{ "Event": { "published": true, "date": "2022-01-08", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-01-08", "timestamp": 1641686581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "18149f1f-a2bd-4424-9464-1f684d2724e3", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a973f60c-709c-11ec-9275-42010a9c0029", "comment": "Malware payload (OrcusRAT)", "timestamp": 1641657870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657870, "uuid": "bc3fc368-516a-4e1b-9180-e5bf20d3ddf8", "comment": "Malware payload (OrcusRAT)", "value": "50051672183c94eb34de4953132badcb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657870, "uuid": "4ae8eb5b-2fab-431d-8284-8abf03aee35e", "comment": "Malware payload (OrcusRAT)", "value": "030de3a6ac5f11501e8a9492846e393fc8be584f4dd68355bc54a70bb35ac4a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657870, "uuid": "eef736cb-e02e-4055-a838-43330a5d91bf", "comment": "Malware payload (OrcusRAT)", "value": "1a14af135927d66e3c5aeb694c6e4da28c1461b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657870, "uuid": "6d05123c-61f0-49ac-b806-5cc8fab50372", "comment": "Malware payload (OrcusRAT)", "value": "b6effe1f5b2f36572051a9c6050f7fa8f675ccf9bec33d7a288652b96de8f34efbed8185cc1427521022d2216ff661be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657870, "uuid": "82048cc7-1913-43f9-9400-6a32b08124c4", "value": "T13F93CFA56B9944CBC4D39976D89FC146CB70AF061101C67BB136BB84BF1B3E72748A0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657870, "uuid": "a4e9a2e1-99a1-404a-963e-fead0569f2cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657870, "uuid": "4466e828-5af0-4bac-abf5-a0d66a2e88a0", "value": "1536:r1peOOgU9OtuOsECrEerq1o1Gnvlyr+CwaMYONe+b3SFu1AFNGaX9cfo:v1OgU9FQqcoQntK+C7VieM3SFZNt9cfo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641657870, "uuid": "fec7bdce-86e1-458b-afd6-4fc5643f0741", "value": 92880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641657870, "uuid": "b09e2c55-f9d0-40d6-9e8b-a0ba789a62b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657870, "uuid": "ce864699-dc63-4678-bdaa-387131095d31", "value": "50051672183c94eb34de4953132badcb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ceda5d0-709b-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1641657258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657258, "uuid": "364ac54c-0367-408e-99dd-d390f8839a79", "comment": "Malware payload (RedLineStealer)", "value": "97e5bbcfeae7f50fa58f6da1ac4fdf8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657258, "uuid": "968bd529-e332-417a-900c-2998273eef8e", "comment": "Malware payload (RedLineStealer)", "value": "05990e0e6bd0c476cc1ff70c03a62114c146cae1b891b9c25a4c1e28d7416e65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657258, "uuid": "c993ad68-2da6-442e-b971-66d0072d4ce7", "comment": "Malware payload (RedLineStealer)", "value": "d64b8352694694ece020250723ac14490a4fc124", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657258, "uuid": "0ae6eb71-8434-4248-bb9c-eb8f4d9c89f5", "comment": "Malware payload (RedLineStealer)", "value": "c343868fb320c95e7016cf6074c76014c23b9f759a8bcf0e391cb882f6d8e9029e2cff7c52bba97d49ff48a270c33671", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657258, "uuid": "f4be7b08-ad0b-45eb-8866-fa2314a00cf1", "value": "T1452509DE91C15849CFEF07F01DFBE22E857292C613474BEA731E95F06B6208EA56D4A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657258, "uuid": "addf7af7-afeb-49e1-a711-82c2179683db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657258, "uuid": "dfc665b2-29b9-43c6-9ae9-7e6d9a8d274c", "value": "12288:RK0WaztfVnIchASXzti+AP3EZphNfropB7j5Ryg0scGKLaxBJ:fnvzXzti+APuhRAF0Jp+x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641657258, "uuid": "9e771262-9812-4372-9fa7-5c23b5d46661", "value": 999936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641657258, "uuid": "108c96ff-dbf1-41b9-bb80-0385524adca8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657258, "uuid": "b6304888-f486-4555-aac5-d90d4d882fac", "value": "97e5bbcfeae7f50fa58f6da1ac4fdf8c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09e4efcd-7057-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1641627967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627967, "uuid": "b5be74c2-fe42-4f06-8c11-39224331a5a8", "comment": "Malware payload (AsyncRAT)", "value": "b92db3df4726ca27d6ae536ed1497b69", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627967, "uuid": "eddc62a8-c79c-4699-8dee-3e0ad564a45f", "comment": "Malware payload (AsyncRAT)", "value": "07498877e79ec7e25b488ff9c1504d6a1eb3f51640dc91216b1713d73f518646", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627967, "uuid": "1dad7682-a5ba-439c-85cd-1fbed6e469e3", "comment": "Malware payload (AsyncRAT)", "value": "cf8b9f8c8552677a22813e035823da5ca316c3b5", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627967, "uuid": "4f2f98a5-10b6-4098-a188-2d19e4e4d686", "comment": "Malware payload (AsyncRAT)", "value": "e6ad714a744427d49c83f62f293bd866c0e74c3800d7d658472a622c19fa2e2b2f8303de01f4922bb6c3b94e5470b055", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627967, "uuid": "f385ff57-13a3-469d-ae61-d4ffddca5190", "value": "T13AC33C5231488AB7F2131CBA8C1ED2B215D76D64506AA51D71AE331F18F232253EFB6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627967, "uuid": "60743627-0526-4d6c-bd0f-40e9616e6753", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627967, "uuid": "b626be66-bade-447b-95ba-a6f89d187427", "value": "1536:zJrRk9/hMMCJ8sBp2wYG95AdtPKwl/rs:zNRk9S/jBp2hDPJljs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641627967, "uuid": "7bbe5172-74da-41b6-8c3a-3a9dba94f49a", "value": 120320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641627967, "uuid": "0b7831ab-4f3c-41ef-84cd-89de41d6e77d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627967, "uuid": "05683267-c58a-4cde-ae3c-01328e4e5ce9", "value": "b92db3df4726ca27d6ae536ed1497b69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e2b6156-70d7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641682976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641682976, "uuid": "96a1c105-e9bd-4066-826b-000dc586f830", "comment": "Malware payload", "value": "1663e8b6180030793b432b0829222536", "object_relation": "md5", "Tag": [ { "name": "Cerber2021", "colour": "#853B9E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641682976, "uuid": "e94795d3-ef4f-4ff7-99fd-3e0339a3c680", "comment": "Malware payload", "value": "078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7", "object_relation": "sha256", "Tag": [ { "name": "Cerber2021", "colour": "#853B9E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641682976, "uuid": "6186d5d7-6918-4081-9882-e379e332d745", "comment": "Malware payload", "value": "9751d0f4df34bdfa97b380dbf2f082d8171bb0d4", "object_relation": "sha1", "Tag": [ { "name": "Cerber2021", "colour": "#853B9E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641682976, "uuid": "d89ad43f-9402-474d-bf25-5b4b484e35fb", "comment": "Malware payload", "value": "3f5a88d4fdb2396783c656d50d3acf9f722eb772bdba233708e705a7fc7fc6c2f7c6ff1c3c62663c1b23a2100584b3ea", "object_relation": "sha3-384", "Tag": [ { "name": "Cerber2021", "colour": "#853B9E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641682976, "uuid": "7a32d122-c0d5-42e4-87ba-7bcedfeb7219", "value": "T13DF49D32B7D3E273DA5224F04D6D664E6439F4260B255BE7F7D80B2E8E305D10E316AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641682976, "uuid": "117457cc-cc52-4e03-be95-639f52b78c98", "value": "7356353e737f66f09abf3c6b64e34146", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641682976, "uuid": "b39cac14-c9cc-43b5-abe5-c79d37ea59cc", "value": "12288:7tG9VAdkXKy900ZW9Fiwv+OeO+OeNhBBhhBBNaJqE6/Ix0fpL0qZ+WJEglNsTVZF:c9unCaJq5AafpL9+JsWF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641682976, "uuid": "f71045a4-3f28-4892-b59f-5f6b4ae48db5", "value": 772096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641682976, "uuid": "5881812f-095d-4ba9-9da9-3a6f37cafd9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641682976, "uuid": "3c9d1dd6-15e6-4d2e-a29e-d4591aa4d71c", "value": "078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c6739e6-7079-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1641642654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641642654, "uuid": "076d964e-59bd-4e8b-bd32-51b179ff4142", "comment": "Malware payload (NanoCore)", "value": "f2e19acb32d6b46f98239761d4ad880f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641642654, "uuid": "04112689-87b4-4c5c-8a30-8603aef35744", "comment": "Malware payload (NanoCore)", "value": "09efb455bb0ce60c3e25c3d2179b7494a69efdee0507cc96a46e1bc838d60041", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641642654, "uuid": "5a005710-5e07-4d37-a31a-8dfa9c991846", "comment": "Malware payload (NanoCore)", "value": "925cb5fa35251e11388f6a85246b34b90c883d9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641642654, "uuid": "01f65205-66c5-4b30-b6a5-f951813b3f80", "comment": "Malware payload (NanoCore)", "value": "83f466d36291a0a275af3a3b98efa483b056fd98c50e9cb5d635fdd8370c8244646e90787b8cf79556e3f1ccaa5036ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641642654, "uuid": "bbecfec1-a836-4332-8009-b938136a24ad", "value": "T11BF3CF587FE98922D7EF0AFD5076628903B8F273EA53D71F04E460BB18127D58A1139B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641642654, "uuid": "f57dfcf3-2e19-4d1e-a40d-77d3ddfe13b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641642654, "uuid": "cfbef1f3-f9b8-4f66-b6eb-c5fa868d10a8", "value": "3072:WJEZzJZ5WY+apEbTmFxjpcJslEjqZ4UHtbrOA5qlcGgZB/jVTCuWCqRj2Ojpx3tV:nZT5TbjiJslEjqZ4UHtb35q+HjVCuSjz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641642654, "uuid": "74b986ac-9469-4fa3-b6f1-2041790b478c", "value": 160768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641642654, "uuid": "634380fa-4b7f-4d94-9542-d603673b9ddd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641642654, "uuid": "e092d52f-3d07-419c-b8c6-7438c2288ec9", "value": "09EFB455BB0CE60C3E25C3D2179B7494A69EFDEE0507C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1b89272-7072-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1641639952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641639952, "uuid": "8894a752-9246-4f3d-8497-8127ffebf9d1", "comment": "Malware payload (AsyncRAT)", "value": "0053654b6c297d57ae94eb7f99dd2f60", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641639952, "uuid": "17957018-e226-4bae-abb5-8e62835ea515", "comment": "Malware payload (AsyncRAT)", "value": "0ce84fae6db12f20d7077e243fa0162ab40e4f65379a9266e967ea65f42810e4", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641639952, "uuid": "27ff9484-e77b-4dd5-ae99-6d9a74370bd4", "comment": "Malware payload (AsyncRAT)", "value": "3f9a9c3d947174638252c008d91452f3df49c652", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641639952, "uuid": "dd0b8fc1-adab-4558-a39b-81572f53af5f", "comment": "Malware payload (AsyncRAT)", "value": "575e6875c6c7f58da9c3d7324c8f5a3dd3e48390c56e5dabf4ef9f335f32d791bb415ba401bbf3c69a91e668a4a2d52e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641639952, "uuid": "22e3a538-b810-41e4-8572-fa7cbaf32e61", "value": "T173B31D5331448ABBF2131CBA4C1ED2B21497AD64506AA51D75AA371F18F232213FFB6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641639952, "uuid": "fd328593-5dc4-43bb-96d4-c898d307c87c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641639952, "uuid": "d30ffc36-e759-4785-a169-bbe8791359ea", "value": "1536:3ENkb3gO+baCJ8sBp2wYGq5Ad/PKwoKrF:3EZO+b5jBp2elPJoSF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641639952, "uuid": "55b7ad7b-0dcf-46a0-992e-858db934751e", "value": 110080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641639952, "uuid": "338425bd-66da-4e13-ac82-0dee4eecda2b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641639952, "uuid": "b8685df5-7a09-4034-8558-578686e94617", "value": "0053654b6c297d57ae94eb7f99dd2f60.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6c2a0c4-70ba-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641670857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641670857, "uuid": "23f1a568-a3b8-4af6-b9a7-3bfe63eadbdf", "comment": "Malware payload", "value": "c850ac294227106597e1db44843160ba", "object_relation": "md5", "Tag": [ { "name": "JavaScriptWebShell", "colour": "#B97185", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641670857, "uuid": "4fcc2ae2-3de0-4feb-a64c-70b72801fe56", "comment": "Malware payload", "value": "0d543f51da0bb39eb85c890d3fdf628d18ec5b58630950160569ddfb5819dc08", "object_relation": "sha256", "Tag": [ { "name": "JavaScriptWebShell", "colour": "#B97185", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641670857, "uuid": "273e8fba-7cfb-41ec-9644-06b016e0ec44", "comment": "Malware payload", "value": "9eb6ba2ea035b6aa3308f0a7d91fcd14097797bf", "object_relation": "sha1", "Tag": [ { "name": "JavaScriptWebShell", "colour": "#B97185", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641670857, "uuid": "0a7c435d-b67f-4b70-b47f-3f509a32db7c", "comment": "Malware payload", "value": "a77acac025d11a9116391fe9c0b1f031009fbe6d9082d0a775c3feb371a167c8876be6a334461a0a6ba73ebaf2dcf941", "object_relation": "sha3-384", "Tag": [ { "name": "JavaScriptWebShell", "colour": "#B97185", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641670857, "uuid": "7b52fe14-adf0-4e27-9ad4-a410281830ac", "value": "T1ABA1FC49331C165A657053B84173F089ADBDDA708324887BBE85DE0AFAA0282D737FD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641670857, "uuid": "a184b03a-cfc0-41ae-a2b9-1bb74fedeb66", "value": "96:Q6ZnimRVoFVyTBmCWNkQHvv57A9776Vc3W54LJk+PNFk3qg4+oHOFX:QwRVoAV+ANunLX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641670857, "uuid": "f459c95d-dffa-4955-b4b7-366a1ac42db1", "value": 4940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641670857, "uuid": "2fc4a980-fcd8-4f4e-a785-89c7e5d8d071", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641670857, "uuid": "d2a35446-c1df-4ae3-a9dd-3e753aba6be5", "value": "MggwptZT.dec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ad6cc9e-7054-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1641626707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641626707, "uuid": "a082dbe3-c8ef-4d5c-a44a-a2c43ef836df", "comment": "Malware payload (RedLineStealer)", "value": "5ef4bd936dc436fc754fcd3ca9be2fe3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641626707, "uuid": "0182b69e-26b9-4e9d-b234-fb7f9c6076d0", "comment": "Malware payload (RedLineStealer)", "value": "0f78d260bc75a1ed048e436b51c5de0dde22a79c75039c0fc345eb785dc72c59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641626707, "uuid": "27f87237-a573-4d17-ae03-2c75c9535954", "comment": "Malware payload (RedLineStealer)", "value": "3a8c85377aacae66b5d83ac8875962d8cffcb921", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641626707, "uuid": "d2dd4a1b-d6db-48ff-a3f4-39392d2b79d5", "comment": "Malware payload (RedLineStealer)", "value": "c098b5e7613e0bce29c4319eef46d3cf8e81dd6ad2b0e4978e29c411956a9fbdd241d082ea36a834b2fa594af64cff89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641626707, "uuid": "dce775b6-00ed-4c81-a3bd-e173af6afc96", "value": "T16E35E9DD51D59849CDEE27F00DFBA89CAD7094C9938773EAA32C95F0AB423C2654D4E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641626707, "uuid": "d1175773-d8b6-4887-b3d7-cf3ab814f6a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641626707, "uuid": "4eb288cf-ba87-43a2-8d70-248e9d04a27c", "value": "12288:WTTlVn2iFe97SeF9iWnN/feE86TJBYbgqvF7QGiEuWShQ+EUbWywgj:LSeSY/fTJB9u+G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641626707, "uuid": "b7efdf1f-25eb-4763-89eb-06310ba4b3cf", "value": 1117064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641626707, "uuid": "92549cb1-134e-4d5d-aa1e-b0a4dcfd3295", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641626707, "uuid": "2a582946-f3bf-4fc9-a91d-50bb0bf72098", "value": "Genshin FREE Cheat v 2.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "764f83a5-7056-11ec-9275-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1641627719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627719, "uuid": "76f81a98-6b0f-4388-999c-80095bc5f346", "comment": "Malware payload (Vjw0rm)", "value": "3cf58910eb5201dac3201d875f399c31", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627719, "uuid": "ac92a6fe-ae0b-43ee-90ad-32239aa46084", "comment": "Malware payload (Vjw0rm)", "value": "117c5cf0e27bf23b55685767432ab6d2819a52c91423ed0eb74c221d96b6ce98", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627719, "uuid": "253c1d3c-5463-4d74-a277-e7b1f24b1af6", "comment": "Malware payload (Vjw0rm)", "value": "6ececbecf3d424663818288c69882037ab261347", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627719, "uuid": "c4936ffc-f361-4c65-9c0c-16fe9ed6b51f", "comment": "Malware payload (Vjw0rm)", "value": "4996a72b7a11b48d72ec3d1bf55eb9e0ef78cd78d9dfd0ae1018618404db049dd203319b2ee23ed35a00ab0d69907445", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627719, "uuid": "39649139-1f8e-4eae-b0db-e6510401c9a9", "value": "T1A02474499C61E0B9D63CD120B9793AD983B1A24FD451ABCE751DB348EBB7B00D3E8079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627719, "uuid": "7fdd4dc6-84d5-4b70-aa1a-5ab5061c40ba", "value": "3072:jhmSuv9aoFQYiKBtyg2WUkXBH+L/hedy+bDzGnZTs4RpjlwEL6+xH225dHIkqQ:8DC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641627719, "uuid": "722f4462-ce70-49a3-a10c-00b3576ee999", "value": 223178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641627719, "uuid": "f040564b-e672-4302-bbe0-7d5359ae864f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627719, "uuid": "ded80de2-28c3-4db5-8fa1-19c8f49a79d0", "value": "receipt_ups.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c474c7f0-709b-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1641657485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657485, "uuid": "b086dfdf-afa4-4901-b921-e882cc225aee", "comment": "Malware payload (RedLineStealer)", "value": "20a4fb50d23656551638133aa3cb49dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657485, "uuid": "2504be57-ade4-44ad-83c9-f8d688990735", "comment": "Malware payload (RedLineStealer)", "value": "123f3e76c54fff0e2b50c7a5501b5d531ad16c6eebe301d52a72ba6f7d4efd8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657485, "uuid": "ebff6d8e-8609-46f6-b084-d4afd552fed3", "comment": "Malware payload (RedLineStealer)", "value": "ff9244910d8184324386fdb7ad30d6c6153b49ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657485, "uuid": "44ebc796-df7c-4127-8f91-9ef679958a4a", "comment": "Malware payload (RedLineStealer)", "value": "8512435e01a6b6f4f8d88461785660b34b5b28187e4aa4a09c2e9eba73712b38b8cfa2410626b5524d010daf17b8f6e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657485, "uuid": "6105e0a8-23ef-4e34-909d-aacd2ec86655", "value": "T181E41211F693D431DAA764718D35D3A01F3BBE231A75818FB36897DE4F232916A213B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657485, "uuid": "fe948b8f-2944-4c93-9d01-6400f009f3f9", "value": "3f07075ef838296be9ff2ad3cf3a6bc2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657485, "uuid": "075f2c5e-3824-49f4-8b3d-7969763aa1b8", "value": "12288:KpqonTAID7csnra7LkXNNhgzc/TDwYzR2OInyt1ODPRqn:KBTXDaHkdIzc//Rzt8e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641657485, "uuid": "3b572e95-6935-4e6d-8c3e-82b171fca828", "value": 680960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641657485, "uuid": "c73e2d6d-c17e-4d11-82aa-4c8a0056a3a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657485, "uuid": "ffcb90fb-70f8-4138-b3d4-8039e7c4ea0e", "value": "20a4fb50d23656551638133aa3cb49dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0a2c33b-7069-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641636004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641636004, "uuid": "38a623a9-6586-48f9-89f2-3e7fff258549", "comment": "Malware payload", "value": "261921653b2c4f0d5c6254fb00b27da0", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641636004, "uuid": "bf10be42-760b-4b35-a61b-3b4e0eab3e81", "comment": "Malware payload", "value": "17ad74753159b805aa0d474d04afc1226c55114a2836529aa9f85241deabaac1", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641636004, "uuid": "74f84555-159d-4754-a22e-9331862c37eb", "comment": "Malware payload", "value": "56bff4720fd9d680ab124542fb11d109e95c2a4e", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641636004, "uuid": "d8d7b89c-d1a4-482f-abae-0929877138b3", "comment": "Malware payload", "value": "4d2700b00a90c0d9cade7c0b74015aefb24929f44b05118051ce50d5acebaa5015ea5775b5e1c3feff18236c73bc53ad", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641636004, "uuid": "77b5ac45-9441-4eda-a0b2-8759973fcca5", "value": "T111A5330853B979ECFD9F06292B538DD0C2EDB2F0F54061A2A2545CA85D3F1BE039F966", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641636004, "uuid": "83776ee9-6fe4-4d61-a90e-9d6216ca2cdc", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25Lfn:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641636004, "uuid": "67da3652-c9cd-47be-9580-c97a025f3d67", "value": 2101248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641636004, "uuid": "a0969e1b-26dd-438b-9f68-3d43b49ce1e5", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641636004, "uuid": "60962bf9-214e-435a-8032-d8d7346757d7", "value": "17ad74753159b805aa0d474d04afc1226c55114a2836529aa9f85241deabaac1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fc14fe3-709c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641657853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657853, "uuid": "ab81018c-a9ca-41d2-945a-347dcf4be006", "comment": "Malware payload", "value": "823f8d998af26ec465d0617f6f185d48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657853, "uuid": "658a2275-70d8-4d14-81e6-ea5c130cb37e", "comment": "Malware payload", "value": "19a09526a8fb21c9f6d9f17c0c00c6d26f3f5026797c1ae9ba96535d7df67941", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657853, "uuid": "4d251612-07a9-4635-bfbe-2bbce50f1822", "comment": "Malware payload", "value": "9a21ab268eecf42bbba4d5a5b9c0d2ab002deaf7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657853, "uuid": "12f79f9a-4f70-4a27-8b01-3bb23d74ecdc", "comment": "Malware payload", "value": "231e01aa21b817d54a8fb089e64beee344c2f8094f904a5d3951a1fce8d2d4313fccd14bb41c6815de1e7887ce2d8457", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657853, "uuid": "d4ded0f9-844e-43db-bf45-be5ffa7e565c", "value": "T15F651836FABB8A42C29C5B36C5E9240E87F0EC45A617D71B65AD23651CD3FA64C0360F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657853, "uuid": "89e797d9-2798-4889-86be-8ce54cc81a12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657853, "uuid": "f02abfe8-8983-4c11-8581-18442ece8d67", "value": "24576:6oeJ6j35LgHxPY2Q1GDkhTPPAw8XQLmYezg4TVEN2:66WHxA2Q1GDklPPeXQLmZM2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641657853, "uuid": "4ce2340d-06a2-4e4b-81f5-0190600505bd", "value": 1506304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641657853, "uuid": "a74373f4-32a1-45e3-a1fe-a00480dee285", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657853, "uuid": "2d2437d3-9c85-4004-a19f-8fba8985ce1a", "value": "823f8d998af26ec465d0617f6f185d48.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd3e22c2-7058-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641628804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641628804, "uuid": "9cde0e93-d284-4015-ac6b-81172b0defae", "comment": "Malware payload", "value": "67201654fc5a8609216aac21dc53ea33", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641628804, "uuid": "bb78c1c4-5b83-485f-bd6b-2f781650ad50", "comment": "Malware payload", "value": "1a1d7857ef51676eb06afde4e18a2d2aaadcf64323ef2c8b112ca2f3e24d3af5", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641628804, "uuid": "932eb48b-fe00-47c2-a4eb-e9eae6ba506f", "comment": "Malware payload", "value": "e785d3399139b228a8d7ef16c9194f09a9f78eba", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641628804, "uuid": "0b5ae8a8-ee7e-40d2-b9d5-0c653b98e67f", "comment": "Malware payload", "value": "c485a07e1f5a95c23ca16c82ad13a63c77e726b43e8bea65f9a8c832e858d8fd48c6c2a3991734d80c45da47ae48a5b7", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641628804, "uuid": "8642995a-1227-4506-9ee6-b7d92541e6bf", "value": "T1B675330822B97CD8F5AF162D37524CD4C3BD32F1E441B49676881CA62A672FD039EDB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641628804, "uuid": "eabf2965-c3dc-45de-9e62-17aa9935ad08", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8R:IDSTOhnXSI0Wk5jG2nfBtkR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641628804, "uuid": "0041282a-5e0f-4d80-9bcd-2d4638107341", "value": 1654784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641628804, "uuid": "53d3f69f-9e80-46e6-8800-b0f24e247336", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641628804, "uuid": "b04e651d-9961-444f-8cf0-9f2bf4a6cdc0", "value": "1a1d7857ef51676eb06afde4e18a2d2aaadcf64323ef2c8b112ca2f3e24d3af5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a22d3a5-7050-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1641625175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641625175, "uuid": "edb99516-2b80-4c39-82c4-0717d398f100", "comment": "Malware payload (RedLineStealer)", "value": "e1573e67664715db6fe842de15b44ece", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641625175, "uuid": "1a719ef2-54df-456c-9285-41dfdb8ad00b", "comment": "Malware payload (RedLineStealer)", "value": "1b7e034dcef7122ca791a5da14c588922d67cf81f33c6d1e281d54df46a11bc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641625175, "uuid": "51a6c644-8584-48ad-b4c1-60c078bd0ab6", "comment": "Malware payload (RedLineStealer)", "value": "a3b6fff6ce083594aaf50a540c56f0a251b459fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641625175, "uuid": "95a79976-f018-4229-9ef4-24cfbed5aee0", "comment": "Malware payload (RedLineStealer)", "value": "784a41df446e083b6ee0deb06ab435f27ae5f3b553cf494581fe6cd511d481488d6d6ba1938ff34eee4eefced3051ea0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641625175, "uuid": "c0aa163a-56e0-4434-bdb8-21685fae7d2b", "value": "T1B2F5334960113E7CC17ACEF6AA0B2FFAFAF893251BDE8607D41C6697830544BD71B858", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641625175, "uuid": "36756287-fe4f-46a1-96b3-8a7e5dd615b1", "value": "c284fa365c4442728ac859c0f9ed4dc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641625175, "uuid": "7a7a4386-2f2e-49ea-9a5e-c977889256f0", "value": "49152:YAqg1ixg7ftpEyZwdughemrKDzSxZ2WpjrktwMWDLZ1RhY2G2NyVeAudNvwU8ceV:BO0tp1ecVzcl44bY2G2NCy+DceGCR0s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641625175, "uuid": "cbb5598a-dfac-40fb-bb5a-5803f070481e", "value": 3563008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641625175, "uuid": "1d920ed8-5aaf-4e54-96d3-79ce77f7a794", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641625175, "uuid": "2ee307c2-bbbd-4a3d-9e36-24e9becb0d24", "value": "GenshinXYZ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c309266-70ce-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641679322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641679322, "uuid": "b4346f37-3396-4c11-88b5-ab2e4e5d549b", "comment": "Malware payload", "value": "4403836ac9af55e0dc0300cc58a3355c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641679322, "uuid": "b96e0783-4243-486c-b3cf-8404dccd1145", "comment": "Malware payload", "value": "1bb3ac10b2cdd0a1edb3c730f766cb48e8173dbccea04a9afe44f3aef1060682", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641679322, "uuid": "3f8ed77b-c75f-404c-aed0-0ea3d1aadc6f", "comment": "Malware payload", "value": "e8a82a7a115a5805ff6a578bf7b1c2e84a426787", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641679322, "uuid": "a67cdb4b-da8a-4a65-8328-dddae6e25357", "comment": "Malware payload", "value": "b02c95fe2239b9a52ab3837f7d38cc53111413ae64411c1e8fedff13a7ce2b5d1e340526ce38e4e16d5e5dcec5ae2f8f", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641679322, "uuid": "8e7d82db-5280-4448-ad00-aadd06b41cb8", "value": "T172C52347BBD5E843C5E3D1310A6381A3553A8E9B86A26E17374D3A283F736E05F1B9C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641679322, "uuid": "8702c3b8-4d6f-4c6c-a01d-36e248d81e87", "value": "49152:rNHeovqSJvJJHsIsk0MXcjmInGb8d0Bg+GYHCUdHOLiz/+X:rN+ovqSJv7sjk0bjmInGb8NHYHCUdHOX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641679322, "uuid": "4539f2c6-6324-41d8-bd22-f36031060fa4", "value": 2620950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641679322, "uuid": "fd07caf6-aa65-4c65-b55a-a22af5467bd3", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641679322, "uuid": "4a1b715d-6bb6-4243-94ef-2bb7d772ac9c", "value": "90621_Video_Oynat\u0131c\u0131.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27f93fa2-7053-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1641626299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641626299, "uuid": "57762f8b-2229-42c7-8109-f268c78713a8", "comment": "Malware payload (RedLineStealer)", "value": "6bbc45ff17d2ad2c1534c16d5828c0f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641626299, "uuid": "5785e702-9bb1-4219-ba04-f6e2a90563f5", "comment": "Malware payload (RedLineStealer)", "value": "1cc61c7837ace8ee2f52731a3d78e69a3b2b84b136bcc38bddfc67c57d38b025", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641626299, "uuid": "944eabc6-f8ca-46d3-9b30-5e047c260891", "comment": "Malware payload (RedLineStealer)", "value": "0b7c1582cf5071b5061e67345563a39d5ec9b5cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641626299, "uuid": "a8c3d0e1-76da-4a0a-94d7-5b06fae93a3f", "comment": "Malware payload (RedLineStealer)", "value": "c34f20a2c0b1b70e5189d4a80ce0cf1535f7f55ce4f3a6f27b73af20a93efc9f3176a564c6feddfacd102930b713c3c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641626299, "uuid": "d3449016-a630-4a07-8d98-1df2486ea793", "value": "T14435F8DD51C15849CFEF03F00DFBE22E857296CA13475BEA731E95F0AB2208EA56D4A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641626299, "uuid": "72e73937-c4f7-46e2-acf5-945605888632", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641626299, "uuid": "f26eae37-7b02-4ddf-90ff-8daa651425db", "value": "12288:BiZp9xwDLgqjTwQLhhU9Z7ti83XoLUd/lZyO/fNMLRKsP:6WUAvU9ZBmLUjZLbs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641626299, "uuid": "7d9b1f40-df99-4d31-82bc-cc879719a8b2", "value": 1132032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641626299, "uuid": "4980f20c-e81d-4815-80e3-2296a4fc0bcc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641626299, "uuid": "2cd3dba3-0db7-4981-a64c-69d188985aae", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af0969a8-70d2-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641681072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641681072, "uuid": "8f6181ed-7303-4780-be7d-daa97a1c9f5b", "comment": "Malware payload (Mirai)", "value": "4efd911aed40160101551beae9ad2686", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641681072, "uuid": "93a4db58-ed25-45cf-ab53-cfb0af3b8755", "comment": "Malware payload (Mirai)", "value": "1d7481540299c45867e899a8e6cf6dbd879f4a3a024b2ae577409067a94d48c0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641681072, "uuid": "3576fcef-6a9b-4403-aa10-a16b3c65cc60", "comment": "Malware payload (Mirai)", "value": "cc9f355b7b05223d8bb2f7731b4c37bcd674a448", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641681072, "uuid": "b952d30e-5b18-425e-8705-33f217c41f30", "comment": "Malware payload (Mirai)", "value": "561ac2b89499ed031bf80cdd7cd61c88ce95904de1bc1af13608ac3f458d3c0cb7bdfdb43dfa17f957e8ed417e37c7d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641681072, "uuid": "791c37e6-6bec-4c85-8692-997c9dd8c62e", "value": "T1DB1302A261738A50D2A00937F574D8CF192B5BB455A7B44322E4DF1CA6E90A7C2FF8C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641681072, "uuid": "2b5b6ccc-e531-4fca-857d-323ac71edc14", "value": "768:xUVpEA/atEBfl+WuKfNgg2BUGyrRoool03VgGt4jyRzlWt72Q8xNhE9q3UELlm:xUVpE0ay5JuKfNgggNyr7uCuA4u5lWMA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641681072, "uuid": "f2d19532-bc78-419d-b694-06425b93e600", "value": 41544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641681072, "uuid": "2577b4c0-b641-4ce6-8480-2a34c7916df0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641681072, "uuid": "1063a1e9-48cb-4bbc-87c3-808187277b2f", "value": "4efd911aed40160101551beae9ad2686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2f63fd2-7069-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641636008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641636008, "uuid": "76f732c2-7dae-49ea-b8ed-f407e28ac35d", "comment": "Malware payload", "value": "d8c2ebcb677dc1deeefb04cbe46326a5", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641636008, "uuid": "5c69ddf5-5940-4173-bf02-8d8784ed9c43", "comment": "Malware payload", "value": "1f5352c55b80d988faf75d1418926b865dc9b653b7178c8898feb07c39a22039", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641636008, "uuid": "76e77ee4-02c5-447c-adae-9ffd05b0b551", "comment": "Malware payload", "value": "6854e94483b635b049407738d42922cbaff01282", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641636008, "uuid": "025af8c4-72a7-4c9d-80df-932158f2b4b6", "comment": "Malware payload", "value": "76ef8c70be2cec766c25cc9b40a84b99733f87858ec5ee92b864a199f4be22b80a7e85f8957b6f11bc90b20c2a3a0e8c", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641636008, "uuid": "7925deed-8f44-4b8b-82a9-2917c3a85f45", "value": "T10285330C21BD7CDCF9AE022D3B7289D0C2ED72E1E441A09676595CA55E3B1FE038F969", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641636008, "uuid": "b3be6b43-b79d-4204-93fb-ae13930a6b4c", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytb:IDSTOhnXSI0Wk5jG2nfBtkaeytb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641636008, "uuid": "0860cdd2-0fd0-4e10-8a96-be54838dbfbf", "value": 1851392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641636008, "uuid": "1099c172-daac-4c6f-a49f-be6e3f0a8b5d", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641636008, "uuid": "4e44c1e6-c63d-4f1f-9489-4a4da7b3c2d3", "value": "1f5352c55b80d988faf75d1418926b865dc9b653b7178c8898feb07c39a22039", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17e661e1-7089-11ec-9275-42010a9c0029", "comment": "Malware payload (NightSky)", "timestamp": 1641649465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641649465, "uuid": "ded6b3cb-7305-4917-b3bb-466feff09af9", "comment": "Malware payload (NightSky)", "value": "f9481915373852640150ffe98e7218ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NightSky", "colour": "#B05DAF", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641649465, "uuid": "0e7088c9-1dda-49da-88f5-f4731131a755", "comment": "Malware payload (NightSky)", "value": "1fca1cd04992e0fcaa714d9dfa97323d81d7e3d43a024ec37d1c7a2767a17577", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NightSky", "colour": "#B05DAF", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641649465, "uuid": "831d686f-1e3b-40a1-9056-784211ac086a", "comment": "Malware payload (NightSky)", "value": "682fa27b596bab8fc5b7f2a0c002447e6e2f1f6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NightSky", "colour": "#B05DAF", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641649465, "uuid": "b3f16d65-692b-4862-acd9-e7d1faaab149", "comment": "Malware payload (NightSky)", "value": "628e432b595daefa3b964c356c9d580a90d421fb28b50ce4f268796c2dcef789661678f9ab65ce07311230bb87514c23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NightSky", "colour": "#B05DAF", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641649465, "uuid": "97f0f37f-f5ab-4e6c-bf33-4de1dec231b4", "value": "T1E5A612FE61583268C41EC9349423AE49B1F6641907B996DFB5EBBBC02F6B8D0D631F01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641649465, "uuid": "685f67b9-6d9f-4400-9360-2e5f7086830b", "value": "385281fb8c3ae6c79cc58d91e9de2e21", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641649465, "uuid": "4c922c13-2599-4dd1-912e-8b31ae08137c", "value": "98304:m39m4olnLynE2TIx7cEsnRIiTgQQwfZtqifsjEiwkA+DUg47V6pH/LZAtpla02dC:m39GlmjTzEsKmBttRiA+4GJtAZa088V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641649465, "uuid": "ff700613-b609-432b-a252-876b39b29ff9", "value": 9768448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641649465, "uuid": "72011404-65ae-4ffe-b641-908eef303ba1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641649465, "uuid": "f76d9a27-3a66-4a23-bcc3-35be3a44deaa", "value": "1fca1cd04992e0fcaa714d9dfa97323d81d7e3d43a024ec37d1c7a2767a17577.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eb5149a-7061-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641632404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632404, "uuid": "d5988080-bedc-4551-934b-878a09aa3223", "comment": "Malware payload", "value": "462eb1b41491e460ca7db94ee2c10b80", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632404, "uuid": "a4b89f80-895c-451d-815e-ccb843161714", "comment": "Malware payload", "value": "26d4a589f27e084d390bee869dacfb623412646dfdb8e86e3e3535e492cf52d2", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632404, "uuid": "6da30e84-1364-4510-8f65-4cc62f45807f", "comment": "Malware payload", "value": "547f643a675d51e110eca4f9e0f825a416bc4df0", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632404, "uuid": "fbaa1328-3486-4836-9c0d-dc0f36c50e06", "comment": "Malware payload", "value": "257df2fede4eaaef35cd1920f5834505542ae188db58337a27cd5590c42ad7e94ee7e3ba73f06f8e8eaaa82f4eebfc57", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641632404, "uuid": "c76ee63f-13f4-431e-ab16-d42f5be15546", "value": "T1AD95330C62BD78ECF99E422D3B7289D0C2ED72E1E441A192B6545C686D3F1FE038F965", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641632404, "uuid": "3e16e033-d739-49ea-998b-496924cea8fd", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdWq:IDSTOhnXSI0Wk5jG2nfBtkaeytFON", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641632404, "uuid": "0e2f2fdd-0624-47db-b6fa-bb091de8b375", "value": 1921024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641632404, "uuid": "a7d091d8-654d-4206-b3fa-850cefb8d24b", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641632404, "uuid": "3b394b56-e94e-4d3f-9454-c4f08674a8be", "value": "26d4a589f27e084d390bee869dacfb623412646dfdb8e86e3e3535e492cf52d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2196e4cf-7056-11ec-9275-42010a9c0029", "comment": "Malware payload (Socelars)", "timestamp": 1641627577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627577, "uuid": "35453b12-6318-4797-a677-06c1e8b3f383", "comment": "Malware payload (Socelars)", "value": "0a4f4bf838b9cae5a6b2b0f01b18914e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627577, "uuid": "871ee91f-6356-480d-a939-f361003772ab", "comment": "Malware payload (Socelars)", "value": "2abb3bf4ad3fa656c81d72c7b7881bc7800465f132ef5ec598955324e5157857", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627577, "uuid": "c0e7ab77-64af-486e-b638-96f86ce956e1", "comment": "Malware payload (Socelars)", "value": "c4aed46eb0072584d5fdeff3e924793925761385", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627577, "uuid": "6cb3753a-7282-4b06-9bd3-858a77f902ed", "comment": "Malware payload (Socelars)", "value": "d85a408804cb35d639450a82fe12d74fcad298f13111f93d533cee1876f6b70e4a785d56d42ebaab182355944098bd55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627577, "uuid": "56e367df-938e-4778-bb30-8789baeba762", "value": "T1D3659E11F642A036E8E300B386FE5AFE9D287E21031854D7E3C479695E715E23B3766B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627577, "uuid": "087c7601-323c-4512-96c9-916820d559bf", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627577, "uuid": "1f8eb3b8-c84b-4dcb-b5ac-531284a16026", "value": "24576:24WpyFIlAm49DQ0xHsF3PoDQUcBxpPVo+sdycm4SNXybyhVqFmUasD91:2jpTqtSRZlV1lNXybyhVgmUv91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641627577, "uuid": "07ca1d19-9656-45f1-ae15-daadf956143d", "value": 1489408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641627577, "uuid": "c5994f04-6fbb-4fda-b9db-13c427c79b50", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627577, "uuid": "304934d1-b420-45ce-a7db-15ac0894cc60", "value": "0a4f4bf838b9cae5a6b2b0f01b18914e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b560ed96-709b-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1641657460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657460, "uuid": "6449506d-4a8a-4605-a054-192d68a8d140", "comment": "Malware payload (Loki)", "value": "124d58cc6e36f62be4591f5c9ca2415b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657460, "uuid": "7f692b34-24ca-41e5-b228-708829d94640", "comment": "Malware payload (Loki)", "value": "2b90542e7eebea83999f97afd4d69a5dd426891a52ac866613de8e79e634c5da", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657460, "uuid": "bfc7872b-bb10-4f54-9f70-1a2ff04021df", "comment": "Malware payload (Loki)", "value": "3ba4d5d3169f50b0acba43d3076df4326de699f2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657460, "uuid": "d77c72ba-32e5-4c3b-ab7c-1effe41a8528", "comment": "Malware payload (Loki)", "value": "89283a45ceb2ddcad9cd062a9113fc52239115cb84335b4fbfc3e84bfd9ce4afb3c43fecd3d2019e0e4d7aa8ca534f83", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657460, "uuid": "cd25480e-5b7c-476b-ad66-eae1c21c62cb", "value": "T16B9243497EC0B85403831BBAB63FB1CDF1BF19D83488495BD152F892B97521AD6E2932", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657460, "uuid": "d537abb4-ff70-47a7-a2bc-d3958ab39529", "value": "384:ajBQHJ4MwSJkr1RZBUp+u0ghFuaPgMQD5wxHXAj/D0htK/L/un3yOyzxy57ny0Mg:ajeHJ4MwykZRZBUp+u0ghFuaPgMQD5+1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641657460, "uuid": "bdbbaeea-8d21-4325-9393-1caafeb64991", "value": 19410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641657460, "uuid": "a0b3ed46-22dc-4779-9e9e-f6509ea11d29", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657460, "uuid": "6343874c-7e69-48fc-9b62-a45c3a5dfe4a", "value": "Remittance Error Message070120220042.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3feb94b-7057-11ec-9275-42010a9c0029", "comment": "Malware payload (Tofsee)", "timestamp": 1641628359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641628359, "uuid": "d591d983-8e49-4d15-b96b-2d13c78aafca", "comment": "Malware payload (Tofsee)", "value": "d625c2d85ac8ddadb363733bdca08286", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641628359, "uuid": "2d4b5dd0-21da-4a48-84fa-e4b51b518d2c", "comment": "Malware payload (Tofsee)", "value": "2c63bf7e8c39671b903cb389c3ec23b73065f338d817bdd3ef3cc89028b5dd4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641628359, "uuid": "80b58563-3c2f-4d34-8341-53f266d470c1", "comment": "Malware payload (Tofsee)", "value": "1630858a3326e67e8a30036935977871cfd71048", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641628359, "uuid": "59f28f3e-798a-4dcc-ba38-ce4d28ac7cbf", "comment": "Malware payload (Tofsee)", "value": "b791d3472f3fa95a911068c5255b27f1889b8408837d5f4001c67968c91ffdfe292b721ececa0ba6f7ba0432d044c16e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641628359, "uuid": "611a2c35-6f42-44bd-ab37-2992443bf474", "value": "T157549D10BBA0C43AF5B711F846B6936CB93E7AB15734A0CB52D426EA16346E0FC7171B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641628359, "uuid": "dbc7a439-f4ae-4540-b236-3d7eead5ad20", "value": "533c7d85b116be1012511aa29db7587e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641628359, "uuid": "f7de71e1-3296-4642-b318-26b774098bc3", "value": "6144:F2Qu6Zmkt3XpqBiJGIpFkNBlVaQzH/zqKFfoPeRW:F2Q4Y35hJGwFkNBVz9Ffo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641628359, "uuid": "05d53d6a-eb80-4ceb-8a61-3f02b6c40a78", "value": 301056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641628359, "uuid": "b626fa1e-edde-4dea-84b8-0bd1a5f9d4c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641628359, "uuid": "1dde893f-75e7-4ea2-9d77-7f33216b82b1", "value": "d625c2d85ac8ddadb363733bdca08286.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1d49db6-70a6-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1641662206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641662206, "uuid": "ee204bc7-9309-408d-a31a-d6d452ff37cd", "comment": "Malware payload (AgentTesla)", "value": "9b84352fa4893c94451cda3ced226067", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641662206, "uuid": "b921a66a-1a40-490f-8cdf-5d2edced78d0", "comment": "Malware payload (AgentTesla)", "value": "2cbb12fe831f3c51377a9fe87790f3ed802175220d33f50076f6d76894fc20d5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641662206, "uuid": "943d3a2a-8c1b-4319-ac19-d409ce67cbb4", "comment": "Malware payload (AgentTesla)", "value": "9541605d7b21031932a2a954ef755333ac87e4c5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641662206, "uuid": "142a5841-d32d-4c6f-a683-dfdfcb86ed9e", "comment": "Malware payload (AgentTesla)", "value": "36bcd55053309ecf013daca28dbb4218d03a0c8652f93d700fd3383e97ee00213b51a4bb3bbac2aa478f4d7358c18168", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641662206, "uuid": "9a822f4a-4893-4699-a8c6-c130203c2413", "value": "T1AA15E0CA21D5D5C6E8FADBF80DB7A0430EB5BDA0A561D05D2F8D308965B2FE44A1CB31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641662206, "uuid": "37ef4e19-37e9-4398-85a1-5334793e08a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641662206, "uuid": "3eeb3424-ad23-4043-ac8a-13a7848957b6", "value": "24576:F6Y18MXZXTzDfNWapza+R1kIuiORAbJhSsmVJ4:F6YWybfNWapz5VFhSs6J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641662206, "uuid": "7ae3227a-fd41-404f-a1cb-82beb5b15bea", "value": 915456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641662206, "uuid": "1621a1e8-701f-4272-8e9d-685f510cf635", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641662206, "uuid": "a68c1319-0fc2-4b1f-b1a9-a4919f069df5", "value": "PO-49992022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d2db9e7-707d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641644374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641644374, "uuid": "d509a92b-a610-459d-be5d-c3976ff547ae", "comment": "Malware payload", "value": "a0bc1018301f353dc99fdb2c973dbbeb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641644374, "uuid": "e0ec98e5-615f-4618-bdba-56b37546fcde", "comment": "Malware payload", "value": "2d5407433a0d0a90d5ea37643701e5526a6d1e5cc1d1a35bd290a55913302901", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641644374, "uuid": "1af333c0-da9a-4b16-9006-9f73faa1041c", "comment": "Malware payload", "value": "cef3e77aa705cf6b4e295c9c852a559889404a19", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641644374, "uuid": "abe4d564-625f-4efb-96ec-b109e072d6da", "comment": "Malware payload", "value": "581b7fdb8bdefe2aa29df71072bd1d3ae9049649a5351e6dd0d047772ae402592a152721d0d2ebad54b4168bfa72433c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641644374, "uuid": "56d5e8e2-e14f-4092-8293-7c9da61d4e97", "value": "T1EC55239322DDBC51D33618B0B7370AC5DB2E9E0A4A95D51F5AE10E91F63C0277E6BB80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641644374, "uuid": "e36aaa0b-adc8-4432-bd58-0c5a870d71cf", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641644374, "uuid": "cb6dac7c-7cbd-4882-99a1-3bd4edf13da2", "value": "24576:bEV6zCdkXp0oNKqScU6mA/jWcu1f/t2tzIvoGLtFMYWYkEaHNYK3pB1/:bEV4CdZgOAr/u92EoGLtV1NaT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641644374, "uuid": "1900c98c-ee9d-455c-9017-089b2f3a3408", "value": 1396770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641644374, "uuid": "7d0f2954-509e-43ab-9860-fb0eb23d56f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641644374, "uuid": "d4884fdc-fd07-4ad5-99ef-462f1b4cb78b", "value": "a0bc1018301f353dc99fdb2c973dbbeb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9268de3-7053-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1641626623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641626623, "uuid": "a0524d00-51f9-407d-afb2-1912d59e1139", "comment": "Malware payload (RedLineStealer)", "value": "84b7fc2e9b7a864ad2458e3441f9b774", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641626623, "uuid": "d1299674-9538-4d81-b626-c12ca34db5af", "comment": "Malware payload (RedLineStealer)", "value": "2d85c3c393acd49f3d6a4bf20c80936788d9ed56b4fc63c07f92fad0e4849b30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641626623, "uuid": "53fda202-b404-4025-9724-70b798730c89", "comment": "Malware payload (RedLineStealer)", "value": "cea149e902c61631f9e8ba705a7930a478595313", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641626623, "uuid": "c372092d-f8e2-4003-adee-42b89c80254a", "comment": "Malware payload (RedLineStealer)", "value": "cf0e950c0136fc7993e472c829c8151e46f9c17890feca0b2a543f5447e8a73ca6fd2f19a402a8cde0c3bf4c58e68032", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641626623, "uuid": "bdfe5cd2-a007-4c8a-ba61-df751f1373a3", "value": "T1A4451BDD51C15849CFEF03F00DFBE62E857292CA13075BEA735E91F0AB6208EA56D4A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641626623, "uuid": "ff486287-afcb-4c35-bf2f-a56d615f2231", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641626623, "uuid": "a76d3849-7bb6-44ca-bac4-6618a7a457c3", "value": "12288:AN54OcvV9WpUSPvderBdGz42bpUhz/LgoJMiJCE/m7vNP+ngI0:caWD1ereyz/HEvNW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641626623, "uuid": "22c3bf45-28d0-4eac-b016-e527c83205e1", "value": 1175040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641626623, "uuid": "1b02935c-03e3-44bb-9e05-6794ec1ceb4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641626623, "uuid": "e8eb0789-71ae-44b1-9641-061d189779e5", "value": "GenshinHack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08a20cf0-7054-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1641626676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641626676, "uuid": "df8b85de-f64a-41a2-91bb-4f98209920ee", "comment": "Malware payload (DCRat)", "value": "18f57f8f4cebe2fbcf178c66dcdcf108", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641626676, "uuid": "d6f812c3-0ed0-434b-b1fb-10ed7b4d41be", "comment": "Malware payload (DCRat)", "value": "2e1c65ba7dcbd574aa70123733a3a6239560de434d0602b693733482555c0b14", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641626676, "uuid": "3a8f1655-91dc-434a-b08e-e97c7c882371", "comment": "Malware payload (DCRat)", "value": "a2ab39660b2a578a0b5b3b2a6347d8f64025cf77", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641626676, "uuid": "caf7c000-7a70-47e8-965f-ceef966d9381", "comment": "Malware payload (DCRat)", "value": "52cded48a76144677a5c3d1225eed8e8a6c136f25e4c3eadf632bbc6585c0e535a4c0fb0a3557da33175e6f1327b0585", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641626676, "uuid": "2468e14e-9c82-4328-9bf1-fb0cbc0c5b57", "value": "T15E5533EAE523A76BD41AD7F4A077931FFBC738211C9D92C5FECA17445449A88C18C28D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641626676, "uuid": "9d2b14cb-ca6b-4a8c-b785-24d816642c49", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641626676, "uuid": "2d9fd938-5e05-4c54-af89-b918bc6b6f41", "value": "24576:qkGQBGpU1PPHu3sNcGZvmk3SLZgsY6fkidY7UrQ2OYUOkEaHNYK3D8xG4gk8nY:XFVPPHZvlnF3MkidqoDdNay4TY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641626676, "uuid": "19428ee4-ec93-4d9c-a84e-21184749c996", "value": 1366528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641626676, "uuid": "93c31fb0-1a6d-41d5-a3a0-2c96ec70ec34", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641626676, "uuid": "de7c8ace-c5c9-419b-b2f6-25b4c7103917", "value": "18f57f8f4cebe2fbcf178c66dcdcf108", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fb628c9-7061-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641632406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632406, "uuid": "5e96ea40-aea3-4037-aaeb-2ff744e22629", "comment": "Malware payload", "value": "2e2aecb6be657a1ce07ab38dfa82b44e", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632406, "uuid": "65fc92e7-bb3e-429f-b511-a7a7ef4ef3a2", "comment": "Malware payload", "value": "2eaa615cd32b664f2cefd63a260d69e766406d15413a804203c97f68f5d7d2e0", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632406, "uuid": "1f6cdf14-8420-476b-92c2-7f9b14e3dc7a", "comment": "Malware payload", "value": "e20947c9896b79a063f7b2c6ff3cfac8f3cd6093", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632406, "uuid": "3a02a5e9-3c28-4f5b-86d3-2c5248d93f7b", "comment": "Malware payload", "value": "7521fd579a4b61e827c2e578c5cc34949e198300de2b9e48a753da956e91a92f2d0c5093aa0b46733bfea0b7672ba679", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641632406, "uuid": "aee816d9-8786-41c4-8e33-7ae498bb6f46", "value": "T1A885330822B97CD8F9DE022D3B6249D0C2ED32E1B441B0D676995CA55E7B1FE438F978", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641632406, "uuid": "b6e9010d-ba7a-423c-974d-a0f46d34d75f", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYyU:IDSTOhnXSI0Wk5jG2nfBtkaeyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641632406, "uuid": "85c6081e-434e-47fe-ab0c-1e7474a453b7", "value": 1794048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641632406, "uuid": "00f9bced-0705-458b-9de7-8046c3e1dedb", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641632406, "uuid": "4227778d-bb4d-4857-8cc3-13198767b933", "value": "2eaa615cd32b664f2cefd63a260d69e766406d15413a804203c97f68f5d7d2e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c49673dd-7069-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641636011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641636011, "uuid": "d15ad29f-4b1e-450a-b60f-424a604a70ad", "comment": "Malware payload", "value": "13f27b63c0fcb6aa9017b62c11935ca9", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641636011, "uuid": "f3e8fa83-9688-4d4b-8352-ee6669961dc3", "comment": "Malware payload", "value": "2f577b35d5554dc4215422620ef207b3e9a516513fd253845620f725374edee7", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641636011, "uuid": "c49c45c7-7ec7-41bc-9bc7-fc6e08800d09", "comment": "Malware payload", "value": "1670ed61851f4c5bed2aac3a5c3af9d4ace49837", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641636011, "uuid": "2a7e0b61-84bd-4578-8729-ccba77a94988", "comment": "Malware payload", "value": "fa95622334849326663bf40163f2573257051552ab328113a4786eb1e2b479ec7698ce82301d8c425a98845a69a0b2b8", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641636011, "uuid": "a9572d52-f461-4686-b180-3548d943a414", "value": "T17F85330821BD7CECF9AE022D2B7289D0C2AD72E1F441B1D676585C655E3F1FE038E969", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641636011, "uuid": "d0e8200b-9c68-4747-8384-56750c2a5a76", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYyz:IDSTOhnXSI0Wk5jG2nfBtkaeyz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641636011, "uuid": "2ee2c58f-b566-4d87-b544-494e311d72bd", "value": 1843200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641636011, "uuid": "80ca6df0-3089-4224-89f4-a9d352cfb0a0", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641636011, "uuid": "2d3e546a-4d40-4154-be0d-018dd350be60", "value": "2f577b35d5554dc4215422620ef207b3e9a516513fd253845620f725374edee7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4270f83c-7056-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1641627632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627632, "uuid": "bd3e7570-cd9a-4583-835a-d4eb5f8bd98e", "comment": "Malware payload (RedLineStealer)", "value": "31a0329ab292674619cae6220ef4ea1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627632, "uuid": "c0656edf-b0ec-43cb-940a-38f7e1c83eb6", "comment": "Malware payload (RedLineStealer)", "value": "33c657632473bab8d739a4ddd3b45e6c05ee227c897236ef558bf3d6ce186aa4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627632, "uuid": "14e2778b-7103-4db3-a577-f45ef770e7b8", "comment": "Malware payload (RedLineStealer)", "value": "95539f31193a0863866209e45fc0586a4bedf4e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627632, "uuid": "0429893b-6395-4d74-9445-8e797f6b1c56", "comment": "Malware payload (RedLineStealer)", "value": "91d668972c3eddf7242eb046fe1d0320752411f7267bafeb1097895286eacd98595270278c40bf15887b928fc9fb4474", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627632, "uuid": "c80b9fa1-d675-4d89-9827-a140c9f6c852", "value": "T17294CF04FBA1C035F1B742F8597AA36CB93E3AB1573094CB62E456EA5A346E0DC3171B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627632, "uuid": "1ee7d016-3dab-4b0c-a2b8-76f5ffef532c", "value": "7b0816d92f4c2aec46e012b0dd32427b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627632, "uuid": "c290a797-79bd-456c-bda2-aa947cc211a8", "value": "12288:4KfeeS+k5N/UzjL6gtr2PfDTwtB8P+ycc0JO:HE5UWgtiYtB8y5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641627632, "uuid": "2059c982-da1f-4d87-a1b0-74e7c2c01867", "value": 414208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641627632, "uuid": "59bf2ed4-870c-4ddf-9a81-62e8376a7bbf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627632, "uuid": "5e981523-eeb2-4e03-9f17-ec42428e9559", "value": "31a0329ab292674619cae6220ef4ea1c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e78663a-70bc-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641671354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641671354, "uuid": "e07ab4a6-a870-4b0e-8397-f1bacb36c66b", "comment": "Malware payload", "value": "5a8de0f174b73c5c457ae87b6ed94fe2", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641671354, "uuid": "49b44efd-2df7-4ed4-963a-fa3b9f432fad", "comment": "Malware payload", "value": "35719504378f5380b8f4d23189b522a4790a8c4868ef69c5fa7d905bbbca43ae", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641671354, "uuid": "51af620b-24e8-454d-a013-3471ba5b951e", "comment": "Malware payload", "value": "e3289bc623f56efb2ace2a572a0ae72755344a4e", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641671354, "uuid": "c10da151-7c86-4929-9d20-7756d31f51fa", "comment": "Malware payload", "value": "4d017486bab67a8d758e832f59c3cdf24b9b20bf97ef732d8377b5b060cd147c0b2b16e552494e38a10805923c35d6b2", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641671354, "uuid": "af1029fd-9c8e-414e-9742-56042b9d8b47", "value": "T159F1934DB7EC4144F0FE2B3618B6432A8971BB505932D6BF5C824E5D29B2765D820F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641671354, "uuid": "52b41807-55f3-49ce-8cc1-fe6e799087c1", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641671354, "uuid": "c965bb30-d0b7-4259-8dca-003142bba0e6", "value": "192:ulMwglAztAWZdzKpD9n0lV5cTnKgMJr3PqmtlFf:PUAWZdzwD90rCjKgM5PqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641671354, "uuid": "d6448ae3-a323-457a-aedc-1a8c0ab46ff5", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641671354, "uuid": "a38601b8-53b6-4225-afc0-b123621b12a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641671354, "uuid": "3603a3fd-1250-43a9-a56c-2db1804c5e98", "value": "co1if5zh.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19420bea-7056-11ec-9275-42010a9c0029", "comment": "Malware payload (Matiex)", "timestamp": 1641627563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627563, "uuid": "4d5eff8c-8992-4eed-a169-59808e0846a5", "comment": "Malware payload (Matiex)", "value": "bef1a1a790d0fc2997ad2b61e45a681e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627563, "uuid": "564f6db6-752c-4f5b-b268-2da56dfe11b6", "comment": "Malware payload (Matiex)", "value": "3b556f8a00ec76eae2da65106515802e6ccf7f207b93caa00908e412e34e2384", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627563, "uuid": "d7cbc80c-76f7-4639-937f-190014e83ba7", "comment": "Malware payload (Matiex)", "value": "4977286549133a45f5314f0a61e59365ba5444e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627563, "uuid": "3a88277b-4d4c-4533-8498-5f46d885f1ab", "comment": "Malware payload (Matiex)", "value": "8f1215412284fd5bc284560a414ca5d4cc9cf9bec773a6b3a7454655c5589b27fbffb63553025dc3ea392cde83200298", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627563, "uuid": "44732b9b-d5d0-4312-89b2-de3bb4fe7f35", "value": "T1B184CF2D77844E02DA5C087DE0E7E43503A2FA877276C68A7E484BC63F423655D9ABCD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627563, "uuid": "e7cbcce7-0f16-4478-ad3f-58d4e9d61c31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627563, "uuid": "8073b3b6-91de-41e4-85f5-1aa1e635af29", "value": "6144:/KLpXXlQevZlK7+YjdX2nl4FbE6tpq//bUIYh8LKzgQO+7jyLKNSRk96kADDs:/gpXO2ZY6idX2nOhtpq//bhLLWPNSET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641627563, "uuid": "2c6fccfe-8eb1-4e3f-9e26-f635dc1d0380", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641627563, "uuid": "e4218766-b0da-408d-9dea-d8c234c680ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627563, "uuid": "3b551826-d0da-4162-b738-37b7a913f3bb", "value": "bef1a1a790d0fc2997ad2b61e45a681e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b248460-7056-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1641627674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627674, "uuid": "7f1b7606-ceb1-41a7-a7a2-e06aa003024e", "comment": "Malware payload (AgentTesla)", "value": "67a7d78b65184dc159e07953aed8155b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627674, "uuid": "d85f0d46-a332-482c-930d-26fbd7276de9", "comment": "Malware payload (AgentTesla)", "value": "3b5ab13cf874330f81f453e37b6baf5a0ddab305e5913bdecbd111bdd7ac439d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627674, "uuid": "30cd558d-82c1-4527-9dd0-acf97af1f3a7", "comment": "Malware payload (AgentTesla)", "value": "9fa8dcf44d549b2384a0f6e862ec7dd6be0cb2df", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627674, "uuid": "cdeefa5b-8c51-46e4-8f22-fb1719a24bc6", "comment": "Malware payload (AgentTesla)", "value": "db7e7f9fc3eb5d9b6a5195b3b5f9ef1e2af40dd03d451551d3965b7a0d50a079dd9286008fdf940526d8e040c9b163a9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627674, "uuid": "fd1985ca-eadf-45f5-bca9-7021951fafce", "value": "T1B0926FBCD4A306A4CF4AA7B8671B6E05118C762DF3859673327C9B7467D1C3B822283C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627674, "uuid": "e4be0f80-9da7-4a3d-b539-5097294fc063", "value": "384:FOumOVq1E8e/eFvbmSFZDBwN8aLAnAup3ksHJ3qyG3pLdZ1:2Op8e/SjnoD21l7HJQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641627674, "uuid": "28146286-7759-4316-9730-e68a29bf58a2", "value": 20706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641627674, "uuid": "4d8657b4-8f15-4e24-b823-53e35dca315d", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627674, "uuid": "06b5f8cf-18d8-4f89-b454-99bda1eb68fd", "value": "07-1122.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f7708dd-7056-11ec-9275-42010a9c0029", "comment": "Malware payload (BitRAT)", "timestamp": 1641627734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627734, "uuid": "93d035b8-05bb-4fec-8112-ebc46820424b", "comment": "Malware payload (BitRAT)", "value": "088ef2cfabd6e8b52832f5e358bfff6b", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627734, "uuid": "0bcfbf00-081e-4c1d-a739-79572959ee26", "comment": "Malware payload (BitRAT)", "value": "3bdd75cf5a2b26bbf10f298f3071b2d7c7a79b33f880eb3f26c3276baceaac1f", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627734, "uuid": "a6ccf451-ba3f-4beb-b236-08fce3a21ac4", "comment": "Malware payload (BitRAT)", "value": "4c389ccc2ac9809b315b5ba1b3d3fe3edcf9876d", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627734, "uuid": "378c8269-9c11-4d8e-84c9-ad5913f5234d", "comment": "Malware payload (BitRAT)", "value": "6a650111f4ac8d04175db2f505f915b8ca791bde5b45e83a4e75bd680daf7d1d0a763e85a97e007df66c66db1739e87a", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627734, "uuid": "78f2af02-f736-47cf-b1f7-8c1562261ead", "value": "T1504402CFCDE809D2C696A3F071729496BA318FD6393712A26CAAF564347F7C4E1006D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627734, "uuid": "14e52584-1df3-4ff2-90de-30563f1beec3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627734, "uuid": "27b9872d-bf6e-455e-95a6-0f5a6353602b", "value": "6144:rHYJmJy1c3XRvrOvfvZ1mEgn7wlXi3mGXXUgHF:rHYM0wvrOHvZYUdi2wXUgl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641627734, "uuid": "934e8cb5-665f-4f67-ab05-882f9c087ec1", "value": 273496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641627734, "uuid": "1418bef3-6944-4a1a-858b-efd6fb0b8626", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627734, "uuid": "c6df4848-5830-4c1a-97d2-5037ad3f8f9a", "value": "DHL Shipment Note.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62017dbe-7061-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641632410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632410, "uuid": "3c8a2372-f476-40b9-bb78-1b5ed99851e2", "comment": "Malware payload", "value": "539187803ec45d8eaf1f8da2f35eb73b", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632410, "uuid": "c203cfd5-f58c-4044-8e19-8fb616a99051", "comment": "Malware payload", "value": "3c80346eb66498f5426fea691ac1c6ea61ff5b67e7e02a34d7d0c4d1c234a688", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632410, "uuid": "c2cec53b-f725-4927-a05e-5787ee162c64", "comment": "Malware payload", "value": "9a2723fd3a4b01376779c89a8f37512b588b36dd", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632410, "uuid": "753c6684-9014-48fd-91fb-2610958b4a22", "comment": "Malware payload", "value": "87902bd592e8cb8b8fc2fd1deb32720d39375680ca6aa94ca40c6089d54c011770830837f776f9840dcc55198fb8ef2f", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641632410, "uuid": "f358d96f-c177-4a5f-8aba-8e7f7522195c", "value": "T14895330C62BD78ECF99E422D3B6289D0C2ED72E1E441A096B6545C686D3F1FE038F965", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641632410, "uuid": "d6346e4d-9180-4d12-a0da-79aa409a1be2", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW:IDSTOhnXSI0Wk5jG2nfBtkaeytFOo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641632410, "uuid": "7b561370-2673-45e3-af3c-6416b50627cd", "value": 1904640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641632410, "uuid": "b78976ab-a016-4471-9deb-3d4ef9191480", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641632410, "uuid": "d9a84274-4c10-423b-9246-c9347f7e1855", "value": "3c80346eb66498f5426fea691ac1c6ea61ff5b67e7e02a34d7d0c4d1c234a688", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "644ca8fd-7061-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641632413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632413, "uuid": "6d3f3ed2-40b2-442f-a111-1599c9700021", "comment": "Malware payload", "value": "1565a1f424d9b8459caabc91f6340eec", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632413, "uuid": "fea79613-4fdc-4dc1-b846-da29827bd150", "comment": "Malware payload", "value": "3e8f3ac41f77cd545fb0735e04451b98349ea8a5b06a56d4a502ec95dc7126b9", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632413, "uuid": "7b658ebc-b4bb-4db2-b048-5ce34c4e9f5e", "comment": "Malware payload", "value": "abe5551e8ef4a27b8ba559a9d79b397267ebabc7", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632413, "uuid": "f95a66b9-7050-4898-989b-20137f2318b0", "comment": "Malware payload", "value": "5cd050fd63e67d03162bb4236f868ddb99f84b836e3313c3cbc962de47dcccb5bde295213b12bbf9341e25af6ac3b5ca", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641632413, "uuid": "ff1ba2f0-7140-41f8-9018-e5f9d3fd9ce8", "value": "T1C375330822BA7CD4F5EF1629371248D4C3EE32F1E441B49676985CA62A672FD03DEDB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641632413, "uuid": "705a0d4a-64fe-4b17-a585-a45000d6808e", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8d:IDSTOhnXSI0Wk5jG2nfBtkd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641632413, "uuid": "e4354792-67f4-43c3-b4aa-2f5af77d0646", "value": 1679360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641632413, "uuid": "59b18c3e-2d38-4f82-93c5-2c2a88233bdd", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641632413, "uuid": "d70e1980-d0b5-4e53-84ac-d25f7f9d8a06", "value": "3e8f3ac41f77cd545fb0735e04451b98349ea8a5b06a56d4a502ec95dc7126b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9239e06-709e-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1641658836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641658836, "uuid": "731b26af-de56-4cb3-9e57-2dcfa98bb378", "comment": "Malware payload (DCRat)", "value": "5351871e0fde402c14f63225fae75415", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641658836, "uuid": "717228cd-df6a-465f-a358-39ebf02d4722", "comment": "Malware payload (DCRat)", "value": "44caf98e5ae6e4c45d0c49f0ec2ba8e833e806e74c5b3cde1b48d440f873d97a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641658836, "uuid": "11e3fb06-2a6e-44f7-8b1c-9124f7cec295", "comment": "Malware payload (DCRat)", "value": "9158007388f8a67161ecd4930a6feee7eda049e1", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641658836, "uuid": "eb159952-25b6-4a81-877c-c81a1155836b", "comment": "Malware payload (DCRat)", "value": "935d6f7a06368ee72dc2bec80b75101e159c7675488ca1cd080e73d9e93a9c6407ea4ea2b1b4e7c1babd8deb5f657e61", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641658836, "uuid": "100fa7d9-d374-4efb-a375-b23a8bed9540", "value": "T19B7533F3D30665E8C24FD2F4A253CE192867C4A8EED4D2735DF629436A69843B80F947", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641658836, "uuid": "a76e9abe-b56f-4763-ac30-8eab0c729586", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641658836, "uuid": "9ac7849e-e623-4026-8556-3be84b640404", "value": "24576:9LNqIIR/ydpnKiQ4GdmV4xod3zno8zeRWvpYaviz93W5A7ZNHWYWkEaHNYK3xFQG:9JPTrK5WV4E3z7zfG9mSHHaNaJQsos", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641658836, "uuid": "972ad5e0-77da-4d98-a519-59bdf85dbda6", "value": 1634816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641658836, "uuid": "c576c1cc-7034-4ad0-b906-938511b8390e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641658836, "uuid": "939fac30-9f37-4536-a80f-7965f154e3b8", "value": "5351871e0fde402c14f63225fae75415.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c813e88f-709a-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1641657062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657062, "uuid": "e31bc671-87ea-4676-b0ce-f7b016bf21cf", "comment": "Malware payload (Smoke Loader)", "value": "42c9365b1284d5e5e95be8c82e3eb480", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657062, "uuid": "7667f3ef-122c-408d-bb66-494d47f4731e", "comment": "Malware payload (Smoke Loader)", "value": "47c2ec67d40d8e342db29823981ab4539c758486d30d00bd15106acdb39a96cc", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657062, "uuid": "73b49292-d7fd-4f83-b027-f986c3a87061", "comment": "Malware payload (Smoke Loader)", "value": "af966c6db72acf8ccdab4d39f7f328043c3ad592", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657062, "uuid": "e5fd4573-3913-4e92-a892-9914e98637e1", "comment": "Malware payload (Smoke Loader)", "value": "a3674169ca6db446444acc718fef91ed42c1c650c1158512cfabefe542cbaf95129c4b06efca77cc5161fc809a11eae0", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657062, "uuid": "79773551-1ab3-46cf-a890-aac619c0fe08", "value": "T17D44AE3279E0C8F2C4A799744864DB946EFBB8126670824B375417FF6F322D25A2E343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657062, "uuid": "2c983f9f-b11c-4c2e-8e61-47534539f1df", "value": "9cccc741ad1506ba0e46e13b16561dd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657062, "uuid": "82ece5f6-a2fa-45ec-91e4-a04ec9ca03cc", "value": "3072:JcLCU+iNG0bbP+FAqfX9jZQ/XWdtSCW9j90uG64zhs:2LCU+iguPM3TQP6O0uG6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641657062, "uuid": "09e63ece-bcff-4b72-ba53-ccd812d8c106", "value": 278016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641657062, "uuid": "2449d90e-081b-4e2e-801a-ba690868cba9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657062, "uuid": "5fafdb5e-0e32-4822-96dc-6ddd1f0bb694", "value": "42c9365b1284d5e5e95be8c82e3eb480.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dde3dbe-70bc-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641671406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641671406, "uuid": "8c066c62-a4ff-4e2c-8355-b0e5e855d9bb", "comment": "Malware payload", "value": "cf6faf7d7065f2f9ac9b946e563b2891", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641671406, "uuid": "454456c3-1afd-4629-a00f-caffc9fdfdeb", "comment": "Malware payload", "value": "495d083037ebfede3a2516b71fd3f0c63436e9f7db85ad688238df3ab02e8d59", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641671406, "uuid": "28ce819a-7e28-4a04-814c-14225e426f7b", "comment": "Malware payload", "value": "848e396750d032cf7d8eb06c4892bf52f53a34a1", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641671406, "uuid": "c4937f26-5dc2-4be0-9df9-a18350c095f3", "comment": "Malware payload", "value": "6874992955c1a2330e509cbecebb585f2fd8b9c5daa0173613e2c0bf5f0398ce0fcf6b1aab45a8aba007e31e334eef4e", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641671406, "uuid": "dee690e4-84bd-4721-a154-69d84f915014", "value": "T13263F127A604E820D9BBEEFE624518F0B7915303E3759A5B3768F39E21948CF43564CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641671406, "uuid": "ae1e8889-018c-4cec-ba40-6228f8583659", "value": "1536:S0suQYD2hZUGgyxUxn/4pVnKxxN5WXtSZxV0RvIU19E/t:SWQZpxc0axN5WdSZUE/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641671406, "uuid": "3f450008-b605-4710-a019-0a9a84fa6ccd", "value": 70384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641671406, "uuid": "a7be1949-ffec-450e-b0a2-68d9210a48db", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641671406, "uuid": "1115459f-6a75-4be7-a8a1-bbfec018d606", "value": "test.docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e0f293b-7056-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1641627598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627598, "uuid": "05af495d-9216-4caf-b3fd-2002ae0f6db8", "comment": "Malware payload (AgentTesla)", "value": "53c4482e7bf378c6cec9516b425d7a68", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627598, "uuid": "06464931-fd14-4121-9694-93733d2a887a", "comment": "Malware payload (AgentTesla)", "value": "49842a3a363c0d97c75b1920d6a25d21ec40f549bd6275202a3c119cfc327e29", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627598, "uuid": "42816b7e-be23-4770-af10-bc7e47ce3168", "comment": "Malware payload (AgentTesla)", "value": "15fb916fac0520ced63d43e3f5faafc4f9546a75", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627598, "uuid": "55201dfc-0bee-42ed-a600-ea66c64c6f41", "comment": "Malware payload (AgentTesla)", "value": "2615c4705c11bf00cb20e01c678ced99828cb6546150c1d01faac5c3c89b6c2d6e9561c57eca7d269d18e5be32745865", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627598, "uuid": "23c8bf0f-e39f-44b9-ae13-d4ee40b3d899", "value": "T19AC42381F3887D13E1037B868906F9660FE589BD94DA6C4D775273AC6B30DAC6D5CA03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627598, "uuid": "2f8fe4b1-0bf0-4dca-bfb3-5071434af071", "value": "12288:UHWNSdVQ3toG1axbWmvrRSw2ugARv2jw5gHTDauFOWE0sv6za:vNHGierrRv2j0gzDHbT+6za", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641627598, "uuid": "cd60042c-de50-408e-86e0-e8629a1121e2", "value": 560813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641627598, "uuid": "a0ea0aea-6076-40bf-ba61-cbd7005eca9a", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627598, "uuid": "f506bfe7-9026-4cf4-bfd3-7f323394d7f0", "value": "008BX66084.ARJ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c28147d8-709c-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1641657912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657912, "uuid": "684ba10d-d03c-428a-b7e3-dea7b0080546", "comment": "Malware payload (ArkeiStealer)", "value": "66a96ca5773d9925a1c6b1076adf3873", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657912, "uuid": "5e484aba-919e-4750-849a-d8ff619d2d53", "comment": "Malware payload (ArkeiStealer)", "value": "49b52082da7f5250e5828f00e6fd684f26b72b896eec98a1665156954388b40f", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657912, "uuid": "ed0fdb43-0226-426e-96df-0b7969b2d8a6", "comment": "Malware payload (ArkeiStealer)", "value": "d39cc7458e3602e0bbc872352092cfa8af0a6aea", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657912, "uuid": "0e9d591d-634a-4b67-8585-ceb33f0835e5", "comment": "Malware payload (ArkeiStealer)", "value": "774e6403d8836499dc775010002d2212da4f366926ec467e990a3b74055cce097d91bce9cedc71faa2fe6aa3108c65cc", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657912, "uuid": "3cdd3ccd-fb96-469f-9133-1494420a053d", "value": "T116249D10BBA0D035F5B325F896A69379A93E7AB1673091CB43E519E613346E0EC31B1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657912, "uuid": "d13cc611-8314-4c43-ad1e-dd238c0d99a5", "value": "6144:XlfMHGLq2am/jgLWcPmiAtrp1ZDk/3TYhGat:Xlt1amLggiAtrp1dO3khH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641657912, "uuid": "91ce76d4-d52d-4c83-a55d-7c1723c1f3d6", "value": 214882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641657912, "uuid": "ab76cae8-7474-4b7b-a0c1-2a80796e01df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657912, "uuid": "49598f80-2831-4262-bce4-ff9d7910f912", "value": "66a96ca5773d9925a1c6b1076adf3873.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff23facd-7058-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641628808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641628808, "uuid": "1d9a1f06-d493-46d4-ac70-1b8304c62084", "comment": "Malware payload", "value": "8494c140c3dbc8528436115ea47fc192", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641628808, "uuid": "8817d9af-ccd5-4e8d-b404-6413d2506447", "comment": "Malware payload", "value": "4a9b1114be507c6d710260caa714b6ef980037df6668910e490cc671ec3aa437", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641628808, "uuid": "57fb026f-81c7-499b-9869-33c3611c6128", "comment": "Malware payload", "value": "79976848512290c48d9105838491bf49a60e8a93", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641628808, "uuid": "09ac817d-92b2-4dd2-8407-5a5ace7ddf49", "comment": "Malware payload", "value": "6ec5f916fe4438edebdc58ed953f09690ddc1873f463fad2b03699a6f86f8f5910a3ee4c31c53c3189d1107b74d01979", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641628808, "uuid": "fab438e0-b2e5-4e8c-9d34-e93d844f9ada", "value": "T1BC85330852B97CD8F9DE022D3B6349D0C2AD32E1B441B0A676595CA55E3B2FE438FD78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641628808, "uuid": "8f1bd51d-77f1-4f04-9165-fde443b7a2bf", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYx:IDSTOhnXSI0Wk5jG2nfBtkaex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641628808, "uuid": "e676a425-ba60-4c47-b32f-36cdf63325a3", "value": 1757184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641628808, "uuid": "aaadebae-f6b5-42da-9098-116dc48344bb", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641628808, "uuid": "de9b15c1-7d74-4567-ad98-b36d74af21f3", "value": "4a9b1114be507c6d710260caa714b6ef980037df6668910e490cc671ec3aa437", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b82698c-7051-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1641625473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641625473, "uuid": "7c08367f-5601-4491-99ee-ff3a612696d4", "comment": "Malware payload (RedLineStealer)", "value": "8e4d127ffef110af04a4f67e8b2aa6e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641625473, "uuid": "0ffa2fff-33e6-4c99-9811-6ea7497b244e", "comment": "Malware payload (RedLineStealer)", "value": "4b35e095909d55419ed46df3f815f3353de28fe3092e64914f89152ea9306d6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641625473, "uuid": "2a8884f4-a56c-462f-911d-9544f5bf9f2b", "comment": "Malware payload (RedLineStealer)", "value": "a490d96a95c95083033f626d77c9c816aeb937ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641625473, "uuid": "2d33f527-6dae-4941-8aae-4083b05cc370", "comment": "Malware payload (RedLineStealer)", "value": "a23d15a8c9211321b9d94773a4f3bb03b766507ddf5f06649c01258fa587a525dd84319c3cdc7519a801253d6234484a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641625473, "uuid": "57e5bb6d-c9c1-45ac-8307-0ae88b8b0052", "value": "T12D25F8CD51D15849CFAF07F00DFBE62E857292C613474BEA732E91F0AB6208EA57D5A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641625473, "uuid": "511fa102-d68e-43f1-ae53-cf4e04c869dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641625473, "uuid": "d31429e1-a923-4fca-9b08-61d9d8f2ecf8", "value": "12288:VqYtjD0bADN2AwiobjAD1vh5bjqhsQ1jpunff8VqkXlIj3:4gDZmiMADp3buXj1rXM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641625473, "uuid": "892a6220-5959-4a4d-8e7a-fe80341d2b20", "value": 1038848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641625473, "uuid": "b0e4d84e-0261-49b2-bc07-ae89cd58cf6b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641625473, "uuid": "89aa310c-1352-4403-8813-1a0e017da933", "value": "GENSHIN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c518b861-7081-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1641646320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641646320, "uuid": "c0d1342c-2f93-4556-aed3-fc397580c656", "comment": "Malware payload (AgentTesla)", "value": "1487f19006c997d060a1542f2f87ccaf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641646320, "uuid": "dfc5f2ba-0636-4f05-b48c-2626bcd56052", "comment": "Malware payload (AgentTesla)", "value": "4bf09c9861bb150bcd9fa3ee482e21b981e183e48afe9e741be6cd5bd27c51f4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641646320, "uuid": "5f25c8f0-83bb-4d3e-a2c2-25249c59ed64", "comment": "Malware payload (AgentTesla)", "value": "2c19a312214ce0f49161bc06e8eb2462ba964b6f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641646320, "uuid": "4895b73c-3628-44c8-8527-298a8ec992a2", "comment": "Malware payload (AgentTesla)", "value": "b04207ead898074af3ccefd95e48f3c6f4e43ceb1a9dbdd0333649b8931b8db592e23bf8dc42dc7948667af2c0df66d0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641646320, "uuid": "4beda224-63cb-4381-bba0-a40a7d33b11f", "value": "T164359C85E5D491D5ECE99BF41976C8334A32BDA8A830D01D2DCD3D1B3AB7FE6401CA62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641646320, "uuid": "1f35ba11-860a-45db-a49b-fcb101cb9a67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641646320, "uuid": "c2a56773-8a94-49f3-b87a-1fa068133069", "value": "24576:qY1u38PCkY92zUIJ+p1d0YcwtA+WnW1qq:qYVPCkY9SJ+jd0YcoanT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641646320, "uuid": "624ebc5b-f20c-4497-bfd6-d98953fe0b09", "value": 1079296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641646320, "uuid": "944535d1-beeb-464d-abc3-70e8b6b2a460", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641646320, "uuid": "f9a7e911-71e5-44f0-b8bc-12e6978da353", "value": "Bank slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dad0d15-7040-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1641618148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641618148, "uuid": "34bdfb43-efe8-4f0e-b37a-cfbd656e74de", "comment": "Malware payload (AveMariaRAT)", "value": "495587163ddf94aaceb6a5e68af05f7a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641618148, "uuid": "687d5108-e741-49aa-9be9-33784a9bcd1f", "comment": "Malware payload (AveMariaRAT)", "value": "547a73effa2789bdb7c8d66e020e0ec86974de321362e97319be1e6d3fdaf8d2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641618148, "uuid": "187a2139-0cbc-4a00-b3e9-ce63c20e0869", "comment": "Malware payload (AveMariaRAT)", "value": "38d439d7404743aa122cf69cd03aef628eefc057", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641618148, "uuid": "5e4e9835-109b-4c8c-93cc-3606ca5e61b7", "comment": "Malware payload (AveMariaRAT)", "value": "1c3038cb427172ebb72c7906713ee8914e5549ee6b444e5ab6afd4ac9ccd3febcb1b6a86c070c4548738a0ec6d7bc261", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641618148, "uuid": "44a2ee45-ac50-46b5-a139-5f04f3abc3fe", "value": "T13CB39E13F7E54835F3B201B01ABD7E7ACBEDF9700628C49FA394858A2D31946E925397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641618148, "uuid": "c814ffca-c5f7-4217-974a-a3eb06bbe171", "value": "51a1d638436da72d7fa5fb524e02d427", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641618148, "uuid": "bcae9bbe-e085-4e5d-81e9-a4b12159fd08", "value": "1536:h0jP7/L1B5rVmN8sxHv2M28ix8EUaJxWZoB4u0OVE01:K1VmhaH8EFvW+0OVE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641618148, "uuid": "3d3f72d5-fb6e-48d4-87ff-5ac8687b9835", "value": 115712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641618148, "uuid": "6278e768-e453-47d8-8c65-0e19183f9f31", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641618148, "uuid": "512d9f4a-4628-42c9-acde-00c53fcc5624", "value": "495587163ddf94aaceb6a5e68af05f7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51c3cf65-70d5-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641682204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641682204, "uuid": "c08ef259-59b3-47d8-9016-0060a0cf0182", "comment": "Malware payload (Mirai)", "value": "3f8643a3ed765b1805d442aa73c10434", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641682204, "uuid": "afa2b751-767e-49ca-9ad7-cf16e3a47663", "comment": "Malware payload (Mirai)", "value": "559b47ee65670c7b22b7cc9ebb3eef68e88adc56de4671361cbd4712cbca50f6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641682204, "uuid": "6df2dfea-e0e8-4cb9-bb09-3b2a58b2436a", "comment": "Malware payload (Mirai)", "value": "e8894cdbb2147e07b0a339e4367ec58e6f2a191b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641682204, "uuid": "41afab1b-385e-4bd3-b3a9-2900379d49cf", "comment": "Malware payload (Mirai)", "value": "8b7d38655ee64e05e86f816270fa0a70257647adb4d1b7d5507a7cf33fe2ef9c5ba8546c49c51ee3c8636b7836ad71b3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641682204, "uuid": "943b43f7-de19-4bf9-a78b-0b17fb8764e1", "value": "T14B530261B3BFB8FECBB434B5419280423E625FF695B821BB3158C7509FE380A5359807", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641682204, "uuid": "4d04ea90-0bc8-4a0e-b1cf-2c5b0b8a848c", "value": "1536:WX+UwzvJbH2cbngvsMRIWKCW6jrJTovLF1Ch/3EXrVn3mE0z:C+UwzvZWagvsAhjr9ovLnicXrkJz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641682204, "uuid": "1986e884-46c7-4c40-9d18-858b55acd010", "value": 63704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641682204, "uuid": "843dad7a-4c7d-4250-b02f-7bc205d4be4f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641682204, "uuid": "162f35f5-eacd-4e99-8bea-7a9cd1fdfd6f", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7d7c5b0-70ac-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1641664846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641664846, "uuid": "b273246b-ca96-4401-aa38-3ba8840ae908", "comment": "Malware payload (njrat)", "value": "70a2972e4036a8286119eff6e075e774", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641664846, "uuid": "4fa79179-2801-4a56-8568-a5a992216ea3", "comment": "Malware payload (njrat)", "value": "57933f53bc7915a61cfed96f47acdcb579117e9a3b7469812de2b8184e144f7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641664846, "uuid": "1f8ee9d6-f8d8-4f81-9920-586d8cffce82", "comment": "Malware payload (njrat)", "value": "cdc711bcd37e5eadbaf716fac8a47e60a83edcf6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641664846, "uuid": "11e20bd9-f818-4d24-8c34-86bc93047f98", "comment": "Malware payload (njrat)", "value": "567c86328d0224674997d46151ddec10d181bb94663d9181a985f34296df4c250748a47b8701c2bcad08e222722812e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641664846, "uuid": "bfe34c85-76a9-4d30-b609-b375bd00e98f", "value": "T1B3F31855629C8B63C97D57F8A0A5E03153B45EA37092EB098FC23DDB3DB7F604A1068B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641664846, "uuid": "b62e742e-6289-482e-8211-cbc25f974296", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641664846, "uuid": "811f36b7-0d4f-4b14-9ebc-be602d58d3e6", "value": "1536:xgfPXGN13DWm9y1lIWIvyc4fK8NOk8BdHIfNPT2UoxQF6oxjOM6dxzUNcLR:xgfPXGLWN8ePToxox8Rxz/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641664846, "uuid": "76063151-9542-45ae-b4eb-723fae9e65aa", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641664846, "uuid": "baf635e0-6713-4f9c-9f20-4169a9c684e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641664846, "uuid": "2c972eef-8a12-4373-b749-87267fc8bb6b", "value": "57933F53BC7915A61CFED96F47ACDCB579117E9A3B746.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cb11bac-709b-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1641657419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657419, "uuid": "669cf0ac-a19f-4b6d-a220-0b1386c8270d", "comment": "Malware payload (Smoke Loader)", "value": "ed4c8d69f7e7e4e58eef85edd780503e", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657419, "uuid": "b3e22b41-a109-4c87-9278-46a881e065fd", "comment": "Malware payload (Smoke Loader)", "value": "57fcdced3f604edf43e4576f17b23b49ea593fc8dd8194081edbc5c96def6a26", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657419, "uuid": "4726216d-8f16-414e-b8e6-19e717ae07f8", "comment": "Malware payload (Smoke Loader)", "value": "faeba237a67bfb559b8b21ca7a4431bab7c4cb35", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657419, "uuid": "9a6d097f-6656-43bc-963d-23186ab24259", "comment": "Malware payload (Smoke Loader)", "value": "9ee9f05b762caa59dc2193ae4edb4409e1fd81ba8c8d6ba4e6477a5bcea3430f72baa40b568cca154f0f3e98e40d652b", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657419, "uuid": "7f9de1d3-3f4e-412e-a1ef-0f690193eb37", "value": "T15944AD1575A1C032E6AB993C387CC6D25F3F7C229B75844E365807AE1F732A05A3639E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657419, "uuid": "12f999d5-c490-4bbf-98e0-3f9baa22053b", "value": "8baddd7b87e0ac4de3c620216afa4ec6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657419, "uuid": "f30b5c23-c9c4-4d6e-90e7-87a69e17a4e0", "value": "3072:dLtu91l61GMUtESA1JJUSuPAqx/qVLzDhs:dLTrBVLJUJjCpS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641657419, "uuid": "5f7c52dd-7158-48da-a2ec-0388eaf9b669", "value": 269312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641657419, "uuid": "384ac4a9-69aa-4f48-be0e-587225fd8c6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657419, "uuid": "381af4ff-a7c7-4d0f-b198-cc7e703fa5bf", "value": "ed4c8d69f7e7e4e58eef85edd780503e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f272543-7056-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1641627680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627680, "uuid": "829aa944-6376-4b75-9bce-37be84d44b94", "comment": "Malware payload (AgentTesla)", "value": "3fbbbf8f40732d3027a19b0378efc918", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627680, "uuid": "be78e83a-bbcf-4f02-88aa-1e9741a78939", "comment": "Malware payload (AgentTesla)", "value": "58d1fdf7ad19e4844b86136335c60d0d4b23702c7aac3aa508a13bd148aa188a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627680, "uuid": "ca34b777-74fb-4124-87d5-e2375f41ad5b", "comment": "Malware payload (AgentTesla)", "value": "3d81cab81f684c674baa1e6f3c76018656b3ce26", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627680, "uuid": "761b4ae9-81bf-4365-9e55-ca4f6911834e", "comment": "Malware payload (AgentTesla)", "value": "b1513905662051f345c2d67a8f079af71f039b978906ae98fc40098acf36ad46d124f638cdb6dd71e5e858b3141458c9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627680, "uuid": "93c4f126-f927-4fac-916e-5d671e388cfe", "value": "T1EE71C6A5E26C3855CE1229F6953CBD1900B3F1918BEF26C4320DDE7117AA721AFB4CC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627680, "uuid": "04be8c7a-4a12-471d-9fe7-2b2ab5b739ca", "value": "96:V6iUiM2GTah9wj6afLSJ8Ci6r6YOZ5aW6:VeahyT4Xab6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641627680, "uuid": "e2a37a3d-42ed-49fe-9376-3b943363d5e4", "value": 3788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641627680, "uuid": "0b0bb983-6fef-4643-9a24-29045bc40700", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627680, "uuid": "acc09242-19d0-4752-be96-521f5476adfe", "value": "facturas pagadas.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6410c1b6-7055-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1641627259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627259, "uuid": "09e18121-abb0-4db5-8084-a8ab4e897b54", "comment": "Malware payload (RedLineStealer)", "value": "b636a8935a62b0a1af94408595fcb21c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627259, "uuid": "c3791614-3695-4537-a966-d77c02b63e7c", "comment": "Malware payload (RedLineStealer)", "value": "5e5fb939c0bb8474487a8c1809e137183f1178f9a2a700a5f2211fc619a2d1c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627259, "uuid": "9b729dc0-7d22-4c66-b751-b29ff9fe8f3f", "comment": "Malware payload (RedLineStealer)", "value": "1881d56c8354e613f6e12abb9b50d305eb918aee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627259, "uuid": "fa448e40-1da1-47fa-8bc3-91e1e63d351e", "comment": "Malware payload (RedLineStealer)", "value": "9d5d179f26f507fda1b744b82786703e64f9b7339dcefb674ca575e47543db9f16c95d5c44c20ab6b0f4df28b4c7d45f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627259, "uuid": "29de59a8-9af1-40b7-90d3-08dbbe6c9ac1", "value": "T12B563362BFD8A145CC407DFC1846ADD642A3EC7C6808F1B752AEB8C62B68F94164B71D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627259, "uuid": "f7178e41-50be-4ab1-89ba-c7aca1511adb", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627259, "uuid": "8b478af7-4301-46f3-84b6-0bb6e653c2cd", "value": "98304:8XlOr7z9e/jps4vMbi5UlNNgCa6rrn3D28pUAsRVZ1ylGCLC1S1QeAt:8XlOT9eps4EbitCa6P3D28pU1RjcIu2f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641627259, "uuid": "7dc3deee-6f67-4ae6-855a-92d6b4e00eec", "value": 6078326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641627259, "uuid": "9858585d-872c-4f24-891c-74ac0c6d1c51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627259, "uuid": "63fd3401-93b2-4212-a046-3375f454c614", "value": "KRAKEN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf032edb-7089-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1641649745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641649745, "uuid": "faa677fe-c015-4e58-86cf-30ebdb814b64", "comment": "Malware payload (CoinMiner)", "value": "788b0be09e7dbd0ab8def6077fd2421c", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641649745, "uuid": "1fc41b78-40eb-471b-b338-9c602385104a", "comment": "Malware payload (CoinMiner)", "value": "5eac63fc61a6c010a8be021bf6d86d377f03c10fcd447c1342d0aba35ae6b68a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641649745, "uuid": "672605a1-7d03-4e05-840b-9711a5547098", "comment": "Malware payload (CoinMiner)", "value": "23c41b81995c348c7aa17fabf83bef730a9b98a7", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641649745, "uuid": "5a8fdbaa-da4c-4b35-987f-d9f99dccd448", "comment": "Malware payload (CoinMiner)", "value": "6e77f0baffc497581ca0e5c55d459f78074acd6c2577070b08f0512899d192b40f9fbdc9e957d382a90c1a556953a9c2", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641649745, "uuid": "0b81d0e7-4e24-4ada-bc70-1926bde9c9cb", "value": "T112363324789D28E3CD52F97B29FC811BC72B6A23F7F5010B2B2416EB535DA811D9F246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641649745, "uuid": "1cd6c00e-7821-4de1-b3ab-e02f422d228d", "value": "b8ba55866bfe7b49b97c43084c1885db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641649745, "uuid": "e17f641f-f662-4956-9283-6037974f1e48", "value": "98304:MVhHQK9ib1r4XH59UHIU2VDXJB1rrqlIZUU1Zyyy7Qeo5uLHUT4UHY:uJiaJ9UHL25BvUU1ZyyoL7L0cU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641649745, "uuid": "0aa5721f-2c86-4e31-90d6-bd0c34a910f0", "value": 5201408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641649745, "uuid": "cfe27ed7-08c2-4b7e-afd2-7241b093502a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641649745, "uuid": "5cc2d6bd-53ce-4962-b776-273bad1af1f3", "value": "788b0be09e7dbd0ab8def6077fd2421c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccf4e630-709c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641657929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657929, "uuid": "190b93e1-1adb-4dd7-9805-4e6f21e2c716", "comment": "Malware payload", "value": "d4b4869493b02d2d41c6666ce6dd850d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657929, "uuid": "1bf5d57b-7852-4081-89f2-c4098579a80d", "comment": "Malware payload", "value": "5f0bee7a4d9d935b22ddfdfa7e2d637c96f251aba60c9feee2967241b18bedd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657929, "uuid": "8aebd98e-8c3c-49b3-9cb3-ecdf9809bd45", "comment": "Malware payload", "value": "aef27adc0c9d97c552a3632cd42197e1d5e7ba3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657929, "uuid": "b293d2b8-f41b-4ab0-ae7a-4ec5bb627514", "comment": "Malware payload", "value": "f6f6ba5a2a0c2039c6ff0d7625ce5d3911c85243ab6514bc507e00f690812cdd76d1dfa03c6833718e4ed20dae88ca8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657929, "uuid": "973a76cd-5b40-4617-8c29-7b9cee2b5dfa", "value": "T113B30B52314489BBF2131CBA4C1ED2B224976D64506AA51D75AE371F18F232223FF76F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657929, "uuid": "0ffd0e0d-b54a-40d6-9150-698446c1d247", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657929, "uuid": "1b6aaad0-eb59-48e0-9763-ed3058925065", "value": "1536:FEC+sfb32CCJ8sBp2wYGN5AdiPKwTMrf:FEnsfb32xjBp2h8PJTMf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641657929, "uuid": "b902c29c-ce90-4fa9-a1ac-d87344a6db85", "value": 109568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641657929, "uuid": "ca6c5bc2-0175-4a1c-9753-70fd47a6db78", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657929, "uuid": "2b3fae97-2255-40bd-b81f-a2674a0a1868", "value": "d4b4869493b02d2d41c6666ce6dd850d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "004249ad-7059-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641628810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641628810, "uuid": "0ae98667-1168-4841-836d-985dd7f077a1", "comment": "Malware payload", "value": "7dcd9effd33586461b03cc488698bfce", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641628810, "uuid": "b94bd1b9-ebc1-4ea2-acb6-6e9196be7486", "comment": "Malware payload", "value": "5f68a3f051568e483772f6a31670c99c04faf396040e98f834e82f19431319d5", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641628810, "uuid": "7a14092c-04cf-4874-ac7a-6c04be9027de", "comment": "Malware payload", "value": "1b8a2bcf78694ceab68d5013f62439235b89f753", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641628810, "uuid": "e21df5cf-e757-4232-b846-b006eba6aa88", "comment": "Malware payload", "value": "6617c17b01a736f85ff73e5cf52e77825b1a5dacc81f5cb34a9e9a712c7728ffcdb939709e42cf24bf155e7f0cd4f085", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641628810, "uuid": "4f8e86a8-bf72-4103-b708-922e85701f62", "value": "T1AB85330852B97CD8F9DE022D3B6349D0C2AD32E1B441B0A676595CA55E3B2FE43CED78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641628810, "uuid": "7ec72c6d-e337-41a8-a070-7e521505cbe0", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYY:IDSTOhnXSI0Wk5jG2nfBtkaeY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641628810, "uuid": "75e6c273-b7fa-499a-ade8-d4a4bfc7f709", "value": 1761280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641628810, "uuid": "a530fb38-63c4-4147-91c0-a08f7cdbb929", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641628810, "uuid": "55fb0eb4-d019-4f3f-be52-daf23a873e29", "value": "5f68a3f051568e483772f6a31670c99c04faf396040e98f834e82f19431319d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f85271cb-7094-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641654566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641654566, "uuid": "5fe3e6fe-8da6-487e-a9e7-fefe7769e19e", "comment": "Malware payload", "value": "13ec5227fe52bcf2fc8ca6b1dcc07641", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641654566, "uuid": "681c8667-f4a9-4c72-a218-f2a774cb497c", "comment": "Malware payload", "value": "60c546941d7f705156881e6776c482c50f133d54ba520436291695fd39bff8bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641654566, "uuid": "1d1ef91d-597b-4b27-98be-4280f7f107a5", "comment": "Malware payload", "value": "21a546771c1acdde48a8be21081ce0ae1e376bfb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641654566, "uuid": "4f7f9b63-c524-449b-9670-3119b7f3f626", "comment": "Malware payload", "value": "f8fcdfe266b0908a6f02e187027b7b391467deaaa39be21a19aafe34f16244cdc1ad35840cbd3d839db086a45c565666", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641654566, "uuid": "44f92e93-5f0d-4cd6-8ac0-62f772a90a3d", "value": "T1F1D533244976D318C4D0483C7B27D48423C59A16A7AAE1C5BFAB0E925C5833FFEDE972", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641654566, "uuid": "a6cdcd7f-bd7c-483b-9e3e-13264987cf06", "value": "42b27a080e9ee0252f310f33fbc7cafc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641654566, "uuid": "7123e21c-94d2-4be6-9a16-e4e6295ad356", "value": "49152:4SZ+Fdj+GeVapIBkxFU6iLNYU4+Rr5ZJabTmRjyOaSwFvm3nsYlD0xob:GFdj+0skEdbhRr5OPmRjP1s4RR0ab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641654566, "uuid": "7f377e69-1398-4eb7-ada6-cf15261298ac", "value": 2827264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641654566, "uuid": "ec111517-eea8-47b9-b4f4-ab4a4aa1ae7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641654566, "uuid": "3eb001db-82d6-4da7-b6d2-f14ef38adae5", "value": "combir.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bc0ae34-7050-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1641625017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641625017, "uuid": "ecc1a87c-b0f7-40d8-b43c-2751faf5bb5f", "comment": "Malware payload (RedLineStealer)", "value": "e338a2fa45fa4b359b064e8630c05ad7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641625017, "uuid": "454229b4-b675-41b9-82fa-4ba45b260dba", "comment": "Malware payload (RedLineStealer)", "value": "61837eb9320780523b73477707156a0351b09d83d511f0b28f64ede3eec65e87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641625017, "uuid": "f0b0e2af-0592-4fee-a99b-c332df13a0a4", "comment": "Malware payload (RedLineStealer)", "value": "d6b65942ab54361a0fe1cbd63d13dc3155f9a7dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641625017, "uuid": "ba06ca36-ea1f-4431-87be-39a9f937f505", "comment": "Malware payload (RedLineStealer)", "value": "32f81e3d1a55d51a84b21046ab6661fdfc62f5612a8af20a76ed30b7c45e7aea44e316e31c75421484b485693352c926", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641625017, "uuid": "fdcfe819-3f0a-4114-a937-21b2c7f886f9", "value": "T14E450BDD51C15849CFEF07F00DFBE62E857296C913475BEA732E81F0AB2208EA56D4A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641625017, "uuid": "248095a8-0d2a-4ee3-a80e-e39b6cd3c636", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641625017, "uuid": "995d2ca8-8628-4b62-add7-bd2010fb765f", "value": "12288:UYB/zTkQYtPVT4PRwG6KkxepV8qGMRHhpFkCOOCuH0MYA7N:tFGTszkxlqGMRBpB3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641625017, "uuid": "ebda3e35-323e-4aa2-9b82-5ae6cf0c262a", "value": 1165312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641625017, "uuid": "950404b6-980b-48a9-9630-93c9a7396c89", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641625017, "uuid": "789f5ded-ba6f-4d43-a3f2-19d93296a0c1", "value": "LauncherMod.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "667761a8-7061-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641632417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632417, "uuid": "e4701254-d932-4c39-9920-d985700869ff", "comment": "Malware payload", "value": "a016d67bfd51a60cf2887c66070efc74", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632417, "uuid": "36bc6795-e128-44a8-834e-a83e47be07f3", "comment": "Malware payload", "value": "6943b8087ca90035ba7b918726522cde94fbdad029ee0754557067594a865ef5", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632417, "uuid": "7ef10527-516d-4a0c-bc0c-707bab3767b0", "comment": "Malware payload", "value": "c95d8f338a65f0f829f90c37a2fc2f4fd57d66bf", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632417, "uuid": "5b9f4e08-81cb-41e9-9276-a102d81345be", "comment": "Malware payload", "value": "f091c86edcefcb0822349387bcb6062107136352d098a0b4c0f7c4cec14ccba1be4e545f16f0b19eaf7a5bcb20b2d43d", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641632417, "uuid": "e4f2119a-2514-4291-8dfe-77f208548b82", "value": "T10675330822B97CD4F9EF0629366248D4C2BD32F1E441B09676585CA61A772FE03DFDB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641632417, "uuid": "7ac1bd95-8f86-4607-bc07-daf056a609fe", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8s:IDSTOhnXSI0Wk5jG2nfBtks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641632417, "uuid": "46943777-5ff0-4654-a3c7-2e25f76b039a", "value": 1699840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641632417, "uuid": "93090fde-b52a-459f-aaa0-244f9763a218", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641632417, "uuid": "3fd0e7f3-17e5-45d3-af39-ba85279622e7", "value": "6943b8087ca90035ba7b918726522cde94fbdad029ee0754557067594a865ef5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c1bff99-704b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641622843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641622843, "uuid": "92baf672-fcfb-493b-bf0a-3b33f29872c3", "comment": "Malware payload", "value": "afe42bbbb93a6bd0f657c8182bcc4b2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641622843, "uuid": "e0adc1a0-de20-424a-a235-279a363e7985", "comment": "Malware payload", "value": "6db75599243651cc336024c8d4d14a05be1acb0b64627a724dd87e8aa9677240", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641622843, "uuid": "af28af06-ff73-4e0f-830b-810f5c186142", "comment": "Malware payload", "value": "2bd4a049710912bf2ba1d4a8e333d50491744f42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641622843, "uuid": "b93df235-96cc-475e-b647-8ae7ebcee2d3", "comment": "Malware payload", "value": "2b8777b42e1169abe82a1983a6de668b13805bac48075f2186ea0a0fd42f982092736ebac446d538b1672ac789d97be0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641622843, "uuid": "3fb2f799-31e8-45b6-8b7a-96f058b374e4", "value": "T1C4863300348D26EDF21C85F83E5D659E794BCE9EC7D9B3643680A646C783F65C813987", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641622843, "uuid": "8f5b3c89-2f52-42fe-acb3-30d2797c6672", "value": "9dc580b98fdc55e0bc3b6c6f01e8c0c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641622843, "uuid": "cb38ee69-8262-4fc5-a20b-817d347be1cc", "value": "196608:P1LISF7RWq7zXy6ASw77RzzDCLg01yGqMDgHQ/T1M:P1LtHb+7VoH1yGqK2Q71M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641622843, "uuid": "ec82d141-2e77-494b-920b-df47abce4d77", "value": 8483840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641622843, "uuid": "4ac976c4-563c-476e-a923-ad1eee4dbd7d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641622843, "uuid": "f7c152a5-4ff2-4238-acdb-fafea73d3d44", "value": "HackMenu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef76ef9b-7072-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1641639948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641639948, "uuid": "b1107c01-c123-46c1-a028-4a91d6a66460", "comment": "Malware payload (njrat)", "value": "e11fa56349781d01080d0baba6367758", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641639948, "uuid": "c06086da-45af-464f-822c-fb2dfb5f803d", "comment": "Malware payload (njrat)", "value": "6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641639948, "uuid": "b8524016-2d54-43bc-857f-8bdeff2dcbaf", "comment": "Malware payload (njrat)", "value": "6214bdca82fa0e54a75de181fd1ed95dffdaf35a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641639948, "uuid": "eda6935a-0f74-4e51-bd81-20d1d5990a5b", "comment": "Malware payload (njrat)", "value": "54e0c4e15548f851f763611f7264a62c291833fdb5edbd774b18cb2a5cdea6e604411628a01261c156440969a80000b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641639948, "uuid": "c05e9dee-d580-47de-a000-c607f2cf163c", "value": "T1F047338CBBA209BBF59805732D17E63D93B37C62691271C723F1325FE2B1A5213564E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641639948, "uuid": "1e5964c9-9997-482d-bda0-496121ec121e", "value": "9222d372923baed7aa9dfa28449a94ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641639948, "uuid": "3a462919-ba4a-4be6-a6f1-675a17cfac14", "value": "393216:LWT8mUu0qXUeKjI4pBddVogYuWcDYOPXmSMkWUoEQ+b:LWQPDqk9j1pBVoCWcDDNMk5gE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641639948, "uuid": "1f40fc62-f0db-4aa2-97c8-360e28402870", "value": 25116160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641639948, "uuid": "4a38e83e-c9c9-4309-b1af-516399eafcd9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641639948, "uuid": "3088e2eb-7772-4f4c-aa49-a36fbf9ce38c", "value": "e11fa56349781d01080d0baba6367758.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6884918-7069-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641636014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641636014, "uuid": "9e8a3e70-b0e4-4b78-9ace-bdd61863b1d6", "comment": "Malware payload", "value": "47c16f30d61d3c84a5f6657349cb25a1", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641636014, "uuid": "093b9fd3-e180-45b0-82ba-4ea689d42c10", "comment": "Malware payload", "value": "72a1fba6f0fd0559530821adc7f9d0ae5b9c4fe08163f173ebe4a7fafab8a56f", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641636014, "uuid": "b7b6a52b-d8eb-4f01-a4e7-2afa3b65f01f", "comment": "Malware payload", "value": "b0fb7e92aa0eb6d73d1d69095b6b5374ce247e0d", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641636014, "uuid": "a08ee34d-da87-4a34-a7fc-6db640704df1", "comment": "Malware payload", "value": "909e97a334606ef163b80de1e768b6f921f2d2ca66fa020986a85d09d39ec84120dca93198a54c378d4e0b9ff0a24192", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641636014, "uuid": "9a639402-1b77-4253-9a0d-3923ff8b5952", "value": "T125A5330853BD7CECFC9F12292B5349D0C6EDB2E1F841A1A162545CA85D3F17E039FA66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641636014, "uuid": "43139cf4-2c0a-4711-a4c9-6bfb7c5e667c", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25LfW:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641636014, "uuid": "ae95eaa1-5d1d-412e-8854-1cb1087b9e75", "value": 2064384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641636014, "uuid": "0c286589-238a-4f4a-b7cc-bbbdb98c5fa9", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641636014, "uuid": "4e7e3e7d-ae16-4525-8820-b23abe50175c", "value": "72a1fba6f0fd0559530821adc7f9d0ae5b9c4fe08163f173ebe4a7fafab8a56f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b94b8391-7074-11ec-9275-42010a9c0029", "comment": "Malware payload (Lu0Bot)", "timestamp": 1641640716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641640716, "uuid": "82946c4a-512b-4290-b077-a5da3c5fc9a2", "comment": "Malware payload (Lu0Bot)", "value": "f0060fe1e583889499e41ac779a86ad4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641640716, "uuid": "3b9b3b65-1905-4ab3-948f-1c899d2d63a8", "comment": "Malware payload (Lu0Bot)", "value": "7374cce760bf018df8c602b12e475a66114747d96848168cb939f27afafb29e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641640716, "uuid": "0668a68e-3ce2-4b57-8aa8-03b11eff5c02", "comment": "Malware payload (Lu0Bot)", "value": "fe0685cd1414c9337a3e3f74e0ae5067e1c3b56d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641640716, "uuid": "4b316439-89ac-4bf1-9f50-ab9ff10cf8bd", "comment": "Malware payload (Lu0Bot)", "value": "8323fd0396865c879fb2cbfd5b3d0170b79bb6b2a1bae32c788b9ab55b428c7c4f195fe8b0a8e42ff00a4de46c3e4869", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641640716, "uuid": "d0c16771-2f4c-46ff-80fe-ab6f2461856d", "value": "T1FE5196BFDA844DB0C85F83340C929AB5BB9BD532CAF046119FF209C31A68CE41A7CB45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641640716, "uuid": "774715b8-956b-4752-8a9a-ce5d2b595b18", "value": "fac08b18f975fc2489f943dbd52ece58", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641640716, "uuid": "f189a678-ba39-4f71-b842-e9d1b805014c", "value": "48:6alN9Um/0XD/XO4Rx8K1ES7ONdjD8gmpFpupqJ8kWaB:Wrp1/7sDmpFGyMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641640716, "uuid": "f5ef04ac-6094-41b7-b1d1-3c5ea331e5e0", "value": 2560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641640716, "uuid": "4b444d61-9e26-4b6e-93f4-13ba4dbb6041", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641640716, "uuid": "c18bc8d6-4bc6-488d-a4a2-1e3af143d88e", "value": "usfive_20220108-112738", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd452990-709b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641657581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657581, "uuid": "3952d6d2-1fa9-44a2-87ef-7479e03dd9e5", "comment": "Malware payload", "value": "2c47c31f8cb4d85d17ba362c293c91b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657581, "uuid": "c9524b78-73d4-4566-a68d-212a94e40576", "comment": "Malware payload", "value": "741db24bd3a909064f983f8cdbe7f094f27bf5f0ff51b5a9a64e3f1c5dee3a8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657581, "uuid": "06c99a4b-c0a3-44a2-8759-cbf64c1ba727", "comment": "Malware payload", "value": "2c48f3256fc024925912d603de5438bafe9729e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657581, "uuid": "113f30a6-0d10-407f-ae26-2ff07b7798a8", "comment": "Malware payload", "value": "06b7b192ada826036403eccb1f9c2fc802c03c1d071369062af7e0937be510401bad97ed9b2ed89c655646fbff78ff63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657581, "uuid": "965b1dbc-b209-4dbc-8749-72af5d369998", "value": "T107D4F143F85F7FF4D152D077F661A135834720007EFA98986749A32D79C36228B8B7AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657581, "uuid": "8cbf224c-9428-4ecd-93b6-5e568653c1cd", "value": "45c3eee06bcd5ef7518bc946e1677c4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657581, "uuid": "737fee5b-0152-4a4a-900a-9d650224728f", "value": "12288:KmLbEWoQWuPGBOHzGwFTQp+s9NdwvXA7PTEB5hAZ9wr1+:pLQ0G4HzGwF8rNdwvwzHwr1+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641657581, "uuid": "cf706e76-1a18-47a9-9963-878a6357846f", "value": 642415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641657581, "uuid": "ce459e56-ea71-45ae-b582-663ed52bf4fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657581, "uuid": "bb7c02ab-9286-48f6-a9ba-503611963ac8", "value": "2c47c31f8cb4d85d17ba362c293c91b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "039fc139-7054-11ec-9275-42010a9c0029", "comment": "Malware payload (TVRat)", "timestamp": 1641626668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641626668, "uuid": "63ed3695-b8a5-42b7-bd74-4a5c8c484508", "comment": "Malware payload (TVRat)", "value": "6bc6b19a38122b926c4e3a5872283c56", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "TVRat", "colour": "#739DE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641626668, "uuid": "53522b64-f7a4-46bf-a514-facd42682195", "comment": "Malware payload (TVRat)", "value": "7a4c304b810703f0eb30ae166efb16ff9c1cfb0ebc9db5948e959614a3e49d5d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "TVRat", "colour": "#739DE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641626668, "uuid": "09872afb-51d3-4774-afe4-b14595885593", "comment": "Malware payload (TVRat)", "value": "cd00b7f70a26a5c5cb1d775cb25fec8827c8309f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "TVRat", "colour": "#739DE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641626668, "uuid": "42886e6d-5c61-4335-8444-3c6f1ec1430f", "comment": "Malware payload (TVRat)", "value": "fcb7ee2152eda8809f5557c4e6116360bc57560662bf5ce11b9528ca30ad10287961312bce95e5be1a4bdc44fe2f6211", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "TVRat", "colour": "#739DE3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641626668, "uuid": "d17c5d70-7b0b-433e-b1e6-952cc40bf467", "value": "T17176331BE291AB8FF5C478728AB63151A87F9D3E54C62BF302C09551701B790BA7B39C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641626668, "uuid": "f6363c4c-8a6f-4b2b-b3dc-0ccfed15459e", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641626668, "uuid": "52819f0f-bced-41b7-88f0-ee4f0325dabe", "value": "196608:4wAaWs1y8oBH0YHxKg29+H0r7fcm0nHgIEH76:4wc8oiYHxKg2Gm0nH0G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641626668, "uuid": "b950634f-2bc3-4d31-b7aa-b8932a7cac80", "value": 7246316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641626668, "uuid": "bd724d48-a6ea-4184-99dc-88b3689b352e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641626668, "uuid": "6c2349c9-2b0e-4444-ba9c-817502fdf536", "value": "6bc6b19a38122b926c4e3a5872283c56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78b4ebee-7056-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641627723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627723, "uuid": "f3a7fd61-431b-4d52-a23b-7252101c134d", "comment": "Malware payload", "value": "36126f8ae596e2f76141e58f02f04152", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627723, "uuid": "b1092fe8-9e05-4887-ae8a-2f8f2878d057", "comment": "Malware payload", "value": "7a5466661237c83baa00087d0bd4a2b70437a6e63c1d7e9b0e61f4308cd24020", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627723, "uuid": "6d6b58ec-ec53-483f-a7d4-e5734b174931", "comment": "Malware payload", "value": "d60cdc80b4012ca415b976f1a2e46da24d5b5113", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627723, "uuid": "06f060e2-6a54-4084-9e70-5a178cddbe33", "comment": "Malware payload", "value": "74624a794ba5e23dd16e66a2c15b11eb6e857820909c44a3c0b69e3eb2a97fdf31cad3169cfecd2f3da00cc3c9cc967b", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627723, "uuid": "012730a0-cee3-4849-91ab-fdfe7401d70c", "value": "T16BA1E1E32C039D85D5F5F436A81805ACE6783E579F4B6082F02522F73A5E2C9A5CED71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627723, "uuid": "9507bb79-c5e8-4f21-8bf9-d0bdfee7f0a8", "value": "96:0n2ny6EtQYfuLYsDZYI1UYBYYYUafYlYUYrnGKJuGuuJ7qlBvuD:0MEtZGnaHnGKEG9D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641627723, "uuid": "c01fb953-b4c0-48f2-8c09-e231c3c7d4c2", "value": 4992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641627723, "uuid": "d90394ea-2bde-4013-b789-1fb0ff8207c1", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627723, "uuid": "7235e486-8bb8-4c5d-a1c7-28dbc2c3e94b", "value": "JAN_YDHM007390.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9623b92-70d2-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641681062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641681062, "uuid": "de2a8d22-f057-444e-ba93-5523b2ff2022", "comment": "Malware payload (Mirai)", "value": "02ece254ffedbe37c9012fa780dce091", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641681062, "uuid": "decb006e-7d86-4bc4-8c04-173219278f2e", "comment": "Malware payload (Mirai)", "value": "7cebfb668eba64a48537dfa285741a0b2ff414aa7b0f8f78d470a4a44215c27b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641681062, "uuid": "d32b5b37-2949-424c-93eb-494b2fd12318", "comment": "Malware payload (Mirai)", "value": "4980d656c642344fe63246b83b952d9195f6472f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641681062, "uuid": "b87a5db3-311d-4a94-b1c9-af2bc155ba60", "comment": "Malware payload (Mirai)", "value": "2289049bbf0e735319ccd9a0511e34601ada9fc8bfe4d370188c081311e86561797be9bf74e57d160d05834b9fb3c656", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641681062, "uuid": "d8a4e49e-929d-4890-85b3-54d6e1c2c221", "value": "T1F3F2E038E2645D9BDDBF2BB52A85D2A427E29D822753DCF2008C5731D900A1278695FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641681062, "uuid": "32121b44-cb2a-4940-a494-0df4e7115caf", "value": "768:oZlrBPP5JSz+G04wmsGNIow+gQOBE7R4uVcqgw09b:ofrBPP5J1GrNIow+ga7R4u+qgw09b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641681062, "uuid": "231eed58-7089-44ce-954f-6c4505d2b203", "value": 36140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641681062, "uuid": "bf46c4ab-7bc2-43ff-a27f-9ab80bca155f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641681062, "uuid": "7ecec828-8058-402e-97a5-fe3655e1fac5", "value": "02ece254ffedbe37c9012fa780dce091", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd50253b-70b5-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1641668748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641668748, "uuid": "3638133e-222f-4530-b481-b01893be15b8", "comment": "Malware payload (AsyncRAT)", "value": "bd95731e3dba8d4a8345285fa3afdde8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641668748, "uuid": "3555dd83-36c6-4b2f-978c-fa74926bc80d", "comment": "Malware payload (AsyncRAT)", "value": "7d093e8382b6648ad18ae9e5a0e6b9daf7a752910a2e9793b5bdbf4b978e3582", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641668748, "uuid": "8142f3a7-f713-47b6-920f-a3ec97ce0ef9", "comment": "Malware payload (AsyncRAT)", "value": "cf1d9a1c331081bef7b7828f44a229b02df6c11f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641668748, "uuid": "e9aa7030-bd13-49ec-9744-f59efad3c954", "comment": "Malware payload (AsyncRAT)", "value": "0b12b8c3c77905135fb45967c54f7e6649c5e435bf18aa8b139afcc43353a45cda1beb49f4986b716aa0ebe56b3939dd", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641668748, "uuid": "5e7c38fb-9c03-4ad6-94c6-0817e200a2cf", "value": "T1E75408913C39A5D9E54F0BB0A067E315091FBD011DC23D9F206BB7BA8934789673EE29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641668748, "uuid": "32a88c19-9376-4a7f-9bb7-b0306b7007d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641668748, "uuid": "005b0b91-c1ba-4229-9984-8dfcf278d69d", "value": "1536:ph/E2frZSld8GhOXzyWn0TWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWokWWWWWWWWWV:p5E2tcqDyA0Qn7H5rB2rPBc/KD0MHIV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641668748, "uuid": "f8128015-b8f9-4b59-b812-aabf8ba93c15", "value": 292916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641668748, "uuid": "55545e34-7d6e-476d-8442-0705a56f1aca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641668748, "uuid": "83fe0c58-17d3-4a93-8fbe-4b35b5df6bc7", "value": "bd95731e3dba8d4a8345285fa3afdde8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dc8b006-709d-11ec-9275-42010a9c0029", "comment": "Malware payload (DanaBot)", "timestamp": 1641658092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641658092, "uuid": "7a0fcf14-9fbe-49ba-97f9-aff73c42f292", "comment": "Malware payload (DanaBot)", "value": "f8151b5d4c4e62166a8c2e914f54cbb7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641658092, "uuid": "db62dfee-b781-4bf4-8257-9398554e112f", "comment": "Malware payload (DanaBot)", "value": "7d3b2e91c3cfb16df02f63b973c69a2047b8031295a49e4fffa0fad3dba975f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641658092, "uuid": "9485c133-9a4e-4d25-bad1-083246c7284f", "comment": "Malware payload (DanaBot)", "value": "ee9da83f51b904db29d14847a013c4cff7ea6711", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641658092, "uuid": "f4fe9e39-b69c-4506-a64c-94843c94ae0b", "comment": "Malware payload (DanaBot)", "value": "6e312ec4b160ffde5673545568e8e086d65a87299e2ad527714bd146d3aacb1ca33c14fee6a4e3330ad1978413c9eb5d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641658092, "uuid": "47145ebc-5431-4999-b795-7af8632132d0", "value": "T1C645236033F2D830E8F649B10575D7E19E3FF8421510925EBB18339A5F73DA66A2A327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641658092, "uuid": "57cd7502-cd87-4dfc-97fe-57331c03c542", "value": "3f07075ef838296be9ff2ad3cf3a6bc2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641658092, "uuid": "c7b753b9-5b4d-4b18-bead-a5aaf4aa0bad", "value": "24576:xEsbnZPBs/qcdQHsqWr+c6NKuSOxHsKRKUkMwlxCQ9Z4h:xvzZPBs/qOQHPWr+cEKR6MKRKxMwXj9M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641658092, "uuid": "75f8dcea-d3f1-4785-80ae-2c578af462ec", "value": 1164800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641658092, "uuid": "f4182ab5-df6b-4b5d-97eb-58b0c59ff822", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641658092, "uuid": "3c9858c8-6a43-4b95-95cb-0cd3b9618117", "value": "f8151b5d4c4e62166a8c2e914f54cbb7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8731f3e6-7056-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1641627747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627747, "uuid": "b57d55ee-91ef-43af-b0d8-0872a130d3c6", "comment": "Malware payload (RedLineStealer)", "value": "23d937226d61dd1c9196ce59aca7cb4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627747, "uuid": "c1d94c01-df0a-4e5c-bbd6-96efa6437225", "comment": "Malware payload (RedLineStealer)", "value": "8143c63631df50b95ccfc47822f808fbff228f1da4eb5e521c6352fbc678d118", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627747, "uuid": "54147ac7-be17-419a-80ae-f5497b27f030", "comment": "Malware payload (RedLineStealer)", "value": "0a44f235746d86c350f5db8ae2b807fbe3ca43c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627747, "uuid": "ad49889a-7c9f-4ba5-b551-aa8e4f355e52", "comment": "Malware payload (RedLineStealer)", "value": "b9731101d7d5595e1e4d0b7c789c1418275ae78c1e5c1e73e6b7dfe22926ba77d8c7ecc93e1f2f6da51f458027162b62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627747, "uuid": "36d856e8-4d5f-44aa-a86c-47f669d9c6b6", "value": "T1B1F53308F182AB25CB97C9703D9A749C4A9313DC59D1104BDF96166FFFACA924DCCCA8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627747, "uuid": "1920be35-46a3-4ec7-b935-d55613687327", "value": "c284fa365c4442728ac859c0f9ed4dc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627747, "uuid": "b5fa38ee-d5ff-4bae-b511-744763b87cbe", "value": "98304:/Ak2fHr6xap5HoYwxRcC2SFBn457esKK/66tJ7oJI:/f2fHrsaTIYIpzU6uoJI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641627747, "uuid": "ef66276e-8a72-4067-aa48-ee67bbd35d50", "value": 3564032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641627747, "uuid": "61309e71-a429-4edc-bdbe-7a8d09cb4383", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627747, "uuid": "c180aa30-356a-4f4f-911a-74321819cb26", "value": "Genshin Impact Hack Global.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96b68012-70b4-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1641668146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641668146, "uuid": "570bd360-23d4-46ae-b7ed-17d4acb4a921", "comment": "Malware payload (DCRat)", "value": "b2399846a2b9d56bac00631579d4304b", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641668146, "uuid": "24e46647-899b-4cea-943f-dd09b6ba7ff8", "comment": "Malware payload (DCRat)", "value": "82474e08f4e2a3c366f389a593bf4af4f949b6f0a71fd06215a22fc17d6a1c5c", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641668146, "uuid": "38c04dde-5e8f-4b7d-8060-d26c6644ecc6", "comment": "Malware payload (DCRat)", "value": "767e6f97e82be5a99e2cd415305ec93f79515fc0", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641668146, "uuid": "22cfc141-8e7d-477b-b26b-01f206b380ac", "comment": "Malware payload (DCRat)", "value": "da44ba929c17478fa81bab169bb42d7a7e4e2a898a94f17d6ec2c1bf6ca5ad67ff60a96e4ab5c25cb77823bfb6242d60", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641668146, "uuid": "53633a7a-8bd7-49e2-b5e8-27ed21b3338e", "value": "T1A51518127646CE02E269573BC5DF805447BCAD4176A2DB1A7EAF339D21A13B70E0E1CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641668146, "uuid": "21a47a8f-0bd0-41ab-82dc-9dfdba8d470f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641668146, "uuid": "c3a6d2c8-61fa-4093-a312-524150af3232", "value": "12288:Tz41iA4aQeNiHrqyGR65aP812hJlzOAUxJbzP6TTbMW1qn4:Tzek5q365a0Mpo1qTwW1+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641668146, "uuid": "e2705398-e175-43a4-80e6-a02e83ff9c0c", "value": 931840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641668146, "uuid": "8914ed1b-014e-490c-a9b0-5a02c9948566", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641668146, "uuid": "10f4361e-9f09-4446-89f6-b3a75de70840", "value": "b2399846a2b9d56bac00631579d4304b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "382ac269-704f-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1641624608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641624608, "uuid": "2975fd2b-2368-43dc-b9fb-e813d168c479", "comment": "Malware payload (RedLineStealer)", "value": "4ce8146f9431b9163496ad9de116eb87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641624608, "uuid": "f811fa20-ed17-4515-9f45-2b58687350e8", "comment": "Malware payload (RedLineStealer)", "value": "82f60aeafe345ffc8fa14f80db1217bbadb6e8d74fe63f6e72cb350af4d5b61c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641624608, "uuid": "ede48eeb-794a-4b89-8670-2c9278f9d6d2", "comment": "Malware payload (RedLineStealer)", "value": "f92c49e4f2150fe99cd8da8257158df10cc2273f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641624608, "uuid": "6c2eaad6-3c44-4199-9b86-a79ef73ff547", "comment": "Malware payload (RedLineStealer)", "value": "f0b4feca0a99fe71610cf2b0faa26c987be47b16a46e7edbea200b4231370d6d0ebdb92d91975720d556ab2bc592a7ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641624608, "uuid": "371f8403-4bfe-4fee-8e65-b7a3df4090ab", "value": "T1CBF533130370F952CF850FB050ACF5589CF81E5ABDE8717D8A3605C6A9A39B1EA2CD99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641624608, "uuid": "5bef24c9-d200-4bb7-a887-f4b4f3b8edfb", "value": "c284fa365c4442728ac859c0f9ed4dc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641624608, "uuid": "fc3eb66a-ab47-4a59-8c7b-ce8f16dd4a1e", "value": "98304:eKRBuqk7IOgQhSiMKpaM+0VUXeAGNxS0cEK3p2qwL04NHp7teK5:K7xgAS7KpaMLseBi3EK3p2qwdp7teK5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641624608, "uuid": "c04c6d4a-39e9-4fea-b1a2-19bc5682028c", "value": 3561344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641624608, "uuid": "e695addd-b2d6-4716-af31-d6fa85c5e083", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641624608, "uuid": "8bf5dff7-998b-4af0-b89f-7fbd88b51856", "value": "GenshinHackMenu v 3.4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b35bc1da-70d2-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641681079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641681079, "uuid": "a74d93d9-b2e3-4abf-bdad-dd32d75d83bc", "comment": "Malware payload (Mirai)", "value": "70c11348f911c50b3d88a6ac923c2e5a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641681079, "uuid": "5e4ea1aa-8b99-4f1f-ad79-579d773175c0", "comment": "Malware payload (Mirai)", "value": "857b0b4fd3890e6b7ac26976ff8d92181e876fce9924adef48b89d963b3962b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641681079, "uuid": "d85acb0a-3bf9-4823-964c-7bc6857451ac", "comment": "Malware payload (Mirai)", "value": "0ec0305af071b96d2ac46c08c56cdd47d8a72324", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641681079, "uuid": "55ad8392-9e43-44ce-820d-367980b2b052", "comment": "Malware payload (Mirai)", "value": "89e8d827515ecf81bd1fd57d64fd932671e1bb439fa196b3a6c8a8f577ed6ba011e2e84a41b4310451692b200912895e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641681079, "uuid": "f8f011b5-380b-43d3-b717-6430193e0835", "value": "T1BB03E1BAD2BC3B9BDEFC8A7E318802B44167B6E0778557ACF3111C8965507DBAC5806C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641681079, "uuid": "8d2f8209-dddf-40b0-b909-bfaa78a61380", "value": "768:YeQk4/ZWpZZq+bqIxmope2XwLutrX72c+Zs820/KKsro7rg1wW0:YsyZWdTbqI0opBwLUD72cbCKKywrgk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641681079, "uuid": "44cba753-ea82-4c3f-8f1b-9a39fd6dcfcf", "value": 39292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641681079, "uuid": "f016212f-be53-4032-871a-1c95149f2f6b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641681079, "uuid": "a674d6df-abea-4278-aa2d-97a92c16d8cd", "value": "70c11348f911c50b3d88a6ac923c2e5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5f4e848-70c6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641675983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641675983, "uuid": "ab19570f-152b-418a-85e7-fc83d70e9227", "comment": "Malware payload", "value": "255daa6722de6ad03545070dfbef3330", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MMon", "colour": "#360468", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641675983, "uuid": "d1e24ca5-eabb-4408-861c-fa26e1b0d8b8", "comment": "Malware payload", "value": "86dd21b8388f23371d680e2632d0855b442f0fa7e93cd009d6e762715ba2d054", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MMon", "colour": "#360468", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641675983, "uuid": "d07a90ad-d550-4fd9-a398-8a37e4a33a85", "comment": "Malware payload", "value": "80aedf2eddc9e2f39306cbaa63e59c7a08468699", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MMon", "colour": "#360468", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641675983, "uuid": "d6de163e-b536-4990-be88-2fc173e35f0b", "comment": "Malware payload", "value": "ae6c6a7be4ff12c5bde1e0b0ec2cb89b4ffe5aac7a1509b576997f267750eeee1ef905f133ab38169562e929d6b6e16d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MMon", "colour": "#360468", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641675983, "uuid": "259c0edd-6916-44d4-aa9b-b9823ae9c4ee", "value": "T1E0F36B313281C032D657217489F4DB769E6EBC720B6165CB67D80B7E2F646E28B3835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641675983, "uuid": "f61ce75f-3bc9-4dd3-a8be-b1013254a3ee", "value": "24709cece0af7785c579e84a5157209e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641675983, "uuid": "1ffef12e-5fe0-4649-ad84-881527e5efea", "value": "3072:ikmVcWhCz7cruMlg+PtBxp3bTsZiVXBeN/2KD2VD:/muoCz7cyUP9dbTYipBGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641675983, "uuid": "e9e5aa18-4975-4a02-ae58-c3476013a1fc", "value": 159744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641675983, "uuid": "3d039bd4-8326-4af2-9b32-a216bf590bea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641675983, "uuid": "b8ac6bbf-6407-4831-b635-60f8750c03d9", "value": "86dd21b8388f23371d680e2632d0855b442f0fa7e93cd009d6e762715ba2d054", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a28b4692-704b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641623069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641623069, "uuid": "35d60530-bb68-4596-8bb0-cfd26d22c87c", "comment": "Malware payload", "value": "37457a9e7a82a5247622050e0c8ec104", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641623069, "uuid": "ab5f32a1-0788-4bda-8450-7e48a0b87859", "comment": "Malware payload", "value": "87d71d7df9f3e28a71abb9bb8f6b037a100df45cddb9bdd562137902872ca3b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641623069, "uuid": "41c6a9ff-01a2-4007-9f66-7de5b2357208", "comment": "Malware payload", "value": "42c5f303a6cf82be6c40120532a2ea5dfbc31ff0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641623069, "uuid": "bd0495f5-1125-4475-8cc0-1e2ac88f1ab8", "comment": "Malware payload", "value": "a134da94d8458c811fea4dd384d40726e60f679e79be3f1fd26449a97627bc53b44da748edb8523a6e13f936e27025c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641623069, "uuid": "d772a703-2f6c-4099-8088-03ff9e1db864", "value": "T11BA36A01B4D1D473D4721D3418B5EEA19A2DFE314F669EBB2798162A0F380C25A73D77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641623069, "uuid": "50bdcfef-6b3e-4707-ad37-c6d59ec3ad35", "value": "a945118b1ba1ad5e8cb48cc2275f4b2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641623069, "uuid": "4bac3d80-1e88-4091-b982-17fc4690a324", "value": "1536:s95xOcfwNb5PBH2olCoy9AUEclLt35+grNF2brfp5BdR0CNocU5RvsWuMzcdq0fX:hHBH1GA1cJx5+grj2h2cUDYBqoPMFCR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641623069, "uuid": "01abe215-3f00-40ef-8c04-bc71d7ca29ce", "value": 107008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641623069, "uuid": "d06977a4-e2ad-410d-82e8-6b85d0c26fb5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641623069, "uuid": "24a88354-3f1d-4db3-b87a-b6eb3e87db13", "value": "alcx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e281b0d-70b9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641670091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641670091, "uuid": "a9963b6e-4928-405e-9242-fa703fcb8c64", "comment": "Malware payload", "value": "4326634d93e8f75c9217227f62fc7ebe", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPPasswordStealer", "colour": "#3EF239", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641670091, "uuid": "70d277c2-8ef4-48ac-a79a-bd77f0d19758", "comment": "Malware payload", "value": "87f2943276e614b4fcce5cebc5e63154a821046f6f6bc921abd66e7ddebba22d", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPPasswordStealer", "colour": "#3EF239", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641670091, "uuid": "ecb60084-8256-4b1c-8c5c-16c0347fb365", "comment": "Malware payload", "value": "e89bbdd81c406046fbab2ef0347cbb100ada339a", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPPasswordStealer", "colour": "#3EF239", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641670091, "uuid": "f9d4836c-b31d-4983-8465-178fcd0a1aa1", "comment": "Malware payload", "value": "ca9240d65c6a44c45ec5d6b2907c6d36cdb725c3fbd238c28d52db5834f5e48b4d57c91731fa262d6101f07e0853ebef", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPPasswordStealer", "colour": "#3EF239", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641670091, "uuid": "e742dddb-6e04-4abf-897f-541ad342c626", "value": "T1A0F09E3056E0F2D100145185F2B1DC13D144829E11E3F1E843DDCDBFB09DA8974D0E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641670091, "uuid": "ef623521-bab8-4dd4-80b1-daa51cd668fb", "value": "12:NyDvqpxuP2rEBf79tWogM+ahITsKOGeTzvuDvG:oDvoxu+re79wogMxQr0zuTG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641670091, "uuid": "a292b8a8-007f-4112-a832-8f79544345b7", "value": 493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641670091, "uuid": "8c6c55b1-4d78-42c5-89c5-b57b79eb4fd0", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641670091, "uuid": "b1cbff39-598f-48cb-b794-e193c341656e", "value": "SC0H6cud.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1502b0b-70d2-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641681049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641681049, "uuid": "0da4405f-e501-474b-bf83-f496b9b8c335", "comment": "Malware payload (Mirai)", "value": "e210644c302e8f1f43a04af826c1efc7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641681049, "uuid": "03a25ef7-8f62-467e-88a8-4ad14f4b62ee", "comment": "Malware payload (Mirai)", "value": "882599d01469e5973ecb25fac27ee680fb6c5a789248affdb86abf84b5f14264", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641681049, "uuid": "6b7ae1fa-4e46-4415-9099-cf079a0b02d0", "comment": "Malware payload (Mirai)", "value": "264bf7be4135b2d7a2e8529bb20e93f458fdc866", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641681049, "uuid": "eff05806-252c-4197-9072-eb9e7c918855", "comment": "Malware payload (Mirai)", "value": "530c55e1fcd8da56ed74b3045d57e5375b3262d266d1a0d397ca9ae287361d7b8817a3beab2014f39250d68f69dce70d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641681049, "uuid": "6a858ab6-708c-4996-87d5-eedde36ceb84", "value": "T11EF2016C16CE6B60C37A893CFC7D8940B37B02B4606E7428CE802CFD9BB6A04617F491", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641681049, "uuid": "f5156c70-8414-480c-8feb-f2b845bfa8c0", "value": "768:bro1jvHPTMXUWW1d4bfbX6JW8bRNt4s3Uoz0:Xo1j3Or6qfLyJtz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641681049, "uuid": "c518b210-a1aa-43fc-b619-5d7c526232b7", "value": 37008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641681049, "uuid": "5494c645-af12-477e-b811-1fb914e2d8fa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641681049, "uuid": "7aef6b97-2ed0-403b-ab8d-2f6e8268620e", "value": "e210644c302e8f1f43a04af826c1efc7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa140b3c-7055-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1641627511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627511, "uuid": "e092f263-ca13-4510-b4bd-4faf29656813", "comment": "Malware payload (AgentTesla)", "value": "2cdf3d3e054c21562b024ca8704b05af", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627511, "uuid": "a593d041-a2f0-4c41-95ff-c32addb4bb3d", "comment": "Malware payload (AgentTesla)", "value": "8837397938b0bc2bb52c083da0e6db69e79e71a875f83490b06b403ccb2d59ed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627511, "uuid": "afbe1429-61b8-4f09-a079-fa0d77e05791", "comment": "Malware payload (AgentTesla)", "value": "c5bd32ca31088c498754194efc6f3c19ac971b5f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627511, "uuid": "014881f8-6380-4e96-8b7d-335ce4cd22b3", "comment": "Malware payload (AgentTesla)", "value": "0054cc7c5327fb0710426156bc0d962ebdab39286ef40b021165d307ca3a2d3891266b037353d4e86e830c49205d84b8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627511, "uuid": "e9a758fe-6719-42f6-b62a-055ca2e978c7", "value": "T16DD42306DD3E349C3CB0B8837F56BA9C9E158920343B479795EAEE9C5470E5529FCA30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627511, "uuid": "239f279e-07d1-4103-9f56-bd2ae0ad8651", "value": "12288:hExx2Am9dTboC1RdPHwTKuJ3qloqbPT6Rx0lx/c0bkkCSJLO8IOu:yAdTUC13PHBloYPE0lxpF1Fc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641627511, "uuid": "6d9c27d0-61f5-4d54-b4c9-67b8be8ff4af", "value": 618735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641627511, "uuid": "12d49d87-a743-4eda-9854-8fd525014cfa", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627511, "uuid": "e5bd8e31-4c96-46d5-89af-241ee4c2b117", "value": "Overdue invoice.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8c5e487-7069-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641636018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641636018, "uuid": "07261137-3f35-4698-b1a4-f8189880b60f", "comment": "Malware payload", "value": "d4654241a773107aa9f20e09e6d34401", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641636018, "uuid": "35119fa1-63cf-4b94-9937-cceeecdb8e85", "comment": "Malware payload", "value": "88464c94acfed7460203ff6a5b21958810dc8aa67d41d811f528f2e231620e73", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641636018, "uuid": "6536a417-913f-47e6-a329-bd0ee1225922", "comment": "Malware payload", "value": "f75103317899506411c9fcee39dcb21db3ac0420", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641636018, "uuid": "8de789ae-d629-4b81-a1c3-f94141ea5e28", "comment": "Malware payload", "value": "6b0294cbf87008cb01c8c325dfe06bf6ccf2699499788a7890fabfe2df7aa232bfa030732984534ee026f12f9a60373c", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641636018, "uuid": "dc933209-3e15-4e2e-b0bb-50050298f92a", "value": "T10D95330C52BD7CECF9AE022D3B7289D0C2ED72E1E441A09676545C696E3F1BE038E965", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641636018, "uuid": "b9ba115b-a313-498d-b7c5-8a54a5e7f8ea", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOds:IDSTOhnXSI0Wk5jG2nfBtkaeytFO2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641636018, "uuid": "674f6711-a885-47ab-8d68-a381d02bdd7e", "value": 1880064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641636018, "uuid": "495d1aa1-b5b9-4f2f-8c91-0a7d1affbdc0", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641636018, "uuid": "bbf8da12-7646-4840-aaab-6b2866320a66", "value": "88464c94acfed7460203ff6a5b21958810dc8aa67d41d811f528f2e231620e73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a51ddda-70ce-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641679319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641679319, "uuid": "2bc75e45-96fa-41e0-8fe0-7343e1cdd194", "comment": "Malware payload", "value": "1d28e138a9ecf1c9b3240868879bbd54", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641679319, "uuid": "5a02619a-1861-43d3-ae54-9c733df83640", "comment": "Malware payload", "value": "91789d02b5cead0d471ef1948b468b32edd66a072fd7c01834a3962141d25c13", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641679319, "uuid": "e2621d56-283f-4ab3-aeb5-efee5e03aca1", "comment": "Malware payload", "value": "21211142d6d10fe03723f1f235c2ec1296f40a49", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641679319, "uuid": "df17d0a3-b3aa-420b-a2b8-068ca130965e", "comment": "Malware payload", "value": "3b7ac8bee4f5f574074104be444e96cc61010fe28351962a03ca88e52a51dafc66179031d4983ee3627342fab8211045", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641679319, "uuid": "14f19f0f-cdda-4840-b563-8cf3b38e93ed", "value": "T11F751252F345E872E173C636897A834365698C888E46E7573506F72C9EFFE06CA44EC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641679319, "uuid": "0031673f-1d27-411b-9544-56a2305ba597", "value": "24576:wFScS70LxMfV+aKKK9wXrA/s2pFMNJTEYrU3tX3BLtEhpMjQ4OFXiWV7ALtmX9cH:2ScS70LxSZU3pFMvgY8XxcmiLCLtmOH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641679319, "uuid": "1684fd40-a513-46dd-9218-f9af219cfb7e", "value": 1694321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641679319, "uuid": "bb227db9-c78f-49d2-bbc9-b1d0312a644c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641679319, "uuid": "ba03191d-1262-4c6a-a714-ddcf4f67f249", "value": "Player.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9144018-709b-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1641657493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657493, "uuid": "cbe0d4aa-a44c-4575-ae4a-9032c5908778", "comment": "Malware payload (ArkeiStealer)", "value": "e23ee3e23547bd5224cfdb44153981a9", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657493, "uuid": "392b32db-7e7e-4d75-a33e-bb4f69a4a4bb", "comment": "Malware payload (ArkeiStealer)", "value": "918e0831ad0dbda80d659c0f6208ae67bcc45f6f5d542599bc3a8a5c63169e6f", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657493, "uuid": "7992e4e8-6a13-4656-8b53-d3f795a577ef", "comment": "Malware payload (ArkeiStealer)", "value": "e79a7056ac95b119da7047f217b805cae2e4c20a", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657493, "uuid": "04016f97-67f2-4a14-a452-758238890aef", "comment": "Malware payload (ArkeiStealer)", "value": "719703de06cec7c8edddbf709231484ce538acf3d38c9cd4efede26f0f85de351310975fc53a2e2c62282818be2c65f8", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657493, "uuid": "4f594208-b594-403d-8155-5f7ad4a52fb6", "value": "T19F64CF103AA0C832D7E619304825E6B56E3B7D2A1B71C66F774817EE4F732906E26397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657493, "uuid": "e3b98255-de8f-4afb-ad77-b6d917c363e2", "value": "3f07075ef838296be9ff2ad3cf3a6bc2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657493, "uuid": "b56d3039-5af9-4f39-934d-7f6b71910927", "value": "3072:n/DoLe8VAfbgZa822t8KBFDnMNcEvXvVrgEDwjMvu8OuG2S0L7hs:nLoLe8V08a86IDnMNcEv98EcjMlI2hK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641657493, "uuid": "d90b6bd2-87f7-4610-9e6a-98be3d0d9672", "value": 307200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641657493, "uuid": "c5a020c4-6c47-4611-9ab6-c3850bb5f028", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657493, "uuid": "84a7a1a0-97cd-4a26-bb98-cf0577a30dd2", "value": "e23ee3e23547bd5224cfdb44153981a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb0b17ed-7069-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641636022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641636022, "uuid": "6ac89ebf-b0f2-474d-a2c0-bd75f96fcd06", "comment": "Malware payload", "value": "8372792b6fb7f55e1854de0e81526151", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641636022, "uuid": "a3820f7e-51ed-476f-a87a-e182cf48fdb8", "comment": "Malware payload", "value": "9733a3f585c73c70ac2a56eb993e5b743e0a6b666b3fbeee67b9423195970ea0", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641636022, "uuid": "695bf50e-467c-4e43-bdd5-1d2fde8dc827", "comment": "Malware payload", "value": "3ff081bff0b13661a4caa90dba78e65e15fccc0d", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641636022, "uuid": "4ca01edc-0c43-4016-bc97-ef22a25ef677", "comment": "Malware payload", "value": "7e3f97a403dc9440df6e7403d33fc10592086c5f8b809ad1f9dfb0677ade95d222a742c362139539f2221d8516d0e82f", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641636022, "uuid": "577bfbb2-8d05-4b57-b6cb-8a35eb73588b", "value": "T1D595334C62BEBCECF89F12293B6249D0C2FD73E1E44161A1A2545C745D3F1BE039EAA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641636022, "uuid": "c1c35ea5-8faa-4142-8edc-3ae942d2201d", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW2O:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641636022, "uuid": "dad6282a-b592-477e-ac6a-b191eb5ef385", "value": 1978368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641636022, "uuid": "641c1320-1afb-4360-8f02-23b72f284a9e", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641636022, "uuid": "61aab531-2f01-4c7f-8f79-4c3e6efa2aa1", "value": "9733a3f585c73c70ac2a56eb993e5b743e0a6b666b3fbeee67b9423195970ea0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67459e1b-709b-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1641657329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657329, "uuid": "87f9c9cd-c0c2-46c8-8706-16da98d8a313", "comment": "Malware payload (AgentTesla)", "value": "eb1d676f071a55426446471c28f154a5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657329, "uuid": "76dc706f-d836-430a-931d-7f99814df368", "comment": "Malware payload (AgentTesla)", "value": "99411f26d35fa8f0a9ea957f87c63eea48146d012061d75de91d99f50d613b9c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657329, "uuid": "36d4b649-239f-4404-8e41-025e6d8d8a22", "comment": "Malware payload (AgentTesla)", "value": "c7d03208fb3257766ecb6281ccb96ee21832578e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657329, "uuid": "db0dd04f-88ec-4199-b075-4762b1cb4ab4", "comment": "Malware payload (AgentTesla)", "value": "0194a028b2e5e87d53fa5c3520bd31642aaeb5f26b5cbe32b30571913b831389c087a6bde280e21c05ddeb7d1ebc4aef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657329, "uuid": "7bef7dfc-d33c-4dee-840e-eb2eebd8f136", "value": "T146A412E055D48AB9E8950BF2C5BAD56116F2BD1D2476FB8E62CCBD033A7330590A3F06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657329, "uuid": "b95c6929-06e7-4b71-8253-f0302a248767", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657329, "uuid": "41c0d216-599b-46fa-9b07-d41d0ebc4454", "value": "6144:ugp+pi1JwdvhkBYiNA2G/iPB47IcGknaOAA8ZIfyNPhXrkqDlo/BdjQgaW6Ul+As:SpwJwdvyvbB4McnV8ZIfyTXrkqhoji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641657329, "uuid": "5261d950-d5b4-407a-bafc-fc2c0dae9899", "value": 450560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641657329, "uuid": "e5226d4c-8000-4a24-95b8-d2cbdbce69d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657329, "uuid": "46ebe621-8e33-4a72-8d57-dbdcc5c85ed7", "value": "SO#_UPSDT_INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a29a1c2-7069-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641635805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641635805, "uuid": "7d618980-d888-439c-a054-1cac7434e7d5", "comment": "Malware payload", "value": "9dc62381cf30afe0169bb67a8356c216", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "nttdocomo", "colour": "#8585D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641635805, "uuid": "35ff6e78-558f-45bf-b01b-a3b26f819abf", "comment": "Malware payload", "value": "9c090d05c930c7bf7cead3afa80e31e384cb650cc70390d56cbdb26addb2f31f", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "nttdocomo", "colour": "#8585D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641635805, "uuid": "c4a6e65a-c4cd-4745-8316-fd3eae6b4b12", "comment": "Malware payload", "value": "08afe0e3f31f6692c7aa963a1ea7b64102480bc5", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "nttdocomo", "colour": "#8585D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641635805, "uuid": "e5bb53e7-0efe-400d-bf72-50c368bf5e5f", "comment": "Malware payload", "value": "0305b3e934d98aeff979e31e67e83726e2c7584bc2ed63ac7028c830ca0f04ee407f8a18e4ff2251a6b033563ab8b30f", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "nttdocomo", "colour": "#8585D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641635805, "uuid": "ce4c5e91-50b4-4486-990f-d63f1ea526e8", "value": "T112D5F1C5B780AD2FCD7A44321F565232A667AD068E93CB436995322C1D73AD80F6DFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641635805, "uuid": "40b3af6a-60c0-4cb5-9321-b3a7c51e8801", "value": "49152:UsOoqQ+4yCn0i3q0mVRkH3mvUe9jBPjxmNFo3oGlCfAisxg1dCF4tNa+HuF:nOoN+rCK0mVRaM/Vjxp3sgxQFNa+HC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641635805, "uuid": "2c6ed50b-745d-4520-b82f-20a53f3fa673", "value": 2828133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641635805, "uuid": "0804e38b-0425-492e-9e39-92e23b199c30", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641635805, "uuid": "11ebabbc-bef3-4679-abf9-2a2eaca2f3c6", "value": "NTT\u3042\u3093\u3057\u3093\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7651bd5-7052-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1641626083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641626083, "uuid": "47e9e4ed-bf2e-4d34-ad0b-77bef4a57de1", "comment": "Malware payload (RedLineStealer)", "value": "b9da11bb39e247c90a087f249e0913a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641626083, "uuid": "00c48537-300e-49d9-b32c-d4f306d2e7d3", "comment": "Malware payload (RedLineStealer)", "value": "9d315fcbd3b7b8311d874139200ef353bb2eb2d062aea3016243f37867bc414f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641626083, "uuid": "8caf9261-a688-4cee-ab96-18f11c6c0c8a", "comment": "Malware payload (RedLineStealer)", "value": "7d6fb1c4f045499a36861fcc518b44d79930a70c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641626083, "uuid": "a2d556d2-af6d-4a29-b632-b7da784b38a9", "comment": "Malware payload (RedLineStealer)", "value": "04aae26d7e4f1fe6aae786ca52e189c81faf650701edc1d1f2981543e75d204e7ddf6720b3554c8dadb457095f594bb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641626083, "uuid": "c66a17d8-b331-40e9-b219-3e1db2a50429", "value": "T1F0F53334A514EC2CD5CB27F1E91DA125C627C965A4E8A3022FFC8EED66217127F4DF22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641626083, "uuid": "0b49a838-4b63-4f9c-ad3f-ccf1453128df", "value": "c284fa365c4442728ac859c0f9ed4dc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641626083, "uuid": "b2943da0-6e3f-49c3-b1b1-d55677d1a02f", "value": "49152:Go0lbENgS3NrEeQK0YRm2hwilkROrhVWQUM2Uo6FhHTav1K4b7HYNaaU6NVh:p0lbSNQNYE2hwgvhgQUMV6dK4gVX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641626083, "uuid": "7f3c086d-2ae5-4911-9422-87d913acab56", "value": 3564544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641626083, "uuid": "abb7fa4d-696f-4bec-aa51-f4d411d886fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641626083, "uuid": "b180fc22-b313-4d87-9c70-730dad3f66a4", "value": "GenshinImpactHack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47ff0685-70a7-11ec-9275-42010a9c0029", "comment": "Malware payload (NightSky)", "timestamp": 1641662431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641662431, "uuid": "9ee0c599-280a-4685-a1d6-f6d517ca662b", "comment": "Malware payload (NightSky)", "value": "2594077763e054861c086f49b8b1e9cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NightSky", "colour": "#B05DAF", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641662431, "uuid": "efd0eefb-2e6e-442a-ab50-c245d7323ee6", "comment": "Malware payload (NightSky)", "value": "a077a55608ced7cea2bd92e2ce7e43bf51076304990ec7bb40c2b384ce2e5283", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NightSky", "colour": "#B05DAF", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641662431, "uuid": "a35834d3-0538-4913-89aa-1112e3b6edac", "comment": "Malware payload (NightSky)", "value": "44a124b9e5894b69a1ef108d9afcdb64e3591162", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NightSky", "colour": "#B05DAF", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641662431, "uuid": "da91e019-25d5-4ca6-9a1f-738178b37be9", "comment": "Malware payload (NightSky)", "value": "ee222bb13e852fa6c0aa2f96b0c8bf5f588f308ddbcfa56e111e6f0f9d2af0bb65c9493054ebe1957e4325bc1afe51dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NightSky", "colour": "#B05DAF", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641662431, "uuid": "0d5636ed-0814-4850-b43f-c65ea04b2cdd", "value": "T1775612FE21483318C41ECD349423AD59B1F6651A0BB99669B9EBFFC06F5F811EA12F01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641662431, "uuid": "48a676fa-f465-4d9c-8e74-19ad8e64781d", "value": "d9335d46ba7ec00ed7f9cc1bc2720cc8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641662431, "uuid": "1611a847-e722-4202-b55a-7fb9e2b021a0", "value": "98304:7iTgMQwfZtqifsjEiwkA+DUg47V6pH/LZAtpla02dK70xioBqOyo:7SBttRiA+4GJtAZa088hO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641662431, "uuid": "1acd0789-a3f9-4470-bf18-86f4a1313667", "value": 5945984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641662431, "uuid": "7b05af8b-095d-4405-b6de-53d6a2a54111", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641662431, "uuid": "dbd5a841-f2a6-4fc9-b5ec-df76593fb089", "value": "a077a55608ced7cea2bd92e2ce7e43bf51076304990ec7bb40c2b384ce2e5283.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f14c1815-701c-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1641603015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641603015, "uuid": "75ef4ea8-3f36-4fcb-964f-e3b6813d8ac1", "comment": "Malware payload (SnakeKeylogger)", "value": "2cd5e283aa56e72fd8ff5a1f074c94c1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641603015, "uuid": "122d5f14-9f68-48f3-8b2e-7ac9333b5af0", "comment": "Malware payload (SnakeKeylogger)", "value": "a22fbf5e55fb41728d061250d6372caddc4d2cc01bced6003c8532264d3ea71b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641603015, "uuid": "2ac0ac67-d0e3-41eb-be0e-778f5e2b4532", "comment": "Malware payload (SnakeKeylogger)", "value": "06c689908c30cf987e17356dc9c8b3c430734bac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641603015, "uuid": "80ff696f-4983-4d2a-9d2a-f308c00f975a", "comment": "Malware payload (SnakeKeylogger)", "value": "9aec57094727236485d185299e977ddae0aacdee16bb470aabe00e9e57dd93f32bd9fceb88eaa920d2d759761192eaa6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641603015, "uuid": "31f598fb-b7f6-4c82-b059-eb3922167edc", "value": "T1C7551771FABB8692C25C8733D1F8580E83E1DC409A63D71BA5E922A51CD3FA64D4361F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641603015, "uuid": "43e7f63e-0273-40ad-bc75-8123b8f38528", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641603015, "uuid": "778500f2-83b3-4a66-b27c-1d5ecf369e57", "value": "24576:fYBvTK9PxigETT+WlaQ4aJCtejO/kxpIyHKxGBoCoIb7ChsihlXrSrL6P9B6PhEC:fKIigMlaQ4QCtejO/4KyHKxGBoCoIbGq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641603015, "uuid": "85f3ecc6-d5b2-40c5-9692-c38eea7fc146", "value": 1352704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641603015, "uuid": "8255c7dd-40f3-4045-b787-474ba53ee469", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641603015, "uuid": "8dfe7a4e-d431-4574-be28-a0d0c9ac9ed6", "value": "2cd5e283aa56e72fd8ff5a1f074c94c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1c227de-7052-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1641626208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641626208, "uuid": "9b5279b9-6e1c-4626-b82c-c3c2ee007a27", "comment": "Malware payload (AgentTesla)", "value": "d03673d946a0503bded45e9d36fc2d9a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641626208, "uuid": "eff3c70a-061b-4e97-ab67-67f09b2e3ae2", "comment": "Malware payload (AgentTesla)", "value": "a612b4736bef50a4d1dccb200fa3f59c17cc51e5488f4dd6f6a5361b6b4cb2b5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641626208, "uuid": "36eb7452-6039-402f-b86e-85d14f732429", "comment": "Malware payload (AgentTesla)", "value": "1dcafe04faeee87a377178acc99979ed48fd83fc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641626208, "uuid": "2bbadd79-5d25-4d1b-862e-bad1a39929e1", "comment": "Malware payload (AgentTesla)", "value": "f22df455a82b252ba3a0ef94b28a939d8a476fbcd7a8eeb7ac184631cc87dbe57f76882c56a10f253cedd30313353d7b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641626208, "uuid": "cef24b65-a2c8-4223-839d-0ed93b5a4a4c", "value": "T1A405E0CA21E9C5D6ECFADBF82DB2A0030EB5BDE095A1D14D2E4D314965B1FE8851CB31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641626208, "uuid": "ff212061-e9d0-4bd7-a580-ad67dbfb8ae4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641626208, "uuid": "3b33cbd3-a6ab-4691-9c57-319bf4a523e4", "value": "24576:JY1tVIJkUH0x1SwV9374SBfJtZ7ycdrHDQ:JYX2k0g/93HTZuIjD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641626208, "uuid": "85a8d58d-05a2-4cd2-90d4-6665f20104e2", "value": 864768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641626208, "uuid": "404c9f89-875c-46ac-9035-4dc1d83715f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641626208, "uuid": "52ead30f-0fc8-41cd-a87c-c1b767c5ca4c", "value": "BL-SHIPPING INVOICE DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "690758c1-7061-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641632421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632421, "uuid": "fc39956a-9515-4f10-af13-a77377434d5d", "comment": "Malware payload", "value": "7c43bf9fbad736c982199d7f7771f566", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632421, "uuid": "8abf2174-21c8-43ab-bca9-f3773c9a59b4", "comment": "Malware payload", "value": "a71bd44d4631bb60ebb1dc45cee1f7f023a914bb80fb9c7bed2a722a774f73ed", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632421, "uuid": "1a46bdaf-0dac-467b-94f8-6789e4c82ff8", "comment": "Malware payload", "value": "f0664eac7b90584795f1b60d7c87e98a9cbf70c3", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632421, "uuid": "255bd3c3-fca2-4de3-9fd6-4f8471803d6d", "comment": "Malware payload", "value": "d1ee7d5ea2ae0bad0e6726c2a960e50a41e9e8fd20dea82486a641a3c8d64911f9c6925061864f0c4e3e99d6641d564f", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641632421, "uuid": "442e2841-23c2-4208-8ba5-b84baafee939", "value": "T10695334C62BDBCECF89B13293B6249D0C2FD72E1E84161A1A2545CB45D3F1BE039FA65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641632421, "uuid": "86e87f59-51d0-478b-b541-b7f326a38108", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW2C:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641632421, "uuid": "8b0af0c9-a142-44ff-b7eb-c6b707a39321", "value": 1986560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641632421, "uuid": "79bad214-3e06-4401-9c80-4bf65d16f5bd", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641632421, "uuid": "a3df0062-246f-47ad-a220-cf20783939c8", "value": "a71bd44d4631bb60ebb1dc45cee1f7f023a914bb80fb9c7bed2a722a774f73ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd3e3849-7069-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641636025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641636025, "uuid": "8f355e6b-c949-46f1-92a7-ee6f8bd35fed", "comment": "Malware payload", "value": "c6e5b94e76a9986a0c525289a638ef5c", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641636025, "uuid": "4acebecb-66e5-4f81-8f3a-c77d8f1f3c0d", "comment": "Malware payload", "value": "a90981e23d7bf1229c2ea39792be6d2a901a618d243dfdbd109a6e7f46084bfb", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641636025, "uuid": "98027a33-8e9a-412b-8e1e-74825e809615", "comment": "Malware payload", "value": "1b6cb42f46e7be681884d8ecd7b62e5f7acee4cf", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641636025, "uuid": "2baec5b5-fb4f-413a-b3ba-5423ca79d9c7", "comment": "Malware payload", "value": "8f1f227c186e98fac0c71c6d871fadf327dcef8dbec3b13c74f431e3024e66758aa47933e6da974a055ab37deb6408fc", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641636025, "uuid": "6b27efa0-ddb7-4793-adfb-ca7b171f7a8c", "value": "T166A5330C4375B9ECF95F06286B638ED0C2ED72E4F94160E2A2641DA45C3F5BE039F966", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641636025, "uuid": "9b295126-d2b2-4311-9066-3b750e06056c", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25LfS:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641636025, "uuid": "457e9c45-4817-4c13-b5a6-ba9d6b2422e4", "value": 2211840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641636025, "uuid": "4b3c42b4-e215-44e1-ab2e-343eb3905f1d", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641636025, "uuid": "1e0b92de-3186-4666-bf14-ff90b04f5be3", "value": "a90981e23d7bf1229c2ea39792be6d2a901a618d243dfdbd109a6e7f46084bfb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "136ccb2f-7093-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641653753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641653753, "uuid": "a7c917f4-cf38-4447-b9b1-09ab8102a8fe", "comment": "Malware payload", "value": "8688e1320843517798a109556e2bf147", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641653753, "uuid": "1fb8e20d-d16a-4797-a93f-52ad3b7702fb", "comment": "Malware payload", "value": "aba1b7babb81b1f6dbdc4d940d5fca6ea531ccb7b387c4bf000d1cba781ad948", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641653753, "uuid": "c7b234f1-91a6-455b-bf19-b05d7f908891", "comment": "Malware payload", "value": "6bbfab2ccf4a73af7ca7349294d80ff4b46b498b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641653753, "uuid": "8c24bc29-06da-4b24-a537-a9c99faa6f5e", "comment": "Malware payload", "value": "6f2f75b4cbb815adc30986b02941d44b0553d4786ea76c766be447fcda7242aa5c3f50dd64e8d065ffa567e3a954a30f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641653753, "uuid": "19fa8199-106a-4ab6-b5ef-73d219f40e68", "value": "T1DDD5330D3C876507E39D9D31A255FBCA8669AF008DB923F5240F0A72D449DA993F7EC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641653753, "uuid": "fbf60706-a684-460d-b698-cbaa984ed0c0", "value": "42b27a080e9ee0252f310f33fbc7cafc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641653753, "uuid": "39e6a543-9dee-476e-b62f-a7cbc2b65235", "value": "49152:2AOnZQrVe9gKoqxsONuJeBnuHMM1fdTTx9je4PXHCOz87Ilwu4fmS2OuUj62:9OnZMAgtb3t1ZXRP35gve3OuV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641653753, "uuid": "c7fa8329-6851-4316-9686-abaa34fe0495", "value": 2889216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641653753, "uuid": "02a2cc9a-059b-4d86-be45-d42b93dc248d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641653753, "uuid": "4c961fcb-01d4-43af-969d-d64b8c71ec71", "value": "inrhed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5229c7ab-705a-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1641629376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641629376, "uuid": "33a9ca95-c020-4de1-8402-77a5f2c7dd39", "comment": "Malware payload (RedLineStealer)", "value": "f611529b02c5086e13afa8520798e68b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641629376, "uuid": "dae1016e-9a1a-40fb-9d74-2cb758ad1d8f", "comment": "Malware payload (RedLineStealer)", "value": "ac2b0a770779288e613f5a3eae236a32d4d25dff57a0785b07b81a58a43e53f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641629376, "uuid": "d5bcde62-bc88-4c7c-a85f-34682a2ad0ee", "comment": "Malware payload (RedLineStealer)", "value": "421fad450be30a6bb61b59613a3e7659750afbab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641629376, "uuid": "515bf5db-0796-4259-8ff7-084fc56be0ca", "comment": "Malware payload (RedLineStealer)", "value": "d6ed40e39315e762e9fffd828161c3d4787ab3af113e836f69fe57e4702ee75eed0366c53bd7370ae34353f1304806fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641629376, "uuid": "e9ec042f-9c28-4ff9-8234-8c8d42375eaa", "value": "T18635228C5F952782D1BBD678CA86F73927425F94A016D34BF4B63D22B215F832C1D8CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641629376, "uuid": "58135a54-47e5-44c1-a432-21ea72b531e3", "value": "1fc87f42c368292d759cf3279c8fcdcb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641629376, "uuid": "998b3835-f8bf-4932-9632-1062a35c0bdb", "value": "24576:4EpUtrAZhheqtyVu31Iujkdn1GaGPzIUk1Ey5:9UZAZCiyxN1GhP0Ukj5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641629376, "uuid": "04554b4c-d37a-43bf-9f25-542f92e074e6", "value": 1097088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641629376, "uuid": "3b52bd53-2ce7-4c3a-8294-a2efee54bd5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641629376, "uuid": "bcabc33a-d85e-46e9-acba-e4e880719eb8", "value": "f611529b02c5086e13afa8520798e68b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9eea3e4-7089-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1641649737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641649737, "uuid": "5c002989-ae10-42e5-9ce9-df5c696ef8f1", "comment": "Malware payload (ArkeiStealer)", "value": "8da8a8243f31492604ca9d893d877388", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641649737, "uuid": "b40983ea-edb8-43bd-bc9d-8c74e17d7008", "comment": "Malware payload (ArkeiStealer)", "value": "af01a7c85a964816f29a90703ab0db0e4afda17e5ab4842a0d7f353284f17646", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641649737, "uuid": "df016ae9-6145-48a7-9034-e5b9d56eb597", "comment": "Malware payload (ArkeiStealer)", "value": "d4bdfb1a7873cc2f81928712ac0e0a6a00c7592b", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641649737, "uuid": "529604ff-55e3-4c0d-b6da-dfa94518d739", "comment": "Malware payload (ArkeiStealer)", "value": "386129fd914b409cdea9ab450ecfdd8145dcda0cd48166ee38ee6e9e66448a6790934ae3e4521d25c03774bbcce0cb2f", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641649737, "uuid": "06bdc34b-944a-4b41-aab9-5d07664ef9fb", "value": "T1C3653313FB4498C2D4799AF3720F68D626E23E79D190E78B7984E34D8C52913931ED8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641649737, "uuid": "904f55c5-c961-4903-91b0-0a7f35fed217", "value": "450318a2f12449dafcf04416eb1833aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641649737, "uuid": "290dafe4-5681-4bee-95cc-f0683c3888e7", "value": "24576:YnTCI9lVIgDY6kPd7nKPdsHPd5CIfCIjW2Y+lyaOmGvf98k+EUCjIStYJnddPBjY:eIZJlul+lo2YMvGvf9MCj5tYJnddJ1tw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641649737, "uuid": "68af801c-c4fe-49b0-9c9d-7c294df6af58", "value": 1524624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641649737, "uuid": "a267ca18-c5bf-4911-88a6-ac3f8dbaff94", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641649737, "uuid": "4383bc27-ca98-43de-b99a-a64f546797a9", "value": "8da8a8243f31492604ca9d893d877388", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96e83381-7075-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641641088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641641088, "uuid": "f0226c44-08b6-4900-a8cd-e8b5e17cd233", "comment": "Malware payload", "value": "16c633a0dbc26c0b9ef72208078ba8ba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641641088, "uuid": "fc2443e0-044e-49d8-885e-245843107ad8", "comment": "Malware payload", "value": "af04cc48b865042951d3dacef41c86ef7592dfd5dc1479e5cf95cf5cac08f4b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641641088, "uuid": "b8a98b59-617b-4947-9b86-acf3d9127d8a", "comment": "Malware payload", "value": "c7c1c1093776051e6bcc9df6e82f20e0aa9792df", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641641088, "uuid": "98318a29-1763-4827-999c-c7799a5b35d2", "comment": "Malware payload", "value": "2379457e28eee9976dc654390b83a25e1aa79a7812576ea5f4d4cef47c4e2008aa3968c774b70cc104bcc9468bd80c04", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641641088, "uuid": "e022329f-eb12-4355-97fa-29d1a6ecb4cc", "value": "T11D65230204E3AC81CD09C3F381672ED49D4D0CD19B9EAA771F536B9376286B1E97F988", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641641088, "uuid": "8eed2c40-1bfe-4ed8-9e47-9a8ad07cb3a1", "value": "f6af73011d9ad7cbccf66eb190442910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641641088, "uuid": "edc848ea-1198-4767-b246-88b8ea8a72b8", "value": "24576:I5HMKeFE/1RMh0entGccbicJCVdxlCWkJj+KxlejxqBP/fxMVIhgmkEaHNYK3rkA:g10EtRCntA2prC1jvej8P/fxNh7Nad8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641641088, "uuid": "b1de78ca-7a91-4099-a5e6-a68b81c34f23", "value": 1523200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641641088, "uuid": "1e4a5ee8-2b07-48bd-bf46-6976ce27fc7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641641088, "uuid": "1bd69f06-03ae-4a07-8791-b17bc81b2555", "value": "16c633a0dbc26c0b9ef72208078ba8ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50c19937-70b7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641669317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641669317, "uuid": "32cf4e55-51ef-4d1b-b8d6-9068ab56ee2b", "comment": "Malware payload", "value": "6bfc3d7f2de4a00fac9b4ec72520209f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641669317, "uuid": "754fd026-92ab-4c4e-bac9-1badfbf2ac1c", "comment": "Malware payload", "value": "b039b93d8cf1911397f74a703784d69363544f97f059266256cbaf419e8b2c3e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641669317, "uuid": "0d4c2493-9b96-4d17-8950-3694ca2966fc", "comment": "Malware payload", "value": "0dc92779c7bb4c9d6c3a02ffa176199f652b3976", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641669317, "uuid": "82d2ec7a-6598-484a-bd0e-25ef0b39af30", "comment": "Malware payload", "value": "c05ed958eaf98cf71045e18d1934bcc3c5f5be9629c73cb3831332ebfdfeb72cb351e83e2b904542233cc0df15a454b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641669317, "uuid": "2fe16146-25e3-4a46-b18b-1b7b041f9ca9", "value": "T1A284BF14EBA0D035F1F712F849769368BA3E7AB14B2490CB53D526EE46786E0EC3171B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641669317, "uuid": "01de16be-ac8f-4274-bf55-2075a847bfa8", "value": "adc070d713b11b58df50e9c2e148c1f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641669317, "uuid": "fccb1ee8-4ab7-4d8c-9bc8-047471789669", "value": "6144:Ab0yasxDZDYbVJU9Dwsn/m5eo7CKS6O4gySTePDyB9nb41xqGONesE:AYZKlUbVJeEYu9OVxePmBix/aE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641669317, "uuid": "b62de664-edd7-4e42-b998-105bd92b999d", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641669317, "uuid": "ca40210d-e90c-4b0e-9de8-84824f27d9fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641669317, "uuid": "bba5331c-b0f8-443b-a462-7790f92ef1e3", "value": "6bfc3d7f2de4a00fac9b4ec72520209f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aa3e7bf-7061-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641632424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632424, "uuid": "ed84aa22-afa8-44c9-871f-bfffe4d7d4fa", "comment": "Malware payload", "value": "c45353fee828d7178b156b1f562bf83e", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632424, "uuid": "5134123f-853c-4099-b370-3a18da4ec889", "comment": "Malware payload", "value": "b0984f01570b2b5502b8cfe0ed44f4294216b300c2cda485247588d2b29e55e7", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632424, "uuid": "80ec27c2-cf4c-491d-9886-64e1b28b3883", "comment": "Malware payload", "value": "77e0a06bac7f4b7957dba3eda1e57fad03068251", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632424, "uuid": "fd8bec32-9f5c-4400-9312-68c1f1997eee", "comment": "Malware payload", "value": "abd3d4927fd377536fc1a743713d872b95371e1ff0e19ef4101073e63559381106146d3f758c4e1faf9d16bfa78a03d5", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641632424, "uuid": "2cd6a6f9-2f23-404b-9fb4-313b3d2a0372", "value": "T18F85330C21BD7CDCF9AE02193B7289D0C2ED72E1E441A09676595CA95E3F1FE038F965", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641632424, "uuid": "d186c7bf-5deb-48fe-92a6-9bcb64681145", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYyth:IDSTOhnXSI0Wk5jG2nfBtkaeyth", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641632424, "uuid": "d3eeb9ba-d31e-4b41-b26f-bef2b2e2d32e", "value": 1859584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641632424, "uuid": "32cbd617-76b8-4a4c-a8b6-29c5169a1892", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641632424, "uuid": "f2a3cfe3-3746-48ec-8e7b-4fcdc2dab397", "value": "b0984f01570b2b5502b8cfe0ed44f4294216b300c2cda485247588d2b29e55e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e47ede0-709c-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1641657824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657824, "uuid": "2346caab-96ca-43fb-b08d-ce9709e2a5d4", "comment": "Malware payload (RedLineStealer)", "value": "06bb0a8d3f55623c867b0878d91a8e63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657824, "uuid": "b67a84c8-9e00-4b78-8e8a-dbf6dad3ab05", "comment": "Malware payload (RedLineStealer)", "value": "b1e2335eb58049ec7067133d10d49e92807747ad238778d83b3796770e9e284d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657824, "uuid": "281ef125-7713-417d-97be-dd39c66469c6", "comment": "Malware payload (RedLineStealer)", "value": "142eb91d36631bc417b2f2309116f2483739b447", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657824, "uuid": "f3a15044-98c0-402a-8d40-60975bd6a27e", "comment": "Malware payload (RedLineStealer)", "value": "64cb186ebf23752ed621102f2fcd86575a15701a5b5852e71b9b680e4df54d8d5b669a8abd3d6d30682440b2623c92ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657824, "uuid": "719c2169-b801-485b-bd7c-c5da733a1041", "value": "T199059D0273D2D036FFAB92739F5AF20696BD69250123852F13981DB9BD701B1237E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657824, "uuid": "a5cd6ada-719e-4b1d-8d61-3a1dcb5e3589", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657824, "uuid": "6b07f367-0c67-458d-a583-422d4f9c2113", "value": "24576:pAHnh+eWsN3skA4RV1Hom2KXMmHa31a5C:wh+ZkldoPK8Ya3uC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641657824, "uuid": "db3437e4-5920-43d1-be6f-6dca8cc66cc3", "value": 873952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641657824, "uuid": "10c91c1a-d784-40a6-8118-8321dbb7e658", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657824, "uuid": "98eb4aee-84fe-4a44-b256-69fef1333e7f", "value": "06bb0a8d3f55623c867b0878d91a8e63.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01d12bf8-7059-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641628812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641628812, "uuid": "e75e9be7-97e0-4c4e-bed0-6677e25a671a", "comment": "Malware payload", "value": "a2c98ddbb1cdb0082fef3eebaed5e959", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641628812, "uuid": "41dcb359-346f-4255-bcb1-aaada6d39f4e", "comment": "Malware payload", "value": "b2c5e598cfa5a4bdaeb9ee19b95cf31a7e94ae29cc1dccc1432b23226c1f490c", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641628812, "uuid": "ab75ba8e-4515-4534-8a21-f672467b39a0", "comment": "Malware payload", "value": "508ddd1f5d8cc5dc06cc4500359ee083cc8075ee", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641628812, "uuid": "0b9c827f-4445-40c0-af71-27a928b46bed", "comment": "Malware payload", "value": "c3a7ff62bd9dd88e09bef71869f54ddaa0986dcdb9847c235b78c087102af5c8bd87d717625b8baa43f65bbf345409d9", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641628812, "uuid": "8eb873af-de43-4f55-b568-37f1c7865dfa", "value": "T1D295330C62BDBCECF99E422D3B228DD0C2ED72E1E441A191A6545C746D3F1BE039FA65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641628812, "uuid": "250ccd71-c084-49ab-bf01-0983fabe817d", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdWx:IDSTOhnXSI0Wk5jG2nfBtkaeytFO6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641628812, "uuid": "a664baee-c940-4b80-8ac5-c811fba3f3ba", "value": 1937408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641628812, "uuid": "3174bd95-3baa-4ced-8e9a-0a56b2ee50bd", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641628812, "uuid": "2407c579-940b-4d75-99ee-f19abe1303fc", "value": "b2c5e598cfa5a4bdaeb9ee19b95cf31a7e94ae29cc1dccc1432b23226c1f490c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72ebd55c-7056-11ec-9275-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1641627713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627713, "uuid": "6723ff53-7d62-48e2-ae17-3721913a3345", "comment": "Malware payload (Vjw0rm)", "value": "a33c2200100fe989d76d39c7a06b901c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627713, "uuid": "4d29811d-d305-4699-b538-9a0ee864bd48", "comment": "Malware payload (Vjw0rm)", "value": "b4f233164740f4664483450cd5fdc0de8c9ffff7bde6a192f2f9dd6f3844236e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627713, "uuid": "edcfcda0-8f89-42cf-aebd-5790b65d2386", "comment": "Malware payload (Vjw0rm)", "value": "18e7b738905aa65b031b9ed913830d6bf2251f66", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627713, "uuid": "2f121443-4e19-4272-9955-74475a9a73d4", "comment": "Malware payload (Vjw0rm)", "value": "502ff78ed5338e6264af57ef9f644afaa318fe5496b8d05c13382864eefd4f82825575e8ecab8470964e3b39a0a14150", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627713, "uuid": "3c783942-9b7e-4ee3-9e43-4db69cbb456b", "value": "T1BB129EFE9CC0F4686F40F10D686E0D67E9A6EE31A449181593D1EDD42345B0BBC20BEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627713, "uuid": "18ede882-58c6-49f0-a3b9-f76d1a20a21a", "value": "192:xiv6pl88S7O18kVDNNDVyBrsjngFB47lODuwAcC4PQDXrrx0IK+cM0t7ohIcXFvR:IWl+a1hLDgBIgE7wq/cBzNMw7oHXFvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641627713, "uuid": "bdbed258-e313-4773-a163-387a399fe490", "value": 9639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641627713, "uuid": "ee1c432f-b8fa-46c6-bec9-a3eb81e83c2f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627713, "uuid": "4f43785c-629d-4dbb-9d9b-9cb49a67afe7", "value": "JAN_YDHM007391.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb9ca1d4-7056-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1641627943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627943, "uuid": "87e4ce3e-03a3-4b58-9709-d5e9575e2519", "comment": "Malware payload (AsyncRAT)", "value": "2769a5ebf1e43e3b83a79b890a46532d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627943, "uuid": "e6be36fc-1453-42b4-9738-0754da38d004", "comment": "Malware payload (AsyncRAT)", "value": "b5e6f4ce68a0acec1f729cf36c44563f41025b36bb8a8425b0f4895d48f84eb5", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627943, "uuid": "8eed1e9b-4614-4b78-bd86-24b066578afe", "comment": "Malware payload (AsyncRAT)", "value": "195cb3223a0ec93974092ef578459e07395981a3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627943, "uuid": "ec3b7faa-b513-4607-a9d6-dbe886b3965e", "comment": "Malware payload (AsyncRAT)", "value": "a30e781da9d936f9ecf3699de9d4ee09658ed0ac95b9b742638a674d60ee14ee4ddb25502feab2aef274aac212364760", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627943, "uuid": "7a2d4c40-1e2f-4e80-9b64-56704a38cb53", "value": "T1026401A07084C1ABCA5D47760DE2A5DAB927FC00BF7B87473559F32E1DB7A909903326", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627943, "uuid": "df55c22f-905c-4630-a664-439745c4643a", "value": "6144:XxEtjPOtioVjDGUU1qfDlavx+W2QnA3BMjMiNrlBceXt945pqv/WqeCvtnSpFDbs:7mjMirlaet9oE1eC1nSp66RP1OjFH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641627943, "uuid": "75f06501-b9bc-47ac-8aff-c1f0acf22481", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641627943, "uuid": "f63db20c-4c69-4013-b4f9-668ba7e303a4", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627943, "uuid": "65f534ad-0aad-4ff3-b9dd-6cca23371210", "value": "Odeme detaylari 08012022.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2e11064-7055-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1641627472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627472, "uuid": "7278a42c-3da5-45e3-91d5-10f67b8ef222", "comment": "Malware payload (RedLineStealer)", "value": "e6f2b71cf3efe9badeb8f74dafe5d0a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627472, "uuid": "06626f96-ca4d-43c1-8c23-5dcb9eefe353", "comment": "Malware payload (RedLineStealer)", "value": "b689c4e4aee7ffba62e202f76a8af8091632a5afb0b229c7d945eb55090d54b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627472, "uuid": "4a8ce612-f614-4b27-8183-e3c4415103f3", "comment": "Malware payload (RedLineStealer)", "value": "beb97ef2f6c3d80a3676613754a3e2bf221fd883", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627472, "uuid": "3d338e09-d928-407b-8b71-d20b21e76c00", "comment": "Malware payload (RedLineStealer)", "value": "96f29fba933abb0644c64424f9f057aba1a0139b03b7a9c0278511dc6811f84e3b75d84f45ecf471d34f66766d0e7c5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627472, "uuid": "496f0078-bfea-4eca-96c4-619819281441", "value": "T1D815F7DE51D14849CFAF03F01DFBE32E857296C213474BEA736E95F06B2209EA56D4A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627472, "uuid": "7e241921-55c7-4d25-8332-f5489b922933", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627472, "uuid": "d6a7c777-87da-4161-bbe6-45753f4e9ed9", "value": "12288:pCiH1DRbs5PjwqfrJmh077sKR3eMV9EZgaA:XfsIhBI5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641627472, "uuid": "6be24ff1-eaa4-480c-adec-a656339a5650", "value": 922440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641627472, "uuid": "c23a8136-f85b-4a9b-9245-9b2da44f4ffe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627472, "uuid": "71f49ef1-f360-47bb-a7e5-71ba3f6073b1", "value": "GenshinHackMenu_v3.4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecf8fd9c-7051-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1641625771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641625771, "uuid": "cc0b2e35-fd85-4152-8702-418e55e3d547", "comment": "Malware payload (RedLineStealer)", "value": "af20ab47c28a36108fd5e2ec7879c208", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641625771, "uuid": "5c0d5a91-0658-4210-9f8e-dbf50f30626c", "comment": "Malware payload (RedLineStealer)", "value": "bc42874e55e3e5c1c1d2201d619fda3971d27a6427850a03baeb2b67408efa97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641625771, "uuid": "3537fb4b-b0b2-4302-b754-85734634689c", "comment": "Malware payload (RedLineStealer)", "value": "e2c6236ea4c953c5014c04187e2e6043d7a59fed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641625771, "uuid": "c9f84cc1-d8d4-4fe6-af6a-2010102a9b46", "comment": "Malware payload (RedLineStealer)", "value": "f1fe8f95fde58678aa08f14b3349a608d016ba6a76b5e4442e41eddf61a6e2b2b69a074882a6968411e363c291b4db74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641625771, "uuid": "0fa12bde-99f2-4634-89ae-53a5088b6a26", "value": "T17CF5338ADB127EF6CE1E2336FB80B59DCB595B29A9170B9F93F446707B6101DA43006C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641625771, "uuid": "dccb981b-8683-46bd-96c5-fa0fc7d87070", "value": "c284fa365c4442728ac859c0f9ed4dc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641625771, "uuid": "4cd332cf-702b-4e71-9fde-4c7f0d7fd7bf", "value": "98304:WKYEp0kVATP2UH3RWpnjEbeTesT4y4j44nHIT:W3R2UH3UF0nj4kHIT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641625771, "uuid": "dccfafce-fc6b-4dd2-bbf7-59049ee8f7ed", "value": 3545600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641625771, "uuid": "1554d67e-1245-4b43-b36b-8205cbafe596", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641625771, "uuid": "c5a1280c-ee61-4fbf-b928-0fa40d30ab57", "value": "Genshin Hack Mode.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0356f67e-7059-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641628815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641628815, "uuid": "55c5b41d-aee8-47a7-b342-c80b98bcb511", "comment": "Malware payload", "value": "7197f70a97596ad6db5028918dd6ece3", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641628815, "uuid": "f1fb5831-0984-4950-92a4-eca28c028d8e", "comment": "Malware payload", "value": "bc9d008a24b89c35d7f88af07a40d972d4a081df6f691095eb27c39b6e08c8b7", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641628815, "uuid": "78faa03d-0c44-4e31-b0eb-58aa0708368f", "comment": "Malware payload", "value": "0eeb64dd1100be9c7134d1db2abf013938354417", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641628815, "uuid": "44b6f6ce-5773-43ac-b50e-ca6352e24fce", "comment": "Malware payload", "value": "0d2145afb9b211e7126fdbb9f46b1fee0bc3c6f5b6001d2aa274ea88a3e3ff2c6a95068a722698125c3ff2aa1db82112", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641628815, "uuid": "52006197-3823-4a75-9bef-0973b99da0b1", "value": "T11765330822BA7CC4F9AB453927621C94C3B932F1C049B095379C1CA656772FE539FEB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641628815, "uuid": "a481cc51-0f7f-4409-b0c2-f2155c53391c", "value": "24576:IVbRYvjxOgOhntwZIdc/th82I0uDkbekANJLLT1mtPQwNDk2XD1h2VYRflrf:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641628815, "uuid": "baf87eeb-f9d4-46e4-801b-c0beb5113f8f", "value": 1462272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641628815, "uuid": "0f947119-7584-4c5d-b7fc-8ff4ab888e88", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641628815, "uuid": "c9047369-9e0e-45dc-92dd-977b2e272def", "value": "bc9d008a24b89c35d7f88af07a40d972d4a081df6f691095eb27c39b6e08c8b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db623fb5-709b-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1641657524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657524, "uuid": "6a3ae975-bc98-4f36-9a34-eb9340505b6a", "comment": "Malware payload (AsyncRAT)", "value": "8ca90d53322468af117bc19efcacffdb", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657524, "uuid": "4fc70cbd-6d0e-489f-b17b-1a824cdd47eb", "comment": "Malware payload (AsyncRAT)", "value": "bee919222f12459189eaf04246daba4c459fde9f51dee4a381bb6faa20df3089", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657524, "uuid": "18e66255-ead6-4606-9686-ff12a9aab554", "comment": "Malware payload (AsyncRAT)", "value": "6ae61573d5c13e9e8ac04f0c3c76e73aa9b9097e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657524, "uuid": "167ff5d8-e3d1-43fe-8def-af4327c29a0d", "comment": "Malware payload (AsyncRAT)", "value": "f925818d2cd70c84a325fa75c1ea7744435331bf8494c3857dee5c833d2ab6f0f0173e2f2385298e86c9f80561aac119", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657524, "uuid": "1fb6e24d-8832-42b6-bca1-9f2b363b972b", "value": "T100446BD91BDBECF1EB8E097FECE845D12263AF705523CA1AC6D6187F060B178AD41A50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657524, "uuid": "827dabe8-fea0-4fd5-8440-4a8ee3f7e63b", "value": "6144:39Cs28sCk4QsQj53KSk+X6HHPPWIPXSPCjq3ABqd7Sr4Kpc+i60GoBNmkGVSHgVq:UZdSQjJu+4PPWIPXSPCjq3ABqd7Sr4K0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641657524, "uuid": "e1ba8481-91b2-4f8c-808b-6cf2ee11064a", "value": 262144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641657524, "uuid": "55959071-3f07-4f62-848c-6475c1dc534f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657524, "uuid": "a0f2ba80-9f5e-45b6-849a-5cd734ab19fe", "value": "8ca90d53322468af117bc19efcacffdb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c890ea8-7061-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641632427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632427, "uuid": "abaa229d-a902-49dc-b7bc-10d956d11501", "comment": "Malware payload", "value": "1569b372ad3b6501c6d0e31d4cdb5fe3", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632427, "uuid": "0a11835d-c176-43c1-9911-187a6f1d790f", "comment": "Malware payload", "value": "c577bb30cbb24f93e9e82b0f2bf199e5ae4dd6180ee5b672cb73a32121635965", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632427, "uuid": "6fed63eb-a512-4f34-b994-f266abfa85a6", "comment": "Malware payload", "value": "1c576af0e549661b1481a0cc13481463c5241c11", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632427, "uuid": "864370a8-a93f-41cc-a438-bd64585a40e0", "comment": "Malware payload", "value": "15757450bc83f5358c404b0dfa03d84c05976c96777e5c48a6d3673a2f5d1c43eef06fe9c4ffd3d6d7c1c8b352960d2b", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641632427, "uuid": "8ee653d1-4cc5-4119-9d55-d7388c91df0b", "value": "T1C095330C62BD78ECF99E022D3B3289D0C2ED72E1E441B09676555CA96D3F1BE038F965", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641632427, "uuid": "fab54ea4-08e5-4991-913d-f815e69c433d", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdh:IDSTOhnXSI0Wk5jG2nfBtkaeytFOP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641632427, "uuid": "0eb9cc07-5db5-4735-ae02-fac851c6a48f", "value": 1896448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641632427, "uuid": "b210e2b5-9050-4b93-b1bb-3d31615650f1", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641632427, "uuid": "01246787-b54b-4467-a03c-48775ab0759d", "value": "c577bb30cbb24f93e9e82b0f2bf199e5ae4dd6180ee5b672cb73a32121635965", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddc4b179-709b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641657528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657528, "uuid": "63a33e5f-a0ac-4335-bc25-fdd2590c2a90", "comment": "Malware payload", "value": "5c6ef044506772afeae028938e2175f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657528, "uuid": "c1702582-1484-4696-a52e-fd5defb1336c", "comment": "Malware payload", "value": "c592dfe4fecb1b84b76c6b4e693b1a0026254e2bba6661071af7afc0ffaf32b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657528, "uuid": "737d2e92-5538-4bfd-922a-a79702f0b62e", "comment": "Malware payload", "value": "86b03dc7c19b52fe64d02c5521e63f624e4d9956", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657528, "uuid": "c6a7ab23-b82d-469d-8163-8497b6b3e0d1", "comment": "Malware payload", "value": "30337526d9315c9c8475c515d24422b4826c9c301bab80037e158a1b94ae30ebb9398a0ae54ad1cb00bf742b82dc86c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657528, "uuid": "8b287139-2b9e-4e41-a55f-c804bf4c378d", "value": "T1D36533B64691764CCBDE877580B76349BDFCA451FDF6B30822FD68D06A284E3B401AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657528, "uuid": "48bfd39b-e28c-4f5f-b8d5-d878b53f73c3", "value": "24576:+mQtiserHcTX0ZcEZlDewh6VFVYCR6n5neKFzC/dGomAeWHSv/Y8a2AkP+CEaHND:+PcsewbGdt6C5neaCFGwiv/Y8iO+Xa6a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641657528, "uuid": "a7d0a289-de4b-45cc-896f-56bde1bcc107", "value": 1510374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641657528, "uuid": "2703aaee-81c0-4b85-8332-3c68735a967a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657528, "uuid": "727bba17-40fa-4107-abf7-00624c38ffce", "value": "5c6ef044506772afeae028938e2175f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5b31196-7074-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1641640684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641640684, "uuid": "5821e5e0-aebf-48dc-8f94-3df4e3b53f33", "comment": "Malware payload (RemcosRAT)", "value": "fce28eaf27cc125c2881a9b2fbb75f48", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641640684, "uuid": "9d47f69b-46fb-466b-b38b-716296802047", "comment": "Malware payload (RemcosRAT)", "value": "c6d5c5389f6a7d7fadca1c538b5408898454aaf5011910e90549e81fb03c0a1c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641640684, "uuid": "55fd3e07-ba36-42c8-b9be-945b815dcf6c", "comment": "Malware payload (RemcosRAT)", "value": "7ca736402a2c65b1f5211105037d403e96984781", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641640684, "uuid": "e991f60c-0dde-4430-8517-e8ace791925a", "comment": "Malware payload (RemcosRAT)", "value": "fac701bab5d7ea76a779932395fde53e3f3de8481d819c15248b142bb546f5c5ac3bd97cfe73f17a5582bf9a195374e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641640684, "uuid": "9de2af45-48c6-4e3a-ac48-1f752d9f9ed9", "value": "T1C0A4AD11B9C1C032D17252700D29FB75DABCBC302935597BB3DA5D9ABE700C1BB2A6A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641640684, "uuid": "6939e376-9405-4597-9d1a-47baefdf2884", "value": "1f15bed3346039b42bc33c9080047f8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641640684, "uuid": "032729e6-f898-4c6e-902a-6dd408b8feaa", "value": "12288:CegN0jfYLclGb0bVT6e+MT2MffZS/g5SYo:kNywLclGIeMT2MXZR5SV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641640684, "uuid": "6c56e100-15d0-43be-8d6c-263edd6bb46f", "value": 474112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641640684, "uuid": "b9919231-0b92-4fb4-ba89-c618a688e89c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641640684, "uuid": "41ce5e0e-2ccc-44ea-a686-8d3c235f0e84", "value": "fce28eaf27cc125c2881a9b2fbb75f48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a87b0bf-70ac-11ec-9275-42010a9c0029", "comment": "Malware payload (Quantum)", "timestamp": 1641664529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641664529, "uuid": "e9ec3d1e-cde8-4fcb-8df7-47a17c567e87", "comment": "Malware payload (Quantum)", "value": "d35a5caf8af43432ec2f5a2318b20597", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quantum", "colour": "#169263", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641664529, "uuid": "5680d1ac-1b6d-45df-a1b7-49969ca29b5f", "comment": "Malware payload (Quantum)", "value": "c74873d7b8cc622379ed49bd0b0e477167ae176aa329b01338666ec4c1a4426b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quantum", "colour": "#169263", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641664529, "uuid": "9d96cbe1-bd84-4dd4-bf5f-0e749b2dee65", "comment": "Malware payload (Quantum)", "value": "8fd8f62a848a1d9c1ff18c7bc16e8a6d2c67c37e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quantum", "colour": "#169263", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641664529, "uuid": "2f6e296e-9098-4af4-bb9f-18dbc42301e7", "comment": "Malware payload (Quantum)", "value": "e5d21778289accac47e5014a00ed4f9b894a05acf4667568f0603d9052d864d3dd19885e1222144818e69f99a1ad469e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quantum", "colour": "#169263", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641664529, "uuid": "2c707035-c6a1-475d-91ff-cb96e333dd54", "value": "T127045C73968B4882DC85DC7DE71AB3F7D0ABB6544B4180C27A7B9BE777324489219B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641664529, "uuid": "f2339c30-04fa-4cfa-8b40-77073e8e4b96", "value": "1d30df1e5b7623c4b3e7485c04815cbd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641664529, "uuid": "cd610db9-8931-42b5-b18d-80cd020a5e4e", "value": "3072:y3hqOnUKeCBHq5l2GI3NamwWkh2gaER+680q2t1X7LrruiBHta:JYj1iaNamwWk08U68qw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641664529, "uuid": "30799ad0-67d6-4ada-8935-6a36cf79b2f2", "value": 188928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641664529, "uuid": "8cec2879-b47d-483f-875f-173667cffd45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641664529, "uuid": "407cf0ba-ba94-41b2-aad7-20a5051c3452", "value": "Quantum.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70630d01-7056-11ec-9275-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1641627709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627709, "uuid": "50c838ee-85d6-41ce-b8ab-ff8d241ad68d", "comment": "Malware payload (Vjw0rm)", "value": "b8d709b17bcfaf488a6277334d5bad2f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627709, "uuid": "2136e2ec-c871-4980-ad3f-e45ee87a17ba", "comment": "Malware payload (Vjw0rm)", "value": "c7a3ba7def259f78303757d1fabe9767612d0e6f11ca55f0f5b396eec82aed3e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627709, "uuid": "3fbe20a6-8b64-4f31-90cc-3ab370b139fb", "comment": "Malware payload (Vjw0rm)", "value": "3dbebe928807dd6f9c8c828611b3a42ea598e081", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627709, "uuid": "5c55020c-6ab8-4a9a-8ad3-54c418073e0b", "comment": "Malware payload (Vjw0rm)", "value": "dd572f2f8eb1e12f94459b5718ebb0fc3045afdc149143a2c6a7a4f0585b3837806544959dc1b81bf895a87ca94254d0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627709, "uuid": "6b55b01d-8681-47d3-a54b-b9be7dcc4020", "value": "T1882474499C61E0B9D63CD120B9793AD983B1A24FD451ABCE751DB348EBB7B00D3E8079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627709, "uuid": "c492615e-151a-4a78-92ab-1744419f557c", "value": "3072:jhmSuv9aoFQYiKBtyg2WUkXBH+L/hKxNIbL/SjZpe4RpdH+EL6+xHqEr3HyM3Q:VLaY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641627709, "uuid": "0bb65760-2620-4c1a-897f-6c643125993b", "value": 223171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641627709, "uuid": "1cec6712-9bdf-48cc-87ea-f6dfaeb22c6f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627709, "uuid": "99102cbb-f8b3-4c01-a7a3-5198b0d415fd", "value": "waybill.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eb680b7-7061-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641632431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632431, "uuid": "171218a2-fb05-4481-9634-fbd8aa910f31", "comment": "Malware payload", "value": "011a70c467be1e2ae8762b49567954a8", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632431, "uuid": "67b9a5ad-567d-4a79-9805-7eb5bfd8a8b1", "comment": "Malware payload", "value": "c883a28522c47f46ea360fee993d75e1129dbde5ab8701f4f30e61ab89b8bd3f", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632431, "uuid": "0e4c7000-e900-42b0-a753-acc7ccd91525", "comment": "Malware payload", "value": "aeebe50494239b29ee1ad5979341f024df1b7977", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632431, "uuid": "da6e52f1-b925-4bc0-967d-ebfcdf51ea1d", "comment": "Malware payload", "value": "5a817c2eea1731e3b4861d029d57e20f5e051af0572826b83e7246dbe1d1c6853096b9e71ff829536974ffba4f9ca2a2", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641632431, "uuid": "e0106110-2371-48f0-9a3f-0b06e128ab49", "value": "T1E785330C21B97CECF9DE06293B7289D0C2ED32E1A441B1D676595CA55E3B1FE038E978", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641632431, "uuid": "4f85f969-351f-42c9-938d-c11cea8db79d", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYyK:IDSTOhnXSI0Wk5jG2nfBtkaeyK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641632431, "uuid": "cc9d08b0-45f1-47a0-b97a-7ddec846ff78", "value": 1814528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641632431, "uuid": "aa4354a5-678b-4cf5-b90f-0eba1a9a2154", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641632431, "uuid": "0c39e8be-d160-427e-beab-c7d1525951e6", "value": "c883a28522c47f46ea360fee993d75e1129dbde5ab8701f4f30e61ab89b8bd3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "706ed43c-7061-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641632434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632434, "uuid": "8561af32-195b-48f4-bbc0-515bb7be66ce", "comment": "Malware payload", "value": "529a7740615b3df7aa86500f312127f6", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632434, "uuid": "35f5f939-6788-4909-9bbe-83795b9e3ac6", "comment": "Malware payload", "value": "cb58aa51916e39969f6648494ea622639dfddd4a3362e5b14b9e4808d0e2d5ca", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632434, "uuid": "9531ed0d-eacc-4fe1-b0f7-6a67457a5d69", "comment": "Malware payload", "value": "be3b05dceb3e00172f665ce92f8c749f440e5beb", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632434, "uuid": "6244269b-1dcc-4587-96eb-5ac4b613b525", "comment": "Malware payload", "value": "1511ee8bfacde4c7431d9f50d4465b38bac81619c1666d8823ad62c781eede7171554476b7c374d9884afc932a4e07f3", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641632434, "uuid": "a273e84e-36e5-4d77-b03d-48eb74697e88", "value": "T11065330832FA7CD8F9AB163937521C94C3A932F1C045B09537980CA656772FE539EEB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641632434, "uuid": "84dbbe55-ed8d-4c84-83a8-985988ddcf95", "value": "24576:IVbRYvjxOgOhntwZIdc/th82I0uDkbekANJLLT1mtPQwNDk2XD1h2VYRflri+PL:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641632434, "uuid": "9c9c34ff-a978-4320-8399-fef76819bd09", "value": 1511424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641632434, "uuid": "c21827a4-166a-42a8-959a-bf22ffc2998d", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641632434, "uuid": "1293c72a-6df3-4a56-bca2-ba1cfcfb51ed", "value": "cb58aa51916e39969f6648494ea622639dfddd4a3362e5b14b9e4808d0e2d5ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3d6ba30-70b6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641669081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641669081, "uuid": "6673c836-74d8-4800-8da0-48ae30d0ae8b", "comment": "Malware payload", "value": "9de3d900d6afb13e7cc12a70b35cf18a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641669081, "uuid": "daa51454-8f87-4d68-9f54-b3862a8edb26", "comment": "Malware payload", "value": "ce3c4b33fb518725ead0d9c5463afeda603a392b6109813568b47505f81e47e5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641669081, "uuid": "bba57cc9-3003-4ede-87cf-f090dce9cdd4", "comment": "Malware payload", "value": "468f6f3a81494f5d7910caafd7cca53443fa8eff", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641669081, "uuid": "fa9f3a94-952d-4a3e-8251-6bd8d7ed8a52", "comment": "Malware payload", "value": "6c00d63c87f08a6e303983859bf03c25078cdc683288eb60084f9847ba91d98a9a905d3f04f71d63d765347fd7dd4e71", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641669081, "uuid": "e90bfb53-9763-4406-bf8b-b5e4f4a30552", "value": "T1A3456D11A222D055E81E81F0EC2C6BAFB52C447427B0C0C77A9B6DA9F5E56D352BBF43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641669081, "uuid": "28231df8-0ee9-47af-8b61-977346999619", "value": "1fbcf15f3c777be558c02379bb4ebe23", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641669081, "uuid": "83fbd430-0d28-4b8c-a800-a9173676cc02", "value": "24576:PY82TSZBD1KFWZlmfTihb3PmEW2iJWgfwdNtdGLx:A8/BDUFwlmfWb3PmEW2Ifw3tdGLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641669081, "uuid": "c44e061c-0ecf-4441-ac26-4ea11c9caf5a", "value": 1224192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641669081, "uuid": "a063b673-c61f-4503-9505-f337ddcabd21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641669081, "uuid": "0793fe68-da28-4f6f-8daa-acd17b0e4af2", "value": "paradise_1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c79c1542-709b-11ec-9275-42010a9c0029", "comment": "Malware payload (KPOTStealer)", "timestamp": 1641657491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657491, "uuid": "97ce1cb7-5350-453b-8a5d-3d4e5fd78bcd", "comment": "Malware payload (KPOTStealer)", "value": "c327b04826b680b29ff3dcd36aa14bf2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657491, "uuid": "547b6ea5-b5a2-4206-8a50-d75a575b9ed9", "comment": "Malware payload (KPOTStealer)", "value": "ce82d4823d35d70b941eed97aad3a8d3dd271a0f64963e3344d0efc7ab3ab298", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657491, "uuid": "44d171a1-35a2-403a-b87c-1a80737614f9", "comment": "Malware payload (KPOTStealer)", "value": "18e35b63230195f144be197944f34efdb9e0e5bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657491, "uuid": "b79681fb-82f7-4cb9-a1ed-281f77f1c4d7", "comment": "Malware payload (KPOTStealer)", "value": "285d425466301010ec194eb6c1dd99663541673889a7da44b09967a11b79140d1a199518288ca42ea66e172cf489ed87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657491, "uuid": "3547f063-4320-4008-9950-f7455d94d71f", "value": "T14AA4F12AFAB3C431D19F4A714C24C6E01E3F79612A20455F779817FE5FB72A0692A336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657491, "uuid": "3394d119-9520-4adb-977e-7fdf7a19a6a6", "value": "3f07075ef838296be9ff2ad3cf3a6bc2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657491, "uuid": "e0f426ad-d744-4c74-82a8-b280b18fb715", "value": "6144:o5LOY3Ltn0nh5JjefT2Ok/+JUjFv7n0eLS+baZolDst7WDWyfEof:o5q4QJSfHBJYFLjOmLfP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641657491, "uuid": "11fac58f-67c8-42c8-9727-523ae81b6d9a", "value": 457728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641657491, "uuid": "99f9710c-7544-47f3-a3e4-a23329a859e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657491, "uuid": "380c0442-35c4-4b00-a9d6-7fce8e58c434", "value": "c327b04826b680b29ff3dcd36aa14bf2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72a13d9d-7061-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641632437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632437, "uuid": "a5ba3d38-3ffd-44fd-86cb-b288abe9185b", "comment": "Malware payload", "value": "0de1687e4b909683a09deb324fecd8f3", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632437, "uuid": "ef12d931-8f74-4730-ab3f-8ab3c3a94432", "comment": "Malware payload", "value": "ce978c36f0b7afa80e23183a353285c23965ac35792d27ed1508535fc5ffc73f", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632437, "uuid": "b28e4851-365e-4df2-8502-a478252e259e", "comment": "Malware payload", "value": "888fa54bbddcebcca33eac2e9631c04e58075d3c", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632437, "uuid": "39390916-6684-438f-82de-02aedb77b2b9", "comment": "Malware payload", "value": "4de7ec127b59e00c4f893819d3a0be51457ee4ce6f496f8d4ca263ba322d1b1255f5df709421b212191d259fed2aead0", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641632437, "uuid": "e8e53b0b-58fc-4696-9bea-5fb7ac86a33f", "value": "T1C185330821BD7CECF9DE022D3B7289D0C2AD72E1E441B19676985C655E3F1FE038E969", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641632437, "uuid": "e5069210-34b0-4672-bc42-456c433e5a73", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYyJ:IDSTOhnXSI0Wk5jG2nfBtkaeyJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641632437, "uuid": "5d3a8dac-726c-41ff-8f2c-a9d5a79e321c", "value": 1835008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641632437, "uuid": "4756560a-5d54-4fa0-a6cf-24572e70eb78", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641632437, "uuid": "9883d942-deae-469a-9a60-6006cd9e9889", "value": "ce978c36f0b7afa80e23183a353285c23965ac35792d27ed1508535fc5ffc73f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bed7703d-7061-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1641632565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632565, "uuid": "47d4fac2-414e-4dbb-a5c9-e278c4909041", "comment": "Malware payload (RedLineStealer)", "value": "4fcf7c7d3380f6e1c4b74163210691c0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632565, "uuid": "67db1f56-900b-40d6-a2af-aaf0ea6dfc12", "comment": "Malware payload (RedLineStealer)", "value": "cfa1ef201a4dec456d4d6ffddc96267fcbf212f45616223fc8b3c675639f055b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632565, "uuid": "5c9baf64-af79-4a19-9582-b159c9ef8911", "comment": "Malware payload (RedLineStealer)", "value": "bc7942b6187f1fded365bb39053007340604ba18", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632565, "uuid": "0598bf76-17a1-452c-92e0-1c61dcd6c1ef", "comment": "Malware payload (RedLineStealer)", "value": "84a9c1df40ae2c9299a47d2be5ff164993dd573527296b38bda14e99555c725b79b375d7b8061e3fb9ad7213d2caffd2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641632565, "uuid": "98c02ab2-6567-4420-9c32-bef6f36731e3", "value": "T19465336B7528AB05C3032BB83BAE4FC21B4E57245BC8F9DCB5AB49C1212CD67EC57124", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641632565, "uuid": "5324e10b-0eb9-441a-9ff5-a89b0dc59392", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641632565, "uuid": "e61f8488-c524-47b7-b9eb-a39a7ce061f2", "value": "24576:5SGXVcf1gYDq9JuazM2FzQ7y/chp74zCYtmjeqL7KulDkEaHNYK3eeoM/1:5DWNg9ma4C87QapaCYtmaKNab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641632565, "uuid": "8bfa05c1-16b9-473b-9c71-7980326e5398", "value": 1445888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641632565, "uuid": "cc6bc8e8-4014-42e8-8a97-185c5c091181", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641632565, "uuid": "f61ac1ba-36cc-4eab-8cd3-a509c6b3828a", "value": "4fcf7c7d3380f6e1c4b74163210691c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98d7c23c-70ce-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641679317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641679317, "uuid": "8f9f8e56-0d6c-46a6-be1a-e36151032bab", "comment": "Malware payload", "value": "c46614860fa7fb358afd48da095cafde", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641679317, "uuid": "76c48215-bee2-4c64-9137-fa24388ebf17", "comment": "Malware payload", "value": "d463272b1474edac4b7770daca28979db303e7abd19ac3923e236f88e75fdb85", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641679317, "uuid": "6d5ee8c7-606d-42f7-8207-4a07d658f53e", "comment": "Malware payload", "value": "e009d76edbcc21277de768979a557c2b8f4cd29f", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641679317, "uuid": "d3c1b4d9-6c9f-42be-9877-0ae9e5878ab4", "comment": "Malware payload", "value": "e1f4d8764d40b4958667edbddbd089858c79f24122cc815c10591b6f1b1414415ee3a1c48abf69d2bb9c2ebd650b9eab", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641679317, "uuid": "9367a135-9770-4485-b05e-54c151410f05", "value": "T1EA751252F345E872E173C63A897A834365698C888E46E7573506F72C9EFFE06CA44EC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641679317, "uuid": "a6c9c70a-f865-46b0-9c8a-367505c86e4c", "value": "24576:wFScS70LxMfV+aKKK9wXrA/s2pFMNJTEYrU3tX3BLtEhpMjQ4OFXiWV7ALtmX9ck:2ScS70LxSZU3pFMvgY8XxcmiLCLtmOk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641679317, "uuid": "45a6d21d-e953-4d65-bbd2-2ef9c2198950", "value": 1694321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641679317, "uuid": "125ab207-31a5-4155-a56a-3d07a8f429e3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641679317, "uuid": "5a752a36-643e-4dc7-9ee0-1930de664401", "value": "downloader.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42d05b75-709c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641657697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657697, "uuid": "25fe3d1e-6128-4413-bd9e-8d783faa9b8a", "comment": "Malware payload", "value": "4a22dfdf224d019457f97324feb2d03b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657697, "uuid": "cb0b6bb3-6853-41fe-bce4-46cb815bf74d", "comment": "Malware payload", "value": "d635860063fb88401ca13fa2407b03a2a14706146293bc31ee08f8d169867c80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657697, "uuid": "bdf27938-f4db-4d56-94f9-80b53ccbb480", "comment": "Malware payload", "value": "449e88dd5afeb64ffcef71be2e11f3f422cdec4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657697, "uuid": "92c599c9-74ec-4c61-8b57-0e835bb83ff9", "comment": "Malware payload", "value": "af846937d7d96014a53326a879c2d2cc021d132d3ec558c4c0bc739024e9272ca1e98bdaac93fc2adaf17d4eb9c99ba5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657697, "uuid": "4e9e650c-5578-4c1f-a552-ee3cc44b6039", "value": "T19FF533878F389FAECED96BB6D08BD4C9C14ED4C118AA4C8451969F023D905B4B27F93D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657697, "uuid": "a9158131-9558-406c-8331-f4b38a813b21", "value": "c284fa365c4442728ac859c0f9ed4dc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657697, "uuid": "cbb09d61-4820-4832-a7dc-69401ca8d6cf", "value": "98304:hDS0e237QZl5Lexzme+geMYOYD7h7IJo5xCBTEPu:fe2LQZNrMYRWOLYT0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641657697, "uuid": "1a76ac3d-18f7-45b7-a2d3-f46a8e2d2b90", "value": 3411151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641657697, "uuid": "2b903cae-63cf-4623-a2c6-cc249761f771", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657697, "uuid": "e5a93af9-7b3d-48e8-ab9d-4e164a0ce2c6", "value": "4a22dfdf224d019457f97324feb2d03b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "743c09ae-7061-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641632440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632440, "uuid": "538b538d-40ab-41fc-9ff6-54a04b193c28", "comment": "Malware payload", "value": "2c72f34d71788149dad40cacb1b77407", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632440, "uuid": "0c0594ca-2392-406f-bff9-1bcdba197423", "comment": "Malware payload", "value": "dde955ee8f92c858bb003e19bc600032c26c88e3a7a02dc3455ae68af0fc4949", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632440, "uuid": "02d0aad2-6413-4a22-9ee2-f9ccbaeeffd5", "comment": "Malware payload", "value": "5f98637852b08d418fe181de57ad2690c8e68ee2", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632440, "uuid": "c8eaa496-df20-430e-80ef-dd2459e0dd49", "comment": "Malware payload", "value": "fa6564eeacdd49546b8678d529d1f48c601cd804e852f426e1921a043af9f928225b400d45c93bcc06fe29738920428f", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641632440, "uuid": "d33ef570-5ae2-4467-bc4e-02f01318c70f", "value": "T11095330C62BD7CECF99E42293B6349D0C2ED72E1E44161E1A6545CB46D3F1BE038FAA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641632440, "uuid": "87cec5fc-9c9d-4d1d-8dfc-011256743054", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW27:IDSTOhnXSI0Wk5jG2nfBtkaeytFOf7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641632440, "uuid": "5307ede2-0713-4f05-8ef5-5d887dc44191", "value": 1949696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641632440, "uuid": "39c7eeb1-5615-4764-8f58-d6c18b7eb7a8", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641632440, "uuid": "3f775df7-7b05-4cc6-b0cd-d2a5646a3467", "value": "dde955ee8f92c858bb003e19bc600032c26c88e3a7a02dc3455ae68af0fc4949", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7500781-7054-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1641626942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641626942, "uuid": "e9d987d6-670a-41d3-8678-4035503887f3", "comment": "Malware payload (RedLineStealer)", "value": "a4dbd4afd032665bba79c3f9956ccedd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641626942, "uuid": "752c3af1-0d70-42bf-b699-e4cb04aaba75", "comment": "Malware payload (RedLineStealer)", "value": "df8a2b3a6ebb56bb2d1aae4bcbef1e8617f7f19cfbd078b8e47f6c78b481fd70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641626942, "uuid": "f89fd90f-dc7e-4f3b-a088-eb28b2a91f3b", "comment": "Malware payload (RedLineStealer)", "value": "46514b8bc551139efd5241801da1ef55e0c29180", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641626942, "uuid": "05073511-7ed7-4308-92ff-1d699f860146", "comment": "Malware payload (RedLineStealer)", "value": "13ae93c272c7a0b7359f11fa86fbc29fd216d8c2f82679068f1132cec8775d116855bb3604673b492fa15b368fc64257", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641626942, "uuid": "fbe26f99-6740-490a-9e4c-bbcbf2067392", "value": "T1C9C529A17E09E4FFE009197498E3DE86A75813E941148A53F9E93C75BE83D832DC9B1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641626942, "uuid": "c43102af-a346-4228-9d01-9c2db3a9bc94", "value": "f409379b65e58ef730a014c2105818c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641626942, "uuid": "51325d87-6b5d-4ff7-a3fa-79344288dc21", "value": "24576:ghp4/xjCuNUejcReYVH6FGGykJT5NWhAHx6FxRPmhBQoBti2kFbAAJLFIwsua3QW:ghqJfUWJNlNWfbn7m+YZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641626942, "uuid": "b944da23-e353-4dde-9551-205ae491e3ad", "value": 2656552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641626942, "uuid": "967e8ad2-ebec-4338-93f1-e726140fb1fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641626942, "uuid": "1d32fc65-5537-4d11-b34c-f8b8483b43cd", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "240e28e4-702f-11ec-9275-42010a9c0029", "comment": "Malware payload (OrcusRAT)", "timestamp": 1641610831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641610831, "uuid": "024b5490-7668-4e92-8963-31d29117b8bb", "comment": "Malware payload (OrcusRAT)", "value": "bdc30cb84dfff4a659b47ab8a208419b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641610831, "uuid": "5ac96d55-5887-4be4-98f1-edff2f3e85d1", "comment": "Malware payload (OrcusRAT)", "value": "e21d43df96e42ae29354ecf4b21e803c0c3bfd9a706f5f7ee334b1893ae92c6a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641610831, "uuid": "2ebd6908-6425-4d27-88a9-1580e272d152", "comment": "Malware payload (OrcusRAT)", "value": "c2082797039a9375601052c42f05658e1b5356ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641610831, "uuid": "62115124-3aeb-4358-9d04-d62c05ba291b", "comment": "Malware payload (OrcusRAT)", "value": "ba7a17991963272a087008af5d0e2bfee9370b49a742b5e16c2efaf1ac240f252467c88a5f7ef57cf07d16fa2e7d1ce2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641610831, "uuid": "aed3243e-e1aa-4a52-ba54-3dad9ee23fce", "value": "T1E093DFB55FA9449AC0C3D87AD8AFC147CBB06F0A1102C677B535BB84BF1B7E72249602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641610831, "uuid": "533eb810-2f7d-4ef9-a16d-cd103b83eef8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641610831, "uuid": "8af19593-9d9d-4bb3-80ca-11e0da9900ac", "value": "1536:F3v64pWEbE0GnVEerq1o1Gnvlyr+CwaMYONe+b3SFu1AFNGaX9cvX:hy4pWEbEpVcoQntK+C7VieM3SFZNt9cv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641610831, "uuid": "c953a519-f6f1-4ddb-b197-dc39c912c84a", "value": 91344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641610831, "uuid": "e329d54d-619f-4292-94a4-4fdee77f0d27", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641610831, "uuid": "4cd0b44e-11d5-4bd1-a1f8-661ab49dd9b8", "value": "bdc30cb84dfff4a659b47ab8a208419b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "765dacc8-7061-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641632444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632444, "uuid": "57fe7656-c96e-4b04-953f-c30cc13ca740", "comment": "Malware payload", "value": "1edafb6c3060996343400a7500276e29", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632444, "uuid": "5ac343bd-a942-48ea-adb5-33b478577a93", "comment": "Malware payload", "value": "e3df5cf99c8aee3c3f844c818f71aabd23ecafbc42c09d9406c1ad411df870b2", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632444, "uuid": "796c7832-c0de-44bb-a172-c80d4c850591", "comment": "Malware payload", "value": "d4ed77693e7c3dd468b0daa5e1bf8eca2cb4144e", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641632444, "uuid": "b22aa3d5-2c74-466d-9c4e-59e0aecf49ee", "comment": "Malware payload", "value": "d4b25cb8e9278c8cc166df9a18a6be3ee46942ced68a27c11a5711078d4e71333c8458b7b21aa2d77daa663b71158063", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641632444, "uuid": "7a34a2f1-a4dd-4ab8-a831-da9051160469", "value": "T1D295330C62BD78ECF99E422D3B7289D0C2ED72E1E441A1D276545CA86D3F1FE038E965", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641632444, "uuid": "a18531aa-db3c-40d7-b4e3-125ebf9acca6", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdWU:IDSTOhnXSI0Wk5jG2nfBtkaeytFOj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641632444, "uuid": "d36a801a-b404-42f9-99e0-80a5e6bd3d61", "value": 1916928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641632444, "uuid": "d5db879d-0887-47f6-840c-6d486e0e7ca2", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641632444, "uuid": "ab3b566e-aff6-4d2b-a063-a6567152467a", "value": "e3df5cf99c8aee3c3f844c818f71aabd23ecafbc42c09d9406c1ad411df870b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6161969-709b-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1641657488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657488, "uuid": "df2344cf-fb0c-4349-9697-0a727c855937", "comment": "Malware payload (RedLineStealer)", "value": "2d3e4a0d5db026c1778ed5d261846c1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657488, "uuid": "844fd66c-879f-4081-9f85-bce43d47cf92", "comment": "Malware payload (RedLineStealer)", "value": "e5fa3a5fc4f1e1c8286a6bd37ea4b40f6879e629f27e64e7dd491fb42dc6fe36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657488, "uuid": "ade33c29-72a5-40d8-ab1f-77c6f5876ea3", "comment": "Malware payload (RedLineStealer)", "value": "d734f5eb7071e9d2309d933471b6e22e3fdc35cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641657488, "uuid": "8b59b084-fc7c-4308-a93e-d427736cdf5a", "comment": "Malware payload (RedLineStealer)", "value": "fd6d6b2bd90918657a6cb3ba4d204875423827d4ee6fe0670f889664ef50365f0743c5be3b81298592ca1a8811e52530", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657488, "uuid": "87f4812d-962b-4b6d-9c3c-718d3bdc6aa6", "value": "T172E412227AA0C036D6A616741935D26C1F3B7E326E74C487768823CD4F372D49A3A7A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657488, "uuid": "dfa4e468-6a7f-4980-90f3-2c40a4ac80fe", "value": "3f07075ef838296be9ff2ad3cf3a6bc2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657488, "uuid": "7e4c5dda-5f4d-42de-bb65-d5061966328c", "value": "12288:D6iTqFLqPkLEYixXH8jmZ7OVU8xpkwNj48SU/k87jS:Dko0EYosjFVU8xXNjTBvS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641657488, "uuid": "b6a14749-cbce-4e0b-a658-7dd7652b5fba", "value": 680960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641657488, "uuid": "5d367dea-1706-4b03-8010-85d3cba71d4c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641657488, "uuid": "7e08a9e2-ed22-412d-8607-65d2148aa1f0", "value": "2d3e4a0d5db026c1778ed5d261846c1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "939b497a-706a-11ec-9275-42010a9c0029", "comment": "Malware payload (Amadey)", "timestamp": 1641636358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641636358, "uuid": "d60b51ed-7263-4587-a61f-506a88fa508d", "comment": "Malware payload (Amadey)", "value": "c730063f167122d2a9721c4e3eff5d5c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641636358, "uuid": "b2a8fa85-a36f-42d1-9cec-6c2596f700c6", "comment": "Malware payload (Amadey)", "value": "e70a8d5fe537aa2f7bb4d014ee5c35a9c169adab64c4e034d9badd8e8641f26b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641636358, "uuid": "892edcd8-155e-44d7-a6ec-2b42154984cf", "comment": "Malware payload (Amadey)", "value": "998ff60d9810eb0a3a3ffef6f29f38543b4eb927", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641636358, "uuid": "f5d0c0f1-c6ab-46c8-b9d8-a84de910a590", "comment": "Malware payload (Amadey)", "value": "ec60c4715a4a6997d9a56fdaf0004a27887cc4861d79c577f0a34e3ab705153530141155994c16e67edf0c86e372b5e7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641636358, "uuid": "c92672ed-33e5-4a7e-a53e-6961d7b8fd23", "value": "T1FD2419643916C032D660A1B219F57FF6C19DAD15ABB149EF2B800EB7D6212F37930E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641636358, "uuid": "ef650fe1-0003-464f-b119-2ad66320767b", "value": "6b56eb425bb7dbd4f686b84bebc7ef49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641636358, "uuid": "7c7f71e0-ddb3-4bcf-bdd1-c76f5a80da6e", "value": "6144:nJKIz1xzlrYREPxIvD7cMs3LssdLWvuysg/:nhVhxIvvvsLTdLWvuys", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641636358, "uuid": "dd984750-235a-4f49-be06-c3f93b3d7da2", "value": 227840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641636358, "uuid": "0fd12af7-0f1d-4fa6-ad67-def0b819b11a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641636358, "uuid": "327c3fa1-a5be-4be6-9ff1-4f674be0dfd9", "value": "c730063f167122d2a9721c4e3eff5d5c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49297415-70d8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641683478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641683478, "uuid": "a072281d-2c05-4a82-b76c-22b2cfe5cbef", "comment": "Malware payload", "value": "df4e5c6775c14e72fa41bce9b91755f8", "object_relation": "md5", "Tag": [ { "name": "Cerber2021", "colour": "#853B9E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641683478, "uuid": "ce8744a2-598c-4f61-b85c-c7096a9cca5b", "comment": "Malware payload", "value": "eba0482a5b1232db451b1a745dd8e99defb9f1194b070e2f5c20eeb251296a86", "object_relation": "sha256", "Tag": [ { "name": "Cerber2021", "colour": "#853B9E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641683478, "uuid": "4f7c29d3-2a48-4714-b569-d1f2359b85ab", "comment": "Malware payload", "value": "a42413c50f56e92ccba47f62eea44bb9542199d8", "object_relation": "sha1", "Tag": [ { "name": "Cerber2021", "colour": "#853B9E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641683478, "uuid": "ed339c20-1b15-4e33-a24b-2d3babefc46d", "comment": "Malware payload", "value": "4f5b311aef6eccc1fcf278f74b22f13542fe9710fab21a8de79ecfc337de35ff293c96cb1248859ed9faa3ee4d37559b", "object_relation": "sha3-384", "Tag": [ { "name": "Cerber2021", "colour": "#853B9E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641683478, "uuid": "e8ab9afd-3cb5-4e6b-9197-1465e9b2934d", "value": "T186F49D32B7D3E173D99224F04D2DA75E2839F82A0B295BE7B3D41B2E4A701D24E3165D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641683478, "uuid": "e057fdf4-38bc-49b6-a270-92efdf2878ea", "value": "d0e6d8cc31f0d3346e66a38b8a035489", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641683478, "uuid": "d66a2451-fc44-494c-be5e-2adf6fb6b636", "value": "12288:84GTI/cvffub6u4iRFJmVX5h4lij0m+t+OeO+OeNhBBhhBB/quZplAcyOdvo+nwk:84y+UXquZf7Zvo+nvAYVD3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641683478, "uuid": "0edea32c-8b36-486c-8260-eeb487ad6bd9", "value": 764928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641683478, "uuid": "1c5e256e-0d84-438c-941c-3912f36c2ab7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641683478, "uuid": "17b3ccaa-0c56-4866-a97c-faa21c256a60", "value": "eba0482a5b1232db451b1a745dd8e99defb9f1194b070e2f5c20eeb251296a86.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cbffcf5-705a-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1641629367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641629367, "uuid": "1bff78bd-0764-4251-ae38-8478a427e58d", "comment": "Malware payload (AgentTesla)", "value": "16fa3af709a63aa111951190bc8baf0a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641629367, "uuid": "f54764c7-cff5-47a1-9efd-de88261aadc9", "comment": "Malware payload (AgentTesla)", "value": "f0fd61467adc06d117f86ff918d39f4b813d96052afe06f3056c1b117bbf9cb5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641629367, "uuid": "28580242-a841-4211-b336-c1300415c492", "comment": "Malware payload (AgentTesla)", "value": "41590ea895fef53e2795791b92645160fafc9e2a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641629367, "uuid": "e2d492a3-78f8-47c4-82b3-478dd3f63edf", "comment": "Malware payload (AgentTesla)", "value": "a784570b13306c0168817a8b90b4a696235a670948042722ccbf5bfeb6bcf6c0568d8a73806be49e68287b118665b556", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641629367, "uuid": "8121f6c0-b457-4288-baa6-2fdd58559c0f", "value": "T173B4E09C3250B1EFC82BC976DDA81C74EA6078B7431BD203A55316ADAD0DA9BCF151F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641629367, "uuid": "f133e392-0bbf-4fce-9294-f64bb1847f95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641629367, "uuid": "d8564972-5101-4b1d-9a58-c9d17c12c54b", "value": "12288:5fRetiv1U5l0LKrzIJDI8HqwxiQZIhzyHsoa8Y/MqJ/89M1fJpiVX/NGoC+p:reov1U5l0LKr8tIaq7QYoa8gUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641629367, "uuid": "c5683343-d2f8-478a-9188-b186d446ad13", "value": 494592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641629367, "uuid": "41283620-d145-49fa-a112-942995dc7895", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641629367, "uuid": "21fe81a1-cff7-4ab7-ae73-3c640e212044", "value": "16fa3af709a63aa111951190bc8baf0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b7a361b-7056-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1641627701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627701, "uuid": "0b01faeb-a6f6-4886-a74a-bca9d29ea51f", "comment": "Malware payload (AveMariaRAT)", "value": "9888fd22220aea256ab3310c52a85e97", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627701, "uuid": "45ec2b2c-a7ab-404c-aea9-f80330442a7a", "comment": "Malware payload (AveMariaRAT)", "value": "f18d093dc2f73438bd3bed54a6d9b58f3f1910f71f60128082ffccd7dc3e40d9", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627701, "uuid": "899e829f-688c-45c3-a0de-ec9c1ce92cc1", "comment": "Malware payload (AveMariaRAT)", "value": "18d4f2f274885288783bdf4373c1dbdc10a36cd8", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641627701, "uuid": "bd23eb45-ef37-448c-b34d-48c8abfbae75", "comment": "Malware payload (AveMariaRAT)", "value": "f990ed8987c1c75c563ff86e0875b792bd6b929803ff369ec2bc7d6cd48ad539b771eed0eb36cba59db847778ec0552e", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627701, "uuid": "3330f9b1-1dd5-49be-acfe-12e17d2a44b5", "value": "T187B4123234E7601FDBC6527A5213563E9DF6EB18047333BB83926B2E5A3A5C3C289745", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627701, "uuid": "ceffe60d-ec40-4ac5-a732-bc781eadc422", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627701, "uuid": "3ac12dea-dee1-4271-9689-895cb7b02d9d", "value": "12288:WbLT06Yb37ha7QULVKh8pgwlxL8dHS9LQLmMgpD8:Wb+hFckh8pgoF8dHILQOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641627701, "uuid": "10f22c41-cd3a-4766-a4db-fe8cd45c0b3e", "value": 504071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641627701, "uuid": "e466b190-6165-4807-b1e5-644942bca588", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641627701, "uuid": "c6729b52-7330-42af-87c1-ed9abfa5e809", "value": "HSBC_eAdvice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04441293-7059-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641628816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641628816, "uuid": "4c232900-6702-41de-9274-eb691fb34965", "comment": "Malware payload", "value": "98b131a327b758becdfbe3bde0aebf0e", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641628816, "uuid": "a3516d05-9d98-47c9-8a70-4ea51082d3c9", "comment": "Malware payload", "value": "f289f2fe7ebdd948cc5fdbbc365ecd0fb33f4be0c72a9b56eddacf908222a1cb", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641628816, "uuid": "4357258e-a933-402d-b441-e75887ad4860", "comment": "Malware payload", "value": "9eb509298360cbc55fad98e41e01800d24d02324", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641628816, "uuid": "9f0cc82b-f6c7-4203-acbe-fd5f058d1d28", "comment": "Malware payload", "value": "c4ebbe6fd8b9d8c81078fc8c81697fe09527b998c6e0694f960588796c484bd2548cdb81410419fc81923b7abf2ad0d4", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641628816, "uuid": "92be6deb-8d27-49a7-84e5-1921255543fa", "value": "T112A4230862F3709DE6BF5CB853630A909A9FA5E150ADB2AE53885CD91077B3D33873C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641628816, "uuid": "207f3e80-4ba7-4ab5-a17d-fc70e3935a49", "value": "12288:IV19zIoFyUS1omjXhObEq88LhnnE12foZIB2RPYGO:IVbRYvjxOgOhntwZIdr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641628816, "uuid": "0ef5bfe9-00e4-47d6-a22e-e0cc173c8fed", "value": 462848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641628816, "uuid": "7cdfb2cf-f0d6-4f44-8992-dcea66ab9ddb", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641628816, "uuid": "afe26dc0-38b6-4af2-a292-1630641cc42b", "value": "f289f2fe7ebdd948cc5fdbbc365ecd0fb33f4be0c72a9b56eddacf908222a1cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b5cc735-7075-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1641641096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641641096, "uuid": "43bb4b01-9943-4991-abd4-f98caf8e8256", "comment": "Malware payload (RemcosRAT)", "value": "e55022c317eafa93da9321f293803119", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641641096, "uuid": "19f15d96-975a-48d2-8403-e12fb48c236f", "comment": "Malware payload (RemcosRAT)", "value": "f31c3f1bc2ca3732cd557ec416ca54562daaf704f2d5b44e9b7d92d22168ac9e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641641096, "uuid": "3e01b18b-9972-47b8-a765-8075b38c4300", "comment": "Malware payload (RemcosRAT)", "value": "62793b628b93eea608129e901303a4bbdb16b04b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641641096, "uuid": "a6bd4e20-5726-4d18-99fc-3ebe79ec5519", "comment": "Malware payload (RemcosRAT)", "value": "f8811bb7d5f0636656dc3dd06faad9685dcf85eab66bd2f9e3280d31ce922d1346decb7efe5d38fb7bfe4db28d29de41", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641641096, "uuid": "5356411b-c58b-4b17-970f-4f70ae21ca7f", "value": "T1F2653395A2F9F046E14901F09235EEB4D9860DBF18CFB71F5AF95C93B87C8A3C918426", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641641096, "uuid": "e149a8d9-e9d6-4759-b123-33b4ed1a5f0a", "value": "c1d428a624f7ef12578461f043fa097d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641641096, "uuid": "8049500a-242b-418e-a47d-a39d93e40749", "value": "24576:uHseI2qWcbOKEJHgVcXZSWf+DKtjdxjUjBpEanPHmE6lWaUexkEaHNYK3X7oy3Nw:4A2bbD69udKjBaI+lW+NapU6NVu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641641096, "uuid": "5c22c565-bdfb-4b77-9be5-fbc7ac97d61d", "value": 1489920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641641096, "uuid": "dfe00ec9-b3d8-4084-aa77-b3fde6febe43", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641641096, "uuid": "aa735de2-c14e-48d5-9836-55189ca98b44", "value": "e55022c317eafa93da9321f293803119", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdc917d7-7053-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1641626658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641626658, "uuid": "e37ab59b-594f-4bd8-b4f3-2abc75ded13c", "comment": "Malware payload (DCRat)", "value": "60c2cc7d9124cafbdfcf8b539d1231e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641626658, "uuid": "e479f81e-b696-42eb-9ee4-32007652e413", "comment": "Malware payload (DCRat)", "value": "f6b6afd931310b0930205d346b057acc1879a88acff36c460bb1b459e5f7cd79", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641626658, "uuid": "d045970f-2c0b-4e7c-86fc-5c61faee0ce9", "comment": "Malware payload (DCRat)", "value": "1bd2f2124eb36d8406958bd4a798595cf86df1fd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641626658, "uuid": "ed8b99ed-c45c-4d85-8a20-54ac2249985f", "comment": "Malware payload (DCRat)", "value": "b7151a5861d843e18bf723f2224f1770e210e03dbbbe912f004ad4543a28acd2ed604fe68ff9c634572dc39ff7d3d373", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641626658, "uuid": "c29f631c-25df-419e-a73b-9899efe1cf7d", "value": "T141155C203EE91525F17BAF7D85F075959B7EBA733B178A4E01A1028A0B23741DD90B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641626658, "uuid": "9f235f52-8849-46e0-b6c7-bdfe75566af8", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641626658, "uuid": "183a12a9-ed8e-49e9-808c-6e59f3190925", "value": "12288:aRZ+IoG/n9IQxW3OBsee2X+t4RbiqnOkKqfmV/1qYwkG252CyPNN4+276XQ/NO8/:U2G/nvxW3Ww0ti+Ovqfmf+kG2e/3Fq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641626658, "uuid": "ade57810-3d7b-4fee-bd3c-0131ddb5bd5f", "value": 939233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641626658, "uuid": "9ce7ad53-10a5-4bf3-b1e8-8fa9c590f524", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641626658, "uuid": "b93e1930-9ba1-432b-8fe6-97d21273fa1b", "value": "60c2cc7d9124cafbdfcf8b539d1231e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5566d93-70d2-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641681056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641681056, "uuid": "19e7d013-ffca-4fac-b8c6-b19f0e9cbb70", "comment": "Malware payload (Mirai)", "value": "c69b550a14575c7f6a566428cc035b52", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641681056, "uuid": "9b3f50e9-bf6e-4c1c-b1ff-3a8428c2e947", "comment": "Malware payload (Mirai)", "value": "f926609d316ff4814bdd45e6ba3f87c2679e10b77f58286b7b4a52641afac612", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641681056, "uuid": "5894dc2f-bb94-446a-8e5c-74df4d68102c", "comment": "Malware payload (Mirai)", "value": "0c34cbb7ce9729b57399c15c98b9dc495ba90c4d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641681056, "uuid": "8368069e-b9da-4ebe-a0a9-5b41440fdaac", "comment": "Malware payload (Mirai)", "value": "05a13cfe8a8026a316ac38e48b06086de3a0b838d5dd4a9b976972dc799522932e4bc3520f0f2a5062a95c08fb818300", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641681056, "uuid": "9e042918-c56f-4c68-a3fc-be7a0f6684c6", "value": "T1F9E2F11ACCB25344E9FB14F1C8AD7D0D44A8E96E4D681150B7B8AD72DA7E3381C740B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641681056, "uuid": "b0debf0a-d8da-4819-b5f1-d94770f55e96", "value": "768://8KEvEJHtoApd6TtXAdeHutHgLvUjtUAWcWzR967T7nbcuyD7UHQRj5:38ncdmnOyuHgLv1khnouy8Hy9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641681056, "uuid": "b071c14b-8260-4da6-bad2-c9e1788d3941", "value": 34000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641681056, "uuid": "06783d73-cbbe-4ccb-b98c-c1e5c14b64d5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641681056, "uuid": "ebfa947e-9e17-473e-8dd1-c0f849b77866", "value": "c69b550a14575c7f6a566428cc035b52", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf8dbb17-7069-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641636029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641636029, "uuid": "ead5c8ab-d68a-4cdd-adce-46a44d67a190", "comment": "Malware payload", "value": "41975a4c60dccabd1894be7a0dff083b", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641636029, "uuid": "ee80e721-6338-4105-963b-70c9349ead72", "comment": "Malware payload", "value": "fca4eca5ce2aebbca57447c84405d1dfa3d3a9d987318717bbdd457dfbfcf478", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641636029, "uuid": "d509e1de-3deb-472c-9d6a-a551ffc9f7ac", "comment": "Malware payload", "value": "0f1f2aa3bbbd83a553d261d8c0b1838a6167a6e8", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641636029, "uuid": "56e5e05e-1109-4742-b5b8-ac8e4a71bba7", "comment": "Malware payload", "value": "1b02f68f74f541fcb9798aa8f79f5938a40a898f9622b7e75e26ac05b8632302e6faa0df4ea47ae92a23c7847a7882cc", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641636029, "uuid": "20fba989-b026-4235-a7eb-834d5effb48e", "value": "T12295334C52BD7DECFC9F12293B6289D0C2FD76E0E841A09162545CA85D3F1BE039FA66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641636029, "uuid": "c024c4b3-fc4e-4ff6-8041-e9767f6ea7de", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25A:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641636029, "uuid": "4c43d5ea-586f-4bfe-b154-52714461d834", "value": 2011136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641636029, "uuid": "f59048a8-c8f9-4a64-ae18-09b3c3ab537d", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641636029, "uuid": "7358d316-9d7c-44f1-9e28-a578e9e8379c", "value": "fca4eca5ce2aebbca57447c84405d1dfa3d3a9d987318717bbdd457dfbfcf478", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4605e13e-705a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641629356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641629356, "uuid": "70f3b05a-9024-43cc-8ce5-345078a91352", "comment": "Malware payload", "value": "e3ed152ccc1603d19c2e69997407bed7", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641629356, "uuid": "2f0305b7-3f03-4da8-baba-8c5f460e3c28", "comment": "Malware payload", "value": "ff91b27ceafee96143faa965d9316de7746ab90befcf05fcb1bcc4fda5516852", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641629356, "uuid": "24e5df01-b492-4a88-94b1-d3252afefdc4", "comment": "Malware payload", "value": "187c8ec8d24a05250d50cfc3739d54f24aa34826", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641629356, "uuid": "8f2a2274-c35a-439c-b19d-79492a64bf87", "comment": "Malware payload", "value": "de7ab9327e08b1cef1982b2fa4ea99f3def9a5e3261cc3c4d80c9160abc83f917284c000cf99a539220cf7ea69256c30", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641629356, "uuid": "20b20ec3-3366-4fdb-902f-f7010601964d", "value": "T11C457B2132C79A32D493117155AEA3611A3EEC704B708287739C7B9E6FB27C0A73579B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641629356, "uuid": "cc2be142-56de-49da-abaa-6d1c4496e874", "value": "24576:Blgq+3Nn7BjlpOu3LBCvAq23Nn7BjlpOu3dAKqVi0C:BlgJ3Nn7BxwubBCvAF3Nn7BxwutABVS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641629356, "uuid": "2b86955c-892f-4a78-856b-ac79fce14844", "value": 1173575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641629356, "uuid": "c524f74b-fb6c-4e2e-844e-b12b7e1e8dfd", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641629356, "uuid": "ab6160ea-c48b-419f-a6e2-3912fcf7d986", "value": "e3ed152ccc1603d19c2e69997407bed7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }