{ "Event": { "published": true, "date": "2021-08-21", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-08-21", "timestamp": 1629590582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "103cb05b-adc7-4055-a6e3-fa77c554f5f3", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1ca6f16-02b3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629573242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629573242, "uuid": "61ae6daf-37ef-4bc7-8be5-9541d194b33f", "comment": "Malware payload (Mirai)", "value": "ddd233aaa466f6222f718a4e563603b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629573242, "uuid": "a6686ba8-bf5b-41fd-8f24-98380785242c", "comment": "Malware payload (Mirai)", "value": "0046ab40d47af8901e560f4ca2d76dba41a4f6d5b458d528e57865f3f8942067", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629573242, "uuid": "1bf6388e-dc82-4689-8a2c-ff44e0762acb", "comment": "Malware payload (Mirai)", "value": "8c6d9e00c8ada798b3ff2a48b649885e9b58c1f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629573242, "uuid": "f300b9b6-d5cb-456e-8e7d-d904664dd96d", "comment": "Malware payload (Mirai)", "value": "d05bbb3c198a3c79447f0b81b61f769aaf5fe6165afb090024c47039b4de9a732b548d5fbd3d10269f6d70d4bdb520e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629573242, "uuid": "2aa73ebb-bf1d-4855-834f-fc40dffee457", "value": "T17B82D1C962839D01D57C4C335BCA83A6321BD1C99A6510F849D8D846793EC839FAEEDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629573242, "uuid": "2e21e9ad-fd01-4607-8d65-c0f58af5f49f", "value": "384:+hPXV9mWNt7VhW5RQCwGDc2y6vSrjHHsjQmdRZ3hTp/ftBl:+hVt10R8F2y6vcjnOZb3dRl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629573242, "uuid": "fc07bbe9-2a5d-4cc0-a2d8-0d2460cf524c", "value": 18112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629573242, "uuid": "62e8dbe6-59a4-4512-82a1-5ac355ab1b0b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629573242, "uuid": "8d6446a8-4238-4d45-aa44-7ecfed12eca2", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea4b137a-0215-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629505368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629505368, "uuid": "087ca4e7-1ab2-424d-823c-3885bbc90370", "comment": "Malware payload (Mirai)", "value": "33f687ddfdd782983ba62d655c032b42", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629505368, "uuid": "604b7924-6d0f-4fb1-8fd9-616d6ad89bd4", "comment": "Malware payload (Mirai)", "value": "022b25d6252548ee346adb10f5692ff5993fb145b05009441e5eb1f543715072", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629505368, "uuid": "8f8f15c5-aea4-44bf-9bb7-8c63c1bcdfee", "comment": "Malware payload (Mirai)", "value": "7a072e3d70e89dff65e11cc1a4b03ed25e0b814b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629505368, "uuid": "425491e9-43cc-4e8f-a5e3-dfaca3a00221", "comment": "Malware payload (Mirai)", "value": "67a5fbc58eaf2f1812ecfca9bf6903995d2afdfc14a572aa3ca01ad013fcc4f63c65db606e874e89d056798a90415099", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629505368, "uuid": "80e3a713-f7bf-487e-a34e-823b047177a3", "value": "T1AA737109AFA14FF7E8AFDC3349E91B4525CC651A22A83B75B930D428F64A64F14E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629505368, "uuid": "9b34392f-32d1-45b9-a53d-e079f430522b", "value": "1536:5b21YxcQRIXRHV8KjYv8tms64yKNbZ+yZUD9:h21Y+QRIXR6Kj/VNbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629505368, "uuid": "fe043881-4b14-44ef-8a7d-eb6d693d0398", "value": 76072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629505368, "uuid": "46d2d5d8-530c-495a-a262-3eff66d2a103", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629505368, "uuid": "9751c634-3d66-4ed5-beb3-68ed6ceabfee", "value": "33f687ddfdd782983ba62d655c032b42", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46d99e34-02c4-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629580256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629580256, "uuid": "d12fdb78-2ffa-4542-80aa-04bbc03b16ca", "comment": "Malware payload", "value": "1e2003b0beacb9a848550761522f4b29", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629580256, "uuid": "fb276fa2-0804-4dbb-b1d4-8bc7ea26fc30", "comment": "Malware payload", "value": "04102b759c04a2ae110276a0ca98a55d7c3ed504ba2f3bcfe33873df32e1ab00", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629580256, "uuid": "1014a1eb-63d7-4b60-b7e8-e203900f11ee", "comment": "Malware payload", "value": "504f24258edbae7eda0afebb3a010879e95de840", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629580256, "uuid": "4eb38ddf-881a-4c7e-86cd-8dc353b01921", "comment": "Malware payload", "value": "afb12588c191996f80f6e070748748dd5d3665e235aea73d5f8e478d5e2d3cdcb7ab5fc5ed21dacf39c5497e07d66586", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629580256, "uuid": "5560f3dc-3a86-4144-8450-29de6de24c80", "value": "T18125CE663114BA33E15D31324DA5D49005BAFE695C31DB4EEEEF3B64063EAAC3227247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629580256, "uuid": "9f36b38f-4c63-4f53-b19a-e6140e54df7d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629580256, "uuid": "53983e7f-37c2-4985-8ae5-01fd82a05302", "value": "24576:LWE2SV6iH+sQN4LRLwvQ+L256qZhCNr/B7uy6:iUdH+s8Y+aZo7B7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629580256, "uuid": "55dabfa5-f958-4a98-a756-31a86ec11e99", "value": 1024691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629580256, "uuid": "32e18819-23a9-4644-82d7-bfdd7cad70a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629580256, "uuid": "0d31f592-d3a8-4cd5-9bca-640ef678728a", "value": "1e2003b0beacb9a848550761522f4b29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9836708-0271-11ec-8fa1-42010a9c0011", "comment": "Malware payload (StealthWorker)", "timestamp": 1629544854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629544854, "uuid": "3a6adf71-24aa-4d5b-b313-42f6328375e8", "comment": "Malware payload (StealthWorker)", "value": "8a481e503ea29b01dc8869801be68f75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629544854, "uuid": "8d92e4e9-2a02-4a83-af37-0804f7ae403d", "comment": "Malware payload (StealthWorker)", "value": "05f2a5530c978ebaec2034ef6d4006b6c4a7d8fc38cb9050fb0aed955a391d79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629544854, "uuid": "07aad9a8-6f90-42f8-9c05-f0477ca504e8", "comment": "Malware payload (StealthWorker)", "value": "b45a17986dc41e7df31f123721e3afc66dfd48a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629544854, "uuid": "58176c24-ac8b-4368-b7a3-83c3a8bfdf18", "comment": "Malware payload (StealthWorker)", "value": "8c64a07bdd47269430cddf3ac33b2143ef43ee4748e8cafb6002992913820e872e9c178b21b4eba159b554388a66c6dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629544854, "uuid": "bfaedaec-69ea-4c9d-85bc-a0a30ed32128", "value": "T156549D20B7A0C139E4F211F4597DE3AC69287DB06B2450CB63D636EEA6376E4DD30687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629544854, "uuid": "07e76520-b2ba-4784-9b66-d7a67629f229", "value": "ad1c5bf15a899fcfef408e3485448e67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629544854, "uuid": "386d63f8-7da9-436a-8f8b-a36efb7108b2", "value": "6144:J0ifQKNKxQyH5L7XW+B0fol8UYBI3i26wzX:lfQKNSQyt7vB0foq4i26QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629544854, "uuid": "2ed7e1bd-0c89-4176-96c7-98603431776a", "value": 282624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629544854, "uuid": "5e27a607-f823-4116-99c7-8ae5209bc1c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629544854, "uuid": "cdcb00d3-add8-4c56-be3f-92ea996d7e0c", "value": "8a481e503ea29b01dc8869801be68f75.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7d0ce95-02b7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1629574943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629574943, "uuid": "2191518c-af78-4870-9819-2c4a510902a2", "comment": "Malware payload (TrickBot)", "value": "47c429f5e5c98cb341f8d75c8226b463", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629574943, "uuid": "11ff4470-6ce9-45c4-aa02-a928aac4bc4b", "comment": "Malware payload (TrickBot)", "value": "06933c7b3bddbb3d920172216f4886e811397ef933665ff700b3539774e000d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629574943, "uuid": "24bcb76a-9e04-473a-be27-431b0cf79552", "comment": "Malware payload (TrickBot)", "value": "345e2e19aee8d2fb12891f9e2ef798ebe85dbad9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629574943, "uuid": "482cfa81-b7fd-4b0d-b861-c1d3dda87d91", "comment": "Malware payload (TrickBot)", "value": "201801436cd075c9286d6789cf9794a5a5f7347b11b6ee43b5364e22b18fc6b389c32abbbc81205f4a51b83b0cc687bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629574943, "uuid": "287dbbad-8216-4a29-bbc4-d5c4609e7598", "value": "T1EF94E039B5F080B3E577023098F00B7AB6FAFC141B3197BB4B525B1D8C316B95926B5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629574943, "uuid": "38f920dc-95fa-463f-89ee-ac124962d7c6", "value": "a72f794c30711c44b7a2c83e9a1e7673", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629574943, "uuid": "9c30c1fd-bb99-44a0-aecc-1509b31322ee", "value": "6144:9afI6X0INk6tPbuuMcgUrRBIYG0CfARZgmaLb2jnI:sfXhk65bMJMtZKTGjn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629574943, "uuid": "35cecac5-2308-42f3-8d10-616c2f08bd18", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629574943, "uuid": "63598832-ccec-4f31-9858-4a4be721e1df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629574943, "uuid": "3e2c32a7-377a-484d-857c-4941d3e6afee", "value": "47c429f5e5c98cb341f8d75c8226b463.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f58fd678-027c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Alien)", "timestamp": 1629549626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629549626, "uuid": "ea16626c-454a-4c06-adb5-b831e1ce7a91", "comment": "Malware payload (Alien)", "value": "be0a0e5e44bfd1f88aacc9759eecb33f", "object_relation": "md5", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629549626, "uuid": "1df8237f-f338-4842-98c6-5af0a69182a5", "comment": "Malware payload (Alien)", "value": "06cd6615089297c72da04561ffd8c65676304aba74d684ab0559159effbabf4f", "object_relation": "sha256", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629549626, "uuid": "5bf7ce45-21e4-4503-b967-138d244bbc5c", "comment": "Malware payload (Alien)", "value": "115a112ab7ba770606b5a6dd64285351e578f189", "object_relation": "sha1", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629549626, "uuid": "69fb36e7-e817-486e-b576-25a983b01606", "comment": "Malware payload (Alien)", "value": "5ac894af1aa4f16e3ed69cfbc3b5586b0ead7a5b6a65e51bf09aeef408993397eaea2acd039df07f65d05dfde952e90f", "object_relation": "sha3-384", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629549626, "uuid": "0106cf2a-2af4-463e-be6d-5c0cd2d50da1", "value": "T1FAF53344A7D3594DC57742328287B30363662158BBDAA97F847F00A52CF7DA8CB0EDB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629549626, "uuid": "f947e158-9397-4ceb-8c0c-0af996734cda", "value": "49152:ADaiTrDeqky92+PpHiRuNEAaTvAz+dF7xxVQOoz/3sUJuzeaV3V1SAMLKCDNnC+v:ofeqF97A9TICdFlxOP5gt8LtNxdfD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629549626, "uuid": "4257002c-7d9b-4f86-9504-eebbf7fc5b2c", "value": 3338827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629549626, "uuid": "e9bc6b53-31eb-48fa-bca4-7810039e0c0f", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629549626, "uuid": "0fc8d149-bffc-4d38-9f91-5243241c50c8", "value": "AndroidGuncelleme.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87514754-02ca-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629582941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629582941, "uuid": "ecef1e19-5dc2-41d0-b681-7f7086b39b33", "comment": "Malware payload (Loki)", "value": "596fd3b53a765f98a38960301af17b58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629582941, "uuid": "8ae38be1-9332-4192-acd5-fa3cb69e196e", "comment": "Malware payload (Loki)", "value": "087cb4fc52df1c6d245ce0f1486b2c1d3020349d90546eff9700666facf694da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629582941, "uuid": "f4f19741-5b6a-425e-bd16-acc85f0bec60", "comment": "Malware payload (Loki)", "value": "5db45c9614b8c74eff8894e04a46bdb371d831f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629582941, "uuid": "3fa88fe4-a32f-48b6-a89c-cb2a4e08b4c4", "comment": "Malware payload (Loki)", "value": "12200738f9ce400e571b8912b93f7a2265501fe199352b9d035eb79df97e259d4cd782c585afc8c819cd70f11e363a29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629582941, "uuid": "72322f34-a6b8-4f92-8bf9-fb42e7578a2e", "value": "T1E0E4EF262385DA61E9695BB8E12023F017F1BC11F321DE4BEDE47CED7976AC14399283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629582941, "uuid": "e3c59aaa-a408-4300-a0a5-ce8e99d03947", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629582941, "uuid": "70f49905-5176-4655-b4b2-ac5103ba7e10", "value": "12288:TDwLMIDeK/RilfOKp/wEXlqpVT882DtX8QrYkftj951w:T0bKaRilfOiX4HTX2KQrYQ31", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629582941, "uuid": "23eecda8-02a5-4c5a-b469-90dd3ec017f2", "value": 703488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629582941, "uuid": "70e2172a-fd08-4674-94e7-afba65e49cfb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629582941, "uuid": "77f587af-f029-4a7e-bb50-bb9de100fea4", "value": "5db45c9614b8c74eff8894e04a46bdb371d831f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e30949e-02b4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629573343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629573343, "uuid": "e80ee55e-6420-48b6-8d1c-55262f6577a4", "comment": "Malware payload (RedLineStealer)", "value": "fb60e618c5573ebb1366c4b97ca615b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629573343, "uuid": "6d514fff-e78c-4a53-9592-f584a95fca82", "comment": "Malware payload (RedLineStealer)", "value": "09d043a7f289686e33b06b331ea2882c7064b9e2a6712dfeff1752e8ffb7ec43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629573343, "uuid": "e32aef4a-51ee-4edc-8778-4a0a117766b4", "comment": "Malware payload (RedLineStealer)", "value": "c48018f8e69d26a72dcc11e8540a17d0a3dffbb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629573343, "uuid": "0ef2682f-f14a-4be3-b6cb-63536585045d", "comment": "Malware payload (RedLineStealer)", "value": "8651571dcdb42dbca70b3d88f3d361160ee5a3bade3ebd784b29c5d608f40a03cb6e220f6ea197ea955472202c7901b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629573343, "uuid": "d2255153-c01c-4c71-a6a3-a4a6281bbd89", "value": "T126D4F120B2A4C138E5F612F459ADE3B869297E706B3451CB63C226EE66372D4DC313D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629573343, "uuid": "1d683368-da4c-4ce5-b36a-325f5de3014e", "value": "74369709aeb55fd7f8dd333fd3dc6eee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629573343, "uuid": "03c5637e-4201-4edd-a183-0082171528fc", "value": "12288:O+G+Lrt9RKCaadyS3F4qamGFI3p+KbPUsKdxsQHL1qD53IEnIBBg:LLrt0i4qamGyZ+KIsKdxxqDZIBBg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629573343, "uuid": "80bb0c73-a306-4470-b534-ca48acd7b280", "value": 652800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629573343, "uuid": "b038f5dd-0fc3-46cf-98a8-982973519462", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629573343, "uuid": "a708f6e5-fb08-4aaa-9bfb-f85d03e0e9b1", "value": "fb60e618c5573ebb1366c4b97ca615b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc8d8abd-0294-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1629559945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629559945, "uuid": "3f0dbc7f-a737-4a40-bbe7-d5a87be001c2", "comment": "Malware payload (AsyncRAT)", "value": "2052f8a29c37908d7f6566b803c17b53", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629559945, "uuid": "3824cbc8-5f0b-43dd-a461-e78f59588ebd", "comment": "Malware payload (AsyncRAT)", "value": "0c4ad26334219ff8f9e9d6925fb6a2beb950a4cfeb3e647e877298b227f9fdb0", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629559945, "uuid": "74f7f0bc-a005-4662-be21-bd282d6807a8", "comment": "Malware payload (AsyncRAT)", "value": "3e1e23c64dc5071ffd3d1e6100bd322602658650", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629559945, "uuid": "1ecc71fb-1d1d-46ec-a83d-34b831cef2a6", "comment": "Malware payload (AsyncRAT)", "value": "b77104a5f185c5a980d95079e1c18dfc1e033b65e4685899ffb72f9c825acd712e8b12741c22b5bd30573495fe74efcc", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629559945, "uuid": "267d5c79-59bc-4923-9fe9-e175b6ef1cb9", "value": "T105233C003BE9822BF2BE4F749DF251454A7AF1633603D64E1CC4429B5613FC69A426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629559945, "uuid": "b2af866f-4b5f-44f9-bafb-6f78f1a52d8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629559945, "uuid": "b8de0429-ed70-47a3-a275-335e0cee69d8", "value": "768:9uRPNTkAJFuLWU36z+Zmo2qASKjGKG6PIyzjbFgX3iwswiJ3rw7f9EKz/4BDZCvp:9uRPNTk85y2GKYDy3bCXSMiJbcf9EKj5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629559945, "uuid": "33c3faea-b65a-4314-b563-856f82dde69e", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629559945, "uuid": "d6a9badd-53a1-4d38-b3e1-866df1dad197", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629559945, "uuid": "391e53ec-8c4b-48e9-93d2-a2038d938bad", "value": "verphZ1W.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9dd000c-02b6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1629574544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629574544, "uuid": "253c57ca-aee4-4c04-876c-784cc8c37edd", "comment": "Malware payload (njrat)", "value": "a3fe854723ec37a910eb2c9924b941ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629574544, "uuid": "a21ca5fd-ffa9-47b5-90e8-1fbf12df563f", "comment": "Malware payload (njrat)", "value": "0d65aac1dc725db5e6893fb97b2e2401b91ffc7fd2903e7a3c476e8701e202c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629574544, "uuid": "48d6e592-0a36-41f0-9570-5f940b7eedc8", "comment": "Malware payload (njrat)", "value": "6e6120b5c83e5f997156d0a16b9fa8ffe9a983f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629574544, "uuid": "dd10708c-84ee-4e37-a461-d197c50a1d15", "comment": "Malware payload (njrat)", "value": "c284601f43b5e6c13a7f8c5e7c88cabdfb0e3145ec93b972f7c85a0dbdb2389f81bb9236992040cd31058c5e6ba6346e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629574544, "uuid": "82bc1084-0613-46df-b71b-8657853981f5", "value": "T194032A4D7BE181A8C5FD0A7B05B2D413077AE04F6D23D90E8EE564AA37636C18B54AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629574544, "uuid": "0a707601-4904-42d8-85b7-ca54d7ce4611", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629574544, "uuid": "aa3096b3-ff17-40ab-81a9-a5b39df4648f", "value": "384:Jste5aNitbFbOn0aH2ykrkmPbZ4znCSqrAF+rMRTyN/0L+EcoinblneHQM3epzXd:2t7MNWtkrkmzuDCFrM+rMRa8Nu66t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629574544, "uuid": "1320e227-9d57-4f0f-b04f-edf83b39b379", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629574544, "uuid": "a979722c-8544-4cdb-b5dd-c6787649d43e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629574544, "uuid": "dbc1081c-63ab-444e-93bf-2e546999aa89", "value": "a3fe854723ec37a910eb2c9924b941ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "454a5204-02b7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Vjw0rm)", "timestamp": 1629574670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629574670, "uuid": "316e7e94-440b-4a78-bb94-9b404fee2ecd", "comment": "Malware payload (Vjw0rm)", "value": "2d59355fbdada25c304edf911a63281d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629574670, "uuid": "f206fb97-f7eb-42de-a9c5-3838b490f3fe", "comment": "Malware payload (Vjw0rm)", "value": "0fe50396b25c43452630b9cac1e2ddda31a9358cb7be5e8145cf382fc6e8d95c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629574670, "uuid": "884fb95a-7a05-457f-a714-7299956d06ad", "comment": "Malware payload (Vjw0rm)", "value": "2200956e98b3b32e0693ed54af08b3372f541f37", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629574670, "uuid": "22d4be04-8c90-47cb-8774-e0f5330e79ef", "comment": "Malware payload (Vjw0rm)", "value": "8c37b93a94befc00012aec9aa24a7344a710796ac1ff0062641669b758b4c1a7276df780d07e4b049b8affee696ac138", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629574670, "uuid": "ccb6b4e7-de35-486f-abc2-3a6af8262395", "value": "T12042C096330FD9E5550C36A8159FCD638823A6850818F6A52841F71C5C3CBAEFBA155B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629574670, "uuid": "3e56335b-96e5-49ea-a4e7-b7335b518906", "value": "192:e7fID5S39Auo7+nPPl/zsgDkuRxl7VXbTJWQpPqWxFhXwaf5ybRqD+eLdOg:eTIs3Ro2lsgttrlFXRjhbjdB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629574670, "uuid": "3bb2ba24-a699-4b28-9f73-2cb630065b37", "value": 12732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629574670, "uuid": "393b0092-51c6-48c8-b0f8-3ae5d11a20ea", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629574670, "uuid": "b3b3eb81-fdba-4360-8ec3-775854525e33", "value": "W00902_Invoice_Payment.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26596a53-02b2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (BlackShades)", "timestamp": 1629572471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629572471, "uuid": "62d84247-f1cf-4f6e-b0ad-997b3b2e1004", "comment": "Malware payload (BlackShades)", "value": "e967e5778bbce368c0786e990cda6417", "object_relation": "md5", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "CollectorStealer", "colour": "#76C79A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629572471, "uuid": "df5abf72-f075-4765-89b0-5a74fce0bd83", "comment": "Malware payload (BlackShades)", "value": "1012f81b764e19da221657cbf5c400063faef8f97d82ccc1c7b1bab0921aa85b", "object_relation": "sha256", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "CollectorStealer", "colour": "#76C79A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629572471, "uuid": "7ef312bc-f6bc-401b-85c4-c363bc58f747", "comment": "Malware payload (BlackShades)", "value": "92c06f11f52865d2c05a091d92907cc446b150f3", "object_relation": "sha1", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "CollectorStealer", "colour": "#76C79A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629572471, "uuid": "a02c0a63-7f34-4502-9838-662d739644fd", "comment": "Malware payload (BlackShades)", "value": "4de98af1c3a7526914c2568eecfb3e4ea62ebf7d3d3f79b1a690422a139438905e97f394b0b8b9845e074eb69f3185ae", "object_relation": "sha3-384", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "CollectorStealer", "colour": "#76C79A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629572471, "uuid": "902b7785-7a66-4683-8b5b-34554080fcb5", "value": "T103656B3D1AB92B37D179C365EAE44413F2D8981FF611EE567CDE03A7020AA4635C362E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629572471, "uuid": "8b64cccd-6e1b-4d37-bf19-f8a7c4154aba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629572471, "uuid": "26fa8949-2f05-4d98-90b8-23580dff0d65", "value": "24576:rrfP1Tok9Kc87buCPiCH3pSkT4gN38kOW8qdM7o+N4Du7Ec:Pd9KcsbDiCwM4CsBTWMpN4OEc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629572471, "uuid": "fe480187-81d6-4521-b5ca-bee43f804d8f", "value": 1510912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629572471, "uuid": "8262c1c0-7297-48d3-ad2a-81300df1dbec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629572471, "uuid": "b4e390b6-e010-440e-b61f-9f1f71a235eb", "value": "mixinte_20210821-092359(1)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13264faa-0262-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629538079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629538079, "uuid": "16232b4d-9a86-4631-b3c2-4c6222f30858", "comment": "Malware payload", "value": "8d17765168677ef76400b497fb0c0fd3", "object_relation": "md5", "Tag": [ { "name": "Corrupted", "colour": "#67412C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hunting1", "colour": "#439957", "exportable": true, "hide_tag": false }, { "name": "Hunting_21_08_2021", "colour": "#84DB15", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629538079, "uuid": "c9de3053-e017-4d1f-95bc-4b554eaf163b", "comment": "Malware payload", "value": "1091643890918175dc751538043ea0743618ec7a5a9801878554970036524b75", "object_relation": "sha256", "Tag": [ { "name": "Corrupted", "colour": "#67412C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hunting1", "colour": "#439957", "exportable": true, "hide_tag": false }, { "name": "Hunting_21_08_2021", "colour": "#84DB15", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629538079, "uuid": "4eefdad1-a298-4b53-af41-50c8cb0dadc1", "comment": "Malware payload", "value": "32f7064bd6f740041ddd1d819a667b12d6c24a28", "object_relation": "sha1", "Tag": [ { "name": "Corrupted", "colour": "#67412C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hunting1", "colour": "#439957", "exportable": true, "hide_tag": false }, { "name": "Hunting_21_08_2021", "colour": "#84DB15", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629538079, "uuid": "8a0cb266-2af3-4825-91ee-8da99ecb4def", "comment": "Malware payload", "value": "b978786f31ed864b793bf7aa858c289ed57cb6b6d154f4da69a752291502c3ce3729471b9fd0a892b301293fda159f76", "object_relation": "sha3-384", "Tag": [ { "name": "Corrupted", "colour": "#67412C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hunting1", "colour": "#439957", "exportable": true, "hide_tag": false }, { "name": "Hunting_21_08_2021", "colour": "#84DB15", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629538079, "uuid": "9c2812ea-7e30-4c7c-8fbb-5f95c78a79c3", "value": "T1CF3412DA1960BA0CDF21983664DAAF325837D8E665C16A9343E881F147463F234F737B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629538079, "uuid": "5a00fa66-557a-4e1b-a26d-af4c8cfe18bd", "value": "6144:Yd+IxRLbO7zmEUPXQ6RCWAPPXPaCitKmGyVc5+eB:tIS8Pgfpf8tKmzVc5+u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629538079, "uuid": "d5489efc-0ff1-400f-b444-a3614e233bf6", "value": 234456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629538079, "uuid": "fc1c2101-f990-49ab-8888-7741443e797f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629538079, "uuid": "44985754-ae7e-4c3a-a7e5-d0a7c9c3f699", "value": "1091643890918175dc751538043ea0743618ec7a5a9801878554970036524b75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f281fb58-0215-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629505382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629505382, "uuid": "98e3c475-f6d7-4268-840a-e7539532e952", "comment": "Malware payload (RemcosRAT)", "value": "4338aca68fbaab846ec6345a7b85c15c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629505382, "uuid": "5e7ff768-18ab-4afd-ad4d-b6a35e1fcec4", "comment": "Malware payload (RemcosRAT)", "value": "11f6a46954cdec78fec52771521926ff6917af81f79e3dc1198a38571b7d7519", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629505382, "uuid": "896d981b-4939-4ad4-9cf9-c68e81ba73da", "comment": "Malware payload (RemcosRAT)", "value": "d8257c4ed2e6f744ea03dffe19344363a41c4fab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629505382, "uuid": "0e206bb2-7ddf-4a22-9ed8-19bc5bb8a003", "comment": "Malware payload (RemcosRAT)", "value": "877aef3dca86dd469689c285f3f16b6d62275b8286484eff493d51a26556545c11d50af2d9815e134c24cb2ba0cac690", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629505382, "uuid": "e376ae08-067d-4918-bd8a-6f572567ec4a", "value": "T178158D13A2254433D1B32AFADC2BEB520A2CBABC270458577BE75C04BF3AD90355D65B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629505382, "uuid": "8233c5ec-14f8-422a-93db-f2b025ee456f", "value": "eab6b00b3a7206039f5a8a9c3fe64584", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629505382, "uuid": "a24c8fe2-82d5-4513-9be5-3b944701a65d", "value": "12288:8GBapj1mg3ShbnM19hbLgBN0gj6rIU4zcSo6nVwxZzrSYf3ifItMI5WF9:8GUmgShbnM19hlw3HpyVfTt/5e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629505382, "uuid": "f9451666-61df-4bc3-9289-457c9ec31ae4", "value": 929794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629505382, "uuid": "329c7ff4-f733-42c3-893d-2e476e4143ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629505382, "uuid": "557cc0cd-e095-4f49-9ea9-29ca36aafa64", "value": "4338aca68fbaab846ec6345a7b85c15c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d671107-02bb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629576321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629576321, "uuid": "69bbb5ec-4f4c-42cb-87f5-4d148c782cab", "comment": "Malware payload (RedLineStealer)", "value": "82e81cb8cd91936a0492047645be73bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629576321, "uuid": "2544b103-df43-4d3b-b21f-a29a57468175", "comment": "Malware payload (RedLineStealer)", "value": "12185f80846ccff1cdbb9dddc6c751dfed2626b8ee9186407547fdf2171d9e66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629576321, "uuid": "a080ed48-1dc4-4609-91b2-93d84a0b8295", "comment": "Malware payload (RedLineStealer)", "value": "647e5f9268889df7a1076ffbb61a1e9d715ee83f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629576321, "uuid": "47b3f448-a53e-424a-93f7-529bb1d5df29", "comment": "Malware payload (RedLineStealer)", "value": "966423ebea3849c6012def153e926b83d7c78e02c64647490831ba70b2f918081c090128dd15a595f69f1f062baa335d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629576321, "uuid": "78ea0c50-4a2e-4372-8dbb-551e70ce0860", "value": "T1AED4F120B6B4C138E4E711B499BEA3AC69397E716F3050DB23C626DE66376E49C30747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629576321, "uuid": "314d9ced-4f76-44d9-8e54-c3214d80b6ee", "value": "bd83a1bf510d7a089e2d041b1c2c46b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629576321, "uuid": "eafa280d-090a-4ece-b769-74751e2e1ac2", "value": "12288:kjF8fvk0oKvyNy4IW0ma1DKgk8nJWe0AsINiSJF3r3QDXV70nBtHP88n114VIS7z:pfc0ys4IWpSDnnWe0mgSX3i+70pISmg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629576321, "uuid": "84a5692e-8c96-4058-9b2f-ce8bfae18afa", "value": 653824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629576321, "uuid": "37ea84d9-fc60-4b83-84ad-d98325a49a5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629576321, "uuid": "aa6b7bb9-b448-459a-aa33-94cb5a5098c8", "value": "82e81cb8cd91936a0492047645be73bc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c38b793d-02c9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629582613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629582613, "uuid": "84716623-31de-43a8-9842-e89f0f2c5e3b", "comment": "Malware payload (RedLineStealer)", "value": "a71a545591eacbee3fcc17ef3d0aa0e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629582613, "uuid": "1536abc9-f3a4-45c1-8a24-a9322f9e2576", "comment": "Malware payload (RedLineStealer)", "value": "12abb7f696ece767d8bf063bdf82969cdc165f7a9331de2c59f6240c7b9524a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629582613, "uuid": "aedd1161-9b98-4aa7-ac23-bc6349d50c07", "comment": "Malware payload (RedLineStealer)", "value": "9d024b2af90855937a7ffacbfc0128adcd5715a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629582613, "uuid": "6c383c74-f35a-4f67-824b-0ea69ca54638", "comment": "Malware payload (RedLineStealer)", "value": "30d5274202fc3bd50a79817e0b9af625b6c44e9c5a27e0899bb43e27b9da4f0cba3b24b549552f016ff6c4eed8062720", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629582613, "uuid": "b2e52f8b-fa46-449b-879c-4f8caf1c1113", "value": "T1EDE4F130B6A4C138E4E311F455BDA2A86D29BDB06B2451CB63D736EE63336E4DD30687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629582613, "uuid": "5dc52c7b-d4a0-482e-b383-dcad8220bc18", "value": "ad1c5bf15a899fcfef408e3485448e67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629582613, "uuid": "77c644b6-d66b-4309-9468-4e635a3a7dec", "value": "12288:+P9N0EcRH7mx8s84RFalGraU5oX7F48FgWInOBdCUY0Rhx7R8yE3UdSKPpwn:6cRH7AalGuUoX768Fg3naECRpXEktPp2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629582613, "uuid": "b1cc28ac-900f-40f9-89e9-915fe835198b", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629582613, "uuid": "6344a870-4e70-455f-a31d-e4fcdc07bc91", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629582613, "uuid": "592fd2c1-4568-4ea0-8425-96cac78285b7", "value": "a71a545591eacbee3fcc17ef3d0aa0e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc4825dc-026d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629543114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629543114, "uuid": "0b257bfc-a376-423a-b345-67b00ae16cbf", "comment": "Malware payload (AgentTesla)", "value": "7cf31c76aac2393fe599a56e28d57809", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629543114, "uuid": "3724f796-f09a-4d03-a37c-a17f7332df13", "comment": "Malware payload (AgentTesla)", "value": "146becddd5eb0a1c1c014f401b6cff34235ee42690ec54f2f66666640af4d390", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629543114, "uuid": "1bfff902-a080-488c-a89c-a3fd4ac37984", "comment": "Malware payload (AgentTesla)", "value": "ac46d2b88bac9b09b126776d0a562ff8e7b72d8d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629543114, "uuid": "20cf11d7-4621-4f10-a060-94111aaf85cd", "comment": "Malware payload (AgentTesla)", "value": "1b13a423f85eea6fc571bf9b41c3ad21fcb2926d8602f3093c21769a6ca8b3e5a04146ed9ee556a91c3b6263137aac73", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629543114, "uuid": "81b244ff-d0c1-4b63-a0bf-c0a97c1710f8", "value": "T1DC25063D2AB91B27D07AC365EBE44513B2D9981FF601ED567CDE03A7020AA4735D322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629543114, "uuid": "294cd914-26c9-4bb0-be86-966882eca7fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629543114, "uuid": "02ba1e6d-15c7-440f-8b72-7300189b17bc", "value": "12288:WcIfjU0oAw2mUNb0SVhUYpN8ybnJy7ZvXqiHCOwIkfgWrI61xjIHDPn:WFfaDUN4SjGyb8l/qiHXuPrI8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629543114, "uuid": "7d560496-621b-4fa4-8c75-7c8c7924b4a7", "value": 1037824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629543114, "uuid": "3336234d-5a82-43aa-947f-01e2b4de22f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629543114, "uuid": "7174971c-90d4-4297-88a7-088d258fa684", "value": "DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9709f588-0216-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629505658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629505658, "uuid": "2d192e5b-2527-4a6e-be61-7687960d32b7", "comment": "Malware payload (Mirai)", "value": "576b259d0b2a09334d6beab45911d4c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629505658, "uuid": "2d05caef-8eac-4b14-9cbd-9d7769c8e349", "comment": "Malware payload (Mirai)", "value": "16486648144ecfaf67ba5ab5027b930792108242339ac8b5ca1fb64b48b8382b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629505658, "uuid": "9ba6be11-0ce1-4fce-8fd5-d8975427bc7f", "comment": "Malware payload (Mirai)", "value": "cb464af025b26024782ed2648f6330854fb63db3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629505658, "uuid": "4a0279e9-62ec-4a2f-a35d-b5c4efd6a41c", "comment": "Malware payload (Mirai)", "value": "1718ee203ee23e2fa3b7488f452861d355bd33078c4cfeabd3821a7c15a305bcfb09af0e4e1aa4316a2147076f4ec2a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629505658, "uuid": "423e6f43-1595-4a7e-aae5-45f62697da7b", "value": "T1A863085AB8918F01C5C412BAFA1E118D331357A8E2EFB3279E146F6077CB92B0E36556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629505658, "uuid": "3dd3d313-74eb-49c5-99fd-b82dd1822798", "value": "1536:o4noxkyVKe6LL+HvjBBPyU1WtKebekvWcPIviWb22Vzbo7:kxkVLOvjBwU5eaZb22Vzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629505658, "uuid": "37234777-2aed-41a5-902d-0fbe4b93c82c", "value": 66992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629505658, "uuid": "ea655664-2480-491c-aecb-dd04cd1a1e10", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629505658, "uuid": "caed56ae-7a79-4510-8675-069ed8f00768", "value": "576b259d0b2a09334d6beab45911d4c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e89f6e8e-02a3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1629566354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629566354, "uuid": "5e73aab5-bf8f-4d9a-8487-345657b89357", "comment": "Malware payload (TrickBot)", "value": "28272069c90ed677f9ff4ff2370ab8b6", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629566354, "uuid": "b0fb3085-2783-441f-abde-26c5d86575e4", "comment": "Malware payload (TrickBot)", "value": "18b45f75f68019c7e36311d9f62cea57b861ea576a478be6b11ee26d30c32c16", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629566354, "uuid": "330a1b2a-1946-4a4f-b68a-128ad643140a", "comment": "Malware payload (TrickBot)", "value": "579dd838af0a55e379bd5851762cb69409f6c8cf", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629566354, "uuid": "b6b2c547-5b5c-4a56-8fd1-e78cc2011c07", "comment": "Malware payload (TrickBot)", "value": "5c50c1c7d31732ad4822e6f522106d0d4875a666974cda3ab6ff00bd2fe4ea57037ac84dde82cbbe30f07d53135e0786", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629566354, "uuid": "96f32be8-321d-4bf1-8094-a34dbfd30a92", "value": "T14DC4D6991594281DFC73F6FCE4D16342DA35EF796421A80F0DB2A24AB16230D6E9E33D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629566354, "uuid": "308e0dd8-e4ef-4c74-b024-62aab2b1b1a5", "value": "6144:TUiABstkyzwfkYFYZqUZJrpX8hoAOALi/NaZpd2xoifoTvT+4MkINH6eGKtU3ZM6:TUFBstk6YFGqp2UAjVkn9pNxxfXj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629566354, "uuid": "33099347-5662-460d-93f0-87fc95b7ee98", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629566354, "uuid": "47f80338-1d76-4b59-8778-0c18c56ab47f", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629566354, "uuid": "5fec20ab-4f44-47e8-a48f-ad933f4ecf48", "value": "18b45f75f68019c7e36311d9f62cea57b861ea576a478be6b11ee26d30c32c16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fddc155-02c3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1629579949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629579949, "uuid": "04826aa7-a22b-412c-a50c-58ab88953c52", "comment": "Malware payload (BitRAT)", "value": "1e1a9db7ece5e5259814b06f7f9ba139", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629579949, "uuid": "3b33262f-3949-4f3e-9ed6-280d3724dd1b", "comment": "Malware payload (BitRAT)", "value": "19fb5be33cb4ffcf1a5d8ec4e9c1b10ba6bd91c3310bb658c319d564ace9acac", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629579949, "uuid": "166e1033-cd81-4586-b45c-1efbd5e079d1", "comment": "Malware payload (BitRAT)", "value": "77695fe6b9b671f002f46caa62c764c4ffb258de", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629579949, "uuid": "b731780b-bd75-411d-81c2-3df507346d92", "comment": "Malware payload (BitRAT)", "value": "a34a49cda65fd90d8b0a74817e5e3ea5fad28ded24f2f64ad4f31bb195d389da9e2680292c72e6f5dd2df937f85fb1cb", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629579949, "uuid": "e8d29949-207e-4b55-90cf-c56c69f721ff", "value": "T19DA502B0B0978D96F01F4A341578BD6803B275F3ABD699391B16604E8FD9E94BF4820F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629579949, "uuid": "252bea8e-f048-4bc6-a0f6-6553d879c8d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629579949, "uuid": "b275a304-de91-4786-b84a-895cdf2181b0", "value": "49152:KH////////////////////6/////////////////////3////Y////////N//Cy/:KH////////////////////6////////K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629579949, "uuid": "1e27e325-b877-44b9-9ee3-3fc24ce69a82", "value": 2264576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629579949, "uuid": "eaf1f61d-53d5-4957-9778-70e883e79a31", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629579949, "uuid": "c835adb0-3ff6-460f-8f69-042e95c3c6b1", "value": "77695fe6b9b671f002f46caa62c764c4ffb258de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59fee8fd-02d6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629588019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629588019, "uuid": "c96dab6b-bb70-4042-b2dc-5eca2f204b69", "comment": "Malware payload (RedLineStealer)", "value": "d137f82abd8f0613988f37cf21df0fef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629588019, "uuid": "b6430098-6556-4299-9198-8520c72b8079", "comment": "Malware payload (RedLineStealer)", "value": "1c3b0eb4ddd3a2072b4f8b2a86490d8e05523ac124505f08e20012c5080a5ed9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629588019, "uuid": "df6f1ea4-a5ab-416b-8905-3b81e98fe2ce", "comment": "Malware payload (RedLineStealer)", "value": "fe232946da5bb7da065abbfd4a155a99ab2740e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629588019, "uuid": "bc683d1e-b39b-4640-9447-2fd84d6b5eb1", "comment": "Malware payload (RedLineStealer)", "value": "7a1a6420172437f8b350a32b9bbf94749ad4203f7c74a856d26cf6487a8907995e70707c5df11bcd6b7706eadecfbc52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629588019, "uuid": "62ae2cc2-46ae-4055-97c3-087da0f7833f", "value": "T1BFC412E12AF0D772C85E48724846DAD01B3AB8566AA141473F77375E1E712E02E3AF37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629588019, "uuid": "7c146ef6-9c03-49aa-96ac-fa0a79653ef6", "value": "eff27d48d68df0af1612601744441acd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629588019, "uuid": "3569daff-379b-48ef-82ad-96d75a3021dd", "value": "12288:/rjRT3YbsZu/EEEOszr+wNQ67bFtB3NdHYk7DZLH:/vRTobsZCEztbQoPBddHYsH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629588019, "uuid": "29ddadd1-7838-4c86-9685-822503066abd", "value": 557568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629588019, "uuid": "80605982-5282-4ad8-bc0d-80f887e45c34", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629588019, "uuid": "ad01fc49-e079-49aa-82b7-0a5fcd00be84", "value": "d137f82abd8f0613988f37cf21df0fef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5de81b72-02b8-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629575141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629575141, "uuid": "1f9f85a1-3e34-4393-9042-f63ef7dc1c92", "comment": "Malware payload", "value": "ccfc289366f06bf59611aecaba901d50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629575141, "uuid": "fd3f63c6-784c-4838-b89f-146356c12e88", "comment": "Malware payload", "value": "20a8ba80dc39bf96815fbe7aac15ae018c57df40e3fd75f223f31dfc20f1e61f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629575141, "uuid": "b95531da-3067-4220-8daa-8faa0cdc6425", "comment": "Malware payload", "value": "85b43de89a7961447e34e6de1e933eff1c363635", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629575141, "uuid": "1afa2d13-c69d-486c-9183-38cabb9d26b7", "comment": "Malware payload", "value": "87690390b9d37f99594e340de17dae60cfda8b6de21423971fcaf884750f29e76f8f32156a8f13179e075e61da9309d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629575141, "uuid": "daa938f9-c46e-4ace-8cc3-d4832d71f679", "value": "T16435234ABFE98B37E5A705350FB02F57A462E9224D31A61B5200EBCB7C51406D538BF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629575141, "uuid": "a0ef3fa8-622d-4f70-9aa6-0616d528f951", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629575141, "uuid": "241a9987-a6ed-416d-b06c-53a0ec1a13b1", "value": "24576:z71ZOukQnPSxzxXdjT6YQJG3EtzgklajHZTRvi030ZoMgyRRoNq:v1ZORQei80tzoR9308+iNq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629575141, "uuid": "f19ccb0d-20c5-4c87-96a4-49cd39fa556e", "value": 1113704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629575141, "uuid": "f895ae60-6828-46f0-b71a-6bd21774cfc7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629575141, "uuid": "c4f92549-d0be-4f4e-8d2c-927f1c6c9f76", "value": "ccfc289366f06bf59611aecaba901d50.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5498e0c7-02b4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629573407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629573407, "uuid": "77f92738-1550-43bb-b357-c930861e9a40", "comment": "Malware payload (Mirai)", "value": "4500e9e082bce73d3a895ba78748fdeb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629573407, "uuid": "e2a5f0f1-8e7b-4427-9b1c-27610c8c286e", "comment": "Malware payload (Mirai)", "value": "22eefeea31e1a43b2c10e9402ec6c7b9a3a5dae63a38ea786a367b9e3d913224", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629573407, "uuid": "e531d612-3cdf-4562-8237-153ddab3b425", "comment": "Malware payload (Mirai)", "value": "e5d7017aafc1c20f08253f98271689509dde1dbb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629573407, "uuid": "b076797d-300b-4332-bfdf-aafd4479987f", "comment": "Malware payload (Mirai)", "value": "7282e8ac929e5bad01150e4fde89f4020c2e9d816b2c8d719de0afbbfc49813a697f60579c110c4745c18f2b687cabf1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629573407, "uuid": "ca45d8a3-0e28-4047-aea8-77d0916403d8", "value": "T1EBD2E028EBF54CA2C2B11975D5234E8636479E78807AA17A863182D51CF3C1F3AFE467", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629573407, "uuid": "81545cd4-4ba4-4f7a-b0f6-29d9ea512c8c", "value": "768:Nm3Ms7pvLI9pMs0X+GhvI5CTjvjubp4Qv0A8lC9q3UEL6b:035LIXMsGvBI5ISt4KOL6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629573407, "uuid": "832f43e1-6c54-4523-9967-f9a957663bc0", "value": 28580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629573407, "uuid": "13b11c74-81c7-4662-9c96-befd8f330e46", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629573407, "uuid": "f472d1bd-e36d-40ef-bab0-b92a42d3a40e", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99037411-0216-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629505662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629505662, "uuid": "ebe91d4b-a150-4bc2-a6bb-315e2d7e5a2c", "comment": "Malware payload (Mirai)", "value": "aea21290dc2790c2d51aaff9cd05f638", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629505662, "uuid": "609790a4-cf9f-4775-944b-cb93cce72c6f", "comment": "Malware payload (Mirai)", "value": "232210c27912cd03b1d224f7c294b5713e966a250d273bc05ee8f1caa14f0ead", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629505662, "uuid": "5d2912cf-1666-417a-b0d8-550bd9a7cb4c", "comment": "Malware payload (Mirai)", "value": "614ac77fc3547ebc1967ace6cef5356dd22963bb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629505662, "uuid": "372a207c-aa88-4d77-9981-8ca31892f144", "comment": "Malware payload (Mirai)", "value": "b86dd706279a0d9636299551064ad0fcee6f56e5817ea58a39337bb5ed9aca6d49832040dac0f0319ef7e48d5cd33852", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629505662, "uuid": "10049be4-788d-4faf-b79d-66e7e68ae0d1", "value": "T1CB338DA1C47D5D50D25842B4A9288F7C5373D909AA9A3FF60686C366D00BFECF1293F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629505662, "uuid": "a99f8e8e-f507-4e63-aace-8f228fef65b6", "value": "768:v/ioz1BuLJ4Y63WTOariz5qvsHFT2EIojO7rRNZocYyUDiCL831c:v/TPul4YvTOarcP6PoSHXecaDiCL8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629505662, "uuid": "16c0c803-34d3-4fe4-81a2-811a789280ef", "value": 51460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629505662, "uuid": "3b06d9b7-6929-43e7-913b-8b0f0fd6c95f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629505662, "uuid": "3641f365-bc96-4bea-891f-a30657ef4d23", "value": "aea21290dc2790c2d51aaff9cd05f638", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d74e87c-026e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Cerberus)", "timestamp": 1629543384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629543384, "uuid": "aa5e5ea3-d1ad-4aff-a144-672ac800cb0e", "comment": "Malware payload (Cerberus)", "value": "0050ea31acd209a4537437697fe701db", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629543384, "uuid": "7e3289f8-908b-45bd-8aab-eec282105a9d", "comment": "Malware payload (Cerberus)", "value": "2339f4612352ed6d989da4d84dd42a25032b532d3ebaf8a009beb3fac12ffbca", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629543384, "uuid": "dfaf3892-7d43-41e0-a94b-fdf70a5c4abd", "comment": "Malware payload (Cerberus)", "value": "a94e245e1b530208520e7ad112a1404408f50050", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629543384, "uuid": "08e9440a-64ce-4a9f-814d-467e326722bf", "comment": "Malware payload (Cerberus)", "value": "eead1a3b001e64a6d0b9952adcb25ad60a60dd9f5276403366f7e5ab5c9d1cd5636c1cca18c3bc60f16c4c29194db79d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629543384, "uuid": "0b9d15dc-9db7-42c6-95e7-f07eeba0d2fa", "value": "T106F5334E1703DC5EE637CA32A4872837EA3A249543D6A43F25B2444B4CD3F69CB19DA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629543384, "uuid": "4bae6556-74f3-436d-9da8-734207c678c7", "value": "49152:/LiLh/PkF7zFl3DKVx3qHW0FaypW23THmH+kvxVN4xwC2PmToLSD+KEpKfgMLhMU:AXI7/mf70F3pzKlpVKxM+TVDysJ683", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629543384, "uuid": "8d754f30-83a5-4826-ab70-52d6503d24d2", "value": 3438844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629543384, "uuid": "08754d87-c738-491f-9d9e-8ebb5d9378ed", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629543384, "uuid": "386923e6-bf24-40f2-a409-31a48683c3b3", "value": "Yerli_Gizli_Cekim_Ifsa_VIdeolar.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49a9add4-0217-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629505958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629505958, "uuid": "230b86cb-9412-4556-80b9-23ae59258fcb", "comment": "Malware payload (Mirai)", "value": "4bf538e82e2960f3e91877d9e636e3c1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629505958, "uuid": "fa0e300d-59f8-45b9-a3c8-1ae52b7ab5dc", "comment": "Malware payload (Mirai)", "value": "26e81a6a94799d1ab73f3eba9f1878508a3d1a3929afad2c68602fe3521b5201", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629505958, "uuid": "7d5787f9-cb50-403b-ac06-d0c756f2889f", "comment": "Malware payload (Mirai)", "value": "aeb676fa0ac1bb8c94716833ef1066f9bc37a161", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629505958, "uuid": "142f028b-1ed7-4b6d-867b-636ed1a346a6", "comment": "Malware payload (Mirai)", "value": "dbb5e18fe4659f37b1d2f041c1348dc00f03fea4e362f17991cddf1520a75054c1469fd4098c794764af50416ab9302c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629505958, "uuid": "793fd821-16c5-49b2-9591-20f127c62763", "value": "T1B3434BD2F801AE7CFD5BEA7B84124A0EF521B26449520F77A337FC93AC720A6591BD05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629505958, "uuid": "4cc49fac-28b0-4984-a464-30bee3449eb3", "value": "768:bND3ppW26BHP1oeTM4YfzgW/ADVpsm+DOuEYP1Vmp28FmW3jc890:Z1pcBv1o6GE3r+DnEYqp28MW3I8S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629505958, "uuid": "3836395c-53f1-4ff4-9d4e-7cc7693cb79f", "value": 59708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629505958, "uuid": "03a4aa97-7017-4aa5-82c5-e2f3d3c8429f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629505958, "uuid": "5f1dc5ec-95bd-4706-81b9-39456958d7f7", "value": "4bf538e82e2960f3e91877d9e636e3c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24f765f9-02b8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629575045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629575045, "uuid": "d4ef0eb9-fb21-4539-8acf-c896bdd4a30a", "comment": "Malware payload (Smoke Loader)", "value": "11fcf104db2df01616a5200a1fae77dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629575045, "uuid": "5cf3f889-637a-47cb-811d-f45dca589fa5", "comment": "Malware payload (Smoke Loader)", "value": "29b6332d9f6ea83bea4f3f02d4d163b93448a04566cb1f4ff0228d73c6f2e2f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629575045, "uuid": "6cfab75d-1392-4f36-a0a5-35d1a2980017", "comment": "Malware payload (Smoke Loader)", "value": "ccb3e9501e757938d70a9176159d8c6722c722a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629575045, "uuid": "658e12f9-2136-46cd-a24f-399481f12d92", "comment": "Malware payload (Smoke Loader)", "value": "52dc5573a223ff3a5b1838cd81da72e723514829c087eb77f373b1a8b7139c0611731f30934dacd3445fc5e051a3be38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629575045, "uuid": "514c047c-0de4-4c4d-9eed-8a88c9a1b75a", "value": "T1BD549E20B6A0C139E4F311F4897DE7B869287DB06B2050C772D636EEA6376E4DD30697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629575045, "uuid": "5a59d6ea-55de-4ac3-b2c4-961f6f07b67c", "value": "ad1c5bf15a899fcfef408e3485448e67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629575045, "uuid": "9a0f0451-b0c4-4652-99ac-2572e42ad39c", "value": "6144:dQA1Si1KWwlU5p72W+d86u+dGsp9tEl0zX:r1Si1Nwly7cd86ugztPX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629575045, "uuid": "0abe731e-3a27-45d3-bed0-f33e16065991", "value": 283648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629575045, "uuid": "82608c73-063c-43e4-8bd2-df4bcbdf89c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629575045, "uuid": "5fbb56ac-b5fa-4751-a4f3-ad3d106e5e7b", "value": "11fcf104db2df01616a5200a1fae77dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "827cd6f3-0253-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629531823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629531823, "uuid": "e2926de6-71a1-4a25-bd91-c050fd112cd1", "comment": "Malware payload (RedLineStealer)", "value": "988a3ced7344eab8a5b83e7942cf309d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629531823, "uuid": "85dec1e3-1108-47cc-b166-f947d75c3b1b", "comment": "Malware payload (RedLineStealer)", "value": "2f6036f55414ecb19016a69ad0dce6652cf7c04102a50eb95a55afd8bc01d172", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629531823, "uuid": "f4f205f5-71d9-4b92-86a3-7e1ac202b0e3", "comment": "Malware payload (RedLineStealer)", "value": "6e4ea14766099ebd8966d80d9f630897d416f871", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629531823, "uuid": "7faf6f2f-b65e-4209-a591-e341dc78ee41", "comment": "Malware payload (RedLineStealer)", "value": "e3e57e1392b843cbd4e727dfc4a22b22b2473cba4259165174520151f32c6d8c8f3994cf414711acccf05005b996dd0b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629531823, "uuid": "edb3d2ce-4b74-4ac4-abe4-47f2dc6154d4", "value": "T16305FC137D4CE311E9E45E3751EE2D2C23E559CA8633960BBF06FDA924712869CB232D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629531823, "uuid": "fa959402-dbfb-473f-bd40-2ae6f4736e59", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629531823, "uuid": "693f3386-0fcc-4e63-a150-0677c6f36e7f", "value": "12288:2oGeXRoLEmvyVnjvUzSmL5ZAfkVdp90oxg+J/:PGehoQugjvUzSmlZAMVdrlbJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629531823, "uuid": "53273e91-7231-4922-9be8-7997f0e5b3e4", "value": 855200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629531823, "uuid": "737941db-d510-4b56-9688-b0ddde81c180", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629531823, "uuid": "79a5480f-ac3b-424e-ad02-ef1e01173f26", "value": "988a3ced7344eab8a5b83e7942cf309d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c524e6c7-02d1-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629586052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629586052, "uuid": "5ee0c9eb-c6a8-49b8-99d2-e5ae1a964ad1", "comment": "Malware payload", "value": "4fb0ee16540b1779fce8c502e6d877dc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629586052, "uuid": "752e1490-2e59-4209-9aad-44b81aeffc7e", "comment": "Malware payload", "value": "33fcd639567316ceffba1be151d878ece3af93f5a6949be1387d3c98435c5bf9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629586052, "uuid": "260be390-d09f-4cf1-9ebe-925d0dffffa1", "comment": "Malware payload", "value": "4d430ed4a8a6fb742da9c1d8318592b4688ccd84", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629586052, "uuid": "7e2fd8c7-8a54-471c-8270-a2af3fe7e7f0", "comment": "Malware payload", "value": "4282b679c5b6267bbe756af8e28d3a57309883d0c05de3aa011f1d9a14342bb6a927ee8f6bf7a76583233727fbfbfd85", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629586052, "uuid": "8af46f53-4c90-4b5c-8815-f720baeb049a", "value": "T1D5D4C0023292C872EEBB36F058475B7852F4EE969566C35FA7C37B2D1FB16848423346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629586052, "uuid": "e82a6be1-6087-4548-8542-5b7163a04ce8", "value": "00585b5ac1f3a2f8fc50a162c67e07ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629586052, "uuid": "e7bbb835-7a3c-44fd-863c-d3271ab6f86a", "value": "12288:mOxwEPSgOP2Tyf5T53IN/haywGQV20O5vE5j+0Sm:wEagq2TyxV3IDtwp2hFE5j5Sm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629586052, "uuid": "4be4aefb-6af9-4350-82c6-2c4fbfb6966b", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629586052, "uuid": "13fa6ce4-c0c7-4e4f-a966-727efeb2874d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629586052, "uuid": "1f5072b6-b535-415f-9c6b-dfdbe54911d3", "value": "SecuriteInfo.com.Trojan.Win32.Trickpak.gen.10359.11060", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae751862-0274-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629546070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629546070, "uuid": "e4d85670-598e-470b-a155-38525808350a", "comment": "Malware payload (RaccoonStealer)", "value": "526b62ef1d4102a35956115343366bf4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629546070, "uuid": "cb9649e2-b1a6-401f-b3f9-8d75e4c49000", "comment": "Malware payload (RaccoonStealer)", "value": "34033f216c83ba1f02e6e0150ed9d8b1b7322eddeead85da35f212635e389f01", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629546070, "uuid": "fff9078a-70cd-4cc9-a020-0d64ce432bf9", "comment": "Malware payload (RaccoonStealer)", "value": "3a5388ca3c083c2e5c6c41124cd53d8f42573729", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629546070, "uuid": "c40fe641-7fe8-467d-87bf-3f472902c974", "comment": "Malware payload (RaccoonStealer)", "value": "e27b6a4fab33b1a6cb9c1cde2eb733473f40fc7fe0559af5619e4613d0ac2eac9b3aa38cb8d0a84b92b1e257e7f2fdf9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629546070, "uuid": "f4e9bf47-325d-42e8-8fea-ddb360a56da5", "value": "T1CDB4E030B6E0C138E4F712B495AEA3A878297D706B3451CB63C626EE56376E4DC30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629546070, "uuid": "088058db-571e-48ac-a4be-c6318c55cf61", "value": "74369709aeb55fd7f8dd333fd3dc6eee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629546070, "uuid": "afa73794-8281-4a9b-b52b-9641a3a4c300", "value": "12288:iUgxnnRc1wyi2/l1EH08xLsMQYzhiVKqvh5pQ:4nnRz2N1R8CdMhgKYpQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629546070, "uuid": "a022ff4c-2ec2-401f-a0b4-0b03e100b8d0", "value": 534528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629546070, "uuid": "042cbb53-de8c-420b-ade8-658f9d013301", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629546070, "uuid": "95412b2d-2352-4a24-a569-bd651e844169", "value": "526b62ef1d4102a35956115343366bf4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "183a2960-0262-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629538087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629538087, "uuid": "b1d294ea-3cb6-4aac-a1ec-9b784b3ea3a8", "comment": "Malware payload", "value": "bc70a7b384558cafbbc04f00a59cbe8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hunting1", "colour": "#439957", "exportable": true, "hide_tag": false }, { "name": "Hunting_21_08_2021", "colour": "#84DB15", "exportable": true, "hide_tag": false }, { "name": "KillProc", "colour": "#FF436F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629538087, "uuid": "6a6c1225-a0ef-400f-9b44-1c7cac46e394", "comment": "Malware payload", "value": "36e8bb8719a619b78862907fd49445750371f40945fefd55a9862465dc2930f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hunting1", "colour": "#439957", "exportable": true, "hide_tag": false }, { "name": "Hunting_21_08_2021", "colour": "#84DB15", "exportable": true, "hide_tag": false }, { "name": "KillProc", "colour": "#FF436F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629538087, "uuid": "43e2bfbf-be6d-4491-8696-7710668ba215", "comment": "Malware payload", "value": "b8d1b1b4b759c4380293537fc4cc3622fffbd52e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hunting1", "colour": "#439957", "exportable": true, "hide_tag": false }, { "name": "Hunting_21_08_2021", "colour": "#84DB15", "exportable": true, "hide_tag": false }, { "name": "KillProc", "colour": "#FF436F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629538087, "uuid": "338d69fa-d361-4f64-96f5-60dfa0b01096", "comment": "Malware payload", "value": "065bac2916b0f555dadf37653faefa999565861bddca9951fc47f0d82f57182c747a02931bd5905a335d52f9f0e582cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hunting1", "colour": "#439957", "exportable": true, "hide_tag": false }, { "name": "Hunting_21_08_2021", "colour": "#84DB15", "exportable": true, "hide_tag": false }, { "name": "KillProc", "colour": "#FF436F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629538087, "uuid": "3f946348-7d06-4ac4-b4e5-e36bc3631b38", "value": "T1F4C1EE92BDB64AD0C108C5B0258F0891F6ABF61503B397D796C0B4225D4B6EEDD3CA57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629538087, "uuid": "e746eb39-339c-4c11-a6f8-f46a32e4dfe2", "value": "0762daf73ae7993a20fa0033c7952c91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629538087, "uuid": "3e99e302-e5f0-4541-b67e-46c7826c2100", "value": "24:ev1GSTcEYhlcYbFUfFXs0xlTOLStQgM/dH0kluf+3aNDpbwTzFu2/xDkCeMgTDTM:qTcEYHxuHOLG7y1CvbshKCRg/TgDYVa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629538087, "uuid": "d99dd383-a3b8-4768-a103-3dc981d61bc7", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629538087, "uuid": "a4c2ba04-33ff-41a3-9079-3dd64e748bcb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629538087, "uuid": "dd6e30ba-1f32-4328-beb0-3cfed5f64d85", "value": "36e8bb8719a619b78862907fd49445750371f40945fefd55a9862465dc2930f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59cb3951-0287-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629554089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629554089, "uuid": "afe1941e-0028-4dc3-8f8f-98ae0ec88f69", "comment": "Malware payload", "value": "f8d0489e9608a5f4bcc54a9ec542171b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629554089, "uuid": "e3f45d0f-a284-43e6-8a14-f62c26ae535f", "comment": "Malware payload", "value": "375bc3e906ba184369288f6b09889fa45afeedc9529f86749e4b2dcd3af73b9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629554089, "uuid": "ad9c438b-2f34-4a33-999f-765d1dde2e52", "comment": "Malware payload", "value": "4a392aaef758ceb59f43b44882e531e6b257458d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629554089, "uuid": "6dd21973-264c-4a06-902d-f84ae60e9bcd", "comment": "Malware payload", "value": "486b28490ea0647b395a593fe43b4b8c869c5bd067754fd222946041d8d4110f79e32e0b296b0762e1a964e03c4fb248", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629554089, "uuid": "b1a37bf0-745e-433a-83a2-0d2862a3e98d", "value": "T1ED448C20A7A0C139E4F711F4987DA3BC692D7DB06B2050CB62D626EE66372D4DD30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629554089, "uuid": "ca980016-5555-4eee-baac-65f77c11d252", "value": "74369709aeb55fd7f8dd333fd3dc6eee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629554089, "uuid": "717ade8b-4433-4fd8-8db3-bd05dbdc1007", "value": "6144:72uJ5Jp/0MtRyMSVB918sVehYEUMiR3Hz:xvJp/dtRaVBvj4hcMiR3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629554089, "uuid": "d8e7f77b-e3ad-4edc-a93b-5fa1bba4bab3", "value": 275968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629554089, "uuid": "ab607f97-1da3-462d-a4a3-67d92d6ee222", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629554089, "uuid": "e7db5264-742a-48f4-9ac9-33258da9fc69", "value": "SecuriteInfo.com.W32.AIDetect.malware2.12445.5597", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69c7bdaa-02b8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1629575161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629575161, "uuid": "db6442d1-24b0-4924-96cd-1a4eb8236d51", "comment": "Malware payload (ArkeiStealer)", "value": "d382f9b36ebc8c80f5d8a286956755e8", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629575161, "uuid": "7493b64a-ca85-43a9-8a74-afb9149eff6b", "comment": "Malware payload (ArkeiStealer)", "value": "3b85acad536f7a3d80adf32283642f6eb7f4e6d57853765d075ec35143354904", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629575161, "uuid": "481f0d47-1dc6-486e-bc1e-e2408dab7673", "comment": "Malware payload (ArkeiStealer)", "value": "afaa88fa50f348ebd79fbcb1cc2d323558c1e965", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629575161, "uuid": "3bd5f19b-36b8-42e7-aeea-efa33879a678", "comment": "Malware payload (ArkeiStealer)", "value": "bb4935cb5b9e0f1f15946f65ebcc7c2bdb5c84a20f0d90782034d3371a4121aca70db83c8d4d99150ff5efd2c2e48197", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629575161, "uuid": "4047eefe-5cfe-4184-a567-9c090e7614f5", "value": "T1BCE38DD175F0C533C0920470CC65CAB09B7EECA36AB456473E6B231E5F716909A27FAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629575161, "uuid": "ee201eb0-5623-4bea-841e-e264c591e4eb", "value": "d9ba9c76f1c1b9698712bcd1010ec021", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629575161, "uuid": "863e8923-be7f-42d1-9262-f2bc72ea6bf8", "value": "3072:R0o+LDBQDv0xAvERAnLHAUrtiTzgFnLmF:s1QDgq7AU5igFnL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629575161, "uuid": "32b0c872-ac30-457d-9f6e-f5f0c73d85c0", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629575161, "uuid": "8e3c1612-e505-44bb-9639-dd0c63201bff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629575161, "uuid": "ee89b966-8b1d-4c53-bfae-6a569c42e3c5", "value": "d382f9b36ebc8c80f5d8a286956755e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78d95a44-02b8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629575186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629575186, "uuid": "f7d44ab3-8ec7-46c7-855e-e33cb25d3098", "comment": "Malware payload (RemcosRAT)", "value": "f53b11a4a12f5bc26b12dfb56ee3f35e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629575186, "uuid": "ba95f12b-8730-408f-bcee-b6d5cce2a892", "comment": "Malware payload (RemcosRAT)", "value": "3bfc1578a54adf8fddb981d461ebc6f6d730fd7cfbf69bb1df421043210a26fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629575186, "uuid": "ba76aeeb-9595-4e80-aed0-5b85624e9556", "comment": "Malware payload (RemcosRAT)", "value": "53398cac5860fc249d1b0ab188a083d895a46a07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629575186, "uuid": "48d4b921-b7e5-4c59-959c-c2191b71fd5e", "comment": "Malware payload (RemcosRAT)", "value": "29078c0f03ff756456bd31ff75ed84080fd7271d44295052d9b4ef0d412e78567b3d2fd69c1541c7b5745983bda6a8d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629575186, "uuid": "f0a3b905-b3d4-41de-a6e9-0a8cbb5ff6b5", "value": "T153157D02E18928B3D16317F92C2FF7B5492E795D29319D8D7AF36C0C9E37A24392851B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629575186, "uuid": "6425f708-6b06-4b6b-9de2-d12f441e63dc", "value": "eab6b00b3a7206039f5a8a9c3fe64584", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629575186, "uuid": "a44f40f4-2e8b-430d-91f9-e4cc1a662e01", "value": "12288:8GBapj1mg3ShbnM19hbLgBN0gj6rIU4zcSo6nVwxZz7SYf3ifItMI5WF9:8GUmgShbnM19hlw3HpiVfTt/5e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629575186, "uuid": "1fcf2491-1120-474c-9d56-a02bbe24991d", "value": 929794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629575186, "uuid": "7250a461-e873-408c-a91c-af78eabd2b17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629575186, "uuid": "b119ce14-553f-4591-b6ba-4e7fab61681e", "value": "f53b11a4a12f5bc26b12dfb56ee3f35e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "365598d4-02c4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629580229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629580229, "uuid": "8ebce47b-ce3b-4178-a0f5-1a54eaed5d9e", "comment": "Malware payload (RedLineStealer)", "value": "60f03227d5b61821a15b3b3297c1012b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629580229, "uuid": "f6510c0d-77ea-464e-a285-5b3f8979330a", "comment": "Malware payload (RedLineStealer)", "value": "3d8a2fc96d40eb7da26413ef54486ce94e3e89730bf15602e7ecbbc5ad852c20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629580229, "uuid": "76fa527c-38b9-4614-8df6-ebcc606b3fd4", "comment": "Malware payload (RedLineStealer)", "value": "22eec86262fd21a876f2ff87e5d41f0759df490f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629580229, "uuid": "ea8e1343-13a6-4d88-b66e-080d0dbd16fa", "comment": "Malware payload (RedLineStealer)", "value": "af12e52a4ffdbdf9d55c749e27697a810f56629a88bdde01e5e7cb6f410b7e40db9deabb3d2041e071e524041f0dc4bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629580229, "uuid": "17eee70d-8ea8-49a0-b3db-dc1d5b32e44c", "value": "T1F5E4F120B6A0C139F4F311F0556DA3A96928BDB26F2041C773C63BEE96376E49D30697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629580229, "uuid": "54d2523d-d862-4beb-b681-75a44912909e", "value": "ad1c5bf15a899fcfef408e3485448e67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629580229, "uuid": "665e1b2a-9b1b-4cfe-ad62-e6182bc1a2f0", "value": "12288:itEQdlUgG7MIsvQjPWV8X2xFNf0PoyJGEqwRfmT1Ax3GerAt1yITGBn:EUgG7Eg2xFNkoyuwRf/rrq1yBn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629580229, "uuid": "f413686f-a2c0-4204-92e5-afe344bb5d51", "value": 657920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629580229, "uuid": "61c23a7f-9646-48a7-98b7-6326c6d7b2fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629580229, "uuid": "47332f26-486a-4943-861b-2fe1cf5806c0", "value": "60f03227d5b61821a15b3b3297c1012b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62c1fe42-02c1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629579015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629579015, "uuid": "403d5a78-6da8-4537-9cca-dd5faec00209", "comment": "Malware payload (RedLineStealer)", "value": "060b1fc7542e2226c779d5d1df55518a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629579015, "uuid": "1719d105-3e0b-42b9-81e5-b7346ddc0d9e", "comment": "Malware payload (RedLineStealer)", "value": "3ee72905c875bc3d9f7ab69071c1fc5ee0ad43373e72793aa8fe2e2c44b5f7ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629579015, "uuid": "a09bbca3-e47e-43b1-a54a-2ba83b6bd521", "comment": "Malware payload (RedLineStealer)", "value": "303817d9c2a74c08f8006025fa25615dc2056298", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629579015, "uuid": "c2d37f90-7067-4a8f-a917-35e6543ac5e5", "comment": "Malware payload (RedLineStealer)", "value": "072283f16b38993d803b64dcf4e96f48675054baa3b5cd76e6eac8c8b9f9486056377b77161c09b5ccfdc97faf3d23c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629579015, "uuid": "14161db9-3fc6-4637-b2fe-accb9cd4e2e6", "value": "T161E4F120AAB0C138E8F211F449ADE3AC792D7DB06B2401CB62D726DF66376E4DD31657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629579015, "uuid": "3d68a021-2bda-4ddb-be3d-2bc5ff161496", "value": "ad1c5bf15a899fcfef408e3485448e67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629579015, "uuid": "5aa843b9-d0a0-4e5f-b83c-c70a30273a05", "value": "12288:ePV+m+ccGR7TOUBYxMqlKCAy+qyu6gFM02K2TPgx7bwXILSzFhFn:hccM71Cx65K2TPgBwPFhFn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629579015, "uuid": "a84a0466-50ba-4618-8fb9-a8a8598d6ddb", "value": 658944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629579015, "uuid": "1d6bef1d-01be-4ffb-854c-d44617d3239d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629579015, "uuid": "1e053ec3-6578-42a8-8af1-bec684863d33", "value": "060b1fc7542e2226c779d5d1df55518a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "477b1c6e-0217-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629505954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629505954, "uuid": "6c88fbfa-e0f8-4b86-964a-35b36632707b", "comment": "Malware payload (Mirai)", "value": "8740072e82be3b72f6c84318442cb11a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629505954, "uuid": "60a1a6d6-2b7b-4d8a-8427-955e14ced00e", "comment": "Malware payload (Mirai)", "value": "45102f6d3e151771020bcbc5951e6580e86a47d234cd03dbb0723192d84246fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629505954, "uuid": "b7580615-64df-4833-8cc3-23dea66ce6bf", "comment": "Malware payload (Mirai)", "value": "24e2da6040946e2206c97705ab4f2c699ac40f6f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629505954, "uuid": "ae2bcdbe-dd30-471b-ad10-263e8f1acd0e", "comment": "Malware payload (Mirai)", "value": "363cd8937d315160f15bbcab17f74d6c0ca46fc8e4569afaf6a5cdf1b3cb06f0ed8a6165e08a126bf4bae75ecbd03be3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629505954, "uuid": "fb628e0f-3bf2-40b9-b0fd-244d345755f0", "value": "T172D33C46EA818F03C4D52776BA9F424933239754D3EB33068D18AFB43F86B9E4E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629505954, "uuid": "e763b27f-10d2-428f-908f-e66b257ac660", "value": "3072:3l9ALbt2Lt1dBRlO89FEHXKaFJ5Su+kDM/95A/Vtu5:3l9ALbtorBPO89FEHaaxSu+4M/9Cu5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629505954, "uuid": "93f5df14-19d3-4ccf-b21a-dc65d865a4f3", "value": 130708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629505954, "uuid": "530665ab-43c7-4ad9-b39e-0e3772a5b620", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629505954, "uuid": "811b9150-67a7-4eb1-9a0c-baf2a904fefb", "value": "8740072e82be3b72f6c84318442cb11a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b23ed3e-02b8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629575109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629575109, "uuid": "638cf522-7b44-4c18-928e-9c7a097e5992", "comment": "Malware payload (RedLineStealer)", "value": "d8105581df1372d46164bf7172678ea5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629575109, "uuid": "2a2fc1b4-4ba0-462a-b295-611e10feff99", "comment": "Malware payload (RedLineStealer)", "value": "4707cb7c2a93c0c9ebf58ef91c885f32b02ccf808f792a9b311461e349b5c743", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629575109, "uuid": "c9f48c19-51d3-4c94-a0e9-472afb1bc293", "comment": "Malware payload (RedLineStealer)", "value": "8b513da7cf770a96cf465d30cdf6af8cc8fb9bff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629575109, "uuid": "ca7dfa97-8924-48be-8ef9-eb595413b9d6", "comment": "Malware payload (RedLineStealer)", "value": "12591d6cdcfc4914f096808ce8d34a5480584e9829edca375dd28365c0e6ca2b6d1fe7d45d6ac4b7c5095da1bbe86d91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629575109, "uuid": "5d334c0f-d185-451c-adfa-8b4898c8cd6a", "value": "T182C41221B9B2D7B3E57919300956E644373EB84B5A2600077F6727BE3E302E15A2AF35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629575109, "uuid": "4e056246-8fa6-4424-9e44-1b5936abd67c", "value": "eff27d48d68df0af1612601744441acd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629575109, "uuid": "24b29932-8dcf-45af-bcdc-f6ffb6c59087", "value": "12288:BXTByxB/QaeCnkmICs8X7lPVOL5khVsj15X+MPASKNZLH:hByn/Qaewk5T8X7p8L+/sj1cyAS+H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629575109, "uuid": "70f23723-bf7c-4e1c-80ff-6c69e557fbc9", "value": 558080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629575109, "uuid": "f728b853-abdc-4640-bde4-72b5d5e16e6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629575109, "uuid": "c3b7f542-1bce-40d6-9423-2b6dce211e5c", "value": "d8105581df1372d46164bf7172678ea5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51a5a879-02b7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1629574691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629574691, "uuid": "b8e7eefe-0614-42a6-83ef-3ecff912ba2a", "comment": "Malware payload (njrat)", "value": "d7d0e919d8ad45eb4948d3dd17a1ba3e", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629574691, "uuid": "a5b1b900-f0e2-456d-8638-a925baa64caa", "comment": "Malware payload (njrat)", "value": "4fbc591d085964a6799c32946e2e40fe706c8c2b0d7205c5480a0982c5a64d3f", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629574691, "uuid": "03c82359-924a-4c7c-98f4-73f12e91d293", "comment": "Malware payload (njrat)", "value": "d465b59c7561989d9bf8594da2de624aff418e2f", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629574691, "uuid": "e46cb45e-62ad-443c-8c77-0602600420ac", "comment": "Malware payload (njrat)", "value": "919b65b3aa219ef4b1abfdb4a7d05171d1059b0ac5aa0ed8d78a1f7d39f6c03ffa5f84b75c48fdfae2a95749f0f8a11f", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629574691, "uuid": "85ca0e1b-59eb-433b-8fb4-882fb0a707e6", "value": "T1E811CE394CA58AB60346D0B100878DCCDF2087473798FE391836B4955D9CE395E8C91B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629574691, "uuid": "1d832d3f-6060-4aa8-bd62-c36d699af5e0", "value": "12:uhutV6Q77NeEQiuNounuAbZbGJA8kcXO2qvELJ7g3NnLd+KPj2T+TOM:uOV7NeEQiIpGScXO2qvEcNngKG+TOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629574691, "uuid": "9db4f804-485a-408e-b4ea-c28968f5f0a4", "value": 966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629574691, "uuid": "20d5be8b-080e-4ee7-98af-c0fb8eadb61f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629574691, "uuid": "1bdbb0c9-7154-401b-8074-1ddc3d00e33d", "value": "Fed10092735XX.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed56842a-02b5-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629574093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629574093, "uuid": "8f255869-1a0a-484d-a40e-5820fe437cd7", "comment": "Malware payload", "value": "feb80dacb571ce7bafb6730614993422", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629574093, "uuid": "de4c6fa1-4083-4654-a27e-170f03fdfdd7", "comment": "Malware payload", "value": "50fed6621c72b932a6fe333adc9b2084cf02da9130fd4ff57972e5ff4c2799c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629574093, "uuid": "a46b5427-f7e6-4444-90e7-0cb24f7370a5", "comment": "Malware payload", "value": "493580c152928ce449605c992d8aa3526ef1ec51", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629574093, "uuid": "a09bb49f-f298-47cd-8eb9-3aa7dc050769", "comment": "Malware payload", "value": "7bbd8cef4630a6853a035972e6df86603baa026773b174973873c7fd3f91a0ffdd2bfc149227a4abec531f0071ed4c04", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629574093, "uuid": "bff8e3a3-e255-4d4d-83af-dc8354ebf770", "value": "T13962C12045EC4E17C51F9B33479DEDD978E03CC68BD7D548394C6A022C6B136AF76A44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629574093, "uuid": "22887aac-caf3-48ee-b187-1a3424e3eae7", "value": "384:Mt+scl3TfMhJH+s672kZShICSDmpXMkLv1R0:C+F3bEHVw2kZwzdP0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629574093, "uuid": "d2283530-5f31-4c28-bbe5-2e8d6524ca18", "value": 15960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629574093, "uuid": "c0a55bae-0d34-4d08-b254-2ae6d2a47a9c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629574093, "uuid": "e1bec102-ef1d-4947-bc94-9a1d2b714a6c", "value": "feb80dacb571ce7bafb6730614993422", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76ece787-02ca-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629582914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629582914, "uuid": "7cc77d40-9f2b-4eec-b96a-61ccaf94b0fe", "comment": "Malware payload (RedLineStealer)", "value": "c42465a3f78bdc4a328dce809e9af76d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629582914, "uuid": "4658669e-4992-49bc-a9bd-eca1d5672238", "comment": "Malware payload (RedLineStealer)", "value": "52d47d1c153429751dc5fcfcaf3851548631dce9b899d58eab3105a3ec957fd4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629582914, "uuid": "cdfa889d-e8e3-41a8-a420-35ad4107a92b", "comment": "Malware payload (RedLineStealer)", "value": "f3d6e1f632b4018a36730d65e0bdf76508857710", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629582914, "uuid": "d8f84fa5-b19a-4dc0-a2a9-5a91002f6f87", "comment": "Malware payload (RedLineStealer)", "value": "79c9eb0f8bde6bca2846a5a5c50c1a7dbf9aa75badb120642e6cb3b6c4f0df63965e287f9cbe307d05400602a2577182", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629582914, "uuid": "3120b23d-bc3a-4db4-8205-cecf7f763ad6", "value": "T1FEC4121135B0D263C512053047D697ECE17AB9D24F76050B3E8762AE6F727A01E3BEB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629582914, "uuid": "b2700fe6-99c8-48dc-ac81-82b42aede5cc", "value": "eff27d48d68df0af1612601744441acd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629582914, "uuid": "ce9fbdf5-aaae-454a-a285-3f4769ff88f8", "value": "12288:f8toPq53wtvDZiGsZ1pKLHNP1IiYUcw/SpWLZLH:EtPFwtvAzpINdHYUbSpWJH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629582914, "uuid": "76f5cd98-1632-47d4-95ff-08794815577b", "value": 557568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629582914, "uuid": "6f682ba3-7fab-43fa-804d-2f0df0989663", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629582914, "uuid": "9a0c758e-d61a-41a8-ba96-7d0a4e2cc590", "value": "c42465a3f78bdc4a328dce809e9af76d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64b080e0-02b8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629575152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629575152, "uuid": "3a0538a9-2722-4529-8f31-e99ff5fd8717", "comment": "Malware payload (Smoke Loader)", "value": "2f560c3469d3c782d3ed3b015012ec01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629575152, "uuid": "da39c186-96e1-41a1-b37b-3031dbeb729c", "comment": "Malware payload (Smoke Loader)", "value": "53414092b183d0418f274432d526354312d16ae550809ddf41aad36d8481443d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629575152, "uuid": "3cebbb20-9275-4753-908d-9d6ed11a30b2", "comment": "Malware payload (Smoke Loader)", "value": "170b02877a6ba498998065048056633b7427cbe5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629575152, "uuid": "81968d67-d177-4fb0-b5d3-0707448c8315", "comment": "Malware payload (Smoke Loader)", "value": "ba745ea624010fa6b0eae45c44728d02b3cdb33f198a9243717474405eee8fd9a32fff1eb0ec3b75acfb6adf087c5cda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629575152, "uuid": "17c68d90-edb3-4e9b-a1af-60baf2f2269f", "value": "T194E3AE1138F0C473C0A155304990CAA0577AFD616F7446477EABE37E1FF12A19A2AFAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629575152, "uuid": "3367eae1-20b7-4ced-9096-2d1be103b609", "value": "d9ba9c76f1c1b9698712bcd1010ec021", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629575152, "uuid": "fd90b911-2b5d-41bd-b512-059c5375a199", "value": "3072:nuykPLCknyKx6qkTFoCPSRCdecurzgFnLmF:AeknSqyCcUL3gFnL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629575152, "uuid": "e864dd2b-7d04-46a6-8b14-25785cc73c02", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629575152, "uuid": "61385ba0-9617-4461-b182-715b64437c58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629575152, "uuid": "0fe11d44-d498-4cc6-8fdc-075e831efe9d", "value": "2f560c3469d3c782d3ed3b015012ec01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38a1daae-027a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Cerberus)", "timestamp": 1629548450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629548450, "uuid": "2c867606-7f9f-4631-9c0e-93f62da1c30e", "comment": "Malware payload (Cerberus)", "value": "d6d50a753cbd3a8944b96ba372941a89", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629548450, "uuid": "2bbf6938-7ca3-4cd0-8b0b-7e2498276c0c", "comment": "Malware payload (Cerberus)", "value": "56907670f55a03aaf20d07326fc68a25fa001fb10e47b704aa27ce19338d1ead", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629548450, "uuid": "84e0c43f-b630-4f22-a940-1fbd1fa89239", "comment": "Malware payload (Cerberus)", "value": "f6b8675d4f4bb7fd13e6f83764b85db221b3f1fb", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629548450, "uuid": "c89bc195-fdf9-4f44-982c-173d865892e5", "comment": "Malware payload (Cerberus)", "value": "b2e69c968c362e7e2c1ab5f1f85fea51ad85cb4e189ef1f35a82a2c633a7b298135ecc2f179380a168554b68899ced69", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629548450, "uuid": "461642ac-6929-4923-aa81-ebda6b08d5d2", "value": "T1BCD302C79B81A4FCF1EA167A6BDC13797E33C541E4FEAA4B002A4A518D8B6194F31C4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629548450, "uuid": "4a165d7e-a1fc-4397-a294-d4e1d21e166a", "value": "3072:HQJgABUMemHQTd3sk7hSwnKWMDdqNqSJOfJOS8a8jwA4zFwA4zxUlvDm8/UlvDmj:wRBUrTpsk7EwKPDdqNqjwzrMA4ziA4zq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629548450, "uuid": "7202fd12-f217-4b52-8eb3-5584ecc40df8", "value": 139620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629548450, "uuid": "dd5ea3ec-7176-4589-884e-d6e62c3ccd6a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629548450, "uuid": "61d4746e-d647-42d8-b9ae-4edf58d6e463", "value": "Androidupdate.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cf1a376-0262-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629538095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629538095, "uuid": "b387475a-adf0-4c9d-a66b-79d221e1590d", "comment": "Malware payload", "value": "8ed32ace2fbce50296d3a1a16d963ba7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hunting1", "colour": "#439957", "exportable": true, "hide_tag": false }, { "name": "Hunting_21_08_2021", "colour": "#84DB15", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629538095, "uuid": "01a61c9c-51bd-466c-8977-030a03d679e0", "comment": "Malware payload", "value": "5a08ecb2fad5d5c701b4ec42bd0fab7b7b4616673b2d8fbd76557203c5340a0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hunting1", "colour": "#439957", "exportable": true, "hide_tag": false }, { "name": "Hunting_21_08_2021", "colour": "#84DB15", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629538095, "uuid": "16b16744-7aaa-4676-89ff-acded2ff1a27", "comment": "Malware payload", "value": "11ce3d5e6e3451d059f65c4676145020d42c3835", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hunting1", "colour": "#439957", "exportable": true, "hide_tag": false }, { "name": "Hunting_21_08_2021", "colour": "#84DB15", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629538095, "uuid": "1d6b6596-f931-4e0f-8b17-b349c9d3156a", "comment": "Malware payload", "value": "cdca346fbbb886067ebbc3ab5e3779496d17a7dc855d03199c6744489a3e22647d8513a80e608ea7b91b53a14fa771f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hunting1", "colour": "#439957", "exportable": true, "hide_tag": false }, { "name": "Hunting_21_08_2021", "colour": "#84DB15", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629538095, "uuid": "23859b93-adf9-49b7-90bd-090f7d264e8a", "value": "T12D246B56B3A420F9D4728138C9618616F7B2BC6207718B1F53A8727A9F373D16D3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629538095, "uuid": "bbb0da0b-1b54-4ea9-80bb-cd8e9433ebd1", "value": "404e2902c47cf33ee0616252bfbcf67b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629538095, "uuid": "538dfd30-f74e-435e-84c4-2dc341d33d3c", "value": "3072:X3/iPdAWbuNKJ90zHHu0w/2ZCfeCZnWVdFJLiAVl9eLE:q1AWgKkHOzJOnLH7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629538095, "uuid": "2e617e08-c60a-4c05-aabb-a909f0198b9e", "value": 216064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629538095, "uuid": "56d85468-5426-4b7d-9806-bbf0e08637d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629538095, "uuid": "9af843b9-290a-4df4-b653-bd8dbcd951b6", "value": "5a08ecb2fad5d5c701b4ec42bd0fab7b7b4616673b2d8fbd76557203c5340a0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13253da8-024a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629527771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629527771, "uuid": "f5bf67a5-e0e3-4e4d-8124-7d9c5e0ecb24", "comment": "Malware payload (RedLineStealer)", "value": "4608929662ad36f59a9696b9e02ab68e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629527771, "uuid": "32274df2-c78c-4718-99b4-0cb252fadacb", "comment": "Malware payload (RedLineStealer)", "value": "5ef5f8a5b159ff8bb0e899dc25f57293c7bca8f5ac5d644c49a6c92be1b21405", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629527771, "uuid": "c4964668-5a62-40e1-bce1-825571392a09", "comment": "Malware payload (RedLineStealer)", "value": "d4d7edcd00ab81948d11c90df9549367f4e6fbd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629527771, "uuid": "df5c33c0-2fe2-418c-b058-11e424132b75", "comment": "Malware payload (RedLineStealer)", "value": "700effc07eaba7564933099568f8a3f55547fd42e12d1c67b0b80b7b8a47acbc2f2a671c34d15e05b9f2f1142c20533a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629527771, "uuid": "2f2f16ba-c243-4f06-b775-774eca5f0dc1", "value": "T1EAE4F120B6A0C139E0F311F1486DE7A869287DB07B6055D773D62AEEA3372E4DD30697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629527771, "uuid": "40685983-fd2a-4de9-a401-5bcf59dd786f", "value": "ad1c5bf15a899fcfef408e3485448e67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629527771, "uuid": "8f353b4c-2e42-4eb4-a205-1a9e9f124922", "value": "12288:ZAtnh7Q0dS7Ty8ySeAmUgC7Cg8OUzVMkc6erLs8PL3dfff46+gNcXs7n:Z0dS7PmOazVcLxPbdXfh+Cy6n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629527771, "uuid": "b98b1a06-304d-43e7-93f5-f483222ec905", "value": 657920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629527771, "uuid": "3718c576-e5d9-4888-baa5-1673336184bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629527771, "uuid": "38487edf-be9d-489c-9741-f9108edbcfd8", "value": "4608929662ad36f59a9696b9e02ab68e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "623665d8-02b1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629572142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629572142, "uuid": "41315dc6-c79d-4f24-aa69-289b0e5b656e", "comment": "Malware payload (RedLineStealer)", "value": "6470a3e270e32a9b1b58dcb8e7214557", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629572142, "uuid": "754d4049-d23f-4b91-8e62-38c505164e9a", "comment": "Malware payload (RedLineStealer)", "value": "64662d2ab9e2c28c6318e1d61840be90270538c4f9d6d7eb6f5c2cf70507abb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629572142, "uuid": "6038e514-2517-4f14-9582-47ccc097fefd", "comment": "Malware payload (RedLineStealer)", "value": "c4958c0f77da58a2ef5628de8e1dc74e44b86465", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629572142, "uuid": "dcf14d33-52b7-4328-9ff9-adf1cd98b415", "comment": "Malware payload (RedLineStealer)", "value": "accf056cdc94b22f743ba4cca18a96a0d6529441398d6b932c53bad0e9bc679576cf7e183f22a5584dba4c0de366df38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629572142, "uuid": "75305823-8492-4e20-be3b-bb2e193c890a", "value": "T185D40E18667FC015D0F7EAB12DDCA8BBD9A990E7640D793710A4633B4B52784EE0F0B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629572142, "uuid": "41060ebf-4451-448e-92b3-bc92c0b1f852", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629572142, "uuid": "451deb52-b39a-4515-a558-c5ef68167790", "value": "12288:ykOO8TZ35eA1GoALSRSRSSLEeNbWs03UhVFbO/soA:wO4R13rO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629572142, "uuid": "3d9a5714-db03-494e-ab9f-95d95cf8c30b", "value": 602624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629572142, "uuid": "9c7c38b9-1d91-42d7-ad0e-9f1f4a9b2c9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629572142, "uuid": "9c28529a-0954-4bae-8ab7-e0e6315a3ec7", "value": "6470A3E270E32A9B1B58DCB8E7214557.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "817c4775-02ba-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629576060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629576060, "uuid": "c0fd7c84-cef6-435f-ba4c-0097e49e66a6", "comment": "Malware payload (RedLineStealer)", "value": "21453660bdc733439af49bc788a692d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629576060, "uuid": "cce6ba46-a981-4e0f-a9db-13c166f4258a", "comment": "Malware payload (RedLineStealer)", "value": "66945c0be00ac31fd622bc26c36069d389b315c5c81be22b2b77596ba92b130b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629576060, "uuid": "ea1f8332-c9c9-49a8-868a-2a60513b5e81", "comment": "Malware payload (RedLineStealer)", "value": "f2e381d1d80ea07110952d93454aa1a93701b142", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629576060, "uuid": "beecb50d-384c-4a9b-91bc-3157236f22d8", "comment": "Malware payload (RedLineStealer)", "value": "ae551e33a5a5057ae098477de35b03cdcd7fbbe665cf1cde25fe6202533c2a64d505b9dae37a6b647575fd51873ac939", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629576060, "uuid": "3fbc44c1-f559-4451-9855-c2555fdde545", "value": "T19BD40D1866BFC016D1F7EAB12DDC68BBD9A990E3640D793710A4633B4B52744EE0F0B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629576060, "uuid": "570951d6-1f92-4c88-9453-df5abf05a94f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629576060, "uuid": "dcfa6432-3613-4025-b4c7-1799a380da48", "value": "12288:/k+75xc8ky5eA1GoHXlF/yMk30P7vLmw9VTbO/hXM:llHkk13/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629576060, "uuid": "4525348c-40f9-4ef7-969b-3feb75d0df16", "value": 602624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629576060, "uuid": "48aecd2b-4b15-4257-b624-90ba4387b556", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629576060, "uuid": "2228dc39-ce09-4199-9415-ab2685eb6bfc", "value": "21453660bdc733439af49bc788a692d5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f6962ce-0250-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629530503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629530503, "uuid": "34a510d3-37bb-44ef-944d-f038365a8d0a", "comment": "Malware payload (Loki)", "value": "90c0af3bf0e097ea03c06e5dd71b65cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629530503, "uuid": "c0f49926-bfdf-4b79-b6aa-125c06756a4c", "comment": "Malware payload (Loki)", "value": "6877372ebeb306ba9cb1fe266574422ca3b72ad3ca052bc734ce9baa21b76f4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629530503, "uuid": "1da165e7-d4b7-4259-888c-1f550723e548", "comment": "Malware payload (Loki)", "value": "e33f9b086c3842079ab53b66a48c7dd8a1014577", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629530503, "uuid": "0e652468-1753-4133-b646-3a8d7a81abf6", "comment": "Malware payload (Loki)", "value": "f7bb4a1aeb77c676a1b82aafb8af3ccd65e892aa82a9aab0f6eb81fb50e82b6e0a62450795cd43c73cccac07adbe0dbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629530503, "uuid": "de7f1993-04de-41ce-b76f-39ee4473f5a0", "value": "T116A4CF11BC81C0B6C69314B3525EA7BB9E25B7305D20CD8BE7A42DA1FF72971B324B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629530503, "uuid": "4806e245-7009-4a13-9578-f64033859987", "value": "e9aef503b3e4a8eb831af674be5da9e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629530503, "uuid": "d52629e7-b8db-42c9-adf7-165f8916da2a", "value": "12288:IrTu2Jmp4LojOK/PHHub7YSKYmPiEq80+OahBMZV:IrTu2JTsjOK3ifpfEY+EZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629530503, "uuid": "3a22c2bc-0121-4654-82e4-742cb62ef1e8", "value": 460657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629530503, "uuid": "2a3bfa63-6c1d-4d8f-958c-349b9b50d512", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629530503, "uuid": "c25ae536-1742-42e9-8075-4dfefb1f5202", "value": "90C0AF3BF0E097EA03C06E5DD71B65CB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5199c41f-02b8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629575120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629575120, "uuid": "ce826c5a-9c67-4b6c-82fe-74e8e6881ca0", "comment": "Malware payload (Smoke Loader)", "value": "0379bad990765727ec62111ff5a3e8e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629575120, "uuid": "22d3f1bf-49cd-4e88-85ed-5cd20f2618b6", "comment": "Malware payload (Smoke Loader)", "value": "6b8c2357f802c77582699b2df19fb222d44505810717680706d1d2eb990a9470", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629575120, "uuid": "f24c95ee-c350-4644-8658-d69e4869260e", "comment": "Malware payload (Smoke Loader)", "value": "f99d44e5e12bdbe3d860e7e0bd1eab36a9f80763", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629575120, "uuid": "e0711171-d9fa-4edb-8bb2-b2289f28b5c0", "comment": "Malware payload (Smoke Loader)", "value": "9b5c2ce62e92967564051637a6c044b157f2f748c2cfd55e80e1ac13ee20327e07b4815d4c105cc99ee7e410f00a1d29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629575120, "uuid": "605c44ec-d9b0-401e-a021-496480385037", "value": "T12DE3AD1039F0C432C49649334986CA90DA3EE971FFA5C6477F5B236E1FB12D09A2AF56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629575120, "uuid": "3e86ef6e-5e3c-45f9-a942-020643a27a51", "value": "eff27d48d68df0af1612601744441acd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629575120, "uuid": "29388aa5-da69-4066-b43b-b2622bd7cb92", "value": "1536:Wu9K2G7tAsz2wS5kNgyOJX2ks2zF02C5qHP6wG5Y5TrO4sszABFnLFBMK48j:WuCIw6X2knzFiuPRG5YFJsszgFnLmG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629575120, "uuid": "ac583dfb-b2c6-49c9-a491-b7a5171c7ef5", "value": 153600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629575120, "uuid": "9f703b7d-a0e4-45a2-9a42-67e7b3de6b68", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629575120, "uuid": "7460345e-1ad2-42ee-90b1-27e927a789e5", "value": "0379bad990765727ec62111ff5a3e8e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2061cb01-0262-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629538101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629538101, "uuid": "9113d374-aa1c-4cc8-b522-5d765d394e19", "comment": "Malware payload", "value": "a8ddace9435fe395325fc45dde8bd0a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hunting1", "colour": "#439957", "exportable": true, "hide_tag": false }, { "name": "Hunting_21_08_2021", "colour": "#84DB15", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629538101, "uuid": "e24882fc-6a18-4273-9563-ea6a7c6681a6", "comment": "Malware payload", "value": "6e81d7c71b3e8d731e11ad75d3dac02a4210c9f90fac618af5c00cbce3718658", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hunting1", "colour": "#439957", "exportable": true, "hide_tag": false }, { "name": "Hunting_21_08_2021", "colour": "#84DB15", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629538101, "uuid": "cd6c50f8-f846-4365-98bb-3b8a9e43ba6e", "comment": "Malware payload", "value": "dcf9baaa9e3a27450debf4f35112376ed005c800", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hunting1", "colour": "#439957", "exportable": true, "hide_tag": false }, { "name": "Hunting_21_08_2021", "colour": "#84DB15", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629538101, "uuid": "a6f34040-d24d-4aad-8e9b-037e6f1249ee", "comment": "Malware payload", "value": "c3690f85f949eee80c3e64705ed3b24fe2624ba7d6973037c2bac563e0cdcaa04a0b9f9da4b3bbbb583ef7a8d5b2da7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hunting1", "colour": "#439957", "exportable": true, "hide_tag": false }, { "name": "Hunting_21_08_2021", "colour": "#84DB15", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629538101, "uuid": "629ef5b9-42f2-4d6b-acd2-eee8987fcd82", "value": "T1B2738C03B6D18075E8B3073158B4D9524A7FBE254E768C5B37C8129E0EB26D09F2AF67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629538101, "uuid": "099e0f1c-6946-4906-9157-3d34e8257749", "value": "fd008fbfdc73170ba1f1598c4c3a6b88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629538101, "uuid": "3e2b5c21-6f15-42aa-8113-effb8eccb245", "value": "1536:WH8tImFvh/tAoX/V1d/Xc81qsWjcdTxekxemB:WH8imz/H111TxfAmB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629538101, "uuid": "24be1cea-722f-4651-a9e2-3924db403daf", "value": 76248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629538101, "uuid": "18af4015-cf00-454c-9054-489e4035419b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629538101, "uuid": "f1c1fd8f-7328-4df1-a4de-6fac04ad4f34", "value": "6e81d7c71b3e8d731e11ad75d3dac02a4210c9f90fac618af5c00cbce3718658", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3306b1ed-02c4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DiamondFox)", "timestamp": 1629580223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629580223, "uuid": "238ce3e9-ed9f-4e43-ae8c-38770d66fa0e", "comment": "Malware payload (DiamondFox)", "value": "a47e4ba5794dfd910a1402833d5f379e", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629580223, "uuid": "d4c46c55-62e1-4141-b403-3e78c9d9ea6a", "comment": "Malware payload (DiamondFox)", "value": "723e570331aa3284a7b94f247edd6c395df4dc0f55f1d263f418207c28ef0dbe", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629580223, "uuid": "0d82333a-2fff-4db2-b985-325791ab3b04", "comment": "Malware payload (DiamondFox)", "value": "37963628fd5ef4fbf99e03145374a31c99e54685", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629580223, "uuid": "c7792d9c-02fd-49fc-b061-9069013d897c", "comment": "Malware payload (DiamondFox)", "value": "04642a73e71ded41f5f12446b287d2c4a94c86c652a9a77a4832b00dd7349b4c10a7593380f1861618c2fb76daaa7af1", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629580223, "uuid": "ca7b9c14-3ce7-4841-b07b-4682c903611f", "value": "T17E1633F914DA6175D0B5C631CF2FC69FBB9B556529A892D33E920F284802B908E1FFD0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629580223, "uuid": "2b81aaa5-d180-4461-961c-2f93b839fe3a", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629580223, "uuid": "c0cbf811-4e82-4c42-9a2e-6a20c8593ba7", "value": "98304:yZQHaZj1nYFguGgVS1HcjTUYCPENx9wX8/gH28y14PsgjlbD3h:yZQGnAguGQS1Hc3UYP9d4W8y14BlbLh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629580223, "uuid": "779657bd-2be7-4829-9323-ceb3b058acab", "value": 4108083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629580223, "uuid": "ad1d45b2-805f-4455-b637-18e190b0e4c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629580223, "uuid": "8d91a316-4f94-4379-8862-72471909bef1", "value": "A47E4BA5794DFD910A1402833D5F379E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0926b36-02b5-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629574099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629574099, "uuid": "94867c18-810e-45c7-abe9-ca5da070e209", "comment": "Malware payload", "value": "d78e78b723a871da54ef7171ae320ddf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629574099, "uuid": "c9949f9a-c925-4e79-b553-281e2da9dc42", "comment": "Malware payload", "value": "735ac9f6f45101791328e1126911faef2413c674096951195c1d256c99188306", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629574099, "uuid": "1b6694e0-a7aa-4b5b-a15d-ffc89222ffa3", "comment": "Malware payload", "value": "ca8cc3a92cb43134a726c3166d9f45372ed887fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629574099, "uuid": "4da78a11-7215-44fc-ad3c-0bf01a9c6d14", "comment": "Malware payload", "value": "7dcd20d90a8fd07ccb1d006199526bbe4777b2ce090bff6f0bbf570455b28a102cdb77b718115dd77a5a80c0969e3ed7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629574099, "uuid": "93a1a161-1eea-4a4a-b04e-539c7d4ee948", "value": "T14EB2E109E05A6679CB533A7DF57047C73B4215F4C7BD343514B412AC1BC5909EF9AAC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629574099, "uuid": "e7fbeac3-0d0a-4bfc-8741-f9f905899748", "value": "384:0G0PQEsi8PhTl/LMyZoSTTK80GIiYBZdYM+Kvz1p5Jtp6m5Fh7qmdGUEpia5a:F0Ixi8LLMymSTW8/ok+z5P5T9q3UEL5a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629574099, "uuid": "9c933f41-e4e6-467a-9cdf-5fe86b82c94f", "value": 24040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629574099, "uuid": "99dec7b1-94f3-4013-abb3-fec55a479a76", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629574099, "uuid": "c29bcfdc-701d-4727-8d5d-32f39c883327", "value": "d78e78b723a871da54ef7171ae320ddf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f950cc01-02b3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629573254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629573254, "uuid": "9f04e3bf-4175-4e95-b368-6eca9a9b609e", "comment": "Malware payload (Mirai)", "value": "a21a2ab09748c01cbb3aaceccd0df578", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629573254, "uuid": "dbc47c3e-3d16-46dc-8809-1e0d9ca549cb", "comment": "Malware payload (Mirai)", "value": "77251c83985bad036461d5d0417fa844a6949f995c095625539d7b62d9c225ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629573254, "uuid": "939cf178-387d-49a3-80ab-f8627c69dca4", "comment": "Malware payload (Mirai)", "value": "9b27f8c9cd1b5e8a6770dd60b12a87e72ecf0bc2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629573254, "uuid": "378030bc-5a11-4ea5-98fd-ab87456582fd", "comment": "Malware payload (Mirai)", "value": "d2e48c7d335ebfa91a63e903d6703d2d01220d3761003bb42d5dff3c27069aeb905cd9b23a59bdaaf2ef7020d126eca0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629573254, "uuid": "19b72b16-ba9b-4d31-8d5c-41f349a28b50", "value": "T13F72D0A55A034D84E7D5017132D882B30B957F222025C1E258EA90052B3B95FEA4EBF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629573254, "uuid": "2e66b964-d2be-4756-920b-0c5c147241f8", "value": "384:O2fXSdyCFYDx9wtR57fqrGEB/HentgGd4J0hTp/ftBd:XX1CFlF2F/enF4OdRd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629573254, "uuid": "d8b8356d-efb0-4cb7-bf7d-5f550b6ee7b4", "value": 16356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629573254, "uuid": "d47ee1cf-7adb-47b5-9e0e-c52aa19b0487", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629573254, "uuid": "95cce775-c4ca-4584-b6b4-84a05f646d0a", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d701811-02b4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629573395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629573395, "uuid": "d59f3bba-5315-409a-ae8f-b136e1a7fd17", "comment": "Malware payload (Mirai)", "value": "1578827678b498e5876bb6790983517c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629573395, "uuid": "14297a94-febb-42bc-abc8-332b76cf065b", "comment": "Malware payload (Mirai)", "value": "78a6ae1188e717c4b048acdfed71a4d232d63bdd4eb452d6019866dabe853d17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629573395, "uuid": "aea95d38-74fd-4f5c-86c0-07e2d4f5461c", "comment": "Malware payload (Mirai)", "value": "968b191c60049ba7deb1d5af55e7b5cd3d25bbdd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629573395, "uuid": "b18f5d85-2be0-4ade-8610-7e14cf3c67f7", "comment": "Malware payload (Mirai)", "value": "cc81b22e97d967d75dc4ded85c308b8f9a7392a12d6a21b899fd3a54a3ec7ec891c25573da30f0aad6f09defbc1f569f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629573395, "uuid": "e96ff65a-3814-4aca-ba20-d5008444bfef", "value": "T1C682D049CF6D5C5AF73B5A3F259B9C33ABC239051A84206286F271CF2050469F767E61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629573395, "uuid": "3dc56b09-89cc-4e3b-af3f-96af7ef890a9", "value": "384:+LwQ32Kdv242JPrhmIiBx9v/Mulbm904SGObQeMJIl2B5M:r42JlmIITvZYIGYQeMJL5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629573395, "uuid": "c07e89c8-79dd-4124-9134-57be916cda71", "value": 18060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629573395, "uuid": "c0cf8886-e6fe-4852-8126-435d51c55b2a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629573395, "uuid": "5197f689-28a0-452e-86fe-d9560ab9eaea", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c0ee9b1-02b7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Vjw0rm)", "timestamp": 1629574655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629574655, "uuid": "b8b0f090-d2e5-4d10-a96d-0b850672a04d", "comment": "Malware payload (Vjw0rm)", "value": "8fed7262f75ec7c978a03e8177dfadab", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629574655, "uuid": "36ea9d61-74da-4a3a-8308-eaaf3051c77e", "comment": "Malware payload (Vjw0rm)", "value": "7a2fd40a032e726bde8638b079963c499d20c7c197a0f91544f458977fbd3304", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629574655, "uuid": "dfed9a49-5cbe-4aa3-8637-5c69077b7f10", "comment": "Malware payload (Vjw0rm)", "value": "3c95b2b69114082581b28a34533cbcddefd72516", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629574655, "uuid": "589079c9-330e-4f18-8c93-69230b9facce", "comment": "Malware payload (Vjw0rm)", "value": "19ce8ab3d3a7d0bec60959cf8c517bb7c0397b447c9a265620a56aa8d5fa69f6b22838d01d5e3186ccc77c5a0f6a274e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629574655, "uuid": "0ad26ad9-ff37-42c7-a3c4-62c45283291b", "value": "T16FA4E0197A40B723CA67F214547E20399FF07D4BAC4693C97639FF829F4A980D41A3A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629574655, "uuid": "8c61b9b1-0dbc-4740-9091-eb0e44e0e0c7", "value": "6144:Qy6COPsZV2SvRmFgI9smdixnlahHhUgy6COPsZV2SvRmFgI9smdixnlahHhUt:wux5mFg6slxuKAux5mFg6slxuKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629574655, "uuid": "a763f2cd-0fd1-40cb-83a8-2b7dfa41ea42", "value": 481229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629574655, "uuid": "b1bb86ca-fabb-4185-a747-7e29c214b56a", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629574655, "uuid": "68a94c22-8eb7-4659-8249-c0a51780e123", "value": "SKM_C258201001130020005057.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77076574-02b7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1629574754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629574754, "uuid": "db0992dc-2ec5-406a-9421-742dc1d1f3a0", "comment": "Malware payload (NanoCore)", "value": "02cc5d8129865b0178afd7399edc2019", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629574754, "uuid": "d372088d-809e-4041-af43-9401a37991df", "comment": "Malware payload (NanoCore)", "value": "7b75988998d4907ee124796286cf7c632d1c35ffe6d994631b9746bd384598c6", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629574754, "uuid": "0b1579ce-e166-4898-a142-c4590e20faa0", "comment": "Malware payload (NanoCore)", "value": "96f71495c5bce3b555f2a463ab550ad63105b628", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629574754, "uuid": "704093e8-3c6d-42c1-bfa3-34171e5b377e", "comment": "Malware payload (NanoCore)", "value": "a70974a076c3819fecde32c63232f1838be74cedf11ff335369d5407ec04809468c99218644b744e2d5305d149781822", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629574754, "uuid": "88bcbe9c-7707-4614-8c0d-cba09b6867b9", "value": "T17F11AD394CA58EBA0345D07101878DCCDF20C7577798FE791835B85A5D6CE3A9E8DA0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629574754, "uuid": "24758827-8f0d-4a1a-9acd-cb12c1186b51", "value": "12:uhutV6Q7zMBNkiuNounuAbZbGJA8kcXO2qvELJ7g3NnLd+KPj2T+TOM:uOVzSNkiIpGScXO2qvEcNngKG+TOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629574754, "uuid": "0e0eff02-02cf-462a-847d-ee252a8f05a4", "value": 946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629574754, "uuid": "bc23a880-509f-4c7a-bf60-5e0cad1e65c0", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629574754, "uuid": "a7a775db-4758-4188-ac1e-4a6f1d9f5384", "value": "X92867354_PAYMENT_RECEIPT.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "237b5cef-0262-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629538106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629538106, "uuid": "b7cea1d7-520c-48bb-b239-bad4253692a7", "comment": "Malware payload", "value": "335b9a537a380ec5936a7210ad64d955", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hunting1", "colour": "#439957", "exportable": true, "hide_tag": false }, { "name": "Hunting_21_08_2021", "colour": "#84DB15", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629538106, "uuid": "c336bc36-6d44-48f2-8c69-bf70fd46b665", "comment": "Malware payload", "value": "7bcb25854ea2e5f0b8cfca7066a13bc8af8e7bac6693dea1cdad5ef193b052fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hunting1", "colour": "#439957", "exportable": true, "hide_tag": false }, { "name": "Hunting_21_08_2021", "colour": "#84DB15", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629538106, "uuid": "47322314-2a27-44fa-9dd3-dc0fdd50c33f", "comment": "Malware payload", "value": "c17b605ad2630869e063ffc575c36c5b6c8f853a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hunting1", "colour": "#439957", "exportable": true, "hide_tag": false }, { "name": "Hunting_21_08_2021", "colour": "#84DB15", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629538106, "uuid": "49c591b2-08a8-4270-be80-202454e7555f", "comment": "Malware payload", "value": "ca50ed1758b4c8dec3053382dcf31cbd0ec2c4b4d5d8e91376244909db6e32b59946f8405eb64e2c632d2c3875d5eee1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hunting1", "colour": "#439957", "exportable": true, "hide_tag": false }, { "name": "Hunting_21_08_2021", "colour": "#84DB15", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629538106, "uuid": "d2de0d3d-86be-4a91-804e-8ed409e2e477", "value": "T14E721A8AA7DE1525D5EE0F7C88B305110BB0E5160FA3D79F0ADC448F6C23B9459E27EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629538106, "uuid": "5e87cbb6-b54d-4412-a028-ab9919851e49", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629538106, "uuid": "15fc7aba-3e7c-4bac-b781-2513531a2717", "value": "384:4vLWrfGW81MvSKhV19xjdzPnlkJvTQbgveRFw:MLaf+OtjlkJve2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629538106, "uuid": "8fc09d42-f435-432e-8ce2-c2afe9566707", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629538106, "uuid": "71f90247-f200-42a3-935f-0a00b1482ba2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629538106, "uuid": "880da2b0-cf5a-41d0-be73-a8fc00eb257c", "value": "7bcb25854ea2e5f0b8cfca7066a13bc8af8e7bac6693dea1cdad5ef193b052fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "804044c6-02a3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1629566179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629566179, "uuid": "1ef9423b-51ea-4279-96b0-04315d6f872e", "comment": "Malware payload (TrickBot)", "value": "7f120ba802e1972db4166a781294a5a4", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629566179, "uuid": "cb802281-07da-4024-9b3b-343f5235c825", "comment": "Malware payload (TrickBot)", "value": "7f357817d93a435441f54c46a1a877846a879310289df93636ca26d02b9c548c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629566179, "uuid": "0b21bb25-8b17-4e75-bbdb-1563baa975cf", "comment": "Malware payload (TrickBot)", "value": "fbec3c99ee2cf8bf5c8f92e89e88a9012f3a53cb", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629566179, "uuid": "98e02143-e79e-434b-b6bf-581e01900ba2", "comment": "Malware payload (TrickBot)", "value": "bc5be6ea8e53d671639b3e563fd63d640bfe9933c7b792ed021d4a30529ba71410ebbec4869f9dd1b38c356d339f9a00", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629566179, "uuid": "f7eb3bf3-da1a-4216-ad6e-fb1387b53021", "value": "T128C4D6991594281DFC73F6FCE4D16342DA35EF796421A80F0DB2A24AB16230D6E9E33D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629566179, "uuid": "875c6fbd-5288-4cd5-a725-db205caacea2", "value": "6144:TUiABstkyzwfkYFYZqUZJrpX8hoAOALi/NaZpd2xoifoTvT+4MkINH6eGKtU3ZM6:TUFBstk6YFGqp2UAjVkn9pNxxfXj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629566179, "uuid": "e0ff017a-ba4d-41c7-b2a2-69a4078677a9", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629566179, "uuid": "d64f632d-c96b-4e22-b8f1-5f0da9990cd7", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629566179, "uuid": "fd142b35-249a-47e5-95c9-5552dc3a6824", "value": "7f357817d93a435441f54c46a1a877846a879310289df93636ca26d02b9c548c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8e7e826-026b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Cerberus)", "timestamp": 1629542249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629542249, "uuid": "4fbb095b-fe02-42fa-8f8e-e9305114b1fb", "comment": "Malware payload (Cerberus)", "value": "cd9cc2c288b39d58324c96eedda21831", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629542249, "uuid": "ed881cdc-1779-4a89-8584-1cef4bb9c451", "comment": "Malware payload (Cerberus)", "value": "808f0c09e176834a8f3c0750677fbe9f6ec10caab55067cbec5c98dee300e151", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629542249, "uuid": "5319d770-b1b3-4628-a3e3-aca2581cb7d3", "comment": "Malware payload (Cerberus)", "value": "8b8b98c2245e32d29b0f2774693ea5b92c556fec", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629542249, "uuid": "8f2a583f-1f34-4d18-91b1-13dee0b10b06", "comment": "Malware payload (Cerberus)", "value": "97a8f63fed20034e82386cd04b11eac3efa6604c3d3fc5fa0b8e3533cf4d68e94fa959163c25e7b8c059e694f659e525", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629542249, "uuid": "e160e78b-0314-4b0f-88c2-c4ab306e9678", "value": "T141E5339F9BC6494DC47B4333950236076205205CC1CEBB3E0AF6445758ABDADEF6AEB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629542249, "uuid": "74ea44fa-5db3-43ab-bbe6-f814f095f6f6", "value": "98304:ujfprLUanrvhUaeohPgThMtdugD2n/gBvPYb:+rnrZeohIThMt0gDIgB0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629542249, "uuid": "e39e9fdf-8394-4bd7-ae93-8e3b3f9601bb", "value": 3275111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629542249, "uuid": "ec48dbc9-5608-465a-b2fc-4721c35169f9", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629542249, "uuid": "c2f75cd1-6fa4-4ca0-8008-b032445b9207", "value": "Android-Update.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc1f3873-024f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629530202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629530202, "uuid": "3a8eea84-6646-431c-a654-2cb81cbb614e", "comment": "Malware payload (RedLineStealer)", "value": "139774e857c8b68d258b24db6483434e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629530202, "uuid": "7bd194f3-7bbc-4b2b-9ef3-0492c02e7807", "comment": "Malware payload (RedLineStealer)", "value": "842078d6a5aef0ad5e1b2f6354ba8cef7dea3018bb1f089343e6f686cce88f64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629530202, "uuid": "c579f069-007a-41bf-8ea9-4aa0d51c9ee2", "comment": "Malware payload (RedLineStealer)", "value": "dc626b1a5cb2e195d7b87f54ca28d5d2212da124", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629530202, "uuid": "8743e098-db63-4725-81a6-42bd29874971", "comment": "Malware payload (RedLineStealer)", "value": "e2a4f594c7b85cfd541d3688df65392856183e0f67b85f80e6416886f2f5d3f56be568bdc45ebccf0bbd51e913b1232a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629530202, "uuid": "2b609840-1d96-46d6-9e9e-5844aa65fbdd", "value": "T1FBE4F12066A0C139E0F352F498BEE7AC69287DB06B2454DB73C626DE53376E4DC30697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629530202, "uuid": "7a3bf5e9-62b6-47a6-8ed6-30464830505d", "value": "ad1c5bf15a899fcfef408e3485448e67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629530202, "uuid": "3a49112c-f82a-4b40-ac01-25ec3d17fba1", "value": "12288:m5VXHAcvY7LEU4uZuEbyoQSOH1p5lfW90zoA6OT67ulXQVsunn:lcvY7iYijOuEBOT6ClXysunn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629530202, "uuid": "e581c0e2-316f-43d2-88d0-8e18171f96e8", "value": 658432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629530202, "uuid": "c869e9bf-4f4e-4d6b-a4e5-e129efe3f381", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629530202, "uuid": "e180711d-937c-4159-96f9-32b8f1c6d0ae", "value": "139774e857c8b68d258b24db6483434e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07e0fcb0-02b4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629573279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629573279, "uuid": "13928587-184a-4ab4-bb4d-9a79325fc324", "comment": "Malware payload (Mirai)", "value": "371c903dd1c28b72f54be3bb351bff80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629573279, "uuid": "daef54d2-a473-4e2c-94bb-0498654eda28", "comment": "Malware payload (Mirai)", "value": "84495999eebbfbc7da33475aa7ebb680350254dedeb827c5f6bf3adb859f80c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629573279, "uuid": "bc6cb87e-a455-4310-9493-248c69c3784e", "comment": "Malware payload (Mirai)", "value": "c5135e214f15e444fff66147163e374dae54c56a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629573279, "uuid": "93bcff97-d27a-401f-a707-c3d8a9e952e3", "comment": "Malware payload (Mirai)", "value": "917196044a82b854bfa0fce5462cc6afae3f2117ea40e2a1e6ea5081a241cc4c17b57f4b4107cf189bdec4d545d531c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629573279, "uuid": "4bc665e8-a467-4b69-8707-7b464684aa9d", "value": "T19F72CFF88194C646C62AA23D944D3488BEBD9C8513AF17037FC1DD325A761E1973ECAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629573279, "uuid": "942e2e17-f1be-4ab6-870e-794fef287429", "value": "384:M6wOGOoGBf29sEbVQJ5F7Zuf210WjRKYFshmzcDYttLv1RX:OOoU+OExQJ7heWj0YFgmzztdX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629573279, "uuid": "d392377f-2253-4003-b9b6-85c63cb33cd1", "value": 16136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629573279, "uuid": "59ea820a-1752-45dd-a893-662c7f5d5875", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629573279, "uuid": "64a1e2a6-49f8-4a9d-bab5-b8ddf2a16c8a", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57bf5785-0267-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629540341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629540341, "uuid": "be869d41-337d-4e64-9a13-3106edb627ea", "comment": "Malware payload (Smoke Loader)", "value": "9255ff793301e07ebbddb71ad8151f42", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629540341, "uuid": "08bdf2ae-b40a-4d29-9e8e-6c6a80a6c96a", "comment": "Malware payload (Smoke Loader)", "value": "86d34c8a0dac58667e0fbed519b0189d90082825cba5721e9d3575c90c47e57c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629540341, "uuid": "98d19156-ab31-4f43-938f-313397563d77", "comment": "Malware payload (Smoke Loader)", "value": "459cd2dadf6a49fbaac90140721e8891f454ff16", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629540341, "uuid": "ec85c35c-0bd6-4bda-9966-64c939ccd137", "comment": "Malware payload (Smoke Loader)", "value": "f5aad4fea98a7144e4d6edcdb1b10606bffa16b837c3767ee52c3e3f544dc949abf4302aabe4f86b75054e0a617414a3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629540341, "uuid": "b3056363-3bb2-445d-9ef0-959fe0c2a374", "value": "T16C549D20B6A0C138E5F711F489BEE3A8692D7D706B3050CB62C626EE66376D4DC31797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629540341, "uuid": "a15f2cfc-56c4-4259-ba0e-ef60a2e656eb", "value": "a30b70feaaf646aa38caacdb4af5c88b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629540341, "uuid": "d172973c-5b1c-4428-8da4-91404eb533be", "value": "6144:gSlJjCfD/1BTF/z5f9H1HPgjSnsZfa9wzV:hRCfDNBF5VHxqSnsda9QV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629540341, "uuid": "e81e1d78-1ba5-4c75-b363-14b26822b6b0", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629540341, "uuid": "9dc4c53d-1884-49af-a0b9-876132be9f54", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629540341, "uuid": "f2dd03d8-b4b2-42ce-b6e3-6a4a18643571", "value": "9255ff793301e07ebbddb71ad8151f42", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b45d8b0a-02c3-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629580010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629580010, "uuid": "95cb6cff-a238-4560-a969-8a9f41f3626f", "comment": "Malware payload", "value": "77918cf16c9d133a94c566bd6de591db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629580010, "uuid": "16c0ac9e-2aba-42b9-9d6c-ca52e194e3f9", "comment": "Malware payload", "value": "89345900ae900c3173451251fd43261dc523c71a11ea8ceb189118274d76328e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629580010, "uuid": "bb6412df-aa64-4e52-b122-bbfb2db004e7", "comment": "Malware payload", "value": "b153f0df1c4c7423bd389356682a9b2c0b29f99f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629580010, "uuid": "a882e2f6-6ee2-4f96-b5e8-e50335c0be4f", "comment": "Malware payload", "value": "9adc4153c0049a54dcd577caf8626b11a971f9ae006778295daa8e66a94043d10edbd7abab01043ebdda21ead850f668", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629580010, "uuid": "cfed38a4-8274-4651-af22-cb2818737431", "value": "T188B4E031A6F0C138E4F311F459BDA2ACA9397D706B2080CB62D62ADE56372E4DC30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629580010, "uuid": "22b3e09e-a6bb-485a-8b2c-a7d6a5a5c4a3", "value": "87931c028561c299d538d462f4889ea0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629580010, "uuid": "018f99ec-964b-40c7-8fd3-d4e61013d1f2", "value": "12288:szDo9gXiieFdZzULC+lRT4EtRfU1Xbfy6gSaWwJMHgIXW0J:7gXHeCnfgLy6PUM9XNJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629580010, "uuid": "8ac2cdac-481b-41fc-ab57-9ec8412b6bff", "value": 535040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629580010, "uuid": "602ee788-416b-4eef-aec3-6fa4e5f3410f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629580010, "uuid": "c8a2dde2-319f-4dd7-ac5c-f37dcee62c00", "value": "77918cf16c9d133a94c566bd6de591db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17a2bd7c-02d3-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629586619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629586619, "uuid": "42b18cbb-4375-4fa9-acbf-fc0da91cf28b", "comment": "Malware payload", "value": "871cba396875673097c170edb571a972", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629586619, "uuid": "41ee7434-7168-4a2e-8a19-b062bb59c689", "comment": "Malware payload", "value": "897676bf56a0dd969a5c9e566e05a0ca8c401d4d0c2002cbca223f249687f682", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629586619, "uuid": "65eaadd1-8659-447b-a73b-06ef10e8fe15", "comment": "Malware payload", "value": "18e925fd8597c1deefd28832ad428744577e6eb0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629586619, "uuid": "e3dad01e-d25e-41ae-a18a-aa75b529cdcb", "comment": "Malware payload", "value": "31d7e720cdee95fc1261b9c0333bc660aa9bd652da32051e8cdc879262ca7d2fba718279ea348fb880e2e8028dd07451", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629586619, "uuid": "51e73cf6-fad0-4907-909b-7a595f4db888", "value": "T1D2D40E1866BFC015D1F7EAB12DDCA8BBD9A990E3640D793710A4633B4B52744EE0F0B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629586619, "uuid": "3fbaa3b3-fbeb-4e5d-9da9-f392b8db2ef1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629586619, "uuid": "cc7bfdc8-41ac-4f08-b0aa-957aae790feb", "value": "12288:Wk7XjhEnob5eA1God0C3RX7Vo9KAQVbqbO/bruWCFKGj:dGoD13l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629586619, "uuid": "a44b8b7c-b9ab-4424-aef2-3f0318e6e655", "value": 600064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629586619, "uuid": "e64f3811-7bdf-440a-a820-1145c13cea02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629586619, "uuid": "aff921cf-2a6d-46e2-9423-7a5e07a546a0", "value": "871cba396875673097c170edb571a972", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ed5f7a0-02c6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (StealthWorker)", "timestamp": 1629581129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629581129, "uuid": "2a5a8e3b-4a79-4e0d-b671-8519227e905a", "comment": "Malware payload (StealthWorker)", "value": "b3f9763036fcbbb828e2420b349b17e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629581129, "uuid": "e9519786-9225-4133-9700-2f7d7481a5ca", "comment": "Malware payload (StealthWorker)", "value": "8a4fbdcb745421e4126672995940c80e9e391bf10cac6fa29185bef7d38682d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629581129, "uuid": "15dea428-416d-4da1-bc24-459e8d1b0a19", "comment": "Malware payload (StealthWorker)", "value": "eb0a47594e7166e7e58bb8cfc6b3e0e2079af4cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629581129, "uuid": "6157779a-f552-47e4-95a0-3681146ab2be", "comment": "Malware payload (StealthWorker)", "value": "3b27a56c301befb6369698298652fcd9c3f4099f4082584769db7e25408a15e48fbd751bda72623cf2b739b5b3092fb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629581129, "uuid": "1c0419ce-9f16-4c18-8932-3f60959bbc18", "value": "T124B4E120A7A4C138E5E711F455BED3AC692C7DB12B2054CB62DA26EE633B2E4DC30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629581129, "uuid": "dd2b872e-ab6d-4f91-9bae-679f03337db1", "value": "7ccab310a438ef3dc7bf868c0f874b57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629581129, "uuid": "85c97e9e-3e70-42e6-8127-1960dede8baa", "value": "12288:Mj59Yzf98ZGo6fKHFjG3lf8bp+ixjBlz0YgkilcMxmYURgV:hzl89k3EXRJgkilv1URgV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629581129, "uuid": "c41f895c-00f1-453e-972d-284086256634", "value": 539136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629581129, "uuid": "4fdfc985-e1a3-4f58-b1cb-a796bdb2f23c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629581129, "uuid": "bb1a9913-d05d-43f6-87ee-1dc48bbbaaf4", "value": "b3f9763036fcbbb828e2420b349b17e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8fb788c-02ca-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629583078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629583078, "uuid": "609626e5-d0e4-4a37-89c7-6d511e0f7188", "comment": "Malware payload", "value": "5253b6a22231af3af11e4e36391ad68d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629583078, "uuid": "314698b6-0ad7-4f75-a60e-621154d1ada5", "comment": "Malware payload", "value": "8adae0a0a0929e193e3dd8a02baa943ed0018460409e053281e69f2edec9d635", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629583078, "uuid": "038989fc-8f00-4963-a87f-55868538975e", "comment": "Malware payload", "value": "1979842fd250b02697a03af2794ffb459eb023c2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629583078, "uuid": "95ad81c2-ac43-4340-aed1-317570c29868", "comment": "Malware payload", "value": "40ffa53e2cb2a671db89e7263439f8735b3ca2e2d6433df3a58576a25a61d3300f25fab4d8f19c403112435f511c2a88", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629583078, "uuid": "eae9f54a-68f4-480f-96ab-fa9e4970bbbf", "value": "T1CFF5334ACC4EC430DEE19F79EE145F36138BAF74FD69F29A485AB0101BF79E52224885", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629583078, "uuid": "8148098c-0852-4f24-8753-d72428b597fa", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629583078, "uuid": "e2db7e0c-cff9-45ca-b581-abcae7e6d98e", "value": "98304:N5PaNDONo+8CL4/TnHsgj0oaHTey63Qv2am5hsmzXTcTgDbd:+QT34/TM8JEv2rs8XTc8Dbd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629583078, "uuid": "4945b8a9-2e40-4ac1-9f17-fa0dbb097006", "value": 3568056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629583078, "uuid": "2e36e378-0fd4-4203-a952-359f20e1e2d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629583078, "uuid": "b82da953-ab46-4798-a7a5-c783439072f7", "value": "5253b6a22231af3af11e4e36391ad68d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "361cc67c-0271-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Alien)", "timestamp": 1629544580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629544580, "uuid": "bb095925-0896-479e-953b-a5c2fe3261c0", "comment": "Malware payload (Alien)", "value": "46fdb068ce8eda8fce387134a4fd4172", "object_relation": "md5", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629544580, "uuid": "8887155e-b21d-4c5e-8383-46b8f9cfcd0b", "comment": "Malware payload (Alien)", "value": "8e168f31f3bf0564d11b01e180d301f41e3582a89efc5ca15ed40a402c0ca3dd", "object_relation": "sha256", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629544580, "uuid": "48a49c6a-57bc-47c9-a9c4-094024ec59c7", "comment": "Malware payload (Alien)", "value": "2f56a65676d377f552a86a4482ee1bf104d05b09", "object_relation": "sha1", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629544580, "uuid": "c0c000f1-0a50-44c3-83ca-8f1bbd33347e", "comment": "Malware payload (Alien)", "value": "ad17ebff3340e8d90c886518fab4b60dfb0dbc5da0b6ef75400c2c20a612006fff376786c0ae83f20d07ebb0c6d243e7", "object_relation": "sha3-384", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629544580, "uuid": "0f1f78b7-59b8-4326-8b15-0f5efa9cbd7a", "value": "T1C1F5334AEB469514EA7BC272C0A30327733C726922CAF67E4575408424EBD6DE72DC7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629544580, "uuid": "570473af-dee4-434f-bf78-2c41f1b27077", "value": "49152:Hsjwrl65NLyheuX0HK/tYhZRpfO9uDtIlhf7Ln0LmeDfb6iIZtiXvDyUhVEtRGML:K5N+hbf6d3to7eme2GxhVURGAyznop", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629544580, "uuid": "eb7e8269-fb59-4d7d-b4e0-a7e7a06cfc17", "value": 3422742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629544580, "uuid": "e6529444-eade-4eb6-bfa8-f83b67c97e0f", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629544580, "uuid": "caa60b32-9506-4290-bc4e-6db6eadccbb3", "value": "AndroidGuncelleme.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a257fc4-02c4-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629580262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629580262, "uuid": "835755ef-dcf5-438c-80ca-badcca16a52b", "comment": "Malware payload", "value": "0da30027b58cd2bef65628dc85f77d01", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629580262, "uuid": "b1e88433-689c-48a8-8027-10f8a9b994c2", "comment": "Malware payload", "value": "9032de8578a6d527a1d0214254c734d46b84f3e4b5658b731b0acfc82c943a69", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629580262, "uuid": "55ffb8da-6fcc-495d-bd88-4e522f5f5843", "comment": "Malware payload", "value": "c8c3d2e0fb03065af5144677d0dc53f18217ae8f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629580262, "uuid": "60230c69-9084-4645-b697-6a26cb6c84bc", "comment": "Malware payload", "value": "c58249a60b3bf0b4a6e15d827cf34b5868cb77b95bba09ed776acf1538a3ce5b954f93be1f3d4069f66060cee83784eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629580262, "uuid": "95d65b60-eff7-4747-be9f-2f3642d5b729", "value": "T1F825CE663114BA33E15D31324DA5D49005BAFE695C31DB4EEEEF3B64063EAAC3227247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629580262, "uuid": "63a1af0f-5e07-46c8-b0c7-6160adad6f7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629580262, "uuid": "e9705ad1-ee7a-46f8-89b8-1dc320211a2f", "value": "24576:LWE2SV6iH+sQN4LRLwvQ+L256qZhCNr/B7uy6:iUdH+s8Y+aZo7B7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629580262, "uuid": "8040f8c0-cabb-436b-b83a-0e08a8d8c979", "value": 1024688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629580262, "uuid": "a1e09e57-a9a0-4927-8d9e-27f0618c7672", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629580262, "uuid": "bc428e0b-566d-44a1-b8fe-fa1115a28e15", "value": "0da30027b58cd2bef65628dc85f77d01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "208c17bc-021f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DCRat)", "timestamp": 1629509325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629509325, "uuid": "cd0e8ac6-b883-4d01-afa2-11da02016d3b", "comment": "Malware payload (DCRat)", "value": "e8317caac6568f4d37d8535a1e56ad29", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629509325, "uuid": "d1e70dd4-0f68-4c09-aa90-354fc0b5e2ff", "comment": "Malware payload (DCRat)", "value": "905fc6297517e940e073d09037ea044f2ba0ecf95f728abae8199bcc0ee2142d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629509325, "uuid": "7e90b565-39d6-4958-a5f4-889f0d3d7813", "comment": "Malware payload (DCRat)", "value": "f0fd94999b1f177a9c356fe7d5d51ff67b57bd43", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629509325, "uuid": "1872b1ee-6bfe-44c4-8516-448d20d1ae84", "comment": "Malware payload (DCRat)", "value": "705618ae834596eaf851c30c9c23ca320243c4cb2801629cc59e4137aaf4fd087f9ead303da8347a31f76413191ade21", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629509325, "uuid": "e8667a95-02e3-482e-8a63-e304bf7f6aff", "value": "T175B49D9A37ECAA11E1BF8776E4F15C694B71B412A6B6FF0F0A8952D91823740DC00F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629509325, "uuid": "e37fc95a-aca9-46d3-a1af-4dae6568928d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629509325, "uuid": "f97c657d-bec6-470f-8350-e519805e766a", "value": "6144:7qqDLOObBf5tUgvk+HyxcQFcUdMOMJa1DHjzCytSi2OFbJKnblNGaN+SZxh8D5m5:2qnOO9BtqxcwdhrjzzcOlWkSZ3y5UB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629509325, "uuid": "a891e0c2-cb96-41be-8975-4e2d22921b04", "value": 505344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629509325, "uuid": "24ab60c6-b002-4bf2-9429-f955748bd8ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629509325, "uuid": "ff0ffab2-0744-4b76-872c-fd68f6b2a5ff", "value": "e8317caac6568f4d37d8535a1e56ad29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d6e850f-02b1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (StormKitty)", "timestamp": 1629572214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629572214, "uuid": "f53d83d3-807b-4a7e-a236-3d5923e2ccdf", "comment": "Malware payload (StormKitty)", "value": "beef5daf51dadc2acdbccc37a73ccfec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SarumanStealer", "colour": "#CF6609", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629572214, "uuid": "db2529ea-af3f-430d-b143-470b79dcaac7", "comment": "Malware payload (StormKitty)", "value": "91eab57eaf00089ffd21329eb93e072c8eb7ed79e37c807f6db2859548c8b5d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SarumanStealer", "colour": "#CF6609", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629572214, "uuid": "1c118041-1246-43eb-abaf-06ed53400a8b", "comment": "Malware payload (StormKitty)", "value": "1a49019a42f0a195828bf2a5e7b41013709cc8c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SarumanStealer", "colour": "#CF6609", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629572214, "uuid": "fee155fc-9e97-4700-a77d-bcb038269f6e", "comment": "Malware payload (StormKitty)", "value": "957f2b9151c6c4328da61dbbef04aec2c27ea967d9f9ae6fccd9045f463c8e513e8fc8bbe1d83aa3b44a875384a2d04f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SarumanStealer", "colour": "#CF6609", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629572214, "uuid": "e38de443-fcd4-4857-b918-8d64b47bb1bc", "value": "T1BB061203B3968931D5B90A34C5DAC1340FB66E8126F3D62A2DF8EE4F78713966C39395", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629572214, "uuid": "d5aad0d6-4d75-418d-92a2-42b3edfe1e86", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629572214, "uuid": "98d1df5a-4274-4e9f-96b9-d70caa1f09f9", "value": "98304:qbkDpLr5n9Ov7NCnsAAS7QG0owscxF7ZLN:q2pA7NksAASUqwsOLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629572214, "uuid": "8581f7fb-4890-46f7-b886-ad863bc208d3", "value": 3732920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629572214, "uuid": "e27d87f4-bc45-4893-a819-e0b4fb211432", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629572214, "uuid": "0e52fcc5-156a-4a27-9e12-8f78282e857f", "value": "mixshop_20210821-084924(1)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aa2e61f-02ca-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629582840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629582840, "uuid": "12cf017f-69dd-4d0c-a215-5a5de1c498a6", "comment": "Malware payload", "value": "79bf86aaf56ba19c831da5e2243668a1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629582840, "uuid": "5a91f901-0d37-47fc-a28e-88935e57aaaf", "comment": "Malware payload", "value": "922ce714ce0b65fb49bfe70194a5a98984122c437c7161a3e3e5916db635714b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629582840, "uuid": "c2e5c9e8-c7ef-44e0-bd92-9c9cb277d2b8", "comment": "Malware payload", "value": "3c4481d92e397c95315653176f956f870daebd1a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629582840, "uuid": "51d29660-e38a-4bf5-ae7d-23d171c26240", "comment": "Malware payload", "value": "468f5974529ed4d4bf47a1420b057f4498ea51a4b3680cff85f7d4b8a71c88a4f8f1d5bbdfbcc5dfd9e0afc8f144fe1e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629582840, "uuid": "d091ec82-625b-49e3-9194-134c22fa90ba", "value": "T1AD74BE20B6A0C039E5F741F449BDE3AC69297D716B2440CB23D626EEA6372E4DD30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629582840, "uuid": "3f2a9405-5418-4f70-97e7-954f2e6b2d3c", "value": "87931c028561c299d538d462f4889ea0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629582840, "uuid": "55e1ef6f-e72d-4229-9c00-1ad391b14835", "value": "6144:dPGwyh2DDenTn34vmR9P+DT88plmbfdXswL02Re6NnyxGwOHiSnFz:cwa2DDenTnJR9SgvfdX3Y2RerxBOHii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629582840, "uuid": "79adc3f3-0778-429d-834c-5274c7de6864", "value": 348672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629582840, "uuid": "91971fae-32ce-4fcb-b0aa-bc271cb97c67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629582840, "uuid": "55945587-6a96-4aef-91f4-13f41d37f0e3", "value": "79bf86aaf56ba19c831da5e2243668a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82670878-02b3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629573055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629573055, "uuid": "829b5273-7963-4cca-a967-44fbca3b7e4d", "comment": "Malware payload (RedLineStealer)", "value": "840d15b774ce1879c9ba73f46cbe515c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629573055, "uuid": "8b80a026-0b58-47ef-a3b5-b6ed4403a623", "comment": "Malware payload (RedLineStealer)", "value": "9280d5241d0edd7ea4ebd80021deebedddffc99056379a29d920a2ed7755b5a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629573055, "uuid": "42617900-562f-40c4-a3d9-59dd7b2c85ac", "comment": "Malware payload (RedLineStealer)", "value": "a999d467e4d4c766c16bdbc87e50cde75e9afc82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629573055, "uuid": "72b2f221-f752-4b4d-afc7-10e0be7e6b5f", "comment": "Malware payload (RedLineStealer)", "value": "35d7c259541a89e64d43c5ac4f56c117fd76a65fd1018648c3970ab19f6abf3d0ce2316dea8d9e3d7e5f7de97cf05fed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629573055, "uuid": "2ea395a5-50a1-4cc6-aea7-dc89c4fcbb1a", "value": "T1C615120B37E504B6E4B557B44AF2018726B2BD95AB3483DF175ED82E0E332A29277707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629573055, "uuid": "170e54f5-e3ac-4118-afd6-9ae21cfaa795", "value": "013c74198fc6e42dcf33737d6c40c012", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629573055, "uuid": "d2337f5e-43d5-44fa-af90-7c8502dc2c0e", "value": "24576:nyLHuEU/Ve5SXJe8qXHgaKpr6gLUIpnK2ljS27vs:yLOgR3fgLPpyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629573055, "uuid": "1281098e-e73a-406f-9691-9b6aa95f3915", "value": 894576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629573055, "uuid": "09b687f7-be4b-4851-bfd3-a944b2ac8a76", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629573055, "uuid": "455e4672-0931-4020-adf0-926920a545ca", "value": "9280d5241d0edd7ea4ebd80021deebedddffc99056379.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e25b9f59-024e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629529837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629529837, "uuid": "1b2124b7-2060-4045-8e1e-87a1ca0ab143", "comment": "Malware payload (RedLineStealer)", "value": "5840b28d0e6e88d0bd44803d74faf62b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629529837, "uuid": "28e6a106-2f0e-4b62-9265-7ae1b5c0e038", "comment": "Malware payload (RedLineStealer)", "value": "94f4e88d6d4dd425968bd6a683d3b5722eb3bd52e9d89be85771c5490930871d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629529837, "uuid": "64cb0ee0-cfc9-4d85-ab1b-1136eaff172b", "comment": "Malware payload (RedLineStealer)", "value": "24f30bb0de4b05b29db76a234b5b7a2d9331fc50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629529837, "uuid": "889f003e-4ca6-4eb0-80b9-5a64a4f64a46", "comment": "Malware payload (RedLineStealer)", "value": "6fb4405fcfa73e4f737dbaa3e98db4c06c5213fb1b7b3d9ed28c6403cd783ede87ebf49d45d573a7a2a855bdf5d36a25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629529837, "uuid": "f12fe6e4-a084-4581-a694-8b91a61605b5", "value": "T147C5335BD2B3B94DCDA3CDB54E93ABE452213FBBB0600FAF119875963A763478216C04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629529837, "uuid": "1ea67a1c-bf41-46fe-8b3a-2f014d321ea3", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629529837, "uuid": "2040cec6-0866-4ec3-a807-258418bbabd0", "value": "49152:2CErthheABivIh1aY/7mECJCX1m13Uif0OBWXQ8TcdVoY4JExZ1noktkdWemIO4:2CmVzXhz/7mECJCX1ab/IA8uVP42LokY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629529837, "uuid": "def35db5-2ddd-43d4-a087-beb5cf5653d2", "value": 2742328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629529837, "uuid": "77a74914-6fdf-4d3c-9e3d-d10f87f6a9a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629529837, "uuid": "6cdc6376-8579-47e0-94a8-24151ca42038", "value": "Lance.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7241be44-02d1-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629585912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629585912, "uuid": "da2fb107-42fc-41c1-8623-90f88c19382e", "comment": "Malware payload", "value": "7ee0c1c8f76bd87982f5e238d7cf44d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629585912, "uuid": "6c04d9ca-5042-438d-8933-ee6045f4fa9a", "comment": "Malware payload", "value": "987f20ff829ea4c324d87ca9b55860111b827d0fdb01499bb704074d9d220016", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629585912, "uuid": "a7c305f2-49df-41f3-a85b-bb58db0bcfea", "comment": "Malware payload", "value": "6f476c2ac0b7e83605ed9eeafdd0461c807240ac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629585912, "uuid": "8fdee075-9eb2-436e-80b8-a1aff719081d", "comment": "Malware payload", "value": "ca60bda11ceba4176c43e095dcf56fcdbc296095d8820668ff3c51b0f47efe865a90bfb0094c58e9aba1cbdfbaece483", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629585912, "uuid": "51d2d45e-83cf-4bd6-bae4-675ac4aa2d14", "value": "T1B3451230B2A1C539E1F715F45A7EA36C65297DB0672080C722D626EE533B2E8ED30787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629585912, "uuid": "6e639027-40fa-4c0a-83ad-9e2da0dd92cc", "value": "87931c028561c299d538d462f4889ea0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629585912, "uuid": "3a62a995-5e3d-45bd-94c1-ef310e4707cd", "value": "24576:27l+B6syClv2eGZCFNJ0/CuDOAzKskZJFdyjxzpJDgmvNsXL:eRCl9GZqs/CgxyFI17kmvaXL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629585912, "uuid": "dd5a09ed-da09-4e07-a43f-80c5380b8d96", "value": 1191424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629585912, "uuid": "d23199aa-19f9-4e82-a362-29bc974118de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629585912, "uuid": "7c4a3ced-6f95-45b2-8342-2b852f75da82", "value": "7ee0c1c8f76bd87982f5e238d7cf44d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15af6b4e-02ce-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AZORult)", "timestamp": 1629584469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629584469, "uuid": "53b567da-aa68-4620-9a4e-5ddc3995ab70", "comment": "Malware payload (AZORult)", "value": "3a3e08b214ea474bb34b21bbe955271f", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629584469, "uuid": "3de561fa-3f86-48c2-8c78-213e72b203c6", "comment": "Malware payload (AZORult)", "value": "9b41d1e4376e36f486f80533f162bb343828c2b37d6c811ba49effedc531b3fc", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629584469, "uuid": "36359c2c-631e-4106-b640-1d32919f6b7f", "comment": "Malware payload (AZORult)", "value": "4443dbd6b69e5019cfa3967b05e321bc49d91e33", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629584469, "uuid": "840d2a82-4c64-480d-86a5-10d0c62f5354", "comment": "Malware payload (AZORult)", "value": "ad99362b426b3b6e3268ab67a9a54ca488b3a82fa826db95d6d5685d7583fe2e28d09509ee483409f2f2a6c09ae204fa", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629584469, "uuid": "fa75a435-1aa4-4542-bd3d-3bf2043613a6", "value": "T12B84DF12E6869037E5B3147A44F19639683C3A71071F5EFF17884AB98F781D1BA30E6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629584469, "uuid": "61dca59d-8a0a-49c2-8b3f-ebcaa67125b4", "value": "f21b9f4ed04fb68076e88d1363ed51e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629584469, "uuid": "d15d0b75-d730-4d46-82bc-0797d4aa71a2", "value": "6144:ulbMGjZFeMhheRltDXmRS/ZdKHyyA7pyvcSp5sZLljMlJSVlmam0w8o4A5nbrSKY:ut3hheRltD9iyyQPlMlIHm0RobbeKY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629584469, "uuid": "13e3d24d-fde4-4c5b-9907-28cb47e5b162", "value": 394481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629584469, "uuid": "1b8a702f-00c1-43b0-b0d2-93a2ef5a5e75", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629584469, "uuid": "ab1220b3-8e7c-4ca9-8569-8d6990627ce3", "value": "3a3e08b214ea474bb34b21bbe955271f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db225bab-0229-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Cerberus)", "timestamp": 1629513933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629513933, "uuid": "93aa4430-4669-469e-9f8f-bef070b03014", "comment": "Malware payload (Cerberus)", "value": "73393c85cc6e01a7a9d6cbccbc66ae1c", "object_relation": "md5", "Tag": [ { "name": "#malware #cerberus #android #rat", "colour": "#2D2046", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629513933, "uuid": "24502e7e-496b-497b-9d61-ac40e0da1df3", "comment": "Malware payload (Cerberus)", "value": "9c157af9c0f9a2234e5670133e420b78a8329125cc6699151cfa9e0d205e4415", "object_relation": "sha256", "Tag": [ { "name": "#malware #cerberus #android #rat", "colour": "#2D2046", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629513933, "uuid": "359923cc-818c-4296-9d0e-7b503a2a8a7f", "comment": "Malware payload (Cerberus)", "value": "7d0168c57094d35d22d48b60a95c89dd81439767", "object_relation": "sha1", "Tag": [ { "name": "#malware #cerberus #android #rat", "colour": "#2D2046", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629513933, "uuid": "340f56ca-0e76-4253-a1aa-a13bf7a916e2", "comment": "Malware payload (Cerberus)", "value": "dd7e728640db94ba74bc8a1a33ad93e2335d71b3585570cc7391156e52e807e669a8f98a3ddb8338a410b551da42d43c", "object_relation": "sha3-384", "Tag": [ { "name": "#malware #cerberus #android #rat", "colour": "#2D2046", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629513933, "uuid": "d5321d54-a09d-4ada-8a22-faa3d2821940", "value": "T11FE301D2EB32417EC1B76C7084E66330263545A4A3B2DFCE535A0655ED226A14F3BFE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629513933, "uuid": "e9a926e9-dd7c-48ff-a074-59bb57684f8a", "value": "3072:DBa5aeyj9kdWoM8pmPUZF+U7El8Z5lP0ZlsepJx+9AeP:DBeaewedWauUD+Uq85m2Z9AeP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629513933, "uuid": "496ff8ce-fc3f-483a-8c87-501834c12ef4", "value": 147615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629513933, "uuid": "1d33f167-0d4d-463e-a18e-a8c7c94c942e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629513933, "uuid": "ba6df177-77ff-4863-b8e5-6793d245a265", "value": "test orion.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fc2bd85-029d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Alien)", "timestamp": 1629563548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629563548, "uuid": "bc880a26-25cf-46c6-b4fb-639486d53099", "comment": "Malware payload (Alien)", "value": "faece6df07cccc010c8a2eaaca541bab", "object_relation": "md5", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629563548, "uuid": "ce680126-b66d-4ae4-8f05-57e9c132eeb7", "comment": "Malware payload (Alien)", "value": "a0876d4cde77a0378cbf1ce15d188abf397b33e6d836bd5f799c798d311e2906", "object_relation": "sha256", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629563548, "uuid": "78eb0c7f-aa70-4ee5-acf6-eedfc8415a32", "comment": "Malware payload (Alien)", "value": "f9f22b1404b8088835371666493fa3f0db2ef71a", "object_relation": "sha1", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629563548, "uuid": "668d28ad-1a3a-4997-9912-cde45a921922", "comment": "Malware payload (Alien)", "value": "7f738f3935efd17975d05c38e30f18df364997d687506a31fef39de4c0c44063aa0695523a3fbe5f6a60694e267ea140", "object_relation": "sha3-384", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629563548, "uuid": "c2b79dcd-60be-4eae-8bfd-56bf10cfd321", "value": "T1B3F53345EFC34508D9278332811B9673365CA5EA81AE7C3F097480D629DFBD44B2EDEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629563548, "uuid": "a7c47bb0-2a99-4de9-88c8-1cd7c0d719d2", "value": "98304:98vL6E8gsu3FIVLZC9RzzrheGseo/REQJqtFAt:98T6EvseFIJGRVeGfRSt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629563548, "uuid": "fd5729e6-73a6-4416-a386-70395c34d3dc", "value": 3467299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629563548, "uuid": "ac1b2a41-d158-4560-8abd-eb0ec20b09b4", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629563548, "uuid": "eddaf8c3-9655-4e4f-8c6d-9cb57f703258", "value": "Android_Guncelleme.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cc078af-0216-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629505668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629505668, "uuid": "862c18c9-6e1b-4ef8-a3ad-01f47edad576", "comment": "Malware payload (Mirai)", "value": "92c78acd9d4db8fe08ebbafc56b2ba99", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629505668, "uuid": "6818a475-bdd6-451e-998c-8b595b35cc1d", "comment": "Malware payload (Mirai)", "value": "a2a789bb219679bfc5a331bbc20047af77017381d033c6db88a7456629988ec8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629505668, "uuid": "c2fbd8c3-f5a4-414d-b4b9-8a5a6b3a6715", "comment": "Malware payload (Mirai)", "value": "b996e329e97cd733126ab62e5089e0866e3b44dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629505668, "uuid": "269cb4f1-df6a-4a4b-8bcd-6d2ccafc84fa", "comment": "Malware payload (Mirai)", "value": "78cb2863c40873f2a86c0703d94ec39052ab9cfd3375483f1487bd17f07e214a0d34569660e5cb92a09adf373741932c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629505668, "uuid": "86842a88-d316-4037-bcf3-d0d41980c127", "value": "T144435B02765C0E47E1561EF17A3F1BE083AEED8011E4F5896A4FFA8E8176E735149E8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629505668, "uuid": "3a35195f-a2a3-45c2-a471-1da27bce0fee", "value": "768:/Q+l/pOkiChWcezMC1RD/TyJOdmIxPHXT46eSsH7GlD2jc6yUIyinx1A:9niCGHkq06eVm2YPUIhns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629505668, "uuid": "09eaab32-ccbd-45e3-aa76-e754066e7a15", "value": 55244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629505668, "uuid": "19b64a07-db70-4ad9-b276-681d465d35c9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629505668, "uuid": "9837cfd8-9a1c-4a47-b056-3f9f745b81f4", "value": "92c78acd9d4db8fe08ebbafc56b2ba99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed854db6-0215-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629505374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629505374, "uuid": "b5a796a8-3e62-403b-9734-a1f15342cd9b", "comment": "Malware payload (Mirai)", "value": "75b42abcd4b9ec96e76616bc33c3ab55", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629505374, "uuid": "1e376d2c-0e90-4853-a987-133526ee11ef", "comment": "Malware payload (Mirai)", "value": "a4c62876ead43cc6ba9d3e5f328cb60d0082b6024428d06259bf9b3c49025fa6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629505374, "uuid": "27948e8d-7f1b-4fcd-a346-0d14f0149070", "comment": "Malware payload (Mirai)", "value": "f69b697abba236fd9a09f24ac1926eafb2fcde29", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629505374, "uuid": "061de25b-06d7-476c-9dee-6f194cee3c17", "comment": "Malware payload (Mirai)", "value": "b61b0411a589c48114d8fa2d90bb7aabd3a32221578e9b79484e8948032d0328507dcc1dfbd1f06ead00d38a6440c9b6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629505374, "uuid": "16bbefbe-e131-4605-a702-ae6590bdba8c", "value": "T15A73854D7E319F6CFBAD863487B74E219649339536E1C584D29CEA011E7034E342FBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629505374, "uuid": "0c90c047-68f2-48c2-a853-0d74b90f6b0c", "value": "1536:EcVhD3icpt17thsx5w9H/zjFKl+L8T5G5hCFqRcOsV6M3tiwUq:pVN3RpfTF9YE5hCFqRcOsIM9RUq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629505374, "uuid": "febd5d15-fdd4-4b11-b83e-4b11ae08a040", "value": 76072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629505374, "uuid": "b133c855-a837-4635-b067-ba0ddacfb222", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629505374, "uuid": "93881399-58e4-4801-aa97-b456f5af6ff7", "value": "75b42abcd4b9ec96e76616bc33c3ab55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09fa3cd4-02b8-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629575000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629575000, "uuid": "f90b20d2-51c1-4119-bfc6-cb9eaf19956c", "comment": "Malware payload", "value": "275e8545b0fdb6c7acef45aa6e109685", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629575000, "uuid": "82a66120-63e1-459f-a966-9e4a823a7806", "comment": "Malware payload", "value": "a9524141feab182697ee45965c0d91577eb32f4c9252160b1b50be3ed9b000e2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629575000, "uuid": "5a31d9ac-6e0d-4082-a514-9882d8e850ea", "comment": "Malware payload", "value": "5fcc96f9ecb5230c02c2fc2bc368d06352a944b1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629575000, "uuid": "2548d65d-95a9-4d04-99ba-7561c26e6071", "comment": "Malware payload", "value": "20121f0160bd1cc6dc7cea34353f21609b46c7f1ef038323fff6650f3f09ab15d4b30ac4b2dd2382866d45571e207318", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629575000, "uuid": "95178521-8e51-481e-a54d-c6e47e4d05c2", "value": "T1B2C5395179EA4098B07178EB7ED4AF658919AF7D3F092D3E309033468EF1746BC0AB61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629575000, "uuid": "bade5853-0b0c-4ab3-a8cd-2dca15206a69", "value": "24576:q01GaJxve1E8pkCLLe/K43EnnnclQwIqJY0OjklWXQMFBRpm4L/59ah0USm3uwl2:q0ckvuV/59a6USdi9Ues6bV6bn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629575000, "uuid": "f66021a6-dd83-4dab-9320-45f9dee4d15d", "value": 2721732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629575000, "uuid": "d017d3b4-eb16-47eb-929b-6b5b50a5b642", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629575000, "uuid": "89ea0ee9-2a43-45ec-bac2-57f99fc3f440", "value": "275e8545b0fdb6c7acef45aa6e109685.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4262b19e-02cd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629584114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629584114, "uuid": "c14f3b36-bd0d-4509-9e0f-05e3516d228f", "comment": "Malware payload (RedLineStealer)", "value": "4b14f522523b1b305b691c6585af8434", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629584114, "uuid": "f863f108-906b-400a-b1b3-99392fd24211", "comment": "Malware payload (RedLineStealer)", "value": "aa2a031901ef1d8d0ee6aa1c1cb0ee70c110bbf1e9c5922ce607ccd13b9c731d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629584114, "uuid": "b46606c9-ff57-4d66-a82d-bd717b038c41", "comment": "Malware payload (RedLineStealer)", "value": "9e5222ca45fd176e2f0ee3ea6a51977aae4091c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629584114, "uuid": "b977022d-0c36-456e-87e6-469ac73cfd54", "comment": "Malware payload (RedLineStealer)", "value": "354b5774089398880023760ab789e9c0fc8bcca64602e1f7337a2dee5197e16160aa44ec081b4552916e7f0995461040", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629584114, "uuid": "158da7fa-d8fa-4ac5-ba26-f416184ad69d", "value": "T199E4F120B6A4C139E1F602F4597DE3B8692D7D712B2050CB63D626EE62372E4EC31797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629584114, "uuid": "21122d0a-f6f7-45c5-9d53-6d9730e0eabd", "value": "a30b70feaaf646aa38caacdb4af5c88b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629584114, "uuid": "bb7257ed-5691-4f19-8ef9-cb423a94fcf5", "value": "12288:LnELfkR+UZ5H1J1aV9k65qRrkeNQpFuP7SVZv9nLyr645GmqL:cfkRq9k5fO2sX0DnqL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629584114, "uuid": "250b43b5-9da2-4555-ab66-4b2776fdbf0e", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629584114, "uuid": "4d78f68f-4a52-470b-bb84-3db945e7970b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629584114, "uuid": "33f5ee8b-e017-4b92-9896-1dd66ee5bd8c", "value": "4b14f522523b1b305b691c6585af8434.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ae9fcce-0231-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629517154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629517154, "uuid": "c432e30b-4986-4db4-bde7-d216d737c340", "comment": "Malware payload (RedLineStealer)", "value": "e917cb865fedd0d1f444a4911b146bbb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629517154, "uuid": "dd6560b6-e2ac-4549-9de5-1d6ff96be549", "comment": "Malware payload (RedLineStealer)", "value": "ab5c2bdc6b3391c94971ccefeb8552a2de837478465617232248525264e0badc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629517154, "uuid": "b2bf1b4f-702c-476c-9668-4c2b35081e71", "comment": "Malware payload (RedLineStealer)", "value": "a8ddb7219dd15c0c7be99620c1a6c48fd83f39c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629517154, "uuid": "0509826f-5389-46fc-a84b-ae7168c20611", "comment": "Malware payload (RedLineStealer)", "value": "d41561238a71fdbf95fed3716e15865673db31fb28041edfe0d5bb151f11b2fb3bb064b0e3c30896ebe6d8bb27773f30", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629517154, "uuid": "26c763ee-1754-42c9-b45e-3ad372d4811c", "value": "T1C3A32A3263ACC629F7BE0A3668701125C7F1E08F2401E75E5EC574EA1E76B826548BF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629517154, "uuid": "21a29355-80ed-4586-97f4-ae3f939754fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629517154, "uuid": "f22feb49-1f5f-434b-8e9c-f16979fb726c", "value": "1536:yo6aG7RC1g2IfMDCGQVoJHmMauZwugbue7vmuvNyLsdCCetx5REPG6WAaoigV:ydxtCCkfs283mulyIdsNWll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629517154, "uuid": "b351b44f-a248-4e08-ab4b-3b389279d179", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629517154, "uuid": "b90863fe-6fa4-4ecc-9f4a-89b6ae5286b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629517154, "uuid": "0b699dbd-79a6-4c36-b151-f24c35e6d95c", "value": "e917cb865fedd0d1f444a4911b146bbb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf7f918f-026b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Cerberus)", "timestamp": 1629542260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629542260, "uuid": "ae074f6e-b7a3-40d5-8750-c08847b729ff", "comment": "Malware payload (Cerberus)", "value": "805c1d41637d0d7b18af82e421683f3f", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629542260, "uuid": "66c3d769-442a-4184-ba79-cc621991172f", "comment": "Malware payload (Cerberus)", "value": "acdba5189ad88501274c446dbf3b040917cc4c1f1b67fb9e4d2f69c6805920c2", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629542260, "uuid": "d0540738-0b89-4db3-a65f-e45c8e9573ff", "comment": "Malware payload (Cerberus)", "value": "cc683c563374efca3afce26946365c0a166959b4", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629542260, "uuid": "3467140c-1212-48b2-a01c-ec1b143a80df", "comment": "Malware payload (Cerberus)", "value": "1f03879c48f870ca6e4cd23ecfa0226f1599e63904ec4fcb2bf56b476c2927b54e4988b66519f163472f0d5da89cfdf9", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629542260, "uuid": "92d5e89e-7db1-4e24-8f73-4f8cdf1086ed", "value": "T18AF53356B3C0DC6CFA97C772414BDA163B1E254A46EA3D3F4A7548B224A3F4CD3A1D28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629542260, "uuid": "feae1db0-cda9-4562-9a93-c5277f1da6f8", "value": "49152:Q72KTiQsCyRCOTvHKPKFXWVmB/9MAHDnqe3GeH+0zMooARZMLpa/5ozzUkR6JReH:rQsvRzCgGVm8AHGeBHdHGa/5ozzUwQ8H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629542260, "uuid": "14fa2219-af20-4ed2-9732-7f397947c075", "value": 3459802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629542260, "uuid": "7f45beb9-403b-46d7-bb4e-b973a4fde155", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629542260, "uuid": "96762ed4-8f6a-4a1c-83ad-e4e612b8f05b", "value": "Google_Play_Store.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ee26783-02b1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (StealthWorker)", "timestamp": 1629572136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629572136, "uuid": "03173085-97f5-4751-86b3-90de6d77b2e5", "comment": "Malware payload (StealthWorker)", "value": "0ef11d95ce195cb49efa5bfb435ac0e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629572136, "uuid": "67bb4f98-a594-4bdd-ab06-a1b8b2a24430", "comment": "Malware payload (StealthWorker)", "value": "af60109268a951cfdc2841dca40c755add994bff880ec34bba832182119c48a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629572136, "uuid": "d651b8ad-cddb-47de-b6e3-7cd8b57f6ca2", "comment": "Malware payload (StealthWorker)", "value": "3760aa4062ea7ecc9cb0db01fd6b119f71a892f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629572136, "uuid": "198602af-541c-4dd6-86c1-0abb59d0b285", "comment": "Malware payload (StealthWorker)", "value": "42600b6aca5ee84a976e0b56173eff1e90894781822b1ba809be9100e41d933eb4a81a6adb4fda35d06d3be74cef42ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629572136, "uuid": "4311878f-cb0b-4981-b1fc-01959b7cf954", "value": "T160549E20B6A0C138E4F311F4596DE3AD6929BDB06B2050CB73D62ADE97372E4DD30697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629572136, "uuid": "ff96529b-a8ff-4156-92ee-5cd90fc7f5d7", "value": "ad1c5bf15a899fcfef408e3485448e67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629572136, "uuid": "ef7f8aef-d68b-43fa-a9e6-93b1b8ede779", "value": "6144:eSmwhAheKvIrO5I7LW+Pske1B6xUpjNqSnV7BqzX:1hAheIIr17TPskePSINqSnZ4X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629572136, "uuid": "8466d1bb-8f31-4428-ba1a-084a13fe9356", "value": 284160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629572136, "uuid": "ca2b9945-39c1-4f8b-915c-381e5e14176e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629572136, "uuid": "5273a3fb-9583-4d26-b8fb-aaa3b1e13745", "value": "0ef11d95ce195cb49efa5bfb435ac0e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d9da998-02b7-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629574818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629574818, "uuid": "ec749bc1-9dd0-4bcc-8978-e903d457e215", "comment": "Malware payload", "value": "4b51e85417a4ca4493cfa176c4c81cf2", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629574818, "uuid": "fe469a68-fbe1-42fd-9de0-02cf8526e401", "comment": "Malware payload", "value": "b3fed3c7e4b2615e12326966d11f624df16994cee26474dad74ce69fff38f6fc", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629574818, "uuid": "2be679a0-2873-4c7d-90bc-db804df67fb8", "comment": "Malware payload", "value": "9fbb56b57446448f6bc8b99ed6a8f57a93f99bb6", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629574818, "uuid": "3fc4607c-575c-4a7b-ae65-45d8af068cb9", "comment": "Malware payload", "value": "23ddd53b744fd4453482d1b9bf4ede074ac80994f455224b0968e560e010b17ec0e1202b5e73db3a01047fdd83599439", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629574818, "uuid": "d2e56015-1670-40ec-83e4-588414e9dca1", "value": "T19E11C0394CA58EA60345D0B100C78DCCDF20C7573798FE391834B4595D9CE395E8DA0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629574818, "uuid": "c258fba7-b9ad-4277-8879-73c7ab038f3a", "value": "12:uhutV6Q7zMBNnkiuNounuAbZbGJA8kcXO2qvELJ7g3NnLd+KPj2T+TOM:uOVzSNkiIpGScXO2qvEcNngKG+TOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629574818, "uuid": "75948f1d-8fcd-4257-befd-43ea7b340421", "value": 941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629574818, "uuid": "d91eef7c-d98d-4311-ae8d-8982a0a1888b", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629574818, "uuid": "b3dcfb6d-5343-44df-b1a5-d2e76785d0b2", "value": "H6289_Payment_Invoice_.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0a00880-02da-11ec-8fa1-42010a9c0011", "comment": "Malware payload (OrcusRAT)", "timestamp": 1629589856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629589856, "uuid": "7b9a68f9-32b4-43de-92ec-b91b9c50a54b", "comment": "Malware payload (OrcusRAT)", "value": "39b730bb5f42dcd279483574a08dca4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629589856, "uuid": "0cfeb0cd-fd59-4353-988f-1ecfdaf94709", "comment": "Malware payload (OrcusRAT)", "value": "b5fa05263e53d8fee01ac12bb9dac350164d9594e0131f58a66baefa6f5ae0c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629589856, "uuid": "aa46b836-fe73-4ba0-850a-5687ff104f97", "comment": "Malware payload (OrcusRAT)", "value": "f5ae73c1b7eaadc174fd5b1fa588782a693b55fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629589856, "uuid": "512cf0f9-11c5-41e5-80e6-ad0738faa3ae", "comment": "Malware payload (OrcusRAT)", "value": "0efe6e984328abee3feff32295a7cd4b653ba61edec47dc96c1bae798312d047822be9077e8f0451dcccdad398fd96da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629589856, "uuid": "6244fdd5-aec5-4f65-b641-b96aa31f5166", "value": "T1B7C63301216082ADE23B6B32D1C65FB127674BD6ED7298F12FCA4A10EC5E613D1D2F9D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629589856, "uuid": "85ed0de2-ab4a-4b79-9cb1-085f36ebd971", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629589856, "uuid": "9932d34b-638f-45db-84b7-b6f5171d1365", "value": "196608:Hm9t0n5I2VexPYioLSjkBB1xlZWDlqmYK8iR6Hpe0KKCuLeClp:Hmrt2ViBoL8DlzwQ0K0LTl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629589856, "uuid": "2f720b1a-c27a-4bed-8653-788587a98e10", "value": 12268544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629589856, "uuid": "59218e6c-de4a-4ab1-a2b1-f8b0355fa5ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629589856, "uuid": "620c4c23-9fe8-470e-967e-2b1f7e74b9ff", "value": "39B730BB5F42DCD279483574A08DCA4E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa47987b-02c9-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629582571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629582571, "uuid": "c4249822-9f68-4740-b05c-5de7026b27c8", "comment": "Malware payload", "value": "51f0887e1e94b2d5bdc7acf159e98670", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629582571, "uuid": "240b6a6a-a5b5-4af4-b11a-b4892b6891c1", "comment": "Malware payload", "value": "b78535aa7762e46ae614bf634240893124d20dc958d934748ebdb382425f474d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629582571, "uuid": "c2a063fa-8f8c-4ae1-ba32-dfa7e2481f27", "comment": "Malware payload", "value": "43a7d88d64d241b8a0f6ae8e8967133e42c8dd99", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629582571, "uuid": "fc8610ec-065f-4f2b-b1d7-17c3fe1d9a2b", "comment": "Malware payload", "value": "f35d784f7ee1e2a42ecc28af4b93d53e57dd6b93acc7fcb7458464ae077f774c4e884e6552e75730ede888ee634b7891", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629582571, "uuid": "ab5b6b65-0524-4413-ae8f-445da2b898a6", "value": "T14C64BE20A2A0C138E5F712F4597DE3AC692D7D716B3490DB62D22AEE56372E0DC30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629582571, "uuid": "71f5e1f2-a787-457c-b627-7f7aafd56114", "value": "87931c028561c299d538d462f4889ea0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629582571, "uuid": "6c233625-6dd6-4966-b204-4b1770d5c357", "value": "6144:FunQyOt3rTUYM4Mmt8SZgGetnUd2wLdbfAjzCE1z:UQNt3rTUYJt8SKAkwJsjzCq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629582571, "uuid": "2be36861-80ab-45eb-aeff-a1e0eebb9a09", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629582571, "uuid": "d407f385-eb19-4a1b-8334-4fa34be7abcb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629582571, "uuid": "5b2c4ab0-d8fd-46f8-86ad-b13b6a59a96f", "value": "51f0887e1e94b2d5bdc7acf159e98670", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fe35d3e-02b1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629572111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629572111, "uuid": "9ebf2ffa-2533-4539-89cb-51097a85ce38", "comment": "Malware payload (RaccoonStealer)", "value": "700867b5fa6090f82471905c08e3290e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629572111, "uuid": "8dcafce2-fa00-4994-a0d1-bfc67753bc89", "comment": "Malware payload (RaccoonStealer)", "value": "ba0da6a3639ca5192cc50b70f1b9e5bb86be36a53a8b1cfacf3f5f35d2ab5c0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629572111, "uuid": "0db8640a-3450-49d4-98e4-701a815ee596", "comment": "Malware payload (RaccoonStealer)", "value": "dccf44baea80b22d047e5995948e213b98bb19b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629572111, "uuid": "ad6bd377-c2a6-441b-8fbf-b22225d8d8db", "comment": "Malware payload (RaccoonStealer)", "value": "6e83112a1d1d03b1b9b8e0658ea6bdb4caf0c7fbd5f522133bbd6d4eb5f0c64179b74c3e2a353c0fd50ef15418e0f8a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629572111, "uuid": "421d07b7-7096-4bcc-a3af-6f7995137e26", "value": "T1B11633623BFAC8BAFD8154701A445FF8707CCA98233A83C3BBC5D9195A3D5DAA14F548", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629572111, "uuid": "48371a9b-6c0f-45d0-a9fe-b30d95b52b72", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629572111, "uuid": "ca3c3206-6e66-4c68-8215-4d9c2d147f99", "value": "98304:xJCvLUBsgiT5ZOPV+7ePBTZRH9K3cDtyANhpiGWe2zrs:xiLUCgiTuVf7DKsDV3pi1s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629572111, "uuid": "e7033370-7ed2-4290-a472-0771cd3ea4cc", "value": 4056643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629572111, "uuid": "623874de-54af-415c-b28b-8939a16b1041", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629572111, "uuid": "ae20f7a8-661c-4f9f-9b50-b5d16caee5c3", "value": "700867B5FA6090F82471905C08E3290E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "088136c1-0295-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629559965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629559965, "uuid": "71c40ab2-59dd-4205-b063-6cbadd2a9b91", "comment": "Malware payload", "value": "73920582a5c2d3b28d17e77af42001cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629559965, "uuid": "58a9e35d-bc77-433d-8be3-a43147fe8171", "comment": "Malware payload", "value": "bb56b47dae434fc40a2c391c1901232bb2d43c90dfca1c282667f954fdc3da92", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629559965, "uuid": "b978b7ea-2f3e-4d8c-a519-1d26ecabfdbe", "comment": "Malware payload", "value": "7666b857ef4db9a74a73a88b19ccadcac3e4e293", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629559965, "uuid": "6e7f630f-bf9a-4c5e-845c-819b5ecae707", "comment": "Malware payload", "value": "ea162d226801db8d7abce9b0bef18ea76bddd37935063157efb6b1af45586251ddef05b7be19eae573753b1511c0d4ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629559965, "uuid": "e73bf5bc-6635-45c7-b7f0-9f3936df0674", "value": "T133A4E01DEE286612C3C676B24FC6C17003F0AC9D6C50C56A2AF57F9B36FE7235982256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629559965, "uuid": "2fb201a0-e321-40f5-af4a-fd637a527c6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629559965, "uuid": "7ef78a80-3661-4ce1-b41d-b847af30f576", "value": "6144:0Jy5254o9U+b1n2OvBniE7HMW/fFjAFr+ZC3jDy2KOMqnnC:6y52eeU+b9xjMWixpHycM4C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629559965, "uuid": "ba8ecee6-60a2-4817-9ed6-0900324afc3a", "value": 465752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629559965, "uuid": "d375f315-b22c-4f04-a3cf-7136f482eba7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629559965, "uuid": "44337a9b-f237-4099-9824-4847c0dddf32", "value": "73920582a5c2d3b28d17e77af42001cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0140d85e-02b4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629573268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629573268, "uuid": "94a756da-2385-467e-a43a-f5fe57d12ace", "comment": "Malware payload (Mirai)", "value": "c6542871650a1d65ea73e13fc5a2eeef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629573268, "uuid": "81fddf85-bad5-44d0-a260-c8c7ca993068", "comment": "Malware payload (Mirai)", "value": "bdeb8d6d49ae86aa733f5fcf066dbf8ca040e6e6536076a8852a79b1c5120e97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629573268, "uuid": "0ab3a89b-6686-406f-aaae-8acf1a9e0206", "comment": "Malware payload (Mirai)", "value": "c11bd9db5b7fff79c06cc555b150a31a3f2c2e8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629573268, "uuid": "c6b31bf5-429c-4a84-8cd9-04984bd55c99", "comment": "Malware payload (Mirai)", "value": "68945aa575484609e1b41ee8aa93a161013d6dcfd1548f8715f5ae4d960f090b0d001c81b51b6b5de9a6f4a4f0205b5d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629573268, "uuid": "c0becad0-f89b-4ef4-8e27-27450bd36fec", "value": "T14082C066B410C104C5A484BDDCBDC661FCA3DEA4FB6D9B82A78566D3F4F126005F88BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629573268, "uuid": "42681e28-0c72-4939-ae4b-760fc115db31", "value": "384:JneP4C1uxicP5R63KQ/n2fLGXB1HTSG7T7tFmCK6Tn:JZC1uxicP5R6D2+97TZF9K6Tn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629573268, "uuid": "dd7ad47d-2e91-4df9-be57-c65284b1fd8f", "value": 17976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629573268, "uuid": "f5b58583-9d21-4ee0-8ee1-8ca0294cf343", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629573268, "uuid": "1d747e21-b033-4981-8e18-778f8af15907", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f972c1d7-02cd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629584421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629584421, "uuid": "1da81763-3b24-4f03-ab94-d0f354168928", "comment": "Malware payload (RedLineStealer)", "value": "212269c212b5a9493b8edc746c82c6be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629584421, "uuid": "ef9dd8f7-a8b6-4fad-90a7-cca7217276aa", "comment": "Malware payload (RedLineStealer)", "value": "bf07b65101a8edaf131b6f3f5431a6eab676c6c59ef6129ff935f0ee44b34902", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629584421, "uuid": "24e816fc-efe6-4a18-bf80-bb61309f986d", "comment": "Malware payload (RedLineStealer)", "value": "9988f36b4cd0571f68f332cb0757515cefde9473", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629584421, "uuid": "3132d659-1937-4edd-9a8d-58f861cabf0f", "comment": "Malware payload (RedLineStealer)", "value": "2d833e7bde89ddd7cf38cd77003d09e16d6eb6fd2b82fbdf788252f716cd5952b7c2cffc14a709f4541507404baf6634", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629584421, "uuid": "0f3d6af2-0439-4cce-aed0-4bdb01f6327a", "value": "T1A9E40130BAA0C138E0F311F4956DA3B8A818BDB1AF2055DB62D626DF67371E0DD71687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629584421, "uuid": "ff6ea1e2-7d99-4e6a-ab9f-24828f7fb265", "value": "ad1c5bf15a899fcfef408e3485448e67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629584421, "uuid": "e924e33b-b26c-4df8-aaa0-46ed593825ce", "value": "12288:VtwB7u0SS7Tc8Mk/xqeXChP+dR1LTurAFQHs9E7OzIx8gus6doc3Unrn:X0SS74h+dR1/uMmULzQ/rn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629584421, "uuid": "a321cd59-8b86-4e65-8d51-a9e36fb6e2c5", "value": 659968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629584421, "uuid": "c035b16f-f525-4716-8ff8-c100121a5219", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629584421, "uuid": "7b805f7c-545d-485f-b9dd-9db00daf82c2", "value": "212269c212b5a9493b8edc746c82c6be.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bcf78d4-024c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629528698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629528698, "uuid": "91a32dc1-085e-4760-845f-7d6238667609", "comment": "Malware payload (RedLineStealer)", "value": "0e845bfba3e168cd26c0aa2cd1c555c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629528698, "uuid": "aa55522e-544a-4613-a785-15b18306765b", "comment": "Malware payload (RedLineStealer)", "value": "bf5c7c3980b642ab126a43b7568a6c46605cf592d709b63bfb312964500250f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629528698, "uuid": "2cf35894-3def-4ebb-9691-af92f2018439", "comment": "Malware payload (RedLineStealer)", "value": "e8d9b20260f93c2107bcd046f3047cb9a7848a15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629528698, "uuid": "f5118080-1c28-4cd7-87e4-89856abecd01", "comment": "Malware payload (RedLineStealer)", "value": "7b2bb7d3321c3baf6cdc86003aff00953832ff97316701bb3f12f51d8088b51f8667b055c749b19e17777fb840ca7458", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629528698, "uuid": "ea947e25-79b3-40f4-ab41-e49a33828e4f", "value": "T1E4C4125D26708333C25718304436CB9196366E548E29460BBF3B236A2F727A19F37FB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629528698, "uuid": "d475b33e-5d40-4484-beef-70b48e92ef7a", "value": "eff27d48d68df0af1612601744441acd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629528698, "uuid": "604ad875-73ed-46d4-a859-cc49c0066afd", "value": "12288:bzHtBkPwEHpsJzbJbY4ugwMX5aUTUiLmJdjvud8edCF74g8+fiOSOZLH:Pk4cpGzb1fwMXkUTUZRurKdfiAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629528698, "uuid": "4c8f6a39-da23-4111-b187-6f0321418b26", "value": 557568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629528698, "uuid": "d5ce55d0-821c-4435-b84c-83a9cc12b200", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629528698, "uuid": "6f180589-8f3b-4645-bdfa-567471898990", "value": "0e845bfba3e168cd26c0aa2cd1c555c8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51cbbe30-02a2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629565672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629565672, "uuid": "e11b595c-5503-4054-b37d-3f20f15d9286", "comment": "Malware payload (RaccoonStealer)", "value": "6363978d15ac1b1bc0da818e7a2723bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629565672, "uuid": "9c5e441c-335c-4a4f-a291-d9046e829118", "comment": "Malware payload (RaccoonStealer)", "value": "bf955e96dafd88ef3b4c926108800c1d220cf07fff9e7cc58086f2c70a81f245", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629565672, "uuid": "a93a9658-77e3-481e-87c9-52be6140b324", "comment": "Malware payload (RaccoonStealer)", "value": "7f59e06917e437e34187bde911d9c45307dc1490", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629565672, "uuid": "19d706c9-25b2-4920-aa56-1ef18ab3ac18", "comment": "Malware payload (RaccoonStealer)", "value": "c143e23adba3b1d574605b5d9d593bdfcc6711bb18d778c1fff1968452447de4e9daefe48c9aab019a34c19b581b90ca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629565672, "uuid": "0b9dd941-f131-4ab1-b52e-5ad012ff2284", "value": "T12FB4E02076A4C138E4F702F8597DA2ACA92D7D716B2050CB63C626EE67772E4DD30787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629565672, "uuid": "f21e8fd2-b0f6-4fa8-947c-547dfc01aded", "value": "0579ae0629fc2c520498364f1f007f60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629565672, "uuid": "25e9b35f-cc68-4181-b469-663fa6032d21", "value": "12288:hLZz0IbktEArBM5b9kugMv3IWUnqKFb+R:YIbmEPCMTuB+R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629565672, "uuid": "84de8f8b-5678-418a-9cb6-779cb49d1f61", "value": 535040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629565672, "uuid": "444827ee-e5b5-4ebd-8ab4-4657cc774283", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629565672, "uuid": "298fa665-957c-47f2-bb21-aded9511704e", "value": "6363978d15ac1b1bc0da818e7a2723bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4107ed78-024c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629528707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629528707, "uuid": "d57680d0-6659-4c6b-a5a1-5ebf1628877c", "comment": "Malware payload (RedLineStealer)", "value": "e3f8ec41336e54a169dfc57672556450", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629528707, "uuid": "97a9aea8-fcb6-488a-a8ea-ac1c7ca0b613", "comment": "Malware payload (RedLineStealer)", "value": "c05415ab6dba7038b35bfab04610a8d0038b3f99e5795f616c65c924c2765c99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629528707, "uuid": "a6651c27-ed39-4f56-97a3-d00e783ad590", "comment": "Malware payload (RedLineStealer)", "value": "e89fd37a86bf1ddc81c1d6d2f6f7c268fe9407c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629528707, "uuid": "0be5f1e2-cb84-4b76-9212-ce4edd203826", "comment": "Malware payload (RedLineStealer)", "value": "e570da180cb0d8e1431c208fce2f8341293326405cd6ffe66485caf162c9bb17dd5847c6d2bba2374751fa27da22b230", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629528707, "uuid": "47bb86e9-37e7-4404-b949-5c2097b440d0", "value": "T191E4F120B6A0C138E4F321F5696DA7B8592C7DB07F2051CB63D62AEE66372D0DC31687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629528707, "uuid": "397133aa-cf29-4399-b088-afc768194007", "value": "ad1c5bf15a899fcfef408e3485448e67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629528707, "uuid": "e02794cc-1181-4f98-81a5-ee7ec3b2d044", "value": "12288:VvhB0U09j7uV8wMVcbMBMwRjBudCp7NmPQ07EYi9MRq13P3mVlsYn:h09j7qbMBMbU7QPQ3YsMRq5P8lsYn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629528707, "uuid": "63cb3e3d-16f0-4adb-adae-e3a3c76acb27", "value": 659968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629528707, "uuid": "aa36b1b3-25d6-4e09-91c7-e8717d4fe805", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629528707, "uuid": "6d236316-6b0d-4a1b-989c-0b932efb77bf", "value": "e3f8ec41336e54a169dfc57672556450.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94fe21dd-0216-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629505655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629505655, "uuid": "54f883fa-27a0-4b1a-a0fb-9364b9a7076f", "comment": "Malware payload (Mirai)", "value": "4b8452ce7605cd119c65cb0c48e2ce5e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629505655, "uuid": "d59e9cfe-c4f8-40f6-8678-c5a623c15c25", "comment": "Malware payload (Mirai)", "value": "c111692f0517098f2567364ec7a51ec2e0159b41df09e840d5d22cfb900211d2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629505655, "uuid": "85ce31a2-8604-4c6f-80ec-9218c642e18b", "comment": "Malware payload (Mirai)", "value": "b5590910fbac97efda37aef0f6c5166ca162331f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629505655, "uuid": "ba38a9e4-38b3-4f32-a6b7-5c030ba0b242", "comment": "Malware payload (Mirai)", "value": "04fb147fed9fa25ee879c4c8397674ca3e6b726f78f9c01ac022c350f3a28cc5fd3a92d6d724b9103e6bd90ea77412d3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629505655, "uuid": "2bf67826-b16a-45c7-8591-7cec4ebd9da5", "value": "T10D230996BCE28A59C9C42377FA2E419D3312A3ECC2EF3717CD141B1176C651E4E72A92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629505655, "uuid": "354361d1-063b-4830-aa65-f0d94757ef88", "value": "768:XLBRG0CCxDSTeNhKsCn1/ieQYRPxTBQoBOPYNr7SxOHyw6EN91MCdBNoF1:1RzUeesCEex1BQoB+kwOV9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629505655, "uuid": "4f7774c8-e075-4b0a-b179-346918bd7667", "value": 46460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629505655, "uuid": "5eb2510e-45fd-4b77-815f-0237b9423543", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629505655, "uuid": "1a3d2de9-030f-483e-8a3d-c2a3e5d1464f", "value": "4b8452ce7605cd119c65cb0c48e2ce5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "679b7085-0249-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629527483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629527483, "uuid": "58f38bd9-d8f7-47a3-b6a5-158ca990c601", "comment": "Malware payload (RedLineStealer)", "value": "454c19e2bb2b52b74fce8a789e827309", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629527483, "uuid": "a36ed65f-f8db-4c20-98f9-04d3ebe8c1eb", "comment": "Malware payload (RedLineStealer)", "value": "c1659a495f138b63f88811224783a82f96af6f37e6b3df0a8aa771e946a26a7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629527483, "uuid": "c862fedf-b0c6-42d3-8ada-69a9d2046c4e", "comment": "Malware payload (RedLineStealer)", "value": "40f3a3c88ad85d793d729a782a333a51e597f784", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629527483, "uuid": "33eece6d-3329-4b28-8866-c239a0639288", "comment": "Malware payload (RedLineStealer)", "value": "a938d8f577f24de1651e368f275d194683781b696b8704adf7e22e733c29d5b9a8418e9618dc133d294c608fecdd2eea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629527483, "uuid": "eaf8eddb-c712-4cd2-896c-565e79ab7338", "value": "T15DE4F120B5A0D134E4F322F558BDE3AC69297DB06B2450CB73D62ADE96371E4DC7068B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629527483, "uuid": "99e65af6-e308-451a-be05-5348b0b938ce", "value": "ad1c5bf15a899fcfef408e3485448e67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629527483, "uuid": "26207ed1-fc87-471a-a90f-f7ae4c86a9cf", "value": "12288:l5K3Skk1D7LtU6sNtefo9m1mWid96KgxsDiXwl1cvIDblDfgL8JIsnS3mn:Qk1D7Nfo81mWibb+scg3ZLZIF3mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629527483, "uuid": "7c411df5-6f9e-4b2c-8a6e-045a366eaddc", "value": 660480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629527483, "uuid": "1dc65171-ff2c-428b-8522-4be3c18f9ce7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629527483, "uuid": "1dfd57b9-ac12-4e6a-a730-3e8832502ee0", "value": "454c19e2bb2b52b74fce8a789e827309.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec03b650-0215-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629505371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629505371, "uuid": "de4dfa08-59ca-43c4-86c3-1c15210029fc", "comment": "Malware payload (Mirai)", "value": "1faf14fde13567ac7be76dbe6940b159", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629505371, "uuid": "1fbb02d6-6037-4525-b7b4-d08f36920947", "comment": "Malware payload (Mirai)", "value": "c29ab11586ec97a16e9e7bb099fa2df56a1e2cb9f8563d1a5896c72f420ec17c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629505371, "uuid": "e47a07b9-ce1d-40f7-8736-9f6f9f7fe407", "comment": "Malware payload (Mirai)", "value": "6006746f2537d6641673501aef9d53b443e728e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629505371, "uuid": "ea2add9f-3b74-4d7e-8a8f-968d2a6d111a", "comment": "Malware payload (Mirai)", "value": "82f68d9b583e3a7e702f7b914d21a7d5c0c2246c8dc5399632834b3e5d16838006eb3a5b5f24d701971546bf637849fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629505371, "uuid": "11250272-5ba5-4138-8772-33f9fb9c40c4", "value": "T1F9335CCAD983ECF5D811493130779F319AB6EA7E6065EA43D7D8A532EE02702E11739C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629505371, "uuid": "3a58ded8-254b-4ed9-a0cf-bca6f7b998c9", "value": "768:FaDRcoWmr4xAh7byZlfWZA1z5LKJZXDKK0xFMaPjyuZSU1:EDRb4xAh7uZlfn5+XDexFMaPjyugU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629505371, "uuid": "f1d3533e-786a-4ff0-b1a0-625f5f5e3646", "value": 51356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629505371, "uuid": "b846b242-b600-4558-b7b3-5a7b4022abb1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629505371, "uuid": "3f524663-77c1-4202-8136-a08560d50db6", "value": "1faf14fde13567ac7be76dbe6940b159", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f64c53f-0216-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629505672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629505672, "uuid": "0cf7cfaa-b9b3-43d0-85a3-42a8f3f2b155", "comment": "Malware payload (Mirai)", "value": "f9ea7045ce833e36b0791266658d1f83", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629505672, "uuid": "ba363f16-cc70-4145-8b2c-0b5c93eb4e04", "comment": "Malware payload (Mirai)", "value": "c3589aa9c25c3fa2d666ab84d09661e0a7628bccd58a2ac5d4fc05c0dd69d715", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629505672, "uuid": "02a3b757-aba2-49db-87a8-b52c19e853dc", "comment": "Malware payload (Mirai)", "value": "bb40c5307c85ffff94545f9a62e2e6febe6cf12a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629505672, "uuid": "7272f649-6a1c-4854-84b0-766093090029", "comment": "Malware payload (Mirai)", "value": "f325178c0ba1bbe7aa2009b55cf4e19e8ca9a0b15e4303b84011d18458b8f99a586759bc64ebe765eea6c9e745227128", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629505672, "uuid": "47bab59f-314d-4785-b60c-72b584af1033", "value": "T18F43195ABC918A06C9C46277FA1E41DD372563ECE2EE3303AD162F6077CB81E0E76156", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629505672, "uuid": "55b468ee-da17-42ec-b72e-c8c971f5175b", "value": "768:HvOoZWijy4eVlhZSpG33+/iKB9dk36sJ62jBOP2siLNI0HGnWENsicM/+mBNOzTh:PpzythAm+VBY6sJ62jB+KXis3YfZo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629505672, "uuid": "32e57a20-488b-467c-8ec9-78ed50aaff27", "value": 56164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629505672, "uuid": "e9fcd929-84f0-4001-9ecd-cc4b77525a4a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629505672, "uuid": "b4c32ddd-377a-433b-9c8c-bb62355f3451", "value": "f9ea7045ce833e36b0791266658d1f83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3871ac8b-02bd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629577226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629577226, "uuid": "1c69974a-16ce-49d1-8a89-56c8e7fd8a5c", "comment": "Malware payload (RaccoonStealer)", "value": "56c83bbfb9857331a6cba51f8f0d8b02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629577226, "uuid": "2d899533-c5e3-412e-9cac-99d5f16e503e", "comment": "Malware payload (RaccoonStealer)", "value": "c4be95ed58c7350e35d6348e7f2e73d59c84d525796dbeac67fab6c7070280e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629577226, "uuid": "9bb87aad-2ff4-414e-adea-8ca4c98bb676", "comment": "Malware payload (RaccoonStealer)", "value": "046c111dcfc505d2a349443a903dd891932a83dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629577226, "uuid": "8a7026f9-9ade-4658-ad30-830a1e250b89", "comment": "Malware payload (RaccoonStealer)", "value": "78fc94e1658124134bcaac78437bd89d11ad40cc1fdc51d25f30d6cabf47c8796edacb17c3ed8cb958f797f72d562726", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629577226, "uuid": "19bf48a4-e227-4489-adcd-c25a5e58681c", "value": "T138549D20B6A0C138E4F711F4597DE7AC69297DB16B2050CB72D636EEA2372E4DD30687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629577226, "uuid": "e9f56e51-79c6-4c48-afa7-e1a76f0a29ff", "value": "ad1c5bf15a899fcfef408e3485448e67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629577226, "uuid": "0289b256-1f9a-46ce-9832-49c3e6859e03", "value": "6144:CERt2j2K3QNm5q7jW+98elDt6Yt9GxgZODB73Phxa3zV:Nt2j2IQNv7L98elxT3GxgZYPhxkV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629577226, "uuid": "e6b85c7a-87b1-4fd5-8d71-9c9aa1d09e6c", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629577226, "uuid": "cf51b141-40ad-4bd9-a9c9-05b82e58ddd1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629577226, "uuid": "35fc734b-f1ab-4b79-8b92-e349aaae13cc", "value": "56c83bbfb9857331a6cba51f8f0d8b02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5d9bd0d-02c9-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629582563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629582563, "uuid": "cb09f727-894d-4f22-ad70-4e02fcec8b61", "comment": "Malware payload", "value": "ebed5b4e23dc7bc73a207b16bf8decd7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629582563, "uuid": "0ecc226c-8958-47ec-ac5e-cc3a9eee8e79", "comment": "Malware payload", "value": "c50a0af193496e9c8d3f2a640451385ac4f3769e5cc1ca99941bc904703e51b6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629582563, "uuid": "657c54f4-f336-418f-be88-bfcd189efe7e", "comment": "Malware payload", "value": "37d84a79d82c2c4b3407764080e559d6440260cc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629582563, "uuid": "c96b5bcd-af3b-48a7-a090-9adb692fc559", "comment": "Malware payload", "value": "907f625bf180bba37465c90b2f28522c7ca71f7ecf389fb6584747c3b1f5e252bf5a0a92c19a3933701b5b4b4e80b368", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629582563, "uuid": "7eb4696e-b39d-4c45-b2dd-37823f5cc350", "value": "T152062316E7DB81B4FAB50AF855A69B005C363F2929EF515E0C38F50D0D326C2987AF23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629582563, "uuid": "889140bb-c06e-453c-acdd-5399b415550e", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629582563, "uuid": "1ea038c5-af45-4b63-a91e-40d583166765", "value": "98304:pmpcBU2WdRpvjerjZ4oGjCPb2mfZiYySOekup8:puyU2WVaZcOj2aQIVkM8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629582563, "uuid": "19afcaca-291a-448d-8380-922a644a988c", "value": 3741624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629582563, "uuid": "87ca2ec0-b5d0-4239-97c0-3fe18ebf3b14", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629582563, "uuid": "8cc96054-ee8a-4762-a619-9c685cde5fc8", "value": "ebed5b4e23dc7bc73a207b16bf8decd7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33ac60c0-0230-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629516659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629516659, "uuid": "fadfc4ae-f8dd-4f46-83f8-4b60cde75239", "comment": "Malware payload", "value": "8137fd340b95ee840fcc59cfda1b822f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629516659, "uuid": "1a213ff3-9bcd-4c4e-8a8e-570395f07b13", "comment": "Malware payload", "value": "c84efa5991ab32373624d35d1cf4921ea0f9c2eb52d5703d059d5cba39280087", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629516659, "uuid": "0cb6f3ef-146e-4c2e-8a3c-ba017f61efad", "comment": "Malware payload", "value": "cf2e0d1d54ad1edbeb73ddad5ae9ff1bd9d148d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629516659, "uuid": "62434406-24e7-4896-be05-e2468b76b891", "comment": "Malware payload", "value": "795cf6983e440b0004fa1673e187cf3367419c22a80ce7a763a48f6f9a75dc2107c27ff1ba2e0307eefe421350e7abc1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629516659, "uuid": "a2ed25b2-31fb-42a0-a6c6-761fb09a4fff", "value": "T1BEA4D020B6A4C039E0F311F4557DE3BC692CBDB16B6450CB62D626EE96372E4DE30687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629516659, "uuid": "130198bb-9e35-438a-962b-0108126f0023", "value": "ad1c5bf15a899fcfef408e3485448e67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629516659, "uuid": "d8a9e8d9-a622-4be3-b43d-ff95e6b6b925", "value": "12288:3P3K3m4LJ7/V8iZwmJI+L1ifbzvWtCTTXyfMPH1c1V:b4LJ7VI+L8ACTTXyfMfy1V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629516659, "uuid": "46dd70d3-6db2-4c95-9e8f-42aef663473f", "value": 454144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629516659, "uuid": "f2f7c471-4b0b-440c-afc0-9631f37defa3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629516659, "uuid": "b89606cf-ffc6-43a4-b7a4-edd5d64054c7", "value": "8137fd340b95ee840fcc59cfda1b822f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11ef69ab-024a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629527769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629527769, "uuid": "43f85d23-f3a9-4ec3-8c66-95724c0c6cb5", "comment": "Malware payload (RedLineStealer)", "value": "ac1064081f8fdbfefd0157e16f9b2761", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629527769, "uuid": "c5cfcf3f-b2de-4b2b-aeb5-10e9b968fe45", "comment": "Malware payload (RedLineStealer)", "value": "ca0bc652d651f727d69fbb22cc91037bc825989e759fd54f6eb0cc118286506f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629527769, "uuid": "d8d1ac29-55e7-4ecc-9c55-c697bd1c5f89", "comment": "Malware payload (RedLineStealer)", "value": "17e22c40cea27e5af57f045dff7f9798167f67b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629527769, "uuid": "6a14fe00-9006-4106-94a7-28f1eb122982", "comment": "Malware payload (RedLineStealer)", "value": "36563fcc3713bf53bc0436b8ef8302d0a0662592cdc0abbbd1e603151eb29c8693d3c96fb5466320ef241e64ba329384", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629527769, "uuid": "caa3639f-43be-4cce-adbe-16e95f3ad770", "value": "T1FAC41205B0F08B33D08964754E56C7B10669BDA6AA910207BF57E76E3F321E09B27F39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629527769, "uuid": "358cad91-b274-41ff-b24e-1a3c7088d4ac", "value": "eff27d48d68df0af1612601744441acd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629527769, "uuid": "8c24fe3a-4782-4a83-9704-76a0ae8a1702", "value": "12288:chL7MRu0opy2U+MWoZXzsxlLzGf9Kbc7tFEVFnJpQE7eh0ZLH:cGs0ayh+ho1za6f9n7MVFnob6H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629527769, "uuid": "a59c3105-2989-4a96-b626-6872b470fd5b", "value": 557568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629527769, "uuid": "6cc14309-e711-4881-a2cd-fa99e750c2ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629527769, "uuid": "3daeed8d-d2f4-4937-88e8-426032f6a084", "value": "ac1064081f8fdbfefd0157e16f9b2761.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ced12d37-026b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Hydra)", "timestamp": 1629542259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629542259, "uuid": "dc790fa4-9af8-463f-9bae-7ce93cf7d6f4", "comment": "Malware payload (Hydra)", "value": "22c6380abe1a2ff9b7d6f6d4baf252e2", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629542259, "uuid": "02c58739-7612-44a7-975d-1794265b432a", "comment": "Malware payload (Hydra)", "value": "d0775b35bb8cb849d1049e9cea3d990f97bf09e908d19c93ba6ce0c184bfa668", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629542259, "uuid": "1643f790-3d84-43bf-9a58-e260bd46f2af", "comment": "Malware payload (Hydra)", "value": "4226fb895d2ea02c462a6aa4965991ef08a5412f", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629542259, "uuid": "8ceaac73-9e04-4afd-9053-8334ded5f028", "comment": "Malware payload (Hydra)", "value": "f6b31c1c723f91c3a14124975b0003ece002b287feebc8e899ef4304eb397513cc71c23e3a797fc366444cccb3302a4d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629542259, "uuid": "d157333a-9b86-4969-935b-129d1cc0e128", "value": "T1E4F533A68E428081D207EC79568B9B4EA0095DDE554FEF3F85318EF844B1FB8670FD86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629542259, "uuid": "ed728bb6-7aa1-4a69-b559-fad4cc06b728", "value": "98304:Jy7LJupxtNBfPDGGQ74yVpfPi0Qto94Uhb:JUdupLU7xVpfq0Mo9Fhb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629542259, "uuid": "20b24ec9-789d-4731-bfc1-de171edde473", "value": 3504903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629542259, "uuid": "9db0a3b2-bf10-460d-8ee6-a4b6c9cb8bc8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629542259, "uuid": "e51e522d-6ee0-42dd-8d14-4e1925f27376", "value": "93740_Video_Oynat\u0131c\u0131.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6727de20-02c1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629579022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629579022, "uuid": "8b59fda5-9654-4bb4-b106-d04c9b7b2d68", "comment": "Malware payload (RedLineStealer)", "value": "7f5010f3fad1feebbffc269f6c58994f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629579022, "uuid": "24950d79-cbcb-412c-ae7d-5b743f2e3c1d", "comment": "Malware payload (RedLineStealer)", "value": "d13c6afa7b77e0426a8b83a84868d4b86bd2294cf6f1d37c4a8942c881402925", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629579022, "uuid": "06057b5b-dd74-4fe9-8df2-a7f946ae6f73", "comment": "Malware payload (RedLineStealer)", "value": "9f0fe74214b857e11d384d6fe3bb42ad4ff5c717", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629579022, "uuid": "b6a1d81c-462d-4661-8e65-610dfb6f7195", "comment": "Malware payload (RedLineStealer)", "value": "01279dbe91df7f6cf37f413a2cb52f458fbe75a27ec35024bd0b9d4f4a77942b1358f765359796a3435bf07e94225323", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629579022, "uuid": "5c123182-fb44-46d4-9a6e-7a41b093863a", "value": "T1E1E4F120B7A0C038F5F311F449BE93AC69297D706B6450C762D62AEE62376E8DC31797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629579022, "uuid": "12fe3fdb-9afb-4096-a8e5-9a7a87e97e71", "value": "a30b70feaaf646aa38caacdb4af5c88b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629579022, "uuid": "8b7eb7f9-22f5-40c9-90fe-1417575d3784", "value": "12288:TnhIvmCHxgZywH/JzOJyeCp1PwRm24TigjlKif4m9p/lDfPp3o:uvmCMH/JKyvPwRgfr4YpNp3o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629579022, "uuid": "4c3b0a84-e62a-4160-a1b4-1611386cb7b6", "value": 658432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629579022, "uuid": "34ad1229-a67b-45de-803b-c4e0d63e7496", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629579022, "uuid": "b681f35a-f865-49e7-a456-3976471c87f8", "value": "7f5010f3fad1feebbffc269f6c58994f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aaabdfe-0216-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629505664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629505664, "uuid": "bcb179fb-3e20-4366-b4b1-54846365010f", "comment": "Malware payload (Mirai)", "value": "60be98ef6fcf2c6ada60aec49af83ca4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629505664, "uuid": "fdd8edd2-099c-4824-97f4-5095e6a83760", "comment": "Malware payload (Mirai)", "value": "d2defe2126f091e25ebf9c0f03b95abd442beb5aa2ec9ffe990df2c73d60060a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629505664, "uuid": "bf0629d8-0654-46db-a405-dab80d2f21a0", "comment": "Malware payload (Mirai)", "value": "d9bccc7a19b3179e2107acc5cdec55ea77f03241", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629505664, "uuid": "9070ed22-b9da-4045-80d2-8ace74531230", "comment": "Malware payload (Mirai)", "value": "4a0faab07f3bcc5dfb969617b76c2ce6495ece7e615e673275a536bf23f6d3d6cf1801b83d7f37176711d95844b9e86f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629505664, "uuid": "1b721595-414f-41f5-bafb-960f029e893f", "value": "T184536B21EC793A17C0E8A17B12F34325B1F56B4F29688B2E7D610F8DBF51A4062672F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629505664, "uuid": "f1c5293d-8766-444f-9797-52043f7a2f4f", "value": "768:r7w0cG27oLSTVe3dltG4zsuS+sEFNwP0JaCO+3HComeNSGz:Pw0cG27iiVQHzZSK5ag3Aeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629505664, "uuid": "dfe86ad0-f7a5-49f1-86b4-8fbbe7d22859", "value": 61276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629505664, "uuid": "7e9f30f1-f97f-4aee-99c7-2cdab9a99774", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629505664, "uuid": "83e9f99f-fe4d-4cc0-aa48-bf9b41056560", "value": "60be98ef6fcf2c6ada60aec49af83ca4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62d394c3-02b8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629575149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629575149, "uuid": "228576f1-fecd-4fed-a85c-c76b967dc9c8", "comment": "Malware payload (Smoke Loader)", "value": "e69c2c74dfd875161e6f9fe92887aba2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629575149, "uuid": "b0ddac6e-b7c5-43d9-8709-2c3f73921cd4", "comment": "Malware payload (Smoke Loader)", "value": "d48c402b275e25c7929030ceb7d41accf93ac02c0050c0113db3abeb30a3345b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629575149, "uuid": "e49eb3d9-d429-46c2-9f16-0e085fd1096b", "comment": "Malware payload (Smoke Loader)", "value": "f9856bb6950564447fd2dd7cf8540e84e244c869", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629575149, "uuid": "ca005a74-28e9-40c4-80ef-0994b17524fd", "comment": "Malware payload (Smoke Loader)", "value": "25a4b8d57e0b2a299703f492a787ece731442be17f5538a608e2e3be2338081b3fb6cf7008724f9710767bf7aa59ad2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629575149, "uuid": "297a4187-49bd-4e5b-8245-f7e02fcd4256", "value": "T1C8E3BD1079F3C572C09245314855CA9CA62AEF206FB396473E9B129E1F613D0DB2AF6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629575149, "uuid": "30815866-8628-4414-987c-c7286b4b8c95", "value": "d9ba9c76f1c1b9698712bcd1010ec021", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629575149, "uuid": "8fb23272-3cd4-466b-aa50-409bd9f75b03", "value": "1536:zdkqjNNNMpj016p/qNyK8yw2awR9ATZeQg+OZhqn2RGJIdv/0YE84zzABFnLFBMT:NHMq58yI64ZeEOZon2RGY30xzgFnLmF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629575149, "uuid": "114dabe9-3499-4829-b395-d09daca78ef3", "value": 153600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629575149, "uuid": "042ccbcd-00b8-45d1-b75d-f403b9a4e5ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629575149, "uuid": "a5cad10a-13b5-4cfd-9999-58eb222a4667", "value": "e69c2c74dfd875161e6f9fe92887aba2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cfde0db-02b5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629573931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629573931, "uuid": "18d006ef-40c8-40b0-a550-0986437824ee", "comment": "Malware payload (RedLineStealer)", "value": "a508fab290cc3cd24db6cc604c6415bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629573931, "uuid": "bc1bfc8c-47af-43ed-b8c4-daec8c6b8c24", "comment": "Malware payload (RedLineStealer)", "value": "d4b1889937cb1c7c543b432827bbb97220989e8d39131c73bf562d1b06c968a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629573931, "uuid": "f3998cfb-fade-4db4-8c48-c38d3428a798", "comment": "Malware payload (RedLineStealer)", "value": "f1a5590892c14e708f56f5be7e41ba28cc9d2561", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629573931, "uuid": "b762987a-13f9-4843-8b9a-aa22b71482e2", "comment": "Malware payload (RedLineStealer)", "value": "ecf9c00f48902b354f88bf3d07fdbed91289d3a4b09dca383c23c38585162eb6a829d6fe1432817d533804361c04ddcd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629573931, "uuid": "188d9cec-08c3-444b-8854-cdfb417a74ed", "value": "T19BD4F130B6A0C034E1F312F449ADA3B8692D7D716B2450CBA3D626EE66372E4DD31797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629573931, "uuid": "b2876872-cf4d-4cb2-ac71-bc7a8d512334", "value": "74369709aeb55fd7f8dd333fd3dc6eee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629573931, "uuid": "f162d60d-7235-4545-a5e4-c622d9dfd819", "value": "12288:JIASrPFTUVQXNYBsdPi6W2CX9qLRR3FOBNnKxyHUkdBBWL:crPFeIFWxMLgpKw0UBWL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629573931, "uuid": "e2d4e858-723e-411b-bc77-efa87230cad8", "value": 653312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629573931, "uuid": "bcc80f0f-fb8f-4a4d-8d2c-ed5049f4c5b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629573931, "uuid": "f3701976-c7b2-4ce1-b1c2-62faa57b4f2e", "value": "a508fab290cc3cd24db6cc604c6415bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc6d921c-02c2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629579621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629579621, "uuid": "f4b41e78-aba8-4c2b-8514-4f63eee37675", "comment": "Malware payload (RedLineStealer)", "value": "5cd5817730e1c989896ca0c89b9afc48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629579621, "uuid": "8ac41725-8af1-4940-94aa-7f090e3899bf", "comment": "Malware payload (RedLineStealer)", "value": "d51dd44a65bdd80d1dfcfb6424668f25933ed52348e0eae8c5beac66b200410c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629579621, "uuid": "f8ac5168-8b58-4aa4-b6e3-a52c82d5c653", "comment": "Malware payload (RedLineStealer)", "value": "bd6ad9dec18c94a492744d327ee7ec03d4b0c4c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629579621, "uuid": "ef063af8-72b4-4b9d-8a2e-26626b546e6e", "comment": "Malware payload (RedLineStealer)", "value": "51c7b2fe4fbe1af1371f45ee1a431d07f530bed511898ff3d14bf8bcc7e93d5cc59c2eecae75fa2e52d3e4df2dd22ea1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629579621, "uuid": "ebe0173b-01ed-4a17-99d0-3da16fca3f58", "value": "T158D4F130BAA4C134E5F711B049BEE36869297D717B2450CB62D626EF6A3B2D4DC31387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629579621, "uuid": "b5db22a1-4bff-4e4c-8744-b1c62b140314", "value": "74369709aeb55fd7f8dd333fd3dc6eee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629579621, "uuid": "92cb5524-35e7-46e4-9b7b-436230fffd22", "value": "12288:xogSrPFdVwskfUY3Tl0mSYIvwVVucDGHybL:UrPF0/3SYIvaDXL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629579621, "uuid": "b9d57979-d41d-4fb7-9d91-7a4969e27c45", "value": 653312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629579621, "uuid": "89dab4df-59c9-4b98-aef1-cb39ebf2cb3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629579621, "uuid": "41140274-09c8-4525-b381-8c6ce168a9dc", "value": "5cd5817730e1c989896ca0c89b9afc48.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f17b62fe-0270-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Cerberus)", "timestamp": 1629544465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629544465, "uuid": "b06f9dd8-7736-412e-8499-28ae513777bf", "comment": "Malware payload (Cerberus)", "value": "9c5200a23dcebb4ef84a97352b6b865f", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629544465, "uuid": "d84b8f33-006c-4b57-9c71-796aebcea02f", "comment": "Malware payload (Cerberus)", "value": "d81c00d48f918cab3bdfdb461378872db0e2a076c648b07a8e80d9093fd35b75", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629544465, "uuid": "da1beab4-c842-4202-911c-50e059f8ae77", "comment": "Malware payload (Cerberus)", "value": "df4ac5ee9d114e22f413995bcc28376da66c74b0", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629544465, "uuid": "6b614536-61bf-436c-a69a-3663c34237cc", "comment": "Malware payload (Cerberus)", "value": "319d222841bfa723101208af6e727c20c2f9fa9f19b6e6a4aee4d96a7364162074ed3e6a7c9c7b02ca4112a473bf1d9a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629544465, "uuid": "31a80ef0-2385-4090-9d37-b4e3cb5b0678", "value": "T17CD3F1576BD42465F0BBBA70878DA3625BB68DC0FB91A3C32900500D7CB6BA71F58F08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629544465, "uuid": "55393382-ed94-44d3-ae3e-916a2d79fb9a", "value": "3072:seDseSZnX0VD3xe676N/CQ0TSzX30KuLuIQ2XzXcvm:CeSNCDheE6N4U0KovQ2jsvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629544465, "uuid": "0d9e77e7-3918-46b5-8fbe-b7a6706f761c", "value": 136612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629544465, "uuid": "aba25eb5-a714-4ad4-b8a5-7a1a70dde6dd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629544465, "uuid": "ab695820-33ed-4612-bbd7-72029479e75a", "value": "playstore.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5909ffc0-0287-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629554087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629554087, "uuid": "4e991396-ce63-4afa-8aae-cbe93c6eeff9", "comment": "Malware payload", "value": "469cf485e5d95a8dddd3f587549638b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629554087, "uuid": "3108d411-3f5e-4226-aa96-218dec4a3579", "comment": "Malware payload", "value": "d822b79bcbf0001dc173bce259e55de9a855bcfe469b337228f838f639c91db0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629554087, "uuid": "e5f49d4e-6a7b-4c95-9263-531f6b752612", "comment": "Malware payload", "value": "af9d3c48a97ed368f5537fe4f70de2727482efab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629554087, "uuid": "cfd87c8c-114f-4e1b-9a99-399954b4b3a1", "comment": "Malware payload", "value": "4530082f6c3c6cb39863aaaa3b601038873a3eb0a9323e098523afd9d01dab0b4e7299f5f8d83481e2c84766ab482b52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629554087, "uuid": "a7cb37fc-9f30-414d-9d08-83cfb60fe127", "value": "T16F448D20B6A0C138E5E711F4997DE3AC692D7D706B2050CB63D226EE66372E4DD30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629554087, "uuid": "74422957-7fb2-4278-b500-137205f569e9", "value": "74369709aeb55fd7f8dd333fd3dc6eee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629554087, "uuid": "b3239a15-0106-453d-b4a8-21b13d6afc09", "value": "6144:H1RJaQR3y0xLM3dWFqEzZiux3SZwfnlKELCLUGz:/cQR33xcdoBdiPZw8EL2Ue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629554087, "uuid": "551be792-ba59-4a6a-b43c-1e14107d95a0", "value": 275456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629554087, "uuid": "f6a4b72b-b879-4d8a-b303-22fde85aa22f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629554087, "uuid": "f389d8a4-a777-4574-8ed1-c0ea81396cc0", "value": "SecuriteInfo.com.W32.AIDetect.malware2.19574.2816", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ea816f4-02c8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629582014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629582014, "uuid": "d87008fe-1c31-4d7b-bdc3-3ddb8fcb1897", "comment": "Malware payload (RedLineStealer)", "value": "066de45b31087f5bb223f5943b90b3a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629582014, "uuid": "ad5783b5-53c9-461f-871a-ebffb2b37cc5", "comment": "Malware payload (RedLineStealer)", "value": "dcf34ea65d0f2ed8ad3cceaa8b788f37f160328f696b7367142006b73dd4482c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629582014, "uuid": "e420a308-61fc-47b1-ae61-598b548fd255", "comment": "Malware payload (RedLineStealer)", "value": "8c77681a98dd069875c3089a8d3616ac37d6b360", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629582014, "uuid": "1c17711c-8581-4bcb-9cd9-82e253a62d3b", "comment": "Malware payload (RedLineStealer)", "value": "799af5a4f562b04e42116fcad51f69fcf03ffe2b4779151322ef36660077ecaeab6ec4e1da8ccdb6c77c38b6dae4c205", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629582014, "uuid": "fd5d0a89-e642-4029-9e74-47ad78d85ecc", "value": "T17AE4F120B6A0C139E4F711F4946DA7A868297DB0BB2041CB73D63ADE56372E4DD31A4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629582014, "uuid": "73836f86-10e4-4250-8b86-712dde5a5a49", "value": "ad1c5bf15a899fcfef408e3485448e67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629582014, "uuid": "44f1bb1d-0542-4e73-a330-ddb749380b58", "value": "12288:R5Wr2ZBktq7c1UmsrvXfcqFTnmJ8HTh48OLE+v4UejXcgvbINs/Gn:q2ktq7R/zh4DLDSjXcg7/Gn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629582014, "uuid": "16ea5fb1-de9a-4038-8666-dad3493f7bc7", "value": 658432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629582014, "uuid": "c49f973b-7606-4621-a576-e07d49c29f57", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629582014, "uuid": "d3eeb4aa-e89f-435a-99bb-cbe0b78494ea", "value": "066de45b31087f5bb223f5943b90b3a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b09f5a63-02c3-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629580004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629580004, "uuid": "5618aeea-e963-4cd0-9ad5-a258e933e52f", "comment": "Malware payload", "value": "a2192e431df4c85dae92592c2132ff8c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629580004, "uuid": "324b5877-4481-4214-889e-306ee255ab52", "comment": "Malware payload", "value": "dd38dd14352a344a14cdd8f25898c92afb791bf02c23c290b070fb6358d6dc75", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629580004, "uuid": "88b88b59-9085-4c97-ab9f-10ad518999be", "comment": "Malware payload", "value": "36ef01ef34226448081e1fa68535a667fa50c11b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629580004, "uuid": "146ccd6f-9e03-4fa2-9566-7a38a6a6cd9e", "comment": "Malware payload", "value": "44074eda7bb23b368108a50c7e25ee8e7844cb907b5f4a712074e28f1a1cc5eb91a048ccddf324c7936a2f1fb076b80d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629580004, "uuid": "b14f0f7b-79a4-4f53-801b-9335d2fd7591", "value": "T1B425CE663114BA33E15D31324DA5D49005BAFE695C31DB4EEEEF3B64063EAAC3227247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629580004, "uuid": "e60a2bc4-da28-407a-82e4-72578dff8890", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629580004, "uuid": "2bf2ebae-0338-4205-a02f-4e34ddb8f93a", "value": "24576:LWE2SV6iH+sQN4LRLwvQ+L256qZhCNr/B7uy6:iUdH+s8Y+aZo7B7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629580004, "uuid": "75c282a1-7936-4c25-bf00-ffca44cda081", "value": 1024687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629580004, "uuid": "14d9523a-ea49-427d-970e-5d7beef9559d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629580004, "uuid": "14dab112-75eb-48b7-a4d3-98d6c86e5dd6", "value": "a2192e431df4c85dae92592c2132ff8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "250d5ece-0251-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629530807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629530807, "uuid": "b34a6257-d302-4d19-995d-0d031bd93e4c", "comment": "Malware payload (RedLineStealer)", "value": "709929aa3b4a2c6b044303552a77cc88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629530807, "uuid": "91609970-58d3-4811-9b39-45600e820523", "comment": "Malware payload (RedLineStealer)", "value": "dd7b2f4e9d64a2972f4c4ca43fa9fa7923c6afdb6c401409a2a2ad7b4c263e12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629530807, "uuid": "535676aa-29dd-4fcd-8f71-c8fcb0efbe57", "comment": "Malware payload (RedLineStealer)", "value": "f43ac8de0e425dce7a08b4c8449c5b1e7a176f39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629530807, "uuid": "95cffcae-50be-4b26-9b5e-065ae3199518", "comment": "Malware payload (RedLineStealer)", "value": "58537a974f5418d11cf1837d0cc97d67e68f95e8c2f6190024e53a3332e252ad6ef1b6bc7bb0f5dcea494c32cf34a742", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629530807, "uuid": "e950b401-78c5-4e05-a3ef-ed49f8291e8e", "value": "T1C1D41D18667FC016D1F7EAB12DDC68BBD9A990E3640D793710A4633B4B92744EE0F0B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629530807, "uuid": "f72414f7-114f-42d3-b5d5-b03ec65ecf12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629530807, "uuid": "ee72eb41-913f-48f6-980d-5cae2c383842", "value": "12288:zkTtU5eA1Goq/6K6Qj3omKnQVwWbO/Trmp:atO13g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629530807, "uuid": "a706da18-6a0e-4be1-a2b9-6aec4bbc2dfc", "value": 599552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629530807, "uuid": "b9f76141-0665-4593-a2c6-9a655cfd4785", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629530807, "uuid": "2d783553-eb62-4b1e-bc4d-bdea438301da", "value": "709929AA3B4A2C6B044303552A77CC88.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d922e90-024c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629528701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629528701, "uuid": "97852f06-05b5-421c-ad57-2d5db3fca684", "comment": "Malware payload (RedLineStealer)", "value": "d9416c5aa7a2959ba5038c5e952c0066", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629528701, "uuid": "54e644e8-a309-40fc-b029-48826cf13c0d", "comment": "Malware payload (RedLineStealer)", "value": "e0d1bcffc60dfdecaa8994b0386b17237f58498dcf0aa843f78a179f88e58814", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629528701, "uuid": "b679c7e4-d62a-4dcd-b765-ae8a7135a9c3", "comment": "Malware payload (RedLineStealer)", "value": "8989d30b24d327bea866c368d1780690eebaee1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629528701, "uuid": "a6255855-4dd3-454a-bb78-31d0d952e7b1", "comment": "Malware payload (RedLineStealer)", "value": "4818d021108db78ff53b8ed94b5eeb215c922196d64f13215077b3b150fea135a48bac3db3986bd95295c390a7226250", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629528701, "uuid": "73e382a1-6707-42ce-aac3-4504f225a039", "value": "T1A6E4F130A6A0C138E4F311F555ADE3AC69287DB06B2451CB73D626EE67372E0DD31A93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629528701, "uuid": "93ac718f-89a4-4deb-92a9-a0d5ffe20108", "value": "ad1c5bf15a899fcfef408e3485448e67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629528701, "uuid": "b9bf0ef2-d0d6-41d6-ae30-b4d51cf88adf", "value": "12288:E/SQh+Ugz7zXsh6BHm7frRBLDJMbUDsr3lOBN/9OVJpsM4Jo5DgHn:JUgz7rgrnDyQDs7lgkVnsMn5EHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629528701, "uuid": "4c12fe1d-9fba-467b-881e-b8f8d769ace5", "value": 659968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629528701, "uuid": "c5190aed-b762-4ad7-9174-3714c8d484bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629528701, "uuid": "6331a985-8d73-47b9-8af3-196cb31c8a7a", "value": "d9416c5aa7a2959ba5038c5e952c0066.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e395ed5-02b1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629572108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629572108, "uuid": "0b64c085-2e21-4176-8266-da95f8166c50", "comment": "Malware payload (RedLineStealer)", "value": "8d744f7bea76b2cff67501320174dc53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629572108, "uuid": "25fdb58c-6a26-41cd-9594-2ca01f4d9011", "comment": "Malware payload (RedLineStealer)", "value": "e1c8f91a01400615df83126a8b3a323425f30b5480d405b26adf2d924c21464f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629572108, "uuid": "8809e6d5-7087-4843-b22a-d11295b0cf6b", "comment": "Malware payload (RedLineStealer)", "value": "e7d3db7eeb2d01ae30cc1a8e628379224c9cd583", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629572108, "uuid": "09e14fa6-aecb-4bdc-80b0-14d76d4fe24b", "comment": "Malware payload (RedLineStealer)", "value": "fccf91ad32116e3dd4b7b5203d76a70a44a8d10771221e26d29570611272fc2fe429ca0f40b1d801c149dfa3ce9d1c43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629572108, "uuid": "1f4037cb-b77a-402d-a907-5ceb0b48f778", "value": "T1E416335AFB593949CD8380301DF903721AA7282322C3956F57F0A5C469E56DB4EACB3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629572108, "uuid": "bc0c83d9-c227-4ca3-a1f0-6c50495a65f3", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629572108, "uuid": "2e92a0bd-8f46-4a20-a1af-00d2dd7f4903", "value": "98304:yKJZw2Zs03SGh6mYCnw8njzAP7u21Q54yrKNe6jLRufhimI8h:yQDtNh6VMj0P7vW4pHwhjI8h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629572108, "uuid": "5648010e-fe92-4454-ac5c-82514c5e508f", "value": 4080601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629572108, "uuid": "54db3423-6707-4640-88e8-40218fb4a291", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629572108, "uuid": "fd1df176-4d9e-46e5-a658-096541198647", "value": "8D744F7BEA76B2CFF67501320174DC53.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9fbe7cf-02b3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629573228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629573228, "uuid": "6f580d57-968d-4e99-ad77-287dc2150c46", "comment": "Malware payload (Mirai)", "value": "fa5d9338271be7672587aa73acbbfade", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629573228, "uuid": "766a836b-7fc1-4813-9114-f183ba0f839c", "comment": "Malware payload (Mirai)", "value": "e2fafdccff56b1aad92eb1fd8ce2f5f10b5149507dd2004e8f9d7988801ef894", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629573228, "uuid": "15d733c6-c70a-4261-8a99-8d14fdeb6299", "comment": "Malware payload (Mirai)", "value": "0eb829790637c784337343e05c717deb06c14201", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629573228, "uuid": "87af6f48-829f-4ef2-9441-a93e52ef1112", "comment": "Malware payload (Mirai)", "value": "2ce2dc411df383c2c7d1910d5b3597d4c128a7f161cf1a58fb53f8e13284ce5d3fcaec324068bdb9208bafa4bb58729f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629573228, "uuid": "98bfb082-d400-4de6-8c9c-ec8651e0c27c", "value": "T1CF72D03B9ABE8727D8D6C4372816D0D9A6F35C012AF07314C2C954D63A2959493AE72F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629573228, "uuid": "5404ec9d-9708-45c4-a7b2-446c63157dc0", "value": "384:v/mhiEV1f0FxpJC4j6TsHG7Pv79qzRc74gl4c+iFqcJTE:vTEV1sXpkGisHGczRPgl4jsFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629573228, "uuid": "33d778ba-0a75-4dab-ae0b-9ab5a115db5d", "value": 17432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629573228, "uuid": "0b210403-845c-4c6c-b9ce-c53e44ab9fc1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629573228, "uuid": "e6925659-7c63-4637-bb12-4d8f510aeb6e", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "559f9f31-02b7-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629574698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629574698, "uuid": "faed30f2-69b0-4296-a261-8b3c0fb5bd9a", "comment": "Malware payload", "value": "1c822ec541645aa256e31cb6ee224e7d", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629574698, "uuid": "795878fa-5a72-46d3-83ac-e3ba0b20fdd7", "comment": "Malware payload", "value": "e42f9e7951ae952e32659ba94e92fc24851ee7e2db0d42f33c39d217e85df48a", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629574698, "uuid": "7422e750-58a0-4538-99d2-de0341040dee", "comment": "Malware payload", "value": "9c7ddae31cb917090a1dafd50cdadf8d1c313db7", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629574698, "uuid": "1e68200f-20f8-4e23-8198-dbaefbf0613a", "comment": "Malware payload", "value": "4d692e7f378ea6ecd779088b86b6c8092e25ebda70b3af784e10b147a8d24fdb2609e8e0e3e139fe17cd941a6416ee4b", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629574698, "uuid": "bfbc118f-6877-4021-96b5-6ac600fe9d7a", "value": "T1155145657D920A72CEB2CA817654B195EDE428A7C6FB007AF18D2C7A0BB4196D14FB10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629574698, "uuid": "db6b3da2-079c-49b2-b86e-8c22687ad372", "value": "48:/0SzrziroNFsufk/oUdpjfFq3lFq3QJP/NZiu9AbZjQs8v+EY8ELEgL75R0EL:/0mt30fqPqgRn9AbWs8v+EY8ELEgLMEL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629574698, "uuid": "9a1397b2-89c7-4dd9-9867-b3f0725d0488", "value": 2586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629574698, "uuid": "d1b4e85e-1d58-4591-864f-e9e1eb5b505a", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629574698, "uuid": "fde1f985-e7ef-458c-8971-fcf41a7ef4fd", "value": "postes.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b34dfed2-02bc-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629577002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629577002, "uuid": "8be3021b-180c-42fe-88a0-c4298486ffe2", "comment": "Malware payload", "value": "c3ebe3d5ca7275e30ef823b8cb3d918c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629577002, "uuid": "aa7b7e5d-b8f4-412a-a90e-20db0478afae", "comment": "Malware payload", "value": "eb521300b6ee49fdaad2d339f8389528bd676124d78b2490a238d8f439574635", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629577002, "uuid": "a964a484-29c3-460b-abae-cdbe42930b4d", "comment": "Malware payload", "value": "ebff14398d62ff79569da4c6f08f4b2fa20f1e6e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629577002, "uuid": "ca68597a-b3f0-47c7-ba07-582dff54d278", "comment": "Malware payload", "value": "56de86acf361c4f66952cceda19d8e3c7050ff81a0903780132b159ba89fb1a185558d809c1f483b2f1ee4d498ff6946", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629577002, "uuid": "b83690aa-8940-41cc-acbd-8c9d7da40fc6", "value": "T1F1B4D020B6E4C138E5F701F4597DA7AC292D7D706B2080CB63D62AEE66372E4DD30697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629577002, "uuid": "408f4dfd-9a09-4fea-9fb3-d6a026588a4f", "value": "0579ae0629fc2c520498364f1f007f60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629577002, "uuid": "666ed4cd-36fd-40a9-99d1-1a30d6022b28", "value": "12288:6gaHQrr2V/NhpxJa6dChWIpqm3itwdqlCmoLkAQziS7S7v:Zr6Vx+COWIqm3LsAjkAOOv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629577002, "uuid": "daac0c9d-ba0e-4acc-8013-451476a4e55c", "value": 536064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629577002, "uuid": "2f720e91-acf9-4530-9ae4-3b90db7ac5d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629577002, "uuid": "32830cc2-4552-431a-bdf6-f9298b6fcab7", "value": "c3ebe3d5ca7275e30ef823b8cb3d918c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d862aba-0295-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629559974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629559974, "uuid": "9409009d-eb15-459d-a579-55f9539c6934", "comment": "Malware payload (RedLineStealer)", "value": "96d3ef5ec108f2534df06d39ab70aac1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629559974, "uuid": "87c08717-c7b7-4821-969f-dc1ce854d0f8", "comment": "Malware payload (RedLineStealer)", "value": "ec3defba4407352ff580b14d9b88e34643db2c48dab859099693a636987d0abb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629559974, "uuid": "45e54ba1-177e-48f6-912b-f0abd2627f2c", "comment": "Malware payload (RedLineStealer)", "value": "c2aeb7e2d02fd3bd49c356551eca388243ad24bf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629559974, "uuid": "395037e3-bde7-4e75-9c6b-1dd00170d3fb", "comment": "Malware payload (RedLineStealer)", "value": "4aa1e19b59966bc39b1fe97f5f1b444bfbbb01edadf6b875cae5a8e9fce21c8c5311dfd1b18fc23a26d09cc6b1f03c4a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629559974, "uuid": "8355ef7b-71f0-4a24-b5b5-5e9c550e32af", "value": "T1FC74CF30B6A0C139E4F711F049ADA7BC69297DB06B2050CB73D626EE92376E4DD30697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629559974, "uuid": "0ee47f66-a62b-457d-b612-b91dd6c26c76", "value": "ad1c5bf15a899fcfef408e3485448e67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629559974, "uuid": "c8e258b6-59c2-40f4-b0ea-d03099f0a6f2", "value": "6144:I46rxyiaKocc45u7gW+dccaOtzFINcuyFO9uuvELcDb8juZzX:CxyiaTccp7Wdcca45IN3uiloqNX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629559974, "uuid": "6ec09cc6-d045-4457-bf26-6130b73fe2a5", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629559974, "uuid": "c3928d5e-973f-418d-a017-a2855e883609", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629559974, "uuid": "c9201537-d6b3-4fc8-a40d-3df511387b35", "value": "96d3ef5ec108f2534df06d39ab70aac1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8939dda-02b2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1629572770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629572770, "uuid": "1e222060-4aa4-4fd4-92a7-9663e0944f79", "comment": "Malware payload (ArkeiStealer)", "value": "86b31adc12f4b3279e5099e6c1169967", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629572770, "uuid": "b0e4d3e0-e116-4bf5-9320-551bff0b6a81", "comment": "Malware payload (ArkeiStealer)", "value": "ed2483bd5eecc185be7bce77dfaea0f2d7e4e525903d318786d502ece18ba83f", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629572770, "uuid": "79005c21-5da4-48e7-8729-f9d3a733fb4d", "comment": "Malware payload (ArkeiStealer)", "value": "3323e67f75243781e68645f638fd70bc74f26491", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629572770, "uuid": "877ae7e4-ab8b-423b-8ba5-18e3defeb434", "comment": "Malware payload (ArkeiStealer)", "value": "20472060cf59cd8211e51faac960f976ec7aa7a3a44c4779dba9ac72aaf9e8e575895f4c8bce68e28a983dbea500cc8a", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629572770, "uuid": "88142059-9581-4742-9b18-ccabd664d648", "value": "T1ABD4F020A6A0C035E5F711F459AEA3AC69397EB06B2040CB63D72AEE56376F0DD30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629572770, "uuid": "1531de84-36d1-491f-9b71-682f68f3435b", "value": "0579ae0629fc2c520498364f1f007f60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629572770, "uuid": "be36132e-1c77-434e-a655-57c149d27504", "value": "12288:5Bmu/LfZqwQWSgApRkVJxeLVptrvdqb44p8IRlbDfdxPv:ffIwxORLVzvdqb44rpDv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629572770, "uuid": "17abf0f4-2bcf-4dff-9355-855a01aebe65", "value": 620544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629572770, "uuid": "7b1e45b0-1bc0-4857-be00-01a7e2537e5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629572770, "uuid": "52833ac8-6af9-4c22-8dc3-6adfd2b0c082", "value": "eufive_20210821-175653(1)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee7f6e8a-02b7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629574954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629574954, "uuid": "779e64cb-147a-4f0a-aa80-ee55becae28f", "comment": "Malware payload (RedLineStealer)", "value": "a5fa9b2b71d7d7f7cb9c1440b4b90ec0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629574954, "uuid": "d0264b2d-e759-4517-b8e1-caddffadfc61", "comment": "Malware payload (RedLineStealer)", "value": "f209d0916ddfb26a18d236c030e4cead3691a07e2008964a12b36bf7262ad0d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629574954, "uuid": "911ea308-3b20-474b-a02d-cf7f7b328833", "comment": "Malware payload (RedLineStealer)", "value": "c44fbbf9ca8f6ab69a4f22e16370915174367c24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629574954, "uuid": "bd57d80f-123b-48ac-be3e-c91711e962d6", "comment": "Malware payload (RedLineStealer)", "value": "4d8706d21dd8dbf1f3a4bdf47970d67cdb2cf370f5f9210a1ae75f6c9ad581aafcc29d4bd14ecae533bacd1dfef7ad34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629574954, "uuid": "0c4e4520-343a-4797-a12a-e7e7efb69fbd", "value": "T1AD6559B3742D1EB5BBDA1C6790170C0F65B4AC33828FB614B7D46B27C84FE8CA855A16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629574954, "uuid": "7e228147-4a44-4528-b752-40929c9fea78", "value": "ffbb45b6f5c54321e555b15ab01a5aed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629574954, "uuid": "085fea46-b76a-42d1-8c94-e52f05a51d32", "value": "24576:agQf8jfctdh6JRDIDJAlPi3278v4ptKvfhvuY4FgIXJNbmPGZtWusXQXbyVVW/DK:pjfk4onOGNIpiWtHszM5tWKHZ2ngJwOY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629574954, "uuid": "6de519b5-77ba-410b-ad2e-9c7c676db66f", "value": 1474208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629574954, "uuid": "f6b58224-8bbe-44be-8242-389e1131a519", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629574954, "uuid": "03caa8df-bebb-46a5-a734-f0b680b87cbb", "value": "a5fa9b2b71d7d7f7cb9c1440b4b90ec0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c771181d-0214-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629504881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629504881, "uuid": "2f5deb74-6c14-4379-9894-2153c48d210d", "comment": "Malware payload (Mirai)", "value": "8e54a6b373b3d0bbb0e1af16b5696dcf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629504881, "uuid": "1d1ff856-7ac0-410c-98af-d438742d1021", "comment": "Malware payload (Mirai)", "value": "f55405c99903d8c57974ff591885e92ec43b55b871c793dcb126677a4b913f02", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629504881, "uuid": "db06d2d5-43fb-46a3-b7a1-13e70f0b443b", "comment": "Malware payload (Mirai)", "value": "9a27342d213d3d983590b72f466f99ce871282f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629504881, "uuid": "e6f97949-d98a-400c-abd9-a0fd152c6d2b", "comment": "Malware payload (Mirai)", "value": "da111a49fbd76a37bcab17821effcac0dbf76c62d44fc126becaad198844528df7fd762fe15df85fc7e8eeced35609a2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629504881, "uuid": "223174a5-26ca-4d16-9d3c-4c306d4a892b", "value": "T12364E18AEE01AE35E9C0167ABA5F034D73778BADD3C7B111F610C72936DA54A8F76084", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629504881, "uuid": "d75ff747-54ed-43e6-8e30-2a0ca39de84e", "value": "6144:p3lOYoaja8xzx/0wsxzSiBa77oNsKqqfPqOJ:p1CG/jsxzXBa/HKqoPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629504881, "uuid": "9b73a690-cc64-47bc-934e-de3bf9c6cf1b", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629504881, "uuid": "acaa17ae-fdac-407c-9447-4a946e7e173c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629504881, "uuid": "8a8ee2e6-be0a-49d6-a300-d7bc0bfef05c", "value": "8e54a6b373b3d0bbb0e1af16b5696dcf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e982299a-02d2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1629586542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629586542, "uuid": "0857798f-d7c6-433c-8f40-1cc53809cf4c", "comment": "Malware payload (BitRAT)", "value": "0c4c4edca67714e662299ff964cf7f64", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629586542, "uuid": "82c406d2-7019-41f6-8941-66a62ad5bade", "comment": "Malware payload (BitRAT)", "value": "f6b226170f5bd1be5091bdaf491e4c76575879be7545e83b6ba65df90385bec0", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629586542, "uuid": "7a11f854-f279-42c4-9056-69b18868f319", "comment": "Malware payload (BitRAT)", "value": "6522491af1b9e9949dab2c00df3c06135d0dfbd7", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629586542, "uuid": "e21a8784-4931-4671-b02e-e64f69fa30b7", "comment": "Malware payload (BitRAT)", "value": "25baf783cb9d13275fe97b0113acfb4981561d684d29d45c4e1ec38801c26c51c913a089a01210024e849a55985aeefe", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629586542, "uuid": "efa2b415-6ef6-4ff0-a194-814f8bc7b785", "value": "T15FF46D33F6C1713ED86335785C3FB770081F7A3B2959AAD259AA4F090F38A6175122A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629586542, "uuid": "8babe548-343a-4177-a395-942e8186cce7", "value": "6c9d1a5b45d1e2b88b5ba7e4ca7a253f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629586542, "uuid": "b6e75c3c-b37c-46b0-8129-dcd88e921c01", "value": "12288:RvaIM7GdxoDQc/Jz/LZZkvY5VcdbmRmOfCEmuV11b6nuf51Ifeo8Z5CnFx1An:AIs8aDQ6z/LTkAYdlubBvB0fez5CnL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629586542, "uuid": "7b466c37-40c0-481c-bde6-e8e5bcd1c447", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629586542, "uuid": "150338c5-2e5c-4513-b8be-962d3de90e44", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629586542, "uuid": "55fc4e75-4b6f-441d-9e5a-754f6807f9c2", "value": "from-isoATTACHED.EXE1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20c00328-0273-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Alien)", "timestamp": 1629545403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629545403, "uuid": "8d2a05b9-497c-4acc-9982-26e13280fc99", "comment": "Malware payload (Alien)", "value": "d8d350a851b553a6b02a952a0307b7eb", "object_relation": "md5", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629545403, "uuid": "f8e8e3cc-2616-4902-beed-97ac8208f7ea", "comment": "Malware payload (Alien)", "value": "f7a2065371c494fe901131fc41ecd11895f34f0ebf7bb41512b0972c92784dbe", "object_relation": "sha256", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629545403, "uuid": "95faed21-2073-4a02-82b2-ba10fafa19c7", "comment": "Malware payload (Alien)", "value": "8c3485192bb7bbaf00ba942097067de1696d7a97", "object_relation": "sha1", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629545403, "uuid": "4713e4b2-2d59-4f6b-9f2c-c97de6ea4383", "comment": "Malware payload (Alien)", "value": "c1b77f263ac6acba174d42fe81925eeebdb33c620e20ea27b639f92addc59b4b71aa2122c7701c18c82d85ec0abdb102", "object_relation": "sha3-384", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629545403, "uuid": "f9905fe2-ca64-4bf1-bd54-1e20daf15b8c", "value": "T151F5338EA7C5850ED93B57318043533337A8976C82C93D2E1426609474EBFA8DF1BEAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629545403, "uuid": "13c214ec-be1a-47bc-b07b-584ed6db97cf", "value": "49152:pBuGlUYQH6KLIjknS752gSytBS8BHTh+9fAeWFBe9tt/15OCewLVbUFJPGmkAprS:nfQHHu75PftbZSoeWF4ZNUf+mkA3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629545403, "uuid": "a39e0583-b49e-4948-a426-419bc18bcec3", "value": 3448503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629545403, "uuid": "21fe4c6d-ef9d-4e2f-af00-3bc678fe1c50", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629545403, "uuid": "f08f0f2d-2184-4ddb-b724-eee71e662d32", "value": "TURK_IFSA_VIDEOLARI.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cdbeb44-02c3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629579971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629579971, "uuid": "751dd6d8-804b-4925-b7dd-af9de39b4ba0", "comment": "Malware payload (RaccoonStealer)", "value": "fecf6d57ea185e830ac79e939b810b1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629579971, "uuid": "fb5b13da-3ae8-425c-aac6-0223b85adf63", "comment": "Malware payload (RaccoonStealer)", "value": "f8087ec5ac9908092bf0330cd1605b0ab37f2e29b17afb486a8c734e2ecf2c01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629579971, "uuid": "065c1dec-16b0-4975-955d-ea2eb7074ea4", "comment": "Malware payload (RaccoonStealer)", "value": "5bdab2a57adf1b000ca9f90dd4d305c5a0254814", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629579971, "uuid": "166789be-3afb-4f81-9569-58a02086159f", "comment": "Malware payload (RaccoonStealer)", "value": "7abc7b8b8ff130bc9f3337d4af447bb22bb8a466112f35265d403ec039084b1bfe34cebf8b6e5710bf0ea00edbb333cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629579971, "uuid": "e90f56c9-e4ca-4e87-b386-bda104e7cc7b", "value": "T1EDB4E02076A0C039E5F701F459BDA3AC682D7E712B2450CB63C62AEE56776E4ED30787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629579971, "uuid": "6a5e4e72-69ab-4f31-ab73-bc634c389c3c", "value": "0579ae0629fc2c520498364f1f007f60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629579971, "uuid": "65c678f4-ef72-4a84-9353-3246d276ebf5", "value": "12288:6JHNBbZdgZdXFvKxJO0qfcjRXsCS2E9HvdxeSpiGUscSiFL:qbng5ixJOlcjRXpWPxewhmL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629579971, "uuid": "2cd729f6-2bfa-48de-9564-a2c7e1ad8d4f", "value": 535040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629579971, "uuid": "ba6706aa-990e-4bb3-808a-a057a77037e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629579971, "uuid": "4541a610-1b40-4a6f-8d21-a9a2493c02f5", "value": "SecuriteInfo.com.W32.AIDetect.malware1.10263.5705", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0332be5a-02d2-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629586156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629586156, "uuid": "cf494063-aedb-48b7-8be6-577096936812", "comment": "Malware payload", "value": "a249b457c3b1d22040ca4e8d09039449", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629586156, "uuid": "eb48d17c-730a-46e1-b8ff-15e7928b6564", "comment": "Malware payload", "value": "fcecbcea7e3f8b8af9657b27aee80c44fc6bf24c2df563607925feca4e2fec38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629586156, "uuid": "c38810cc-d877-45fb-bec2-e0b19a02a26a", "comment": "Malware payload", "value": "fb07d5682336102f2f803467342d543954e0dc90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629586156, "uuid": "6334f73e-d967-4032-b791-08d5c3577724", "comment": "Malware payload", "value": "9f40938afd72caf37027912671379f4b616c6c4681b05aeb2efb2318d583bc6b180b9bb36eac75ffdffc04faffdccb2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629586156, "uuid": "a80dbe67-cca4-418d-99f6-4c52bec21b6e", "value": "T18515120B37E504B6E4B557B44AF2018726B2BD95AB3483DF175ED82E0E332A29277707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629586156, "uuid": "fbaedbe5-8d88-4fdc-b7db-1b6eea0ed399", "value": "013c74198fc6e42dcf33737d6c40c012", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629586156, "uuid": "760367fa-e3d0-4142-b8a6-202ca8056a5a", "value": "24576:nyLHuEU/Ve5SXJe8qXHgaKpr6gLUIpnK2ljS27vs:yLOgR3fgLPpyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629586156, "uuid": "c260b656-4169-4c92-91f6-ef079a2a555a", "value": 896809, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629586156, "uuid": "290c70f8-ea4c-480d-99d3-9261cef2f108", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629586156, "uuid": "d00fc2d2-b81f-4e93-b302-8b067c1e2e80", "value": "a249b457c3b1d22040ca4e8d09039449", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea1ff927-0253-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DiamondFox)", "timestamp": 1629531997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629531997, "uuid": "9498d238-5a3c-4d1d-90dd-44d96eca3031", "comment": "Malware payload (DiamondFox)", "value": "cb927513ff8ebff4dd52a47f7e42f934", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629531997, "uuid": "734089cd-6b09-4c5b-8293-70d395577895", "comment": "Malware payload (DiamondFox)", "value": "fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629531997, "uuid": "73f799fe-2aa5-4eb3-b7d9-a037c7c7fdb2", "comment": "Malware payload (DiamondFox)", "value": "0de47c02a8adc4940a6c18621b4e4a619641d029", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629531997, "uuid": "2eb2686f-773c-444f-9c22-bd8d688a8149", "comment": "Malware payload (DiamondFox)", "value": "9ae690717a61345d1ee2b1d291808c9b792d446afcc84eea75bc23e065e957365a4c0fe9a3360d483d733cdc2a7924c7", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629531997, "uuid": "2d8e2c5c-a989-4508-b412-80cae4da9d2f", "value": "T191D4493155A4F866F4A50CB8A1A6E3B698386F758AD78093F2B07B3F86313D17C24537", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629531997, "uuid": "1b3b6f33-7347-4580-bcfe-10b68fb07933", "value": "5e66d8d528d67d716d50d46578794396", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629531997, "uuid": "393981ed-b2bc-4963-8729-8fa7730c94ec", "value": "12288:0qtavSvIGmVujfIzEQlzlmgGak6H3lP3XJik0YhBhrj05:0qsVrYyl876j0KDrj05", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629531997, "uuid": "5b412068-0492-4a57-8f88-a81427fd180e", "value": 646144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629531997, "uuid": "207f6f15-d3c2-4734-b7c2-b9ff37859af4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629531997, "uuid": "b53b646b-7292-4d8c-99d1-0f9f7bb9ffa9", "value": "fortnitecheat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a4d4700-0278-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Alien)", "timestamp": 1629547540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629547540, "uuid": "17a9e21c-216d-4b39-a4e7-d1c2476407c9", "comment": "Malware payload (Alien)", "value": "30c89c2cb856d9ec5ea26ac8cf8084b0", "object_relation": "md5", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629547540, "uuid": "f6a90387-5c45-4d3a-8a9e-f4a8ec7fcb66", "comment": "Malware payload (Alien)", "value": "ffdf537102cad9f4b12795bde56c421e8d7a627e2939a56aff448ef04cdbe336", "object_relation": "sha256", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629547540, "uuid": "a26c8dc3-45d9-4fa3-9d60-566f989195b7", "comment": "Malware payload (Alien)", "value": "b3511c4845849455079ffaa9ea8d38310990229c", "object_relation": "sha1", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629547540, "uuid": "fa8944d3-f895-4f2e-bd0d-81cbadae87b4", "comment": "Malware payload (Alien)", "value": "d9cd059ea34a34daaa14fe0a105657d9291e0d490ee39f6ae9a5b521a29affcf835a3f2ec6d78a0d15278d4905b9dd9d", "object_relation": "sha3-384", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629547540, "uuid": "fd694379-8044-4811-a005-905af5c8336a", "value": "T155163347FBA490E2F3AB55B2160243537A390DE24541DC1F0563ACAA5D9BFA85F34CBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629547540, "uuid": "0955e47d-8c6f-4097-b30a-c75f15d637ec", "value": "98304:HsNwtuKRIDpiP+JEPLrq+lrjoTQS9505ISGOO+q8PAooJCxgTF:MNyQi1LuQR1NRvAj8gB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629547540, "uuid": "637d3654-2046-4613-aae6-a0215094f5cb", "value": 4082098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629547540, "uuid": "fe3c2672-adc0-4529-b696-71ef93c16dc1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629547540, "uuid": "6452e4b2-aa95-4308-8b38-236eeed1412e", "value": "Chrome995396.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }