3d9be011d02aeded9d83f6cdf0e14c76ce58a1fc0e19b2c8", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706140, "uuid": "a9c723cc-e82e-45c2-97bd-791558bd640a", "comment": "Malware payload (NanoCore)", "value": "e6c76e0cca31648bb8db54c7624ea993de1bb871", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706140, "uuid": "97694914-f553-48d3-b513-9bb1822542fa", "comment": "Malware payload (NanoCore)", "value": "2990b458146a7d9d923a15cedcc01afbfb9d35f991011e903f7de637eef2b46ca9ffb3854c786493ab98cc84e80dbcd6", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706140, "uuid": "fdddde63-b9fb-4cb9-bd64-82261120dd7b", "value": "T17C03F75AE79F0265CF5112B7171B0A889AFCB33EB35151A1746C933433EDC2E4266ABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706140, "uuid": "fa165440-22e7-44a5-8b1e-2ebef4d65fa5", "value": "768:/Fx0XaIsnPRIa4fwJMdQgfezwSc2BNjKB4Qd7PJJAe51:/f0Xvx3EM2sScyu4iJJAe51", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706140, "uuid": "3eaafc29-a4df-432c-aecf-159f288329b1", "value": 40668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706140, "uuid": "84842d04-394e-49b3-990e-a144dcbb26f1", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706140, "uuid": "95515f08-f476-4eea-b4a6-edb2bf98e168", "value": "INQ ORD45600.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa3c3cea-af95-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676729420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676729420, "uuid": "c1961358-51f4-45e4-82c9-cf94f96ca275", "comment": "Malware payload (AgentTesla)", "value": "a2482e9269c8002073ec13d12e661fd6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676729420, "uuid": "be099097-9323-45f1-af95-96295af5cef8", "comment": "Malware payload (AgentTesla)", "value": "ff836c380d90efd7df3619d2aeaaace64fb057413e4330a6ddf2f9d147a64f57", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676729420, "uuid": "b45334e9-2be2-48d3-b63f-e40700d209d1", "comment": "Malware payload (AgentTesla)", "value": "4a84707cb347f35b7441d99b0bda62d99cd41ada", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676729420, "uuid": "ddba987b-f83a-4c86-a2a1-3bda8a24a021", "comment": "Malware payload (AgentTesla)", "value": "c1f024a2bc97f9d0c56c58d62bce27b2e6b561d1c3b69673fd8657e0bd77856e8c2b99e821281dbb7a2aea83ad153fec", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676729420, "uuid": "5bfdbb3e-5c20-4503-a125-f7296ca41755", "value": "T195B423663A7DEEE444F256B976A310EFE1FC4D308D62E2A5ECEA087523A717C502D434", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676729420, "uuid": "94b04d15-6721-4b6f-864b-59e08419bafc", "value": "12288:BKT+tGnxH2WzVGUmzlNY/DD/t63ica2w/bOyGHo+M+ycoO:B3WHnkZDY/DZoica2w/bVOoRq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676729420, "uuid": "03836ffe-8b62-41e7-ba84-bfeec2cb48f0", "value": 513025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676729420, "uuid": "a14ee590-87fe-4af4-8615-bc27bfdc901c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676729420, "uuid": "66971544-453a-4e69-ae8a-e8da1a00d270", "value": "nCita_pdf.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa4f02d9-af61-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676706952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706952, "uuid": "841274ea-6047-4f6a-a2ea-e68ecdbc72df", "comment": "Malware payload (RedLineStealer)", "value": "011ac118a65e39743baa8a4d6f765d7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706952, "uuid": "ef1ffb4e-96a8-47c5-b481-f89455363d4e", "comment": "Malware payload (RedLineStealer)", "value": "ffc503e35e7884be31693005500cbf89858bf9d8017e3b10ac2144d0692c7929", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706952, "uuid": "56ad8ad8-5712-4956-9c99-b651f72bc0cd", "comment": "Malware payload (RedLineStealer)", "value": "e1e21379d7a1e9c0936f32d4dae9edca84e45896", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676706952, "uuid": "3542cf0a-4a05-4e1c-87c3-3568a996cc00", "comment": "Malware payload (RedLineStealer)", "value": "d74879c9a40a79769e53071c8fbce56b49601dbd31a81d18b8ac151d3e430fe304016c92059db4977a13de5a17fbc834", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706952, "uuid": "03638b6d-fb9a-4924-9704-d7899615c5c4", "value": "T1C8B40247E6EC9022E8B52B7019F707D3063BFD606A74829B220E6D6A1CB3574B631777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706952, "uuid": "516c5d96-5ac6-4ae5-93b4-265673404e59", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706952, "uuid": "9ca69f2d-7b0c-408a-b099-2b5e76402e54", "value": "12288:uMrWy90TbRne73b6DfEp5IDs4qxxLYhO+Fw8XMhR/vF8awpbHMc:cykbRerb6jEp5K62FCdxwJsc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676706952, "uuid": "eca11f31-b00f-415c-b98e-1d31d30ab1dc", "value": 540160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676706952, "uuid": "18dab027-3113-415c-8a0b-c19d50729702", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676706952, "uuid": "aee011a5-60d3-4abb-85b4-1271319dbd41", "value": "011ac118a65e39743baa8a4d6f765d7a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }