{ "Event": { "published": true, "date": "2022-05-28", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-05-28", "timestamp": 1653782581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "197b7c05-17a5-4cf5-a244-90b6b0a46027", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1b7639b-de30-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653706206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653706206, "uuid": "46c014a4-1896-4ebb-be97-8d73f93e6db6", "comment": "Malware payload (Mirai)", "value": "a271656a0ceca635caa44688776561e5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653706206, "uuid": "3617d1e6-b2fd-4672-b0ed-dd21da98609a", "comment": "Malware payload (Mirai)", "value": "000a3338e08875012215744f37400dfae75c727350df4d23eba7106948e24674", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653706206, "uuid": "f6bccb92-ac34-481d-ae9a-ed1c4c872f8e", "comment": "Malware payload (Mirai)", "value": "f7ab6ed5413f94228b5e77cb176db8b5f2804962", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653706206, "uuid": "6b7e0820-7b97-46b7-ba76-8e2063a71af9", "comment": "Malware payload (Mirai)", "value": "72bba1652f08757ee9627dfd7f56f649623ff730c55554a7fb64e65b6989611015f43542c53e1cde3f699d04f84cfa33", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653706206, "uuid": "8fff82ba-b60e-4381-a408-4229b784dba7", "value": "T162330785BC91DA13C6D422BBFA2E51CD331523ECE2EF72039D222F51768A81F0E67655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653706206, "uuid": "98d69c59-bca8-4ea4-8299-106d52440124", "value": "768:3HD7NZi1ZRFB2HTEkaEyVYGh7HWvTinbneYPrdGUrX/PJY6sPNOvGV0W3//:vNw1Z/B2HryWvTcneEQUb3a6YX3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653706206, "uuid": "752b2f3c-04de-4768-b233-0d32e2d89e5c", "value": 54268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653706206, "uuid": "50035cf5-1bf9-4fa8-9db6-1741710dd7cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653706206, "uuid": "d300562e-54c3-4d0c-bccb-c7b9bf452a73", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "867a6f14-de9f-11ec-8e58-42010a9c0032", "comment": "Malware payload (IcedID)", "timestamp": 1653753727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653753727, "uuid": "d55899f0-0f54-4e7d-884a-1d9693aee79a", "comment": "Malware payload (IcedID)", "value": "77d0d73564f14e1cb23f57be1ab973b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653753727, "uuid": "18ac6b01-1aa9-4dad-8e19-2fdc562aa199", "comment": "Malware payload (IcedID)", "value": "015326f4d50aadc7642ed6043c8e451e208dfb0c57b1389a8a9994c74a30dd37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653753727, "uuid": "c5e65bdb-9b4a-4ca4-bdee-fa3d9e8f8614", "comment": "Malware payload (IcedID)", "value": "f6cff28fcda4239d35bdb11f3d0d1ead273a5d6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653753727, "uuid": "5cf365c7-0b00-4542-bd96-048cd91e6e2c", "comment": "Malware payload (IcedID)", "value": "5ce4e1a2a95eda82f1c84e81e5142f14e50e5958781b7a9f7b93936ce7651f05f6dffaf759ad35f90f3158eb346fb752", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653753727, "uuid": "3c68e91b-5f17-46b3-9cf2-06de6c1117b9", "value": "T17D84BFB8B6142CE6E67E067BD9D67CE913B627628D8BF8CD4064B7C30563371EE06805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653753727, "uuid": "bc615e35-752a-4fb5-924f-c1efb4c3023f", "value": "12288:n49cfWTcALiwCeWu2E5u0v1qR/B8r5g1h:n4xQtLuZ5x14w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653753727, "uuid": "f31b3ccb-b6a0-44c1-a6ba-d4a07a3cac6c", "value": 402944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653753727, "uuid": "50d82793-e7f8-4abe-9c31-15082e5ce9c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653753727, "uuid": "8d5b68d2-a597-4ce7-80ed-1af802bd42ca", "value": "textins.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5ceb1cd-de64-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653728547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653728547, "uuid": "2aebcb53-78cc-4a13-8309-2e10605727ec", "comment": "Malware payload (Mirai)", "value": "dde87180985ddbaac835145c46e2c772", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653728547, "uuid": "98cde999-c7e8-4c78-b080-cf40ae566251", "comment": "Malware payload (Mirai)", "value": "0321d43399fd0317c1043ab468ae3a58b2eec71b9bb6f4a6bf0a59ce6deb56af", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653728547, "uuid": "7990aa48-ee3c-4198-a932-ad1a870dfece", "comment": "Malware payload (Mirai)", "value": "81e513e1c649cbc5ad2c4162c2b1b4ab13ddbce2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653728547, "uuid": "c26b1087-6685-4b4c-bafc-fbccbebbf816", "comment": "Malware payload (Mirai)", "value": "5ae59a3f6f401756463632fc2b73d08a5212788a137e648b93d5861fd4b76aaa6647c4963d0d1e8f6b9966e7443cf12d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653728547, "uuid": "ade46637-5266-4a97-898b-a2b517b29311", "value": "T17AE22BC69502DAB5FC2145F518B7A7718B76A0763B2AEB4AF3A93731BC027106B0734D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653728547, "uuid": "e5ab9e35-f8a2-4421-9190-0872e1b4c21f", "value": "768:0EuowcuLoCOegFW7SuBNXpUJlt/8vJDcQBgFwnSV3tzck:0ERwcuLoCpgYSop2sSwnGtzc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653728547, "uuid": "1ada2e5f-9b85-4cb9-99c2-99e4e17aa312", "value": 33552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653728547, "uuid": "8a86e5bf-06e1-4c5c-bfee-5efec6aeddf4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653728547, "uuid": "8bcd750e-d004-4c79-92b9-1c29881ac35a", "value": "miori.i5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e119b4de-de30-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653706205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653706205, "uuid": "b259c1e5-b62a-4292-9395-761a3be874dc", "comment": "Malware payload (Mirai)", "value": "a69c6ce7267c2bde630286bbc47dc5da", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653706205, "uuid": "d58da5d2-48ee-477c-8bdf-1653dfe57d98", "comment": "Malware payload (Mirai)", "value": "03846c1bea3b592e0c450aee1a0ffd1f4e1c420289f6e2e29d4f7e07024a69f8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653706205, "uuid": "47b429b5-a79c-4a6a-99ff-4a7dbb406e9b", "comment": "Malware payload (Mirai)", "value": "6cd4be5c349c2adbbc96418c8e664aebc28bbf8d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653706205, "uuid": "77acd668-2b95-4da8-85e4-160c9611fce6", "comment": "Malware payload (Mirai)", "value": "a9580523860eca12c519c554574155b1c2064d2e903d0e4b591013ef5f189cfaaf3a5a92be6fc5e4a469de1e54f4eb23", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653706205, "uuid": "497dfd96-9d13-4a99-95d5-3cfb73392f41", "value": "T190234CC89583DFF5DC1106B431B7AF328B76F13B2166FDE2C395A532A942602E50729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653706205, "uuid": "bc9e644e-bc4b-41cf-adfa-14b666f6648f", "value": "768:TOArwMvTu5qM94QozES2U7E8yHyNm/1vKmrrr+AlxAanOGqixfzhq2h:qArwITu5qu4Qjhgm/VKbOO/idzhqo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653706205, "uuid": "4e2c3d4d-8d4c-40d4-bc25-d31fd77b0588", "value": 47216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653706205, "uuid": "57d188d3-3777-497c-9c07-8508c270b733", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653706205, "uuid": "a3149f83-a9a1-4819-ade4-2a78f183031b", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2874dbcd-de9a-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653751422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653751422, "uuid": "2c7ed292-6c74-46c5-b41c-d6cf51b3518b", "comment": "Malware payload (AgentTesla)", "value": "6e266c25de9c957b8cb4934312c0f5bd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653751422, "uuid": "6dcae698-e1bd-467d-af3e-19cda7ca078b", "comment": "Malware payload (AgentTesla)", "value": "03920d7fd96be69ab56cb8d5bb1968419254d064f7ff4630c05ff52f83eb3b36", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653751422, "uuid": "aacba1f1-317f-4a83-a532-b941073fd986", "comment": "Malware payload (AgentTesla)", "value": "1db80268a944dfd9a96b26976e243127811f9471", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653751422, "uuid": "22e70fdc-4e02-446d-91d4-e02556657f36", "comment": "Malware payload (AgentTesla)", "value": "e564f88330692009a814f14ee55438b05a1ece35d363e56c949e6824ce8b5984be751e79f9407ff57daef6ec59c8f09f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653751422, "uuid": "14a766ba-b5dd-45b8-b40e-e7d86f633686", "value": "T12005E17AB2535E13C05917FD80C2A86407B966079132E7C72FC721D62B16BEA4DCA7CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653751422, "uuid": "4a94f9c0-9d8c-4bee-97a1-6ae3265ddca4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653751422, "uuid": "04e98eba-3ab7-47f4-96ac-2e58302f7f59", "value": "24576:jps6g3H13YvA5FloK3w5HqdtsIgfjNuHpELpod:jpw5Fl5w5ets5wHSpM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653751422, "uuid": "2e55fba7-426c-4ae4-9766-fd904171003c", "value": 817664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653751422, "uuid": "5c63b343-cde6-4788-ac7a-a070a409d2ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653751422, "uuid": "10e31ff6-e4f2-4266-8ca4-6ee53ee1f517", "value": "6e266c25de9c957b8cb4934312c0f5bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd5a81d4-de6e-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1653732801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653732801, "uuid": "1ff2683a-2680-4304-a8fd-6d4f24f07560", "comment": "Malware payload (SnakeKeylogger)", "value": "f29288bf08515e015bedf11f1570a3cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653732801, "uuid": "e847bcd0-ad3a-4a99-98b6-139ddae8752c", "comment": "Malware payload (SnakeKeylogger)", "value": "0750a013cccde43a721e417544ce05413cc3ec5fc05a417ad57e47b22e37bf25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653732801, "uuid": "51ec7076-7133-4ebb-b6e4-afa18777d82b", "comment": "Malware payload (SnakeKeylogger)", "value": "1a5d0fe45137bf5a6116b0b55e72d8093f301be7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653732801, "uuid": "1dfc4ee9-9153-47e0-bdd2-cdd63c6665aa", "comment": "Malware payload (SnakeKeylogger)", "value": "99e063a11de484e008f1f45bc548e9cd336947ee74846d3f20ad5523eb882df490686925b515643834feecece4d2e439", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653732801, "uuid": "79089c9e-5542-403c-9c73-3636300bca8d", "value": "T18973B3E2A1C4FFC7D5BB62342EE136200B275B58281956508BCC2A1F77269DF3781B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653732801, "uuid": "f06ea0ba-55f3-49db-aa1f-125b0d10cedc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653732801, "uuid": "4e8e2912-1da1-4fec-983d-cff26a303d2c", "value": "768:UkUri6bAe318O+jRWcplTEMrTocPowS4TGE/5555555555555555555555a3B4/q:f6bTl8ljRWcplgMPocPoJ4TGEWx4/25", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653732801, "uuid": "3d15090d-a652-4176-acb3-024a31cf8c5e", "value": 76288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653732801, "uuid": "2304e1c4-cd27-42f7-8586-59891b1a4d9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653732801, "uuid": "65f7df0f-577b-4ba3-a420-f30a1747c112", "value": "Vessel Details .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e67ec15-de1d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1653697879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653697879, "uuid": "c374c74b-451d-4775-b520-779d55b597bc", "comment": "Malware payload (Formbook)", "value": "e617a9401dbbf9943cb5078b4f4ceb4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653697879, "uuid": "faa5e3a2-a6aa-4b64-b8e3-e76dc1fdf41e", "comment": "Malware payload (Formbook)", "value": "075f41c576c8e20d1ec1981a5e4197d514030c69dd653dfc2b94edf5088a0671", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653697879, "uuid": "5e04a057-f8e6-4992-87e5-3553a1f38762", "comment": "Malware payload (Formbook)", "value": "a15686585eb1c02df76a769e0ce3cc9a98d00b75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653697879, "uuid": "3c5fde32-647c-4bb5-afba-611c0a49e628", "comment": "Malware payload (Formbook)", "value": "0414fe96ba9d914dac194500248ab56dbecf0675cb95e71e78f09e21e81d51d6d0aa25de8428b125d28b8b61bda9501e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653697879, "uuid": "a43c55a3-7555-4228-9848-2a58ef1c9c95", "value": "T1A5D423433E618301DB394BF068EADCA2433579119721DB98BC2736DE1BB6BCA4253D97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653697879, "uuid": "8e01019e-0712-4381-9035-93b1161b7260", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653697879, "uuid": "7e0383ad-920e-4a99-a0a6-5048197cf3fb", "value": "12288:ngpvdeUq1tmk+S76lYyMkrx9pLCONGViFXVY/XRj4loXxvOZI:ng/tJkeYyMqPJCsmitC/XRdxvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653697879, "uuid": "77c1d07c-6054-4750-b47e-bba7dd76ed91", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653697879, "uuid": "baf648c9-eef7-49d1-923f-54f29e4c6877", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653697879, "uuid": "7dc4790a-91c1-44c8-bd89-c46438ed5e2e", "value": "SecuriteInfo.com.Trojan.PackedNET.1159.2750.2520", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ddfbe35-de7d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1653739164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653739164, "uuid": "36d6825d-1ff5-452e-af69-1a787f048625", "comment": "Malware payload (Heodo)", "value": "df906f6852627319b26686239950b926", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653739164, "uuid": "2f234e2c-6564-4d30-a42b-926126f2b6da", "comment": "Malware payload (Heodo)", "value": "07ed07a5b2471d76295b5266553f307717282580485dd788d7a97ba3b0b5c234", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653739164, "uuid": "d9a18891-c490-4817-ab4c-35a5b01513f3", "comment": "Malware payload (Heodo)", "value": "11e483442fe3771dbda9f223d9f1253e6fe74617", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653739164, "uuid": "343a4e99-f563-4247-a2b0-35b4844c01de", "comment": "Malware payload (Heodo)", "value": "658f634c34e0af7bc440a15e834f307284d3ba57e64ec045231b26eb87d1397173edfa984d64e521f91b93041f2978dd", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653739164, "uuid": "bfd437b8-73d0-45dd-ae41-edd4e815efed", "value": "T139634B59B76A885EE9198B3048F747D62323FD308F6F0A433259F3926FB9590670390B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653739164, "uuid": "dce3e1df-f857-435b-a3a2-83e5e9cdf696", "value": "1536:OhKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+4+hDcnTLiQrRTZws8E1:uKpb8rGYrMPe3q7Q0XV5xtezE8vG8UMf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653739164, "uuid": "d685e85f-c340-4069-929d-6100efdad851", "value": 72192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653739164, "uuid": "5296a5bb-f74d-4b8d-a495-0838e1ebcd97", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653739164, "uuid": "c2574ca1-6308-4e93-a0e1-a8bd1537bd38", "value": "4235654892.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce5b0b32-deaf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1653760720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653760720, "uuid": "af6b203b-1cd4-4d21-ab68-9e35067fc3c9", "comment": "Malware payload (Gafgyt)", "value": "371257b1c144db29fb823dea67744489", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653760720, "uuid": "d32a38b9-f01c-4291-a457-11ecb6657492", "comment": "Malware payload (Gafgyt)", "value": "0803b261f1c1da4d632859f48ee93ea9e2382b8c2f21c4488b2dd80de0170378", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653760720, "uuid": "397790a5-4990-4c98-a1c4-0d297df84ef5", "comment": "Malware payload (Gafgyt)", "value": "1e12760dbb68fe3cc1e57ce23c43c4f1007618ba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653760720, "uuid": "73416a26-f6e5-4edf-b421-8d135703f446", "comment": "Malware payload (Gafgyt)", "value": "c6ed5a41a4a4d6d1d9dd7b7a749019601ebfbf8bffb718aa9a8d3f10aa9d9888b96d7249e2f220a7ccd08c11521d56fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653760720, "uuid": "c79c5d41-560c-402d-bb87-9d41ef0a2ad1", "value": "T1AE14B744AC64576FCBE3ABFBF714B1CE727686941F83330AD72849F013C16EA9519292", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653760720, "uuid": "d6f123d1-ab4c-46c3-8156-0c87bc683e95", "value": "3072:GrIlV4NJ9XIrTgXxwd5FyWZlNl3yLUUGkDmXbroD8iNkJsegfKv+/5lEhECxxQRL:GrCVIb08OlY9RGZmidoEoDt0vm1M2X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653760720, "uuid": "28ff9041-79d1-4d3d-a1cd-990e063be697", "value": 196148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653760720, "uuid": "baecc028-fe79-434b-a9f0-cc61ea71a827", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653760720, "uuid": "eea1dd00-f4f0-4d7b-a9bb-6f888e9e694c", "value": "371257b1c144db29fb823dea67744489", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c7cdafa-de36-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653708426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653708426, "uuid": "88111dfe-68a7-4b36-a114-92f5de8c2e3e", "comment": "Malware payload (Mirai)", "value": "c83bfb6dac02019518d0d7c9daf6a8bc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653708426, "uuid": "e6cab6c1-c420-4c76-bdd0-91244bbd6864", "comment": "Malware payload (Mirai)", "value": "08b9ef6fbb21cbbce58aa959efcf964c7559e14d707e0e73f5d9d1c1a96cc787", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653708426, "uuid": "03cde6f1-8770-4f7f-b3a8-798dadba3a47", "comment": "Malware payload (Mirai)", "value": "04b1ce7fbde0103f7ed5cec41c0ea252fe0d7fa4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653708426, "uuid": "a07f263c-f571-422c-a24c-d1bc8675bd19", "comment": "Malware payload (Mirai)", "value": "8affdd82d8d2b4f86ac45adee0b906a051309ce43bc698d09b6cfee6e8d99d1fabc4cb0931134976f4058ab913ed34f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653708426, "uuid": "bc5812f1-9f94-431d-a1fd-566bb623835d", "value": "T16153BFB2C4959EC0C609437970708ABD5763E946791B1EF09E49C9AA400FEECF25E3F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653708426, "uuid": "13556d7c-420f-46a0-9870-d427af8580fd", "value": "1536:6/qbwZlraesqtb43pwWf9rpqWcjIKF7CoY2P:6ykFVtb4n1jckKF7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653708426, "uuid": "72ef7648-aa81-4a81-8ac9-81575f906302", "value": 66596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653708426, "uuid": "98bba03a-a50d-43c6-91e8-b2692b6c372a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653708426, "uuid": "b129c935-5481-4dd8-99cc-c402cdce1dbf", "value": "c83bfb6dac02019518d0d7c9daf6a8bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e20318f3-de64-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653728541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653728541, "uuid": "d4009bf7-82c9-4ad1-99a7-294b29890701", "comment": "Malware payload (Mirai)", "value": "2b855f59b4d3e002f059ae988e76f376", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653728541, "uuid": "f428ee13-bfe7-42d3-bd1c-d011daefc0be", "comment": "Malware payload (Mirai)", "value": "0954281d9640f54a2bb595f85f401326928de51917d3d22a2994af3ab836e629", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653728541, "uuid": "21107e84-0ac9-4ff3-9789-bddab4dc9dd2", "comment": "Malware payload (Mirai)", "value": "af2b009e835a894d32c48865ded1c188737de7a7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653728541, "uuid": "d5d26313-05f2-4f28-8af7-4684e09802c6", "comment": "Malware payload (Mirai)", "value": "32d0fcf00594072fa52e5564fb7d59ee015d012a86a706b32f80711ec123d6d78f92b9c42cbb6467a4bee7d7f7a9a591", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653728541, "uuid": "7b8cc97a-2907-4a3b-85b4-d00686854b99", "value": "T13C539488FA59D77EC7E272FEF75802CE373D0798B79772265931199137C8BA0A529020", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653728541, "uuid": "870e6d0c-f562-4a65-b1f2-a4979a6e2202", "value": "768:IpZSYDBZsSeHbnnsdtCvhyIDafNweRZDSstSuDKX1i8lUuxkbA8XoBx+GRBzFnyw:abBZs1n+teogameD+X8+DWZo9Au9xj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653728541, "uuid": "cb087dc1-e41a-4e0b-a92a-103801718233", "value": 64128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653728541, "uuid": "41383fae-a82c-4a5c-ba2e-138bc1949748", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653728541, "uuid": "3ebbebb4-3a61-44a7-92c1-f1eca6e0b32b", "value": "miori.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efbd397f-deb7-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653764212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653764212, "uuid": "8d063916-e7c8-4595-861d-f2ef788346f0", "comment": "Malware payload", "value": "0b84969ac24784f09eabfe9a04b6eb42", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653764212, "uuid": "40193e8f-8ca1-4b4a-8d5f-888cc6444acf", "comment": "Malware payload", "value": "0cc6a1e9ae51170229facde486e8de3c8cfa413b7b53bbe46b42669f09637be9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653764212, "uuid": "dd170198-93fa-4c0c-980f-44281c1efe3f", "comment": "Malware payload", "value": "5b379aa172442b2f28de1f07fc714fc50e3f9e56", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653764212, "uuid": "61c862c4-bcf4-4472-97b7-adc9672c9527", "comment": "Malware payload", "value": "d49859f23274a547027e11e20361fa1027ba0b4744928a68044018090cf15ced8cdeb022236137ca4bdba3f358234bff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653764212, "uuid": "aab07431-622d-4836-ad22-54068a74c9f6", "value": "T13093BE23C9302D24C1058AB071F5EA769323951690C73EFAD585CB6DA843DEEF226BF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653764212, "uuid": "dd3c6ddb-0b83-489e-bee8-68f58b7a81a1", "value": "1536:wzNOILbgXRFi5SygCd1yTd4+2Xyj2iPA6LAWCPkZJKVaMd8JAaH5hra:2/bSCMfsyTd4CjHzLAWWV6AK5hO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653764212, "uuid": "c3d8ec39-4557-4ab3-9992-e7b8f71e4240", "value": 91504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653764212, "uuid": "0960c557-eda5-4cae-8654-5b3f758c2224", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653764212, "uuid": "0bfa0dea-1f12-469a-a2fa-4274d9ba0614", "value": "0b84969ac24784f09eabfe9a04b6eb42", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3ca5dbd-deb6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653763709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763709, "uuid": "18ca7dc2-a895-416f-9bf8-b2e07cdf6198", "comment": "Malware payload (Mirai)", "value": "0029410a8e260fb16d69134b19826a9c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763709, "uuid": "fecd59f8-b5bf-4571-9410-06e270da1b1a", "comment": "Malware payload (Mirai)", "value": "104619921e5c12b880c63a8223efe1b134fee48c9bf228004ac879a9c53b231b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763709, "uuid": "54442d1b-9aca-4c04-9728-9b08f2c13ff9", "comment": "Malware payload (Mirai)", "value": "d8ac29a2f5efdf35290f6c7a10ca39398329ee32", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763709, "uuid": "eeb6d422-9470-414f-aba0-e35418d3d294", "comment": "Malware payload (Mirai)", "value": "f72fff89eb4ac44ca751564097522098973d01a587fca4d385a9a76fca8cc73f0c390952ca99285b15049d015a7b0f05", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763709, "uuid": "ae84d27f-f2d2-4fc7-af52-00ebab70e271", "value": "T119731946FC818E11C9D813BAFA2E118D331767A8E3DF72269D106F207BC692B0E77655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763709, "uuid": "4ef418de-1bdf-448c-87fa-28890ddc497b", "value": "1536:htnyGrtLgWfYkja3HXrJTj8q/9dSn6bBr1AY0yern5+/LQ4MRipbkwrszXJ:2GrBf5jUlw+dS6x6XyeIbrrsz5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653763709, "uuid": "36256ee1-b658-4035-b17e-3f45b4370b2c", "value": 79196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653763709, "uuid": "0f8a3381-75b5-4a49-9b55-4f2ed5248a59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763709, "uuid": "5e1cef05-f2cf-4469-94b9-d631d8305d01", "value": "0029410a8e260fb16d69134b19826a9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bd4af31-de2e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653705123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653705123, "uuid": "6b830720-8d51-406e-91cc-d8a4447b61ca", "comment": "Malware payload (Mirai)", "value": "ad1bec046f8488d6a5176acbf3c371d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653705123, "uuid": "332794c4-1759-4b86-bc1e-1877524ae3da", "comment": "Malware payload (Mirai)", "value": "134ce269fb24df3edad1b82dbb2dac0287b4c487074b31adc67b74d134976095", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653705123, "uuid": "0f6f9479-049d-4764-a6b4-ab27fde2e862", "comment": "Malware payload (Mirai)", "value": "c8080349c0ddb6469d5a2b80fa6b4c6f96673d2d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653705123, "uuid": "3e0be08d-6195-4a12-91de-cb339e1e2de6", "comment": "Malware payload (Mirai)", "value": "17be60ce8755aa87107dbcebe7d00c1a08daf53d42e7b0e6f9121ecd4d1fcbb0403f06e97a1f7de23978462ca417735e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653705123, "uuid": "24fbbd61-9120-44ec-8412-f5ea7f643d49", "value": "T1C5132995BCC18A2AC6D0227AFE6F518D336163ECD2DF7317CD241B14B6CA61E0E67A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653705123, "uuid": "00599013-e5a1-418b-b545-810ec6b81caf", "value": "768:VX5H3XoHHEYjreE0zM1hIXOuTu3HroDOYJoz2zHPrX/PPfcHPNb:z3YHHBjrefTu38DOYCzEPb33cx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653705123, "uuid": "f1105039-8db9-42b2-8c02-e3a3c85f860f", "value": 43208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653705123, "uuid": "cba89cce-78f0-4e30-8b98-94a9a9c347d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653705123, "uuid": "098df884-a874-4caa-ab04-5da2a9560446", "value": "ad1bec046f8488d6a5176acbf3c371d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2388039d-de69-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653730369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653730369, "uuid": "031cdca6-fc5f-4f62-b3cb-77f00316e1c8", "comment": "Malware payload (Mirai)", "value": "1f320d148b44229fba0d5f54759178af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653730369, "uuid": "6026593a-2826-4072-8046-6cd788ad21cf", "comment": "Malware payload (Mirai)", "value": "1383b7a0648544ce8ce423fff66620fe785338fcc531133f9a1b7384a2bfe617", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653730369, "uuid": "c2375cf9-4fe8-4879-8182-ae99d961630e", "comment": "Malware payload (Mirai)", "value": "c6ee23ead6899eba9fee2e8d9e0a0228c99e97cc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653730369, "uuid": "e32947ea-94f5-4f4f-9104-7aed88429e2b", "comment": "Malware payload (Mirai)", "value": "02b6038937028a75e233854bc26e1be7b6a1ce437e225726284f9d108609747f84cb002ef48a09f8c625da763090137a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653730369, "uuid": "a05d41a8-9319-495e-bb63-7ca91ff367a2", "value": "T101634B317A711D1BC0D4657B62F34320B2F5578A24ACCA2E3D720E8DBF6868066977F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653730369, "uuid": "66d8aa45-24d3-421c-a754-a8c5b961f004", "value": "768:25EoRfLVLplsPEo5A8HA3asg2NpYqkBlL/f8fVeO+lM5VeRRD2HnA1t2SYewSGab:WESfLVLplEELlPDlO/smlM5IbtRYeF8o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653730369, "uuid": "c47be27a-07fb-41ad-b05c-17ef9935214d", "value": 68392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653730369, "uuid": "c47374a8-5e73-4722-9d1d-265a7f923b2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653730369, "uuid": "64290918-26c1-4302-9afa-400dc078f7a4", "value": "1f320d148b44229fba0d5f54759178af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a417aaf-dec1-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653768176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653768176, "uuid": "40baf702-96d8-4862-b7e4-2686456936bf", "comment": "Malware payload", "value": "e04b50e6fce81b98b68e30ee7e9a9824", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653768176, "uuid": "3d02c186-e8b0-49cb-af50-e7b4fd8c2172", "comment": "Malware payload", "value": "1659eeb159c06e2761484246798274d8f23bcd85d7ba540e758c17d8bb9fb2d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653768176, "uuid": "77b2f5b5-d440-4090-9bea-f185fa537bc1", "comment": "Malware payload", "value": "14f9087b29c8c95911f9de372e3593644c4cb3ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653768176, "uuid": "935f91f0-ea1f-4eda-b515-d6dfbcb2c65b", "comment": "Malware payload", "value": "962703c47dbe7de420cc700c57543c9abdf21629616bdbff4eda8e5d226978b1adbc94e64b5c745ac7fea1eeb5b70efa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653768176, "uuid": "ca3b16ad-5aec-471e-ad50-74eace253f9e", "value": "T1EC1633434535D814EEE346B01C86883838B56E5D53B3BDF8AE71CCAF8F425B27295366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653768176, "uuid": "e4539f44-dbc4-4d0a-a19a-e6b8497d726d", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653768176, "uuid": "c0120751-a42e-409e-82b0-e06589652174", "value": "49152:mJ7UieaIxXXggKAmPZ3EgSRYnQlNFEioYLznwZoqaHFYIUbZI7E6feGVWr09e9L:mB7IxHggKnEBW7io4iiWIUFX96MQeh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653768176, "uuid": "54c4ab9b-3fcb-4fbc-8a58-18beaea11c81", "value": 4222464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653768176, "uuid": "1c62437b-f683-419c-a6c0-c1be94091415", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653768176, "uuid": "5ea140de-bf76-4806-8ddd-16660db79260", "value": "e04b50e6fce81b98b68e30ee7e9a9824", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2663b5da-de9a-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653751419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653751419, "uuid": "f12db894-b9ec-4c61-a2ce-4ab59aac3abc", "comment": "Malware payload (AgentTesla)", "value": "d7378e4392fbe0d9c4adaf5b460fea18", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653751419, "uuid": "e4189a97-bb35-4250-80e4-2c9995eab3d9", "comment": "Malware payload (AgentTesla)", "value": "1ddff7b1143ac407181bb571180118602fd5c7b8756ce1828f37b68fc24ae077", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653751419, "uuid": "1cfab9ac-ef6a-444f-9bad-4b8006677810", "comment": "Malware payload (AgentTesla)", "value": "ab2eaa23ec8d582b0b949f40af79c11432e53225", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653751419, "uuid": "2a5ad2b6-2147-4ab8-b0f6-e27b9548411f", "comment": "Malware payload (AgentTesla)", "value": "f044ca48e749840f05c622fbe497b26d6912b8aae2baa911e4a15c068844b430cad2365299319a1ebe7adebfdd8de4f7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653751419, "uuid": "a2efb61f-001a-4015-bda4-abadb02099de", "value": "T15FF4011176F81B42E2B58BF40AB551904BF63D1AB57ADA1D1DC230CE2877F919F20B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653751419, "uuid": "3cf7d8d7-8d05-4f01-b93c-f2eb28f4cc92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653751419, "uuid": "ce0ab13f-6f0a-4684-a663-c364c3765d8a", "value": "12288:rWi2iNzbHobPHri1C9a826v0vbftb7kq0NymJoLSCUk6ltnX:rWi15bHoq1CEb6Cbtz0Nx6mCUkEtnX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653751419, "uuid": "8cc98a34-b053-4701-8808-f570f2a3c286", "value": 751616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653751419, "uuid": "c5fe5abf-5cbd-4548-ab0a-a559cd3cb0b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653751419, "uuid": "51dee93b-35e0-46b7-a5ff-eda5deb7feda", "value": "d7378e4392fbe0d9c4adaf5b460fea18.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb750cab-de4d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653718598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653718598, "uuid": "b9bf40fa-ca53-4185-871f-629416c6e1ed", "comment": "Malware payload", "value": "5dd1803af5860a9a20d99b749a00462e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653718598, "uuid": "5c1416c2-bf7d-4f93-a915-962dadb33a64", "comment": "Malware payload", "value": "1ed83cdde85305c31792de47f0b027895d9abf19382e571306b1ff6e9dc91ed6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653718598, "uuid": "b95fbaf7-0f8a-4c18-b9b7-25bbafd5eca3", "comment": "Malware payload", "value": "b08316ede49f65f91ecf25661e80131e82a18aa4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653718598, "uuid": "f697dfa9-e212-49be-8680-1f6dff1623b9", "comment": "Malware payload", "value": "8128122146d463f3b4e3f1cae78ccda5b67e6dc54d07e602a5392fdac1690b4055b1c81197df6218373355c9658418fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653718598, "uuid": "14f59228-f2fd-44e3-8487-047baf6ca321", "value": "T1ED163340C5545413E90AD4B9E08607F3BDEAD20F1EA678EC97C854A1DBE0F6E858DF3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653718598, "uuid": "4815668e-9d6a-4bca-adf5-1f51cd6c7d2c", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653718598, "uuid": "72616d44-bcab-4886-871d-f6f3d55696c2", "value": "98304:WMR43HBgExAWAyEulBFEnIuP8AxAXS6wnw5h5p2V1G8e:m3hgExNJBmn58iA9wnoh5p2V1Je", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653718598, "uuid": "ebc7ab6d-db27-4e5e-943e-a7e705d1d989", "value": 4223488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653718598, "uuid": "dd7d82fd-7172-4de1-8623-7b6113c3fa44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653718598, "uuid": "617e61a2-e16e-44a4-bebd-c851a0540546", "value": "5dd1803af5860a9a20d99b749a00462e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e454958d-de8d-11ec-8e58-42010a9c0032", "comment": "Malware payload (DanaBot)", "timestamp": 1653746154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653746154, "uuid": "7fad957f-53fd-45ed-be3a-0181c9960e93", "comment": "Malware payload (DanaBot)", "value": "9a0ee7f30abfa893ebeadc7dd6245da1", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653746154, "uuid": "ff8d779c-9a16-4a34-b462-e88d4804467a", "comment": "Malware payload (DanaBot)", "value": "20b4d989d117848bea18b1da3e0e7e27e890bdf54a84d17da331ceb657d8a08b", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653746154, "uuid": "2c84fb09-f119-4570-ab9b-61f7027383b1", "comment": "Malware payload (DanaBot)", "value": "3b4859a6ce1836ba3b7ca1ecd48d8a6d2a28a479", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653746154, "uuid": "4a1bebf5-b03b-49b0-8c35-80aaef601757", "comment": "Malware payload (DanaBot)", "value": "00fd5a2ad7b25dddbd3906a88a7b11ef79179cd5002f8028f9c9820c8cea7519b35469220025cd90cd0d7963f0dfec88", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653746154, "uuid": "27ef30f9-4c0f-4236-9cce-68e77f5f2371", "value": "T1A256F113FA446A3EC85E1B395837A6148C3F67A1B61A9C1F47F4884CCF79D80663B61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653746154, "uuid": "7c1920c6-3be6-49fc-aa82-454968177381", "value": "add6ff6fffd605bfe0635c3afef2d07b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653746154, "uuid": "15d12bb4-01a8-4cb8-aa54-b1f4e9fa3a2b", "value": "98304:YHHDLCsHqmj4ASZpa9THkNXc/0abyrEuHcqNk+cb:aDusHlj72S6Xc/L88URc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653746154, "uuid": "9cd9629f-d02d-4aea-87bd-b7947d962c05", "value": 5952000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653746154, "uuid": "4987eec0-572c-4352-91cc-03bb2e85e58d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653746154, "uuid": "f60e85ea-5ee3-4d6a-983c-fb3a93fae8bf", "value": "20B4D989D117848BEA18B1DA3E0E7E27E890BDF54A84D.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd4034ab-deb6-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653763805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763805, "uuid": "fbccf8c6-f988-4b8a-8269-584ef6eae043", "comment": "Malware payload", "value": "c8946ec41243f7701a22e8d978ac3b1b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763805, "uuid": "9098d402-2d73-43cb-93c6-f64d0c38e75a", "comment": "Malware payload", "value": "2209d16d8ba2276de5e5c82bd6f241aa0f25e6500d7f55c3102d76a099139f54", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763805, "uuid": "17ad9963-f608-4495-89c2-b3f7b4f041f9", "comment": "Malware payload", "value": "a8fd696a9fbf4d4f8f1d2d6963ab5de57aecb6d0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763805, "uuid": "794668de-96e4-4ba2-9fee-2f9d22d9e486", "comment": "Malware payload", "value": "8386acda353b44ced171650eca6bb7601deff92ad9f4a93684b5ae3a010168894fa157c79eec0bd4aa3e3d55b0dfeb54", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763805, "uuid": "862cf355-3fd6-4367-8fac-c6a8c3918f96", "value": "T1DF63F12B72EC4572D5319D79C6BB0E8E6A2661F9ACE934530B30DE34E1E301349B81DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763805, "uuid": "4829eb9b-2499-4cda-9e21-a8bcfacadfba", "value": "1536:u2bn/VHlW89XfOC5O4pB3/BD+SLxV8CV+GxF36ufnlusnz/ex:JbnPW89D5SSLx68Vj6ufn5G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653763805, "uuid": "bcb373f9-0e6c-44d8-857f-dbb3a01adfe2", "value": 70876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653763805, "uuid": "a2fc1f5a-689a-47a5-83af-28b549172d0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763805, "uuid": "32497433-c812-4fee-a8cf-1ac49f9add26", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73d55422-dea8-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1653757562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653757562, "uuid": "f067e776-9cb2-4f79-9731-a52b8ac5ea8a", "comment": "Malware payload (NanoCore)", "value": "54551ace26985b6b412b09bae9538c1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653757562, "uuid": "ec4d935a-9c29-4c39-bd19-31ad91e32948", "comment": "Malware payload (NanoCore)", "value": "2221c9b18c1757a49fca7aa819511d51fbcdbc85fb8f0667106c4dc3d1c845cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653757562, "uuid": "05d7954f-89b6-4f5b-a003-20add20c4593", "comment": "Malware payload (NanoCore)", "value": "3c1dfaaba53a23a892dbe6de667d1c318196a04c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653757562, "uuid": "42709f7f-d7df-4b21-9b7a-af86da7c5811", "comment": "Malware payload (NanoCore)", "value": "e1bff42867390613480fa31a6dfaa7fcc72653bee5b905e1856480f3b5db02066cf157df92c064f52ec2de3eecf01481", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653757562, "uuid": "e37350ca-6a27-40c0-a95e-86c93acf581d", "value": "T119059DAC3250B5DEC967CA76C9641C64AA217CBB531BC6079017319CAE3EA87DF106F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653757562, "uuid": "83620ea7-0abe-4f4f-8adf-fe518e589091", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653757562, "uuid": "e4650fc1-316d-41a4-b390-2db030c635be", "value": "24576:o0922sTqnsxC4aT2Qb1R+gzrT2XXqc5/etmAU:VkTG6CgQbj+M3s/52tmAU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653757562, "uuid": "fb9f4796-2592-4a4d-b1f8-cc496ab10914", "value": 856576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653757562, "uuid": "ac7baf1d-5bf1-423d-ad73-789f1d64e398", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653757562, "uuid": "fb24ea28-f3f4-4045-89a7-d141a003c8a7", "value": "54551ace26985b6b412b09bae9538c1d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8295940-deb6-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653763743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763743, "uuid": "f29f88e4-3b42-49b5-b70f-a1180dcd0241", "comment": "Malware payload", "value": "d42b3f07862ae04f03966b49a547b37a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763743, "uuid": "08cc76e1-5f5e-4e5f-91a0-45d6deb96346", "comment": "Malware payload", "value": "2385d8275b96b1919404d34070f0d707bfae950997c666697ecd08a8ecf35c00", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763743, "uuid": "f46a3b0b-96e0-4c6a-b660-3ade8e5da7eb", "comment": "Malware payload", "value": "1a6e90ea290665ec3f392d7350fdc32a4e5e252b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763743, "uuid": "5b7faba2-7a84-40d4-bcae-a92b5c715493", "comment": "Malware payload", "value": "714f3c99a5831a5ea6ab674719b6e9fbed7f09846d998c96566bd835850cb5c7abef1a339a43734c4387ddb0c3ab3913", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763743, "uuid": "48ab142d-3918-4d8d-98a3-cc1b654f4947", "value": "T173D32A4AFB418B13C4D61B76EA9F41453322DB95D3DB3306992C9FF43F86A9E0E12606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763743, "uuid": "0df44fb2-7b23-4263-9678-2d1189bba668", "value": "3072:cchR9tut6ipNBFRVsRYYgUfOeB+34rxVry8tDa:ciRXuUoTFRVsRlBfZ+34rxVtDa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653763743, "uuid": "977e6328-2ee2-4953-83d3-0db49e055fd0", "value": 133281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653763743, "uuid": "cc0f43db-8000-462f-86cf-4f1d7530cb37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763743, "uuid": "9983cf0d-44dc-499e-906a-7705800d42bb", "value": "d42b3f07862ae04f03966b49a547b37a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3b4927c-de97-11ec-8e58-42010a9c0032", "comment": "Malware payload (N-W0rm)", "timestamp": 1653750367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653750367, "uuid": "cd0ef803-b925-498e-8e1c-ff0bf581f31c", "comment": "Malware payload (N-W0rm)", "value": "a8246d9b175683a8621e6b31d855a59b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653750367, "uuid": "c270470b-2dc4-4d48-8964-38b44a781096", "comment": "Malware payload (N-W0rm)", "value": "23c30d4d176ded055abf529bf8c75bc1e0f7656072f6a2a4ac8ad7d9f889fedc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653750367, "uuid": "9617c270-e164-44d1-b6c2-0788925c70b3", "comment": "Malware payload (N-W0rm)", "value": "784d1ecca63351ee4b84d59bcbb7253d44216784", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653750367, "uuid": "1f5c47a3-6ed3-4d31-8abc-b2916f4720b9", "comment": "Malware payload (N-W0rm)", "value": "09fef8ee7257eb365199ae75c68a9d4f26618cce1a3bbab51e989a8967cc34e404104cb85a9ae5e05e6307ec95ee42d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653750367, "uuid": "1655d756-48aa-4695-aa93-fc541fa11858", "value": "T16FC417A3D742D21FE2633474C05DA6B6A01627307A024897B754AFFDE73C2D28A79B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653750367, "uuid": "7cb4079e-a071-4976-aaba-330227896b23", "value": "7f3ac4b9d26098d4cd7c621516ede92d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653750367, "uuid": "0381cd12-581f-41fc-a613-0632ba3f7d61", "value": "12288:9+DtV1RO5HhXukEzsa4BV9b8AeWQd3tuab7xRS/7vpzigr:9+DtV8nEoaEn8AeW+34gI7x7r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653750367, "uuid": "180f2742-786d-463c-a61c-a8aa3587b474", "value": 546760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653750367, "uuid": "1c3fba78-02c9-4d46-a467-39303f674be5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653750367, "uuid": "e9e75d02-e375-41ae-9d19-2af581ec900e", "value": "a8246d9b175683a8621e6b31d855a59b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ee11edc-de36-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653708564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653708564, "uuid": "2d280b40-0f24-40e0-b787-8549f83f3e1f", "comment": "Malware payload", "value": "8e070078e871a5432d5e1d4b6fe8fca0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653708564, "uuid": "21d6f367-d2a1-42dc-9309-654fe0c86c4d", "comment": "Malware payload", "value": "262dd6c5d9ddad7ccd87119b794ff2f2b50c9668b7d15349ce6d0880fc0a55a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653708564, "uuid": "84ec15a3-e3eb-4286-ba49-4a89f440cfe5", "comment": "Malware payload", "value": "87bc4299572fac73c9929ed044ba61324b7b8058", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653708564, "uuid": "802c9d23-d9e0-45ee-b33d-6cb6677b7b50", "comment": "Malware payload", "value": "9a84d69fddde2b7815ece4d5712902cfbb243e84cad9c9a67c0d8c4c129773c0c6b640619a1d6166045c265e9ec444ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653708564, "uuid": "746e4c44-af9e-4809-a152-05453621f786", "value": "T1C01633571215DDCAE2D0787BBF63A14F712A3225D88C2A793C5736F2332A421672AC77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653708564, "uuid": "522e0b1c-0aeb-4d39-a404-1131fbda329e", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653708564, "uuid": "c46d80f5-82c7-4d65-a305-fa4b70eeaae9", "value": "98304:SWCkA4QwXz5YbLwW4p92Ihm5E+G7xJzNxE0cPZrTyX/UzxUYO8:SW4DLw/2uKE+G1PG9i/aUB8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653708564, "uuid": "faaa9cc2-3e32-44c0-92dd-8380dda97559", "value": 4222464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653708564, "uuid": "e42e6f83-1a74-4b97-9f3d-47d9eab014c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653708564, "uuid": "5b54cb72-85a4-48de-a5f2-7e37642a1a32", "value": "SecuriteInfo.com.Trojan.GenericKDZ.87756.28282.2962", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1e264cc-dea2-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1653755169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653755169, "uuid": "2f9e26b4-4e7f-4620-b596-605b837d9bca", "comment": "Malware payload (RedLineStealer)", "value": "45477eb1a457ca525ea32332c4ba0bf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653755169, "uuid": "47e0aa73-3654-4b15-9453-a773e5d744cc", "comment": "Malware payload (RedLineStealer)", "value": "285447895a1b35b576925f1bb723f3574676d9b9f73e6d84fbf5da81c12bbe69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653755169, "uuid": "181ed16c-8851-4c82-a897-031befe453b9", "comment": "Malware payload (RedLineStealer)", "value": "c1250ea2ee9513e481eaef3e8df9718a11f2f9c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653755169, "uuid": "b50dd5be-6d91-48f9-8e9b-74017296ed8b", "comment": "Malware payload (RedLineStealer)", "value": "16c897cd9580067e460736684bce7246984a9fc7c137a5777a9d64f317a9c27df78c89e5d98465486f0f7bfd3951512d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653755169, "uuid": "b240cc3c-cc32-4fe1-bd15-2efd7c43ef68", "value": "T1B1F37C57B3A520F9D1779638C8911A06F772B8361720ABEF07A047766F233D09D3AB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653755169, "uuid": "5498bf3d-f2e4-4f7e-bfb2-37619ab9d593", "value": "650d4576ab84ce0e156f07e808c5a03c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653755169, "uuid": "e13454e0-32b9-4ad8-943a-c55c74e77c42", "value": "3072:WZhOKLjuTpp48g/F3AL4nzGVgOl3g7svNinE:md3uTppe/JALAGmOl3PW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653755169, "uuid": "04ee47f4-7cff-4173-9e62-1db51dc6bc73", "value": 161280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653755169, "uuid": "85fa148a-d4d4-448c-ba62-8a3d01d75c50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653755169, "uuid": "4d8ea6dd-ebab-4254-95a7-ee6c295bb9e8", "value": "285447895a1b35b576925f1bb723f3574676d9b9f73e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb1fcd29-deb6-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653763721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763721, "uuid": "31eefbb8-9c8d-4024-bac4-03f7d756e370", "comment": "Malware payload", "value": "0c9584f2d4f86876e57e1e023c51fbe9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763721, "uuid": "6350a89c-3ecf-41ad-9160-a377eae1f2c4", "comment": "Malware payload", "value": "297bd0129eabc79181b39f5b94e903532d74ac50281bf02a73108332db81818c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763721, "uuid": "3e9454b6-9556-4668-a966-4e3c0aab9aa9", "comment": "Malware payload", "value": "11d8e261568b0a24046be9130f743960d27cdb74", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763721, "uuid": "d2d9e60a-a0b5-43e3-aed4-e780539aec39", "comment": "Malware payload", "value": "d4a6c00691d8cf1aeaa14c43128435cc39cfd273d14b9166ab77da26bbc7e663eb6d7d7e29bc1cf967461b7cb1b4efce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763721, "uuid": "eb11967a-c87d-45bc-8aa7-63fa4dd07d54", "value": "T15D73965D7E319FBEFB9D813887B74A20924933D623E1D584D26CFD021E7038A641BBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763721, "uuid": "c262238e-2a1f-408c-9d17-bcaccdec6b7a", "value": "1536:UxavYkfnebT3fT3PhT3UVaso7ShE4Bt1QMZp/B76rWWKJBz/f/yy9B2G:eGYkfnksE4b1r/B76r2zBD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653763721, "uuid": "39f0610e-89bd-488c-8e1b-b76ecca49819", "value": 75872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653763721, "uuid": "87459051-02f9-4696-881f-0a3a55ca50ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763721, "uuid": "7641a035-12e1-4a0c-bec5-95296c02ef58", "value": "0c9584f2d4f86876e57e1e023c51fbe9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bf2c901-dea4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1653755830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653755830, "uuid": "77da4eb2-9d96-46ae-ad95-7438b8a89d5f", "comment": "Malware payload (Smoke Loader)", "value": "ab1f4d79c91c0946440ac8173164d682", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653755830, "uuid": "99a7bd1c-8c3b-45f9-918e-e57405a62bdf", "comment": "Malware payload (Smoke Loader)", "value": "29bf4a0e9a1b887bdad0a0bc5fd24da603171dc80fd9df7dec7def2e5bbcc651", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653755830, "uuid": "c762654c-78c2-4411-850d-d3b0209a0863", "comment": "Malware payload (Smoke Loader)", "value": "cc3769fe747f75a05d741d8d40619086fef30cfc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653755830, "uuid": "aedadca3-1e6b-4a03-9975-c353701f0d17", "comment": "Malware payload (Smoke Loader)", "value": "0ed9026418e23884f68f953329b62b6a165831c2428bce15f6d286d20b9f1bec99b19572091d13ffe88c660a1b6e4a20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653755830, "uuid": "9b69161d-98a4-4def-9383-61f0bbba80c9", "value": "T1FE647D1C7B98D035F1B713F846BA8368B92A7DA19B2451CB62D42BEE56347D0EC3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653755830, "uuid": "469fbc5d-b0bf-46f9-98f5-cc481e2322a4", "value": "54ebcb663ea607f54ee2ca56ede30f4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653755830, "uuid": "00329c23-f490-4c3d-aca1-3c82d364559d", "value": "6144:3XNH5DAVn+v1+0nrKS46IVmpHbhPaJHDzu0s3hlVk:nNHO+9+0neS4QHtPirwk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653755830, "uuid": "08656315-3c80-4ae5-8a16-10099ac36f2f", "value": 315904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653755830, "uuid": "4f9c818f-ac39-4b95-bae1-a22a7a872573", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653755830, "uuid": "6ac4e458-0229-4204-80d3-30ec27e5d76e", "value": "SecuriteInfo.com.W32.AIDetect.malware1.11648.29135", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d4fd7ef-dea7-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653757121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653757121, "uuid": "a9e4f6fd-715d-4fcb-9f62-70a715432f68", "comment": "Malware payload", "value": "8b3bdb4d51422199cb6c9eae4296c47c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653757121, "uuid": "076da982-cc36-47d5-be80-43b6a3e6dc87", "comment": "Malware payload", "value": "2afc13957baf973fb9ed15021ca7610383c99e0a3933c736ef18c0d776e39473", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653757121, "uuid": "9c84c5ba-c5ea-4301-906b-a13145139f59", "comment": "Malware payload", "value": "ef11c766a3f9025c4ffa48c39e0ad029090b7021", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653757121, "uuid": "03328adc-826a-475d-aa47-8c9a77d0970b", "comment": "Malware payload", "value": "39b62b772337835667101ebb1ada28febd25fa1a57a316d1b286fb80484b0ceb532806879fc378b3a259c29b0c70b4d7", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653757121, "uuid": "2e03ca32-19ed-4c9d-bf64-f61a1f8b5d04", "value": "T18AB5F183E35668AFC5F3C33A46BA076A45568C668747D3534A79B33C2DBB9C04E81F84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653757121, "uuid": "913920b2-300c-4594-9648-69f202626040", "value": "49152:sqlV1dj41krUMj+N+O5eKTadWCNKLZXMZlZ:sqlVboM0+PY9MZlZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653757121, "uuid": "f95ee480-f9f4-42df-90c0-477962bae57d", "value": 2309714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653757121, "uuid": "f6a23484-aa97-4487-9e2d-777b5f19d21e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653757121, "uuid": "bce980c0-a2f4-4e77-8a72-7143934253cb", "value": "base1.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "accecdca-deaf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1653760664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653760664, "uuid": "1dfa56eb-e7e6-4c8a-8011-bb276b0c0181", "comment": "Malware payload (Gafgyt)", "value": "6e5486a61ab3b96ea2ae477d6b610c90", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653760664, "uuid": "18097df4-7fa7-4797-a89b-3a113d83c543", "comment": "Malware payload (Gafgyt)", "value": "2c386c03cf9d852f2a2db889afb9c2d34f716e6b27633146bd1c925149747398", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653760664, "uuid": "ba783b38-73c7-4c79-a3f2-eac6b8f03e19", "comment": "Malware payload (Gafgyt)", "value": "d07ba1a04b762cd51d6f0ce52fa1a8c5cbd757e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653760664, "uuid": "2ec89333-f117-4edd-be1c-254a32436258", "comment": "Malware payload (Gafgyt)", "value": "66baf60f5233adbcb270ee228bf2568a561143d52d12946d9b165c5163d8fa41a59c8e18781f640b8d152ed162529456", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653760664, "uuid": "cd0970d0-6761-4ad2-8a14-4bffdad7bcce", "value": "T121F3B64AB1AAD2F1D4660F732257F83B03F221A6547F1E49FB27EDE1C5D38816225278", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653760664, "uuid": "8f51e664-62e4-4558-82c7-cf42ce6956e5", "value": "3072:WaGfmmyqqn3ddVnME0adBgdDe0wS6Bu6v91jOtOlT5uIrpk9XTa0PfbftpT1:WVfmt/n3ddVnME0adBgdDdw91jOElIIe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653760664, "uuid": "350e511e-05a0-42da-b73b-3c31dbc549a2", "value": 162766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653760664, "uuid": "a6b047af-872f-4315-99c0-d6d570401ab3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653760664, "uuid": "29c1b06f-8496-4658-81e4-7c528c4b0a07", "value": "6e5486a61ab3b96ea2ae477d6b610c90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "967962f6-de98-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1653750748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653750748, "uuid": "2ca03a54-d3cd-42a2-9b32-ea31df413d5e", "comment": "Malware payload (SnakeKeylogger)", "value": "753cbccb4b8a864bf78f6dd242eed135", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653750748, "uuid": "ac835342-ecb1-4d58-bb72-eea66e6ced56", "comment": "Malware payload (SnakeKeylogger)", "value": "2d103ed61c84bae9a4a361d4515e5da08cc4e10222bc0cf64dd7611f1fd467db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653750748, "uuid": "d6316e7e-5c91-4ec3-a40e-7a985fb505a7", "comment": "Malware payload (SnakeKeylogger)", "value": "5959077edf1149f5945ee7125518fb2c9f7ce1db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653750748, "uuid": "6357c461-db8d-476a-9734-36fb82d5bfa2", "comment": "Malware payload (SnakeKeylogger)", "value": "d394373ee6b9f0347937d501976bead8d11921619834193fe74228a3788e6e746ab3962a51d73f44dac5f8b5df074695", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653750748, "uuid": "cf05117a-3252-48ce-a3ec-4afaf82454e1", "value": "T1A0C402113868CFA9C89F463ADC5512EC03B14E52ED52E35BCFA47AEB2E723D1C61416B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653750748, "uuid": "476c4e28-e1f2-4c35-89be-a810fd41fe26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653750748, "uuid": "99e411d0-157b-4e2f-be5d-04f641ae33dd", "value": "12288:6kZ+IxOPITfCGudpOosE4Jc4UezIzd6cD1Lag:GIxCITCzOoB/M8nv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653750748, "uuid": "03839c6f-ad3c-4d28-8169-899f38260248", "value": 560128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653750748, "uuid": "1309cafc-0faf-42a4-9e8b-bc1ba25531e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653750748, "uuid": "3f2a73ec-11a9-4d5a-85ba-f81169dda299", "value": "753cbccb4b8a864bf78f6dd242eed135.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6de622f9-de99-11ec-8e58-42010a9c0032", "comment": "Malware payload (CoinMiner.XMRig)", "timestamp": 1653751109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653751109, "uuid": "7b0bea92-67b7-4ee6-8f37-e0cca4a33e1c", "comment": "Malware payload (CoinMiner.XMRig)", "value": "7fdffc68e0818db8bcbbbef9eefcdd9f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653751109, "uuid": "0420aad4-3791-45cf-ab62-8eb0c7dd1e9e", "comment": "Malware payload (CoinMiner.XMRig)", "value": "2db4047cdf74b73741a4f49ea9764f31f1dc592e0c8699d8abad54e643835247", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653751109, "uuid": "3bf946f3-f945-4a79-8806-1a7680133dbd", "comment": "Malware payload (CoinMiner.XMRig)", "value": "77151c51d4357e2f15e4dcf4b86ccb0cd645ae02", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653751109, "uuid": "2c6aeeb1-6055-4f79-939e-853b68564c6c", "comment": "Malware payload (CoinMiner.XMRig)", "value": "d3ac42372615cee94b398ac638aaa5529c13b0c2044c81958c83cc441a8cd1c51a31b6c1079790a1286bd55441026726", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653751109, "uuid": "f1905927-65ce-465b-9a38-11a16afc026a", "value": "T15905122BAF024754DCAD0E338AF727517F11BB924877936B1D8714AFA817BC52E811E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653751109, "uuid": "ba865a5c-ae31-44c8-9878-178102ba40d4", "value": "24576:31H0MW/IbxmC6SxRfrZduZwDy6dy0BNutS:lUM93xRfrnuC+2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653751109, "uuid": "39d456f4-7b4d-4855-a3f9-6c97b37ac558", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653751109, "uuid": "2af0485d-a54e-40d2-b57c-5b16fca5746e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653751109, "uuid": "7c285c3c-9b69-4175-8d00-a2fb0488afdd", "value": "7fdffc68e0818db8bcbbbef9eefcdd9f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b22b247-de9c-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653752259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653752259, "uuid": "8e450a79-47d1-4c75-9d0b-7fba56c7dbde", "comment": "Malware payload", "value": "0068ac9dbb865c6c03984061540618df", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653752259, "uuid": "9b81b077-4e02-408d-80b7-1ad1c5c5b39b", "comment": "Malware payload", "value": "2dc810c540787f600ba073fcc3966102a266d867938861c3ac3da38dd7c004fa", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653752259, "uuid": "83000836-a82f-455c-82f1-36f094a2e653", "comment": "Malware payload", "value": "32727c96976564a2d7980b04a86add0912b1849a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653752259, "uuid": "69ceaac1-7ebb-417e-82ed-5e25fa1a38c0", "comment": "Malware payload", "value": "1f4a1910f7a53f4d4a651ed43290a633f90eeca50f15aabaf72810ca473ad2556fdb0bf4569bed6a48765df21a501ab3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653752259, "uuid": "5bf8564c-f839-494f-85ce-d35743222971", "value": "T103151285CE781276F0B606B0940329DCE9F05EE11F39C97643FA83DA39712BA957E583", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653752259, "uuid": "c1e98cdf-5a33-422f-bb3f-1f4925acf9c1", "value": "e216bbc2698858002ba12bc18a322b46", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653752259, "uuid": "5abe4f1c-71ed-472f-9f4a-299efefaca00", "value": "24576:qk+n47+G5peNSqxhkMA7u2W6fC+GCTeyX0H47+YyV:NjHre1xhkMA9C+0yX0H4QV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653752259, "uuid": "1ebf32f1-ba93-4dce-8c2e-1d89ba34911b", "value": 909312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653752259, "uuid": "5cec838c-c133-43a1-81c6-9f03a4d542d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653752259, "uuid": "56fbc0c5-2947-43d7-bcc8-36c658cc9124", "value": "glut32.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f8df435-de99-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1653751192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653751192, "uuid": "c609e662-ddda-441b-b4ef-40daa4c395bd", "comment": "Malware payload (RedLineStealer)", "value": "d03d9514b0056ad6b3ef91ac42a25038", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653751192, "uuid": "6b0de093-5f90-49ef-b16b-d6c0d68bc7cc", "comment": "Malware payload (RedLineStealer)", "value": "324e86b2a54e3fbb741ef30a35d7b50bff1ef4c0324be046670a2df33cbac3ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653751192, "uuid": "33835c25-31d7-4d2b-97e5-0ebb1968ba37", "comment": "Malware payload (RedLineStealer)", "value": "0a123057430ae8866686397671a4e46c56a3c2f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653751192, "uuid": "c601e8a5-2571-486f-956b-8996c1fa1cf7", "comment": "Malware payload (RedLineStealer)", "value": "99a428a499e3e7b35081d824ccae992b682a5367ccc8174c70a75067fe2290ec0eb958f5aed60342d25f30202327375f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653751192, "uuid": "f20cf10e-9c6d-4139-b329-28a334145b16", "value": "T1EC949E00BB50D434F1B71AFC4975D2ACB92ABDA19B2491CB62D56AEE56346F3EC30307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653751192, "uuid": "ea6c3401-911f-47fd-807e-b35fc20e77a2", "value": "c5df5f515f76bb815fad87fade1c304d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653751192, "uuid": "a254fa51-59cf-4c62-8f32-6911c6ecacb0", "value": "6144:iDCafe9WkR0b+RWAUllAhFzM9T3VUBirXuv26JTVVm9PE12qOzvh:i2afUR06wAUl2hF2TqUeNzl29", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653751192, "uuid": "ac249112-3674-41eb-9958-f5adb8bee97f", "value": 422400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653751192, "uuid": "09f4f8c6-181e-4081-abe3-4297408f3aec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653751192, "uuid": "650879c1-fef0-4b4d-b030-49a0df223ac4", "value": "d03d9514b0056ad6b3ef91ac42a25038.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9456329a-deaf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1653760623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653760623, "uuid": "1e12bdc0-7308-4960-ae94-f4ef26ba9039", "comment": "Malware payload (Gafgyt)", "value": "d6459a2b4d0ce18386d55f929c05b136", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653760623, "uuid": "894df646-0b27-4306-81cd-a525e4e6b1de", "comment": "Malware payload (Gafgyt)", "value": "3268dd8bbf0093486620fb2821cfcbadac5db66752c3cbec3fdadffb9b1132a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653760623, "uuid": "49647c85-f8e3-4167-b86c-8ecbafa8a554", "comment": "Malware payload (Gafgyt)", "value": "3430d088c6756e59de0afdbb151ad1ec598d199a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653760623, "uuid": "a56a957e-a344-46e6-a444-3e6c0ee6dd2b", "comment": "Malware payload (Gafgyt)", "value": "b3844d4a6c7d41e21848b57a93cc6052cc9b6487d5f59cd335ebc949453451e98982667f6e983a35a3cabaacf1cabfd5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653760623, "uuid": "e19d5306-765c-4502-894d-dd5a692209aa", "value": "T1D044DA0599A05F5FCAE26BFAF75571CE723387946B833309C71C4AF023C16EA9926247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653760623, "uuid": "465c7753-1b8a-4b6b-9b63-768c2ae870cb", "value": "6144:k07775a2jMLNQPsHvM59I+QxPBdM/9lPmNjKq6gk:k0r5a2jMLNQkP/tq/LPmNjKq6gk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653760623, "uuid": "1ced4260-9a8f-4ab2-993c-fd3fbb220efb", "value": 258373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653760623, "uuid": "5fcf59ab-f47c-4ca3-8367-12724cc9fcde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653760623, "uuid": "30e2e71d-bf5b-4402-b445-dc2bee549ea8", "value": "d6459a2b4d0ce18386d55f929c05b136", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3583063f-de36-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653708494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653708494, "uuid": "f41a38de-20ea-4930-b27c-9e79be8b686b", "comment": "Malware payload (Mirai)", "value": "1f94feef584f15fce508c4b37d42febb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653708494, "uuid": "abe4e1f2-49ae-4272-b7cb-7e21de2a097f", "comment": "Malware payload (Mirai)", "value": "34461947adcb3f3610e12e8adb0b7b77f1f47ae89396a6d9fe92b38afa1862c4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653708494, "uuid": "f6f3c914-54ac-4b60-93c6-6709f45926fd", "comment": "Malware payload (Mirai)", "value": "2db26b148ac95fbfca9a78d8ba555b1ef7844154", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653708494, "uuid": "eb446670-ab07-4cff-8db2-5e4a818df2e9", "comment": "Malware payload (Mirai)", "value": "f4904bca17e80d2258ce6dd584eb88bb7741e1a0d09460c8ba22f3586d0fd1325520440a56cd328da9c8dfa7c28dc283", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653708494, "uuid": "bc830f8d-ea76-4720-989c-25b50bcc328d", "value": "T15EC2E178E0CA0DEEFEFE5CB05C40D7CA7B355EC96A799E40588DB8512A0302FF608595", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653708494, "uuid": "05d52c17-1bd0-46b2-b5c7-59f4668f2d1c", "value": "768:P7zC7WpZ8h4sOc58y+u3QgJ0uouGfry4uVcqgw099:vCM84xcRpm1jry4u+qgw099", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653708494, "uuid": "352a2c1d-a35d-4df8-b424-8e483e06229b", "value": 28120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653708494, "uuid": "8934185b-bb00-4e84-a8d6-d6fc50a87c84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653708494, "uuid": "7043746b-10c8-437d-979f-aedac9c51aac", "value": "1f94feef584f15fce508c4b37d42febb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4747378-de4d-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1653718559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653718559, "uuid": "53c1eb7f-410b-4406-b33b-6b6fb132a0ce", "comment": "Malware payload (SnakeKeylogger)", "value": "5cff1b2ff7b47c41b556d4500cc76301", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653718559, "uuid": "f8886fd9-c4a7-4a17-b317-a0ca61e0a95d", "comment": "Malware payload (SnakeKeylogger)", "value": "347418e9a2ab15addf4f49abce3f5e33ef6a0614a6e268226c703647da5a207e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653718559, "uuid": "2eeb239c-68fd-4dfa-a2df-f571dbc3a7c8", "comment": "Malware payload (SnakeKeylogger)", "value": "7b8ae9f04069db27ecd6d6e9bcec7f9a47fdaa48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653718559, "uuid": "dc3f72a8-5e14-4e8f-a08b-48d8ae59dbe9", "comment": "Malware payload (SnakeKeylogger)", "value": "8ab9b17b25e6bd03092fef581bbc5124cc4a59b7886108e92e3fc767c06ba8581eb80f6839a9e81249bae11b006f9843", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653718559, "uuid": "bb1bd1e5-e098-41d3-ade9-f613bc5d8b81", "value": "T13C94CF013BAC7A12D66AEB385161C04447F2944FBF33E51F3EDB2C8E5AA6B409760B75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653718559, "uuid": "55ba2de3-ed07-4789-9d97-4d2e6cacef2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653718559, "uuid": "381308cf-0cdd-4c89-945b-838d27cde7f3", "value": "6144:yY6qmeWkiIsg2WK/7FXWBsQKmDUqB/lW4lcJnAYVdAS3p/wiLAFBGY5wd:yYFmeWZ71WBHKmzB9W4lQp/wiY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653718559, "uuid": "ac6ebbb8-32e3-4061-b745-71c37a22e924", "value": 448000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653718559, "uuid": "7923b76b-297d-456a-905c-7f63952ca2fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653718559, "uuid": "8832428d-5739-40b4-801f-e14d8458a146", "value": "5cff1b2ff7b47c41b556d4500cc76301.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00d73cb0-de90-11ec-8e58-42010a9c0032", "comment": "Malware payload (AZORult)", "timestamp": 1653747061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653747061, "uuid": "182b1863-37f2-478b-a31d-5d30106a4a02", "comment": "Malware payload (AZORult)", "value": "0a7b32e75a01764ef5389a1d9e72ed63", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653747061, "uuid": "8f4ce786-df47-47ab-8f2b-83c8ce5ab0f7", "comment": "Malware payload (AZORult)", "value": "34ba222ef969f09ecca5506cbada7c346469a96a6af0cdd21146d4435196deda", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653747061, "uuid": "1db28ea6-7c6c-4335-859c-df3d8ee6fb32", "comment": "Malware payload (AZORult)", "value": "871366f3573c3349e9dc7b67fef1ef575815c154", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653747061, "uuid": "a8c42474-0df4-4ac1-ada3-1f6ecff89587", "comment": "Malware payload (AZORult)", "value": "e72e03fd5779ef195b61d215d1546168cd96c706b4497440c58074e66a82d50e5eaecfd7b3e9b1a33afe4af6a4d750f3", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653747061, "uuid": "9bd9b707-4fa5-4738-b19a-c68bcd1b38fe", "value": "T103037C6077507627C96A0A71B0230F00C539EB6578BC7F767A878C5F2FEA385E492762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653747061, "uuid": "45787351-3a60-47ff-a26e-61450b86b026", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653747061, "uuid": "a68dd6fc-0715-4152-9f1b-47817dc033b3", "value": "768:+iIW6bBmlnvHesHklOd13qUfqtXhHsGPrNYHOj64/0+Q9y+vp:3IW6bBmxvHesElOd5qfTPGi6Q0+TKp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653747061, "uuid": "53376dc6-39ff-4aaf-9844-64a8cca7bc03", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653747061, "uuid": "7e07ffff-63e9-4a81-90ad-89b80b62b56a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653747061, "uuid": "1c510e56-a1e0-4220-8144-a8024611ec5f", "value": "0a7b32e75a01764ef5389a1d9e72ed63.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3b825d5-deaf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1653760729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653760729, "uuid": "ddd41f22-0843-4464-833d-99aa3b4c985b", "comment": "Malware payload (Gafgyt)", "value": "e19db8aee0aad9a62c18944e93f2438a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653760729, "uuid": "fb00bf4c-51a0-431c-94a1-3db290001de7", "comment": "Malware payload (Gafgyt)", "value": "39f5d66ba954824fd006cc78b51e5b852872ccd79624e6767eeb5a3e50ede48c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653760729, "uuid": "41eb8d62-696e-419b-95ba-cafc56221aee", "comment": "Malware payload (Gafgyt)", "value": "3f15ba8a36a182bd3f7f09a9a31adb066e76bcbf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653760729, "uuid": "6dca3890-0d26-42c5-8765-b19fa4730808", "comment": "Malware payload (Gafgyt)", "value": "2feb15eb09cf1b9117a34cdbb85be87ab09aacfacfc806653d0fe35df8f69142f03eac6ffbd03289ec51b3bf305cb247", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653760729, "uuid": "0a785e95-c960-4e8c-8396-9503f030795d", "value": "T1701462AF7B244353DEC701F6293663E00F68D5F723A051E2A1899F441FB31396A277A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653760729, "uuid": "bc6de851-895d-41b3-9a00-c4124156264a", "value": "3072:4blJiHxvjP0JXG6XC+We9VDyRVa8/fJ29FrfdW63PPTJ0aov7tKPX:4bosnC+HDyRkafA9nW63PPTJ0aov7tKv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653760729, "uuid": "4c9cf9dd-d726-4866-9723-4e44ea7238f8", "value": 196210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653760729, "uuid": "bf1f5147-4f73-4985-ad78-0b61bdeffea7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653760729, "uuid": "707a299b-2a8c-48c3-8713-4f3ab446d473", "value": "e19db8aee0aad9a62c18944e93f2438a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b00ae7d-de6d-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1653732045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653732045, "uuid": "2f3b22c6-8de3-4019-b968-74be699a24bd", "comment": "Malware payload (SnakeKeylogger)", "value": "11cfffb478d0aa07aa34be20ff119d88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653732045, "uuid": "c6d883b4-6830-49c6-9351-7ba7185d52d3", "comment": "Malware payload (SnakeKeylogger)", "value": "3ea105732d9a524bdf914b2caec5f3fd8572149e60be1b66ce05d9ad9929e96f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653732045, "uuid": "b5b49281-7c83-4cd2-b287-733dd6f4cbbc", "comment": "Malware payload (SnakeKeylogger)", "value": "e4e1047ed9e113337ff8229027c1baa713a1f941", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653732045, "uuid": "27d1e0e7-f901-4e7c-9790-be88591ed519", "comment": "Malware payload (SnakeKeylogger)", "value": "c5ff46706dececc35793ceb3e003d21ac674d2e3bb78d17f4b907624c2dd7cba57863c007270eca15ac3398ffd1346af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653732045, "uuid": "2270f1c3-d48b-44e7-93c1-4092c5d5aa0e", "value": "T18F14DD87A146F5DCC95CA17A4597C9D400E02F39B4714EA329C1262BB8FF2D8BE5EDE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653732045, "uuid": "04665037-8326-4125-bd33-2a1d4128c74f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653732045, "uuid": "f36fb79e-bb37-4680-a2bf-48242e88abd6", "value": "768:W6YU6bOpiW3OUvVPi/O924ocYZyM/E9rNpsoAFldB8bV3uzo:Tn6bm4Uel4ocYSrNaBFKV3uM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653732045, "uuid": "2f7ea0db-be98-4111-8dff-3fc47b43dd20", "value": 194560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653732045, "uuid": "ae10ee54-e4b4-470f-ac3a-fbe7925fb9d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653732045, "uuid": "e1d7738a-7d80-4dee-bf67-9d04d9ba26e6", "value": "Cargo Doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f8b409e-de47-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653715759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653715759, "uuid": "2c9e074c-fb9e-4415-bd72-e2979a30927b", "comment": "Malware payload (Mirai)", "value": "cfb7b1a2f98bb0299c06ac858f4dea71", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653715759, "uuid": "baf5ea24-64f3-40cf-a33a-69c857a7472d", "comment": "Malware payload (Mirai)", "value": "40f156d2c2afbf11eb68edf311ebc1c37c36b7e28e18343c6efdba52ba1a701e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653715759, "uuid": "c43dd747-c719-46cc-a4d0-6f2e67befb73", "comment": "Malware payload (Mirai)", "value": "6d7637e6c5e912c4d473c52598a2d163e787b9fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653715759, "uuid": "683621e7-5116-4883-9f85-e8fcf19da22d", "comment": "Malware payload (Mirai)", "value": "3489216d257efbd4162da401472dc00b137d5cf33c01339fc2adac5fc8b691d0942b8af03cb5563ae67c779b8b9e9b24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653715759, "uuid": "7fc861a0-5069-48a5-aa23-3c0e81bbc62f", "value": "T12543016583781071DF65BC72E845077A63138BFDF728BA31D8344B4B6683342A8BC68C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653715759, "uuid": "d9f17b85-d682-424a-8bd6-2b9b70237ffe", "value": "768:yL4blQMvfGrPfglvA51wCSbsi4qE5LzQBpWXHU8i4rzq3UirZ0HfnqUmGpZznX:yLYQMHkPf5CCSj+LzxXySNSMpZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653715759, "uuid": "3839b3ee-60b8-47a0-bf70-0860722bf310", "value": 55836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653715759, "uuid": "e6722e69-7574-4370-a9c2-0185efc7e65d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653715759, "uuid": "a1edb43c-42d7-4d13-86f0-30c386b055d1", "value": "SecuriteInfo.com.Linux.Siggen.9999.2751.21662", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6eda0e6-dec3-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1653769244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653769244, "uuid": "91d29a48-070c-4e7f-a50e-c32da6aebb5b", "comment": "Malware payload (SnakeKeylogger)", "value": "13504e35753149d77ddd3c4f9ecd1ccd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653769244, "uuid": "31151067-8d94-4605-8e4b-1c4326ce688b", "comment": "Malware payload (SnakeKeylogger)", "value": "4187114b133d4f64d04b187f0cdb729c310c37bcd5994ae1b0897ca4fc529ce5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653769244, "uuid": "880334bd-5c76-49ca-89fd-dc8a682363e4", "comment": "Malware payload (SnakeKeylogger)", "value": "282527460090e57be793a0e328b926cb22f61e78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653769244, "uuid": "1c3f8adb-75b3-4342-b988-7dfacba17630", "comment": "Malware payload (SnakeKeylogger)", "value": "a6d63136ebc55d262b1d1bad942fc1c720f2ed5631c7aa1d58b0a3b77c9d38e99c28ef929550f5dcdcf8605c69ae301d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653769244, "uuid": "aa4b4167-cdf6-40a1-b77e-1b3c77290827", "value": "T1F2D4F11136ED0B01D6B94BF51AB1A0801FF63E1AA635D61C5EC231EE5A73F518B21F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653769244, "uuid": "ed25a6af-3fa4-4e56-9fe9-7e2ba4c69a54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653769244, "uuid": "8362b9e1-1cb4-4fef-b7b1-a22a1c2803dd", "value": "12288:b2iNzbHoo740VwDhrVN1nE1HFZeopip9uId:b15bHoo7hVMhrVNKppDI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653769244, "uuid": "82abf0c3-4733-4a91-81eb-0ad51ff7f556", "value": 642048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653769244, "uuid": "d6849518-bd7e-482b-a02f-e844791bce7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653769244, "uuid": "34c29545-2996-494a-b68a-4b5e2029d058", "value": "scan file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e29e849d-de64-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653728542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653728542, "uuid": "61b609c8-4ac1-4938-ba19-e3c123138269", "comment": "Malware payload (Mirai)", "value": "4a32ee1c9dc71be9c19e58203f7e0338", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653728542, "uuid": "6070a30d-da3d-47df-ab9b-8d3ec23345b1", "comment": "Malware payload (Mirai)", "value": "41ebfbade1e167ecbdc847e953804b54c20e14899c6f66d48fd4e57de6b48c6d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653728542, "uuid": "53cb715f-a8cb-41e4-bea3-e9c67978699d", "comment": "Malware payload (Mirai)", "value": "cbe8079b2d549a3458b929bddc284aef8ac0338e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653728542, "uuid": "697f6952-35c0-4c84-93ba-266c9f014b93", "comment": "Malware payload (Mirai)", "value": "8de60589066d6e26b1ff1133ba44e6703c72b6130272af3841effd355480690f1e4500faac1c4de80e0a1bc3f032e56f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653728542, "uuid": "3860a292-67b9-4545-bb73-3d4d6d8baa7e", "value": "T1DD93C54CFA58AB29C7E232FEF74D128E332B1B98B3EB701589315B9533C9B964535121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653728542, "uuid": "37bcc88b-89f0-4eea-9450-9d1ffa8df201", "value": "1536:1Wnx/RqLb9TZ5AdPWjwrfvUQ611ixJ5wzaB1elYyJpiPRATB/vi:WcLbxc00rfvUT11ixJ5wzbERiZvi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653728542, "uuid": "c35e784e-0b6c-4328-a234-6f5ecee216a2", "value": 90340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653728542, "uuid": "35d5fd41-d4de-4bf6-8f0e-49f53567118e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653728542, "uuid": "e0fe5e04-219f-4723-8fad-b656ec44bc89", "value": "miori.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ea045e5-debf-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653767404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653767404, "uuid": "9248dae7-ce32-4a93-a6f8-2605f982ee61", "comment": "Malware payload", "value": "267b602d49f49dfab96dc321b8a0e59a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653767404, "uuid": "7210c2c3-9add-4ba7-9258-5a4dafa1aca3", "comment": "Malware payload", "value": "426856964733cbab8f025daeeb1f083384e0b11124253b31b749598afe11219d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653767404, "uuid": "7d0cd2bf-6891-4b83-897f-8045747be83d", "comment": "Malware payload", "value": "8523a379bb40ba9c808cd4acc81dbb3de8f030fa", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653767404, "uuid": "ba0f33d0-3f5a-42b7-b197-dbb04c0068eb", "comment": "Malware payload", "value": "52f26cbb9f6ba0b6809ba4e4f6b11d5bca6d3cc19a05117a053eac83ee0891602aa324c410a472d3ecaec2a118db928f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653767404, "uuid": "006100b7-34ff-412e-87a7-ef8c179140a0", "value": "T10AE2F1F0D58D2530FBF04B3FAFFA4641D528473481EA31D99B407260E2846AB7FA4D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653767404, "uuid": "65b1f929-e4ba-49ee-99c0-23e7646e0f2f", "value": "768:mvM2WXV8BdUECUZTP3+XNeC+CzfAKhDQQuDABCWV4ws3Uozl:JXV8Bd5Xj3WjjA68A0WSlzl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653767404, "uuid": "8c2b07b1-72be-4398-b4c9-c047c48a72cf", "value": 32652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653767404, "uuid": "0a118fea-bb95-4b28-a5fc-47bbf1a360e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653767404, "uuid": "3d99872a-ab05-4f03-9358-0bcaddb56576", "value": "b3astmode.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20029e32-de98-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1653750549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653750549, "uuid": "d150437b-f5f6-4001-8e95-6926f1fde243", "comment": "Malware payload (Gh0stRAT)", "value": "6f8ed08552331d3dd1f9cf8a857d837f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653750549, "uuid": "2c9f8b2c-0414-4ea0-9f9f-a6b0be7f45db", "comment": "Malware payload (Gh0stRAT)", "value": "434292f26fea797357e82f45440c8e26013486302a0a97dc011641ed015284df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653750549, "uuid": "7a103989-8f71-45b5-8ed9-67615a2e5eaf", "comment": "Malware payload (Gh0stRAT)", "value": "526d1739aa319b0f9424a00b848eb6dfcbd7cf9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653750549, "uuid": "c19d446b-77dc-4a12-9ff2-a2f3f12f2dbb", "comment": "Malware payload (Gh0stRAT)", "value": "90c645e4c196cdd4fcba09351036a9dda87bfa707e763c651e96f87a39dbcd435cdecc20872d31cd645085cbb4b8e1ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653750549, "uuid": "a4acb017-e389-4e21-863c-32cfb63f6759", "value": "T1CFC54A6367ACD121CB211132F529EAFFD9F555300B3506C7A2620A3BAF721D2FD1A19E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653750549, "uuid": "e9a41530-06aa-45b7-b965-1936dfb00c85", "value": "a48c89d892cf85298f99cbdf47341837", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653750549, "uuid": "37e2b464-bdba-4992-8e3e-5498c6a56e41", "value": "49152:WQfN/5zwCUyBVQ3GRoC6P5GSPfeu3iTdyTdeq717MzpldYtY9C+Q/Ga:VN/5zwY73RoC6P5GSPfeuSVq71wzpldV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653750549, "uuid": "fb46d179-1b5a-4f05-a287-c7cd0fd90b5a", "value": 2727424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653750549, "uuid": "edae2f82-2c92-482c-b1d4-c5eabf04d60f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653750549, "uuid": "df367d8f-e588-4d30-bf98-3f806c70bec2", "value": "\u70b9\u200d\u51fb\u5b89\u200d\u88c5\u7eb8\u200d\u98de\u200d\u673a-\u7b80\u200d\u4f53\u4e2d\u6587\u8bed\u8a00\u5305.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8f41bf5-deb6-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653763691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763691, "uuid": "f2a5ccdb-dcbc-44c9-9437-269e06ab691b", "comment": "Malware payload", "value": "3b55eb3d607e4bffeee1930ab756da6f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763691, "uuid": "cd5c4682-18df-4c93-8d7f-4a74c85d2942", "comment": "Malware payload", "value": "4497ce819a6034afaf1d118b0fffe22a8facd5289d1185680fb61112c616ae1c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763691, "uuid": "15aaadf7-66d2-46e1-8de7-003c345407d7", "comment": "Malware payload", "value": "5f6aca99f27130379166af17ef0a18786913846b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763691, "uuid": "e961cb00-f437-4fd9-aeff-10a75d5d0715", "comment": "Malware payload", "value": "de69524358bc7a969aae4897f96e047dd6aa5ff2fd26124aa1f12c4b919b58586d1b0d0c0d9f7643d82d9de1ab592cdb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763691, "uuid": "a2efcd42-cda3-4e47-843b-ab5a570f6eec", "value": "T17483850A2E359F7CFB9D863587F78E21964833D626E1C585E15CEA011EB034E342FB99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763691, "uuid": "6c4c3c8a-a026-48cc-b255-642d3b4f5eac", "value": "1536:5Wl06FFBKJtwitC2X+mKVFEywBYaxsC7qnzdz6aWGn:K00nKTw2X0FqBYaxsC7qnzd2aPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653763691, "uuid": "ee2a95a0-0a02-4ac4-835d-4bc54ab4ca52", "value": 88272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653763691, "uuid": "dc669fba-854b-4c08-aa87-74615283dc53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763691, "uuid": "34a32c80-c758-4ebe-b475-501a39914621", "value": "3b55eb3d607e4bffeee1930ab756da6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "207faf6f-de9a-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653751409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653751409, "uuid": "4aa9673f-232f-4ea7-bfdb-f1fb366d8fc6", "comment": "Malware payload (AgentTesla)", "value": "5a2ef155adb7038a37e124d08b34bdb7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653751409, "uuid": "e4ac3712-b36e-4fdf-ac42-29332ae54d23", "comment": "Malware payload (AgentTesla)", "value": "44f95f7722ee82b8390796228e41e45aa53052ad66b4d74c12d5010faf54429a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653751409, "uuid": "5cc87eb3-0560-44ea-8edf-7e7c5860c69e", "comment": "Malware payload (AgentTesla)", "value": "b143919b947be408fbbfeec11e773d9006a4d65b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653751409, "uuid": "d6bfc90f-5b3a-4986-a543-531c62a4c4ed", "comment": "Malware payload (AgentTesla)", "value": "b84df159903a570afc6aa636adb74cc172de69995d6e2cb587c8d4b24d7fd82e856ae2271cf6bda16da619081f6d900c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653751409, "uuid": "12db3c31-fa10-493c-98e1-afd604e5cf07", "value": "T15EE4F1948367EE76F07463B37114A11C27746A2DD1D4D13A9A9DB0CE30B6B4A0EF6E0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653751409, "uuid": "3372d576-8ba2-4fdf-9b21-8a259abd991c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653751409, "uuid": "bb143acb-8cd5-46e3-8006-21e74e98d334", "value": "12288:QIn2DNFydOjMW4OQDiqaHyYjGWSKJG7aTtCabHo+:Zn2LH4sHqFYjrMQoabHo+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653751409, "uuid": "b08ed75c-4cf7-4e2c-b874-c93f5b3bc8d2", "value": 677888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653751409, "uuid": "fd035e98-0f40-4977-8ff7-1591daddf642", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653751409, "uuid": "c781f312-9f1f-4fba-b6fa-9f6d9171acf8", "value": "5a2ef155adb7038a37e124d08b34bdb7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b208506d-de6f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653733185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653733185, "uuid": "804fc791-5a14-47e2-a184-cb9370065a5c", "comment": "Malware payload (AgentTesla)", "value": "af7c6450300cd6250be96085829e93d7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653733185, "uuid": "2f48eba3-6f2f-46f2-80c6-0749081f93f1", "comment": "Malware payload (AgentTesla)", "value": "484f03a0c9d0086aecb0d2975dd0873b80843ba5fc981837e6bc9c99bea70334", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653733185, "uuid": "00c577f0-91c1-42dd-920e-4f0437e41234", "comment": "Malware payload (AgentTesla)", "value": "916b7764fdee4400d5fe71117ee9120743558b70", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653733185, "uuid": "daf4b031-9f1b-45cd-8648-e39c89a7d849", "comment": "Malware payload (AgentTesla)", "value": "0049402798f43ce799b38ff9db103e581dcf2d34af498ddfc0087f5303ac15cb23b194a477d8f4f5e1fa35f9e8df7119", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653733185, "uuid": "98ec4521-0850-4bbf-8101-5ea9c73fd0d4", "value": "T12705E12976635F07C0A907F980E3941807FA614B9522F3C71EC769C62B467EB8DC9B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653733185, "uuid": "034e9846-9084-492c-b37c-33a0b66857f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653733185, "uuid": "04432ec6-6c9b-4f3b-857b-6dbea29fc564", "value": "12288:VAE84MwD1rLaaeJiuu2CeAG2p3ZkFioD0WiBiVnnFa2DYyprJo+Fl4BDiHPA6PKW:w4lJD4CeAG4ZKsWi8RnFSyhJLwDujP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653733185, "uuid": "cc7d722a-9b70-4890-a8b9-6f3021b488d2", "value": 811520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653733185, "uuid": "64aefaeb-8a94-461d-8c34-74af38b0180f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653733185, "uuid": "21fad0e3-fd64-4915-8d55-fcc37552ad90", "value": "Payment Slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e145f788-de64-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653728539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653728539, "uuid": "d7773fde-9037-4471-a440-726996603423", "comment": "Malware payload (Mirai)", "value": "b136f16845a554680ec4793b40aaff8f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653728539, "uuid": "b2310a05-2caa-48f5-bb00-62acf180dfca", "comment": "Malware payload (Mirai)", "value": "49ff4b7961893b4d68e41933a29e9b428a127f4b232a4f833e1ec82a4c3eb20e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653728539, "uuid": "4956bab5-79cf-46e5-a698-92729ff8b344", "comment": "Malware payload (Mirai)", "value": "05bbce559f1f3bd4770fde850c625416b4d9569c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653728539, "uuid": "61e9559f-b902-4648-8ffe-f02b71121b32", "comment": "Malware payload (Mirai)", "value": "b8af4a1fc58f1a0d5cf44e5ad591cde8e4718e927a49462c40003d8099b031b393f46f5280ba9169d252829f97ade26d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653728539, "uuid": "d447d395-f8a7-4590-8dc9-39d9cb4d41e8", "value": "T19843B41ABFA01EF7EC6FCD3745A81B45348C941A22D57B71B974C428B61B50F86E38B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653728539, "uuid": "d34bc55e-45d2-4e4e-8734-0009366c2ff5", "value": "768:GP84HxJ7SXAZjF4w2DtLbW3CxnMUc2zz0dNe5Sea3e5GoiEZPTgFXiozu4LK5:GP84HxJeI6DMUzEMSL3C99ZPTyz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653728539, "uuid": "e761f5a5-2666-4ffb-85ff-187d0e02873c", "value": 55272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653728539, "uuid": "174378b0-77a3-49c6-a68e-8a1be13adc61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653728539, "uuid": "71b856a6-deb3-4921-8734-cc7a47dbea08", "value": "miori.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64e18554-de91-11ec-8e58-42010a9c0032", "comment": "Malware payload (AZORult)", "timestamp": 1653747658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653747658, "uuid": "131d7d88-a88f-46aa-9436-8c344e9323ee", "comment": "Malware payload (AZORult)", "value": "7e3ee77a4368b038f62d18f7db71c722", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653747658, "uuid": "dc8cc5b4-d858-40ac-a39b-d7a21d89e021", "comment": "Malware payload (AZORult)", "value": "4a0121e211740d5c35f1576d01bcf46ab4dda9d44a8031795bc6015bb3627079", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653747658, "uuid": "0e93c73a-54bc-4c44-b3f2-79a8a05c4591", "comment": "Malware payload (AZORult)", "value": "2f3e78bf162ed48d0be9a7141aaf77df0a21706a", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653747658, "uuid": "92cea499-fd68-4d92-9958-94e593cc4051", "comment": "Malware payload (AZORult)", "value": "047556bc129a2bd74e04cf888a13f4299d1377ae7cf75f9330f94f5c42210d0a6f8fe0f21f7db9b4170047b3e6181bdb", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653747658, "uuid": "f8fdbefc-a729-419a-b968-335bfec1bcf0", "value": "T16A828E35B3DAC33BDAFD0B31A4B38341467DE7569D52C71E59F8201A5D7778006E2AA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653747658, "uuid": "5f3acec6-8eb7-458a-9cbc-eee38fac0d72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653747658, "uuid": "7b78697d-3e26-4b80-ae63-d86970307771", "value": "384:oaumyX6bwozZ9aTMth5rLbxZ1SHlIr/K5aGs4uS:oL6bDxZGlIDK/d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653747658, "uuid": "72275851-9f6f-4af5-8767-c5ca5e17ed4d", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653747658, "uuid": "2e0e95ae-4284-48ce-9c6b-b455631a65ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653747658, "uuid": "a2190b9b-3168-412e-ad58-94dd4539f52c", "value": "4a0121e211740d5c35f1576d01bcf46ab4dda9d44a803.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79e3b356-de1d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653697872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653697872, "uuid": "0a154ed3-512f-452f-98e8-49c722f7cfa4", "comment": "Malware payload", "value": "7ee95161e2c413fcaaaab8a308fe8204", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653697872, "uuid": "2d816549-b89a-4a35-8dd7-abddc741da1c", "comment": "Malware payload", "value": "4e78dbfd9d5fcc891dc5bf5c37930188a51b817f9c94406717ec3b14c300de1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653697872, "uuid": "eaaf8308-59d1-4bd7-9b88-414e77335c35", "comment": "Malware payload", "value": "96eefc3743931d2817c9d2f3fb4f8c409c6f93a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653697872, "uuid": "fab003ff-c3d1-4d13-8c52-70ae403719f2", "comment": "Malware payload", "value": "6613b2dac4428af9195ab1bfd97efa317c382f847ef2bb32f0583ce6a03eb8cd2c4bd8fca117f0166cb1ea4ab6fb6e12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653697872, "uuid": "53ae4648-e3d6-44a9-b8c5-691cc84f954f", "value": "T10616335029E89677CCA5113C8A0D8F42C9FEC6BE3E5ECFC70D922B29D13E6495A37590", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653697872, "uuid": "89b7dfd9-7494-4d69-b9ac-bc6b45cd1809", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653697872, "uuid": "4506798c-f72f-4937-ba08-caf8799c5f41", "value": "98304:3SG3nNVF/ZdTsa7AgnjeZnfCeD7W6N0m882ZJ+k:37UaMgQkTJ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653697872, "uuid": "8992ec1d-5d50-4fdc-b914-7061935facba", "value": 4224512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653697872, "uuid": "a9eee9d9-d33c-4bde-ba1c-0c1f4a3ee641", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653697872, "uuid": "c70692fd-ab70-49a9-94f1-d471b3fc80c8", "value": "7ee95161e2c413fcaaaab8a308fe8204", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c74469a-de35-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653708050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653708050, "uuid": "c9554c79-a8d0-49d3-b8fa-ccd5975a7233", "comment": "Malware payload (Mirai)", "value": "942021bb633c714555793935e38a9c05", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653708050, "uuid": "96da8fdd-6510-4826-9ac8-e975fd1bd629", "comment": "Malware payload (Mirai)", "value": "50beb49fff4d80326563c134611e027609b80c94babbc0ea30ccfc7f9bb3be9d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653708050, "uuid": "9cf5b20e-5e10-4a81-b165-3f6422ecce27", "comment": "Malware payload (Mirai)", "value": "04b3f855bb91abdabf3588211e6797f4ff8627e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653708050, "uuid": "da6011dd-4a4a-4995-aeb2-d560aebcc513", "comment": "Malware payload (Mirai)", "value": "5e62577bf21d4b80cc6d391e15636a92e593b82a98e2cf4c168a1bcf63547b02c3475f66d57b87574899f6f60e650e9a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653708050, "uuid": "93dbd8f1-6288-4143-b106-281c86271c7b", "value": "T155E2F13115F36EC3D84195B2D7BF498B9FDB22B5857F205646D93A9C99C105E30EA083", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653708050, "uuid": "daf00806-93ec-4fe3-bef0-3cf3a88f61f4", "value": "768:MHqPdbl/d9ofYM1Qe/CLV8d22B+y8r9q3UELBe:MH8dbl/LofMeUn2tvLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653708050, "uuid": "acbc3cc6-d540-4b45-9c99-1d590387122f", "value": 33580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653708050, "uuid": "5bb0b3d3-db3f-495f-b6d3-0887310a6a90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653708050, "uuid": "8c038b8e-c03c-40d8-8773-b152663f0745", "value": "942021bb633c714555793935e38a9c05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c074352-dea6-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1653756663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653756663, "uuid": "1f774dca-5262-4986-b05b-493f160fe081", "comment": "Malware payload (RedLineStealer)", "value": "c2853a52ff4a4f76090fa2d15811b2e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653756663, "uuid": "fd95a742-1272-4512-8bf4-1fc15970e536", "comment": "Malware payload (RedLineStealer)", "value": "51302d5b6e16cbc699418320673d689c0aff4200bb8d198a88ee2b7dc0547f4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653756663, "uuid": "27acb339-83b8-438c-b2b8-0048296677be", "comment": "Malware payload (RedLineStealer)", "value": "9b1b1614d80cb595337825436471b7d149215e3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653756663, "uuid": "147540eb-b21e-44cb-a93f-cb3458ca0b3d", "comment": "Malware payload (RedLineStealer)", "value": "877125955be7db03da873902d37d9649c1f6cebcdd241041e68f0162d277e62077f23f0552dc3ec8a8c542a945d05ad3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653756663, "uuid": "e19e4f96-5168-4c5a-99f6-9eecd2a0af7f", "value": "T17CB2F7C872A4FEB6F5061B379863D23116389F09582AC33E63E01F4BBD256E50BD4921", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653756663, "uuid": "252113bc-a4c0-428f-b5a2-29bc2f26460c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653756663, "uuid": "88369415-8d6f-44d0-8e95-5a5bf418daeb", "value": "192:IGVm2I5gkcegr6OIFXTz7Vk9T/EjZa2YVeCp4mRukveH9:IGVmV5gkG6OIFXP29afgeCtuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653756663, "uuid": "0c0c4a60-841f-4407-ae58-ac743440bedd", "value": 25600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653756663, "uuid": "c4bedbf4-c90f-4662-97a1-f52d9cdc944a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653756663, "uuid": "e214be38-5c3d-425c-ac0c-0f6a13456303", "value": "51302d5b6e16cbc699418320673d689c0aff4200bb8d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "380852d7-de35-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653708069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653708069, "uuid": "a3c0f050-d49d-4585-a5ac-c881048f74f4", "comment": "Malware payload (Mirai)", "value": "02f22228398d25a1021149be66b6af8f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653708069, "uuid": "63926a41-a649-4a46-bdde-ab2fad99b512", "comment": "Malware payload (Mirai)", "value": "524026d91cbb0df81996616d59cf51bced310cd0ccdcc2ee521c4e3536474119", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653708069, "uuid": "682c8d99-fd8f-47b0-8536-51d94859ffbb", "comment": "Malware payload (Mirai)", "value": "fb3c32c43a02def941f37cb1f1a1b15fa50fd20c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653708069, "uuid": "3533c84d-5447-4407-9e3b-4d7be4c9c1ee", "comment": "Malware payload (Mirai)", "value": "2296a09d5fc90fea715312bc40d6d9ee6b6155fc66628ad46f7725a9702c1fe14e836666e4cbbecf9a4c8668f85b4fbf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653708069, "uuid": "5359c705-3cab-4c38-8c41-626be1cb4ce4", "value": "T19C634BE5B4029F7CF44BDBB685224A09B521A2450B930F2BE3B7FCD7AEF21548957C42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653708069, "uuid": "5f7288d1-cd76-4278-a280-354974652b15", "value": "1536:Es35C04vIS2u4YWKvZYcoBPKaFRFr4bgb0M8iAd6:Euw4W6zBCc0gAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653708069, "uuid": "aa71ca7f-aabe-4d06-a743-4bae3b1323d7", "value": 72400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653708069, "uuid": "ec1cce26-69c2-4aa6-9e92-7f0d5b53b6bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653708069, "uuid": "6cb7d250-928a-4535-9cb7-c98f179e1c84", "value": "02f22228398d25a1021149be66b6af8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d20cee1f-deb6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653763733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763733, "uuid": "d62abf5d-062d-4aa1-b78a-420e317ca810", "comment": "Malware payload (Mirai)", "value": "8d2da57402224cdb0f03ca7cc376e08f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763733, "uuid": "33c94db2-194e-4575-8b67-cba4ac8af368", "comment": "Malware payload (Mirai)", "value": "526cc6536da4ece9728bd5fc15d21205b699b63958468c93fc1a9830f4522974", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763733, "uuid": "95f1eda1-dab3-4b3e-8aa7-157134dee3ee", "comment": "Malware payload (Mirai)", "value": "ba86d7e60f064d4d94774a4a1851507e8bbc80f2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763733, "uuid": "63d614b7-fc74-4811-ae8d-47bd83f127d4", "comment": "Malware payload (Mirai)", "value": "18f4a6746a41a0c7551ac7a51c79f649e96c3e4e3ca3598548aefebcbd40a19d3675ae5ece8fc646cc71f2aec35696fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763733, "uuid": "243e2bfd-24a3-486f-a550-7e1adef75bf7", "value": "T13F53BF32D41CAD90D1690138BD248E785763F50965A72EF64F968BA68007EFCF62C3F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763733, "uuid": "485e352e-ff31-4ecd-b156-efbaec7f25c7", "value": "1536:M/ov+7AZOuaBwtFie0Q5qP4nsFtaTop1V7CVu:MgvGYJi7eP5q/taTop1V7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653763733, "uuid": "639b4ae3-9cb1-45ff-9d9b-134af2dad9a7", "value": 62500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653763733, "uuid": "7e16ce06-a804-4d15-b72d-06be4ee8d949", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763733, "uuid": "86173519-af4b-4132-816f-3038d29cfd15", "value": "8d2da57402224cdb0f03ca7cc376e08f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "324aab17-de35-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653708060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653708060, "uuid": "a265169d-4de8-4aaa-9f99-849e9fb83dc1", "comment": "Malware payload (Mirai)", "value": "5b21bb06db1d04fa16f65b063d4ec16e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653708060, "uuid": "34c2cdd2-2c89-45ac-9528-772682503672", "comment": "Malware payload (Mirai)", "value": "52d840f8cf97d39154ac49162beac9420627546f477a11d72181ac246815355a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653708060, "uuid": "24ac971b-b174-429c-8f5c-92859c61851b", "comment": "Malware payload (Mirai)", "value": "39ba6dfc0394ffa2d198194295c3c204937bfda0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653708060, "uuid": "828f8663-317c-4d8d-a75b-57e6421d687f", "comment": "Malware payload (Mirai)", "value": "1793d81e1c1d8522a0d9cb9c18dbbe752b8894bf0cf035f6d4da4f2049fe2277388a4f4e9f7d0c3473a4d5470fe3dcb8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653708060, "uuid": "b3fcf7ef-bd00-4076-b5eb-4a94d438b2a6", "value": "T189D2E1655368ACFBC3705C3AEEA88E89E3A35374D2F9733315E042A8B2D195195385CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653708060, "uuid": "3ab714a9-1239-43d1-914b-e52250dd7cdf", "value": "768:GEl47z0zCgf8lKPs3nmqvJPjjXMgfYbIGs3Uozy:hLzC+PsX7vJ3XJYUzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653708060, "uuid": "f687de9c-a13b-4a24-95d5-298c2190855f", "value": 28604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653708060, "uuid": "3a863692-2e37-47d6-8bbf-f7d26dac22f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653708060, "uuid": "dada65ca-d075-4a41-b58a-694943dd8120", "value": "5b21bb06db1d04fa16f65b063d4ec16e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a929bf04-de5b-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1653724580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653724580, "uuid": "cfd944e8-27ed-4403-bf05-901ce79d64b4", "comment": "Malware payload (SnakeKeylogger)", "value": "45c501250d48c6095a9584656270b88d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653724580, "uuid": "dd53b1a0-2e31-49b7-bdfe-308a6a4ee6ad", "comment": "Malware payload (SnakeKeylogger)", "value": "5402394c09450f2dee08a7a009359ad04d282bcc413953a0efaef2b9e8a35de6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653724580, "uuid": "b2b8d03e-0a49-463a-b013-9c1e1a34fd50", "comment": "Malware payload (SnakeKeylogger)", "value": "6a6c1bb9da177d371a9258e2441e63c1aad96ab2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653724580, "uuid": "7d9e55a6-dc58-4b44-88ce-2594ff7da947", "comment": "Malware payload (SnakeKeylogger)", "value": "49ab3a4dae5338af45ac50c4a5b6f8a4124edce885a53c47cacaecbc4151bb806a71c0aafac955effa62b9f795a7c84a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653724580, "uuid": "ec008d3e-f131-4a66-8c16-45ef581b6009", "value": "T1B673D92C32889EB0CE4F8E30D11D95F835125AF975155E39C0E1686AFD2EFAEAC5B344", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653724580, "uuid": "6eeac7a3-c88f-4050-ac46-3e21a2c35bf0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653724580, "uuid": "7e05215a-0b48-45b3-b0cc-c4d081b2d369", "value": "384:9TVNrmO6bOEINwUyCQnzzyHYZi52gInsvwDx0vmDQfJpqP0kG7hvKHoa5xWRdD5k:9TPd6bzaDBvwDx+mD6J4FaXR5K3mqi8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653724580, "uuid": "ca57e801-40b8-4640-9ff1-ed35defb9b8f", "value": 76288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653724580, "uuid": "9edc4f28-0fc9-4290-9dc9-9273d684301a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653724580, "uuid": "2e21bf11-907c-4b5e-8a49-eab9dcab628d", "value": "MV WINTERSUMMER .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8a8d7a9-de4d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1653718593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653718593, "uuid": "2d7ecb5c-b7f3-4788-8480-1eb81759fd27", "comment": "Malware payload (AveMariaRAT)", "value": "2772deb85c93c92e3da447e135735868", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653718593, "uuid": "75d34c1b-a400-4690-9183-80ba2126c92d", "comment": "Malware payload (AveMariaRAT)", "value": "5460ef928999004419a3f3b1b58f85f8099415ec94b88be80a70d776df4c6718", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653718593, "uuid": "485e395b-68c0-45b5-a323-8a85d36e4a2e", "comment": "Malware payload (AveMariaRAT)", "value": "3e5559c6f72b5fdc5b2a32aaeb5eb5a9739d0c1c", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653718593, "uuid": "fbeb16b2-0ab5-46c7-a7d4-fa396c65827f", "comment": "Malware payload (AveMariaRAT)", "value": "a6585fb6349f20b4c9da8a4c4adf80ad30fff7d32f23d5ec1db231d203e2d781121d09e4fc2ee81241f0a53d641101bb", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653718593, "uuid": "f8221717-68c6-41a4-a877-6fb1628b00e6", "value": "T11465231BF7948B54EC1C2632CBEAE364EB1173A2056BD32B4DC209EF846B7956E441F4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653718593, "uuid": "126442a7-2896-4e7d-aa3c-d6c7663d4729", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653718593, "uuid": "a9cdf2f8-af53-4225-903b-c84b4e4a6e97", "value": "24576:nxH0MW/IbxTty5qtZDk7DIVfBFq17zjiWslJqjxFYZ7WTxAWv:xUM9LLIMfBM1b4qjTow", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653718593, "uuid": "9f2672bb-795a-46f2-96e7-43a6d3649573", "value": 1476608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653718593, "uuid": "9656b354-51c9-49c3-88a0-96998c348a42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653718593, "uuid": "07e7d620-590b-40ad-ae79-e6b290f032e8", "value": "2772deb85c93c92e3da447e135735868.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b2c0643-de6e-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1653732663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653732663, "uuid": "8e1c7d70-b34b-43db-a784-37b8cb132e04", "comment": "Malware payload (SnakeKeylogger)", "value": "845d5f872638e901462ef9b5cd2474e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653732663, "uuid": "e302af77-6967-46ac-8810-8c97211ba972", "comment": "Malware payload (SnakeKeylogger)", "value": "5b3ae7cebdeb1c3223ea55a8dfc6c4582af4533d9d67dee4a4ca2735dd2af596", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653732663, "uuid": "0ae21029-7154-4dfb-9889-54e797e46bec", "comment": "Malware payload (SnakeKeylogger)", "value": "f05b987b28232ca4695ed6cf843cc21c7eb0d3d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653732663, "uuid": "f8293c93-9822-4bea-93a3-03fe1237ea20", "comment": "Malware payload (SnakeKeylogger)", "value": "4c3de96dac383bd8320874182e245df5e0f7d2b7213dee808cdc99f55d285a82b1e4cd69db2e454b59bfb6fb7e6afe69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653732663, "uuid": "4b542895-0dea-4b35-a986-944722e88bc1", "value": "T19973B3E2A1D4FFC7E5BB62342EE136200B235B58281956508BCC291F77269DF3781B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653732663, "uuid": "093baeb5-d2fe-4f90-9de1-ab447c1d8bc6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653732663, "uuid": "dff97d27-b02f-414b-9705-ede69a89e283", "value": "1536:MT6bjl8ljRWcplgMPocPoJ4TGEWx4/2G:MT6b7cwzc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653732663, "uuid": "b941f75b-1656-4a9f-b731-74f7840ca792", "value": 76288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653732663, "uuid": "eef5d57e-ad28-47bc-ae4a-197f7998e522", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653732663, "uuid": "708111d4-f34a-4b13-8886-a4b8d98e9346", "value": "royal (3).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5be06fb-deaf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1653760705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653760705, "uuid": "b7326a80-fa70-4a62-b539-f3db1a382e48", "comment": "Malware payload (Gafgyt)", "value": "212ee0ad7c4408599e386ad513411494", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653760705, "uuid": "ec35deb8-5de0-4073-9a80-2bfc43d5d6f1", "comment": "Malware payload (Gafgyt)", "value": "5c0432686641a6af7b1f627f49d064110438354a85acc2f55deaf08e058b7a1e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653760705, "uuid": "21004211-51d8-4968-b352-3a86c6009e84", "comment": "Malware payload (Gafgyt)", "value": "6567ecc39f9b444360ba4d26f028050900f0d5a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653760705, "uuid": "6ce1f069-d912-4ca2-aa50-8aef9b1a2c83", "comment": "Malware payload (Gafgyt)", "value": "730e4007fabed25872dd24b4f3be00cbe7f43058b3975aa6e0f7543c6a4c197e5a29fddee39c47706cb1814a36249f2e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653760705, "uuid": "586e289a-ce5b-4b8a-a8bd-4c5450700ed8", "value": "T15804C997CA61DEB7C053E5323AB5A118B39CBB6A0B0F098B7E5D76610E1E4CF600F654", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653760705, "uuid": "9156c095-bcc2-4150-9e80-961d13a0804b", "value": "3072:bxizqwyjyUdQuj5hkrX3XZ29FrhXQ74wLCY0afP7tKcj:bxTwyjxQujj+XQ9zQhLCY0afP7tKcj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653760705, "uuid": "f3a45c12-0daa-4454-b286-cfb49b1d163d", "value": 178490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653760705, "uuid": "012fb2e2-2785-4f9d-ae08-3775012c8323", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653760705, "uuid": "89568635-16c8-487d-9931-e47edc58c266", "value": "212ee0ad7c4408599e386ad513411494", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04230188-deb9-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653764676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653764676, "uuid": "5d35968e-2a5e-4b28-988c-b8a780cd8bac", "comment": "Malware payload", "value": "4e7f2b114ac148d3d2abd09d5f750140", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653764676, "uuid": "329fecb6-8332-40ab-bff4-05779f1a8c86", "comment": "Malware payload", "value": "5cacc0eb6829e5c824d8f3498b6f99537a806eb48e5af61eb86b9a35ad686248", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653764676, "uuid": "2a322ffc-b42c-479b-bb1e-58fa61e75372", "comment": "Malware payload", "value": "280f22cbd92b8fd7b53105bcacefc974e7b05a59", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653764676, "uuid": "b50735b0-ba91-4af0-a4b5-57f024dc720a", "comment": "Malware payload", "value": "703e6c1020540190da2fe2e0893d30f151662f5d7bf39e7461b497d86e40a945a7a25f765b9d63aee0eee15cb8584969", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653764676, "uuid": "6d4879f5-8373-4d24-88b2-d2d9840a2575", "value": "T19E23F1BE661960BAE956A1F104B817F00A6506F3F1D6D6C77624F7C2DD0D53A2007ACF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653764676, "uuid": "41961b3a-7f10-4a3e-a54b-09486a17f9ba", "value": "768:IXLbH1i2D5cLnZwdqGhgxTK/LkOv5edLa0ZA03J4Zlb+yPzbIZC0FyR7z4VEJgGE:I7bViWcKq9xs5qa0ZN3+P+ynsC0FyRk5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653764676, "uuid": "27d210a2-debf-42ed-b399-9a357345e38a", "value": 46128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653764676, "uuid": "2fa8f09b-4551-4dd1-acda-f1f2a33b3d0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653764676, "uuid": "61fe11ec-5e2d-4958-b2aa-24ed6103bf37", "value": "4e7f2b114ac148d3d2abd09d5f750140", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd766654-deb6-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653763805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763805, "uuid": "9d71c9a8-6513-4503-8735-1423e169c34b", "comment": "Malware payload", "value": "be6b8c9b228ae94dd948df9d119af007", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763805, "uuid": "3fe5b06a-fe1a-4cc5-afdd-462364ff44ef", "comment": "Malware payload", "value": "604db0da98098f9e8432a422e795355a7ab7a5ba93a033ac2e5aa7a8a2b20ad2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763805, "uuid": "694f3cb4-7d18-401e-989c-9bcd1fc56a96", "comment": "Malware payload", "value": "8bbae1c3cd825b94092a8826273b44c8fdf9b2aa", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763805, "uuid": "5fba4a37-fcb7-4465-a3c5-5f5ffe8b0e90", "comment": "Malware payload", "value": "5b8b00a267884d5e6a6681658cc26c2cff2a7856af439899764579cd0b24808d911ac1a0b117af4f8bf56ad4fe47588d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763805, "uuid": "810c442d-5fb8-446b-b891-580540efb133", "value": "T178D3394AFB418B13C4D61B76EA9F41463322DB95D3DB3306992C9FF43F86A9E0E12605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763805, "uuid": "ef4bef25-248d-484e-b046-641915118b89", "value": "3072:cchR9tut6ipNBFRVsRYYgUfOeB+XzJM/9ry8tDa:ciRXuUoTFRVsRlBfZ+XtM/9tDa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653763805, "uuid": "c714c597-ac8c-46d9-aeb9-939d5db54b1b", "value": 133281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653763805, "uuid": "8f9ab615-0d2a-418e-9627-17dbb31d89e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763805, "uuid": "9c26344e-f968-488d-8bb1-e7e4f800962b", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9559c29-de8d-11ec-8e58-42010a9c0032", "comment": "Malware payload (MimiKatz)", "timestamp": 1653746082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653746082, "uuid": "e0d42bd7-288f-48c9-8c94-7bfd4fedae21", "comment": "Malware payload (MimiKatz)", "value": "7586a115a915c813f58059386db4f9ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653746082, "uuid": "a30ef444-ae48-4a75-8521-92a3657a5ee2", "comment": "Malware payload (MimiKatz)", "value": "61d451ce5a169591bd4e8633c9030a8afb54027e66dbae6127984caa48bc2568", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653746082, "uuid": "b1a8b3d7-b547-4ff8-bce1-8193dea8f698", "comment": "Malware payload (MimiKatz)", "value": "9fb24eaef2da9aa81f5cc90217092b09040421ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653746082, "uuid": "feaa60a0-0329-4582-bf82-c91f6c7506d3", "comment": "Malware payload (MimiKatz)", "value": "0886a90a2dc3d9f40fc9e3633b414eb4aa72f485d4e2f6b84bc66750252c0326bd7db21b3102edba9a31f3d0c4333897", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653746082, "uuid": "95a84161-1c8b-4124-b314-b75209d800b8", "value": "T14B262343F3C1D1B9D9B9C0BA80549AB24B642E3587BAC4E777D0762B8E701C0AB36F55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653746082, "uuid": "882f29c2-a9b4-4a9b-bed9-8200fbe65197", "value": "1ff847646487d56f85778df99ff3728a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653746082, "uuid": "87530d40-e2bb-4361-88e9-c29db00f9e3b", "value": "98304:+06FOznLo0+Dd6uxcl4j8YTyaBr/6mNcOBiFeHuOPnFx:+3F6n80W6uGaj8k5SmNcO+qFx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653746082, "uuid": "e825b562-141b-4549-a4f6-b49f97cda030", "value": 4440496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653746082, "uuid": "76ac2625-7ae6-444b-acc4-d3867f76e628", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653746082, "uuid": "6bb06c79-6e1a-4efe-bd0f-427c3f164357", "value": "61D451CE5A169591BD4E8633C9030A8AFB54027E66DBAE6127984CAA48BC2568.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a63fce5c-de98-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1653750774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653750774, "uuid": "2537561c-576b-49cc-94d5-9c6cd09e05fc", "comment": "Malware payload (RedLineStealer)", "value": "399ff83d2b5b70b006c5dc7cc3e297df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653750774, "uuid": "ba9bd56d-62ab-48d6-8d85-4a9bfbc6698f", "comment": "Malware payload (RedLineStealer)", "value": "62e7acfe7b43ea538481f9df2ff72724d0d09728149793effd9b107a873eb345", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653750774, "uuid": "5376c650-0acb-4b25-befe-8fed63abc3fe", "comment": "Malware payload (RedLineStealer)", "value": "ddbc841ce87d931ecd84920931c0ddfb50a8c327", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653750774, "uuid": "826b747c-6225-4c99-88ff-462285c2fdbb", "comment": "Malware payload (RedLineStealer)", "value": "d900f451f9109286b0c362d8edcb2ca4ee2e580422cb895a47bc91de97667b18911722cd88098b15188c9dc8e294115d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653750774, "uuid": "9c55fa70-aae0-4e14-9601-3a868cf897f9", "value": "T1EE94F11476F0CC31E1A22E309865F6B1673BBC6266306947FB80576F2EB33909671B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653750774, "uuid": "4d579641-72f6-4d9e-a599-757467d38dea", "value": "936051dc8adff508935df6441a5fb70e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653750774, "uuid": "43d70b38-8fbe-4c25-84fd-6ebe03d868d3", "value": "6144:2yJRyobGRyxe2nXJn4CONgtnu3kjvYJodXm7n5750qb5igavwVf:2yJRy7Ce2nX5hONKvYedXm75WF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653750774, "uuid": "c7eff2ea-3e4f-4cac-a263-ecef65a44442", "value": 415744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653750774, "uuid": "7a9631ea-129c-40d7-8441-05431ae60842", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653750774, "uuid": "984aab00-1d80-490b-bbb5-6318e9d553c9", "value": "399ff83d2b5b70b006c5dc7cc3e297df.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3f03df5-de64-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653728544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653728544, "uuid": "124d2a39-7ac5-4fbf-a9e3-cf24434af9c5", "comment": "Malware payload (Mirai)", "value": "2a11b5fbaddab21eb379358ca3e767c8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653728544, "uuid": "3658ffd3-92e2-4e38-99c8-2ccd349adbf5", "comment": "Malware payload (Mirai)", "value": "63c1318753462edbba57f946af8eaf19d85aa69e6cd9b0c710386ba2c090e199", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653728544, "uuid": "8cd33925-c41f-4b05-8aad-839e8f366899", "comment": "Malware payload (Mirai)", "value": "daea5cc769fb023b0434b459d960746a6c491fa2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653728544, "uuid": "69e7132c-7099-4833-a8f2-719d289947c1", "comment": "Malware payload (Mirai)", "value": "d711522a4287f984ce248e2735c8aa051d84805e0b16818641366693df4ec74a67e1d391dd87e59481ec72ab95dc705a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653728544, "uuid": "76df1ebc-d159-4330-9adb-686b3c1d8d7c", "value": "T12C03F7136694C1BCC9468AB05F7FB63AD623F07D5231AE5D33D57F22AA0BE210E1E185", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653728544, "uuid": "ba47a207-58c7-4d77-b694-080921227cce", "value": "768:r1/PlEGzAXNVb33/SJUxf70g/IEMilM6VAE4s3:R/0Pzx170KIEF3V14", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653728544, "uuid": "0c630c5a-ace1-4075-b8ab-c59587341268", "value": 38144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653728544, "uuid": "992c9c38-8039-4577-bfd2-241ab646ce19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653728544, "uuid": "b9cf31a0-711d-42aa-a0d2-07bfafad4d24", "value": "miori.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "733c15e6-de1c-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1653697431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653697431, "uuid": "0bf9fb82-0ea7-4c68-a28b-16373289ad15", "comment": "Malware payload (RedLineStealer)", "value": "2697e13f1fd016ce1e7538cc6a2003bc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653697431, "uuid": "be1295b1-071d-4b64-96e6-b2c48e497ffd", "comment": "Malware payload (RedLineStealer)", "value": "663d6c13085975c11d0014705d9233430ab84ff53d0dd1a74b8e387c1e6f9dad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653697431, "uuid": "fd01fd7c-8ee6-4091-b636-80b2aea16e24", "comment": "Malware payload (RedLineStealer)", "value": "bc3a01b32168c3c3c75964e006e9cf7a32ae7930", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653697431, "uuid": "70975a5c-87f0-4800-b580-20a30ec6d23c", "comment": "Malware payload (RedLineStealer)", "value": "f982a1d5c2689c5450781c9b38f17d6be2cad4c21e74346f53e6236f731efb0c9ad214006543c898ef23cf69eb625d12", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653697431, "uuid": "8884486c-f7d8-4b66-ba75-0a8d0564b1c4", "value": "T1C294BF10BBA0C434F1B702F4897A8668B93EBEF16B2451CB63D466ED9A356D1EC31707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653697431, "uuid": "e4530d89-a91a-45e6-8ddc-a7875631f73a", "value": "c5df5f515f76bb815fad87fade1c304d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653697431, "uuid": "f2091b65-64cb-4caf-8cf4-abe6531b4ed8", "value": "12288:3caPSAiFwtUF7h0Ww6QXIxYh+cdq025U8vG6IR:7PSblVhT8+c+O8s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653697431, "uuid": "4d16a98d-d4e3-456d-8983-35e45263c589", "value": 422400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653697431, "uuid": "05c283af-0047-445b-a356-0d081c29c6e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653697431, "uuid": "c8b4ce1c-f355-4dc0-a3ab-c96de6271274", "value": "2697e13f1fd016ce1e7538cc6a2003bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "333750b7-deb5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1653763037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763037, "uuid": "d606ff76-8ad7-4c82-9a5f-34e096ae8b02", "comment": "Malware payload (Smoke Loader)", "value": "8171392b0a7071ed7cc71438de951c87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763037, "uuid": "b4ad77f5-3f60-45a0-98b8-75b5cf8e024d", "comment": "Malware payload (Smoke Loader)", "value": "6722b82d3343d5f2dd2a6024985dfe8791decdb20b6a567dd11a515d356b584c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763037, "uuid": "bdedd827-bd83-4d3c-bb03-aceae1bf565a", "comment": "Malware payload (Smoke Loader)", "value": "cf9d0caf743fd617f86dd056e8b298678b1e4934", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763037, "uuid": "47f9bf55-c9be-4d06-a069-60ee866764e7", "comment": "Malware payload (Smoke Loader)", "value": "8f47cb51eddbcf9bf5e75bd866b4a239212fec49b01e49f7fead367e9f1330b9f96b0737dd1721abb630afe9376b15cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763037, "uuid": "f0a6e2da-fc9f-4511-ba51-8148436c43a0", "value": "T194648D10B790F038F1B712F5497A9368B92ABDE16B2441CF6ED42AEE56346D0EC3135B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763037, "uuid": "6f67af6e-aea8-4f5d-80c1-e94f989775c8", "value": "084c80339173d4d04ca1ca68fda1b9ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763037, "uuid": "cd35ab63-f1cb-4847-b0b0-21eab87c7203", "value": "6144:AgnMqwtyp99XXf0irpWk/e3YpOjI6jQM6SfOsVqBcdf9:JMqrTnf0i9Wk1Opj8SGFc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653763037, "uuid": "9a92314c-8a58-4803-ab0c-4a6554c159a9", "value": 316928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653763037, "uuid": "bc6929bf-5b43-45ff-8bf6-83daefbb782c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763037, "uuid": "eb396ce5-fff3-43a6-9d90-eaf8191eb6cd", "value": "SecuriteInfo.com.TrojanSpy_Raccoon_July_28.15527.7522", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63686781-de91-11ec-8e58-42010a9c0032", "comment": "Malware payload (AZORult)", "timestamp": 1653747656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653747656, "uuid": "e955aab7-2196-4cb6-b596-2ed707dee0a7", "comment": "Malware payload (AZORult)", "value": "c3f533c47a2f995cd4b5d16653698609", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653747656, "uuid": "00c2e682-e813-4f0a-a8d8-40edfffc9914", "comment": "Malware payload (AZORult)", "value": "672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653747656, "uuid": "b449de10-563e-4c16-acb5-70d009adb7cc", "comment": "Malware payload (AZORult)", "value": "223cfb523ff8b64b339a34db3808dc6a386752a4", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653747656, "uuid": "87381edc-79fb-4242-bc35-cc4881640ddb", "comment": "Malware payload (AZORult)", "value": "30bc260dd8acc299f36b77a349324f2835e21ca3f5c0beeaa8b94a015bf6825eaa86d5afc94308237f3edb1f4c5074f7", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653747656, "uuid": "91beb32c-d84e-4241-bd3a-156fc35aa2ce", "value": "T13045228429AB9933F25AD2714BD9E5D807FD3D37B102981FB74D3D1807BAA011AA13B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653747656, "uuid": "b7e1f595-b2ea-4d7f-9cce-a1ff8e1703aa", "value": "6715d450ebf6ee95bf798a46601f6874", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653747656, "uuid": "3509d5de-59c1-4a90-b57d-7c0109e3d52d", "value": "24576:n9Gs50M+jSxjTv9/CPPpTv94s50MsjSxjTv9/CaV/1SoOpOQlS1P8Op1QlS1P7:ws59vkPPss53vkW0f81Pfi81P7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653747656, "uuid": "686e57b5-d6bd-4ce6-8212-343d05dc72e7", "value": 1187840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653747656, "uuid": "1e414f9c-b33a-4eb5-9d6e-137c3c2a2f6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653747656, "uuid": "f52eb21a-105a-4268-821f-0f933ea6b8e8", "value": "c3f533c47a2f995cd4b5d16653698609.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e3276ce-de9a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1653751432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653751432, "uuid": "1a3ef5d4-fbc3-49f5-a432-fa110e3782db", "comment": "Malware payload (Formbook)", "value": "10105c029ec0a14dbd0ea3e96f950128", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653751432, "uuid": "b6bc5756-d3a9-4d29-aa6b-e6c13b9b0d04", "comment": "Malware payload (Formbook)", "value": "6a1304d1c9897938d2217e62aee0f4a79af9535dce964f0661e67139948a380e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653751432, "uuid": "6d6abf0b-bf3f-4a93-970c-c79c61d99886", "comment": "Malware payload (Formbook)", "value": "7b15ee1908a5be0b64bee75f015d0397a19359ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653751432, "uuid": "2d6b3cad-57ae-4a23-b251-ae01bd765cbe", "comment": "Malware payload (Formbook)", "value": "0f4f5fc2a47595a8564ed20c7e8d6d2651def171f600b76f832cdec05f8513845afcae74bb934f45d94c4121669305c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653751432, "uuid": "580061d5-c274-48b6-a3c4-ed1665b7f436", "value": "T1ED25122DBA15CF12C0990EF9C0D3826403F9A56BA671D7873ECD12D60E427D59EC9B8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653751432, "uuid": "661d5891-1fdf-4098-951c-8de3830e7a30", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653751432, "uuid": "0dc85372-16d0-4e5b-8d0c-be061988d4ab", "value": "24576:DzTjxDdnYM0UKVU7Ys6rExVb3PAD21mOfHLm:HxJnYsPMCd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653751432, "uuid": "113b8793-bc39-408f-b85c-6bfb3873be56", "value": 1038336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653751432, "uuid": "e4157855-4654-4217-8c1c-51b40a0414ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653751432, "uuid": "b3afce62-028c-409d-be3e-30ce33c5a41e", "value": "10105c029ec0a14dbd0ea3e96f950128.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b466eb7f-deaf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1653760676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653760676, "uuid": "0e881c94-b8c2-4262-9ac9-0e8d4bed25e5", "comment": "Malware payload (Gafgyt)", "value": "d60ef816ecf988114e1dc9b7b7b1a3ee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653760676, "uuid": "2f59c7b4-46bd-4c1b-add9-fac51b406960", "comment": "Malware payload (Gafgyt)", "value": "715d78681cfe424b5af5f77f5af912c11c9cf771b6fee78abc2186d5c895f7a4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653760676, "uuid": "e5289dca-5f9c-4889-8ced-a6f37795895d", "comment": "Malware payload (Gafgyt)", "value": "cab41a31c4bfea9655a0667232e8abdfa0fb9e25", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653760676, "uuid": "f7b7e595-c17e-4eab-b531-506c6676b265", "comment": "Malware payload (Gafgyt)", "value": "fdd1b9003a6accc660bd09d2259e83b07f8e273ad525c306e77497067a9df349011d621f4a234742ca9e9e82458249ab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653760676, "uuid": "25463144-8754-444c-b4ec-4dda845ecea1", "value": "T14F342E1E63719DBBD80EDE3B02DA4452129D868A03DF5F2F73A1C52AE38A50F51E7C94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653760676, "uuid": "9127f5d5-0725-4edb-9d5c-1151a817e8c8", "value": "3072:uh6f4pE9XMPLZJ29FrvrWo87R/WUqHEgTOGX:uhaFJ+LZA91H87R/WUqHEgTOGX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653760676, "uuid": "fefe4019-ec2f-4513-94b6-fd419bd62aa3", "value": 249013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653760676, "uuid": "1e1727b4-5f42-418d-8706-35221974fb00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653760676, "uuid": "7d06e1df-e5cf-4be3-b496-97db10b36901", "value": "d60ef816ecf988114e1dc9b7b7b1a3ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28c8d255-de36-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653708473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653708473, "uuid": "139e0678-c765-46a9-b08c-3bd9adb9ffa3", "comment": "Malware payload (Mirai)", "value": "253d39c1836bb17710ff35aa64c1bd67", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653708473, "uuid": "fcc06eb5-57ad-4ae4-a682-a57b4e5eb651", "comment": "Malware payload (Mirai)", "value": "71647ef2e0cc8e060ab16c58b910abfa61dc2550d378ba637ed7111545c4d89f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653708473, "uuid": "09851e6d-3721-4623-ac53-2b4c643aa10e", "comment": "Malware payload (Mirai)", "value": "35684342fb7068aaa0332dd72607b053649e0cc3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653708473, "uuid": "d1ea735a-6b92-4926-9c06-45060c9274cb", "comment": "Malware payload (Mirai)", "value": "252b57b41d2e2c531718371387ac426ee21df3d9f628dfbeb0d8f2c7723119fac3c06925818d1b40f286383f4a5b2c4c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653708473, "uuid": "abb30d42-97ad-4f31-b07c-76f1ebdff2f8", "value": "T14AE2E0ECE5D974C9C49D6AF741970AB04F82D0E03E5E97E863025C84E5FA613B9CB068", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653708473, "uuid": "67fef262-1207-4cd0-bbda-5fecd2865db8", "value": "768:Ju/nZZf0MpPkvSWf9OG1C54NJdS9CdgfFpdKwUWRM:QRV02svBlOeC5OdcFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653708473, "uuid": "04bd1f48-64c5-4226-a87a-3cb91be584bd", "value": 31680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653708473, "uuid": "1302aa83-d5c7-4789-b42e-46ea45bc73d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653708473, "uuid": "98a196a8-5713-4daa-90a3-3575f26eee1d", "value": "253d39c1836bb17710ff35aa64c1bd67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26429494-de99-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1653750989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653750989, "uuid": "6bb0bb38-994b-476b-8217-b07941527d68", "comment": "Malware payload (RemcosRAT)", "value": "b2747d25c078a48df74d8d4802eeb082", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653750989, "uuid": "e57740bf-2621-4687-87db-945a2167a28c", "comment": "Malware payload (RemcosRAT)", "value": "7725afd42bf7d167afb294be1018d93327a4caa3fccbe2758a6a00d35e60ad58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653750989, "uuid": "71a61643-cef8-44b6-8f14-3d11a3ed0a33", "comment": "Malware payload (RemcosRAT)", "value": "2e184860933b7293c1084cedf9068e4b9e25542e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653750989, "uuid": "79212ad7-a683-4a14-9807-f328a7a6cea1", "comment": "Malware payload (RemcosRAT)", "value": "5d657d238259a798a784d3d484655ede8fb5e89119c5d56ec1b7eab9716bc0b0907dbffba960ce9d066bc53a31471234", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653750989, "uuid": "27b20437-ee34-4c23-b256-cf66b7f1bc6a", "value": "T14CC40269AB494608D82C177A8CF7A3207F02A7A245FFD35F5D8714AE9807FC92ED11D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653750989, "uuid": "b2a5e427-1810-481b-8163-0f8e4d3aa09a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653750989, "uuid": "0947f2af-6bc6-4c13-87fc-111dcf015359", "value": "12288:bgH22qla5w/yXbx/XUw8LDPMz8N8Ef3UY43uFhOnrEyYvF9UR/:bgH0MW/Ibx/EdfnNzUYrr9tY/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653750989, "uuid": "20b24205-2bb7-4045-871a-3c3787d38d0f", "value": 548864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653750989, "uuid": "fd8a89f8-be45-4f12-b5a9-c99360b2a88b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653750989, "uuid": "52818ce4-60fe-452c-81d5-dd88028fdb50", "value": "b2747d25c078a48df74d8d4802eeb082.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3310166c-de91-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653747574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653747574, "uuid": "a9a476df-50b9-40f6-bf70-a477f0bf8115", "comment": "Malware payload (AgentTesla)", "value": "e5ef7bef4b0b50298c420bcf8c3518e8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653747574, "uuid": "b9f72b27-c4fe-4808-b580-4b6d7cf8ec81", "comment": "Malware payload (AgentTesla)", "value": "7a291efe72d16085c06ef4c91c19cffad0b14ba1499bf46d07deb42f326a3d71", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653747574, "uuid": "e1ddf817-dfa9-46d2-9b00-ae2860b11514", "comment": "Malware payload (AgentTesla)", "value": "05d046542f141e5dddcba7bf4ff7c07f7fc4712f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653747574, "uuid": "2a3a35e4-f593-40fa-8759-f57b97c6ae3b", "comment": "Malware payload (AgentTesla)", "value": "f21f03199492514970d86bded01654dd19aa9157453e383114822bd1c9fc872d91bbbd5d99df8f35b0e2654da2a6316e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653747574, "uuid": "cc7ce467-8f09-4a6e-8c09-397649c7bd42", "value": "T19FF4F15032B85B45D6FA8BF116B560801BF23D1E7A35D70D2DC671DE16B2FA18A20F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653747574, "uuid": "e8b7c941-2f7d-4c76-816b-8a112af6e662", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653747574, "uuid": "8cf951f8-c176-4d09-a9c0-4d2dd08508e3", "value": "12288:9GL2iNzbHohc3muMp6b+baEbLSHgDBswKFqWsRA0WN6l+W7SGl:9GL15bHoS3o6+baE/GwKENfWN6oW75", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653747574, "uuid": "e23a52a3-4a2e-454d-b013-9aabb56ef321", "value": 723456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653747574, "uuid": "86446162-f31b-4370-9d7a-07a63b144b05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653747574, "uuid": "529b656e-7db4-4943-86b2-310456d209be", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "369bfb49-dec1-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653768196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653768196, "uuid": "9c348766-e1c8-4dac-ba40-e16632b0dc3b", "comment": "Malware payload", "value": "794e8cb948a193ee5c57e7b6d2339f07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653768196, "uuid": "229269ab-e87f-48bc-a3a4-e02368a9431a", "comment": "Malware payload", "value": "7ad64ddd8bacd28406e637075a739a21ca413dc6996a5eae7398543d0e4990c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653768196, "uuid": "572bfdd0-8237-4424-88cb-5f664e5b54f1", "comment": "Malware payload", "value": "7cc52560a644bbe42e5927694308aaa6e18c6f55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653768196, "uuid": "98be0a3e-7f63-41e8-89bc-ae7fce09e1c5", "comment": "Malware payload", "value": "a278d601958a9af436a6a31f3214d38a5a88770c3f572e91b9d462ba2c22595e19e73a1b7938ccae991ba0322b7613ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653768196, "uuid": "cbff62fa-9a93-4a18-b080-5877d8f90f9f", "value": "T11F16334003207EADEDC45DF8FA90D58B677561A8A2EDCE05DF8DF88E989F2264BD5130", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653768196, "uuid": "648b2a16-d4a7-47f3-ad3e-d326500ffbd1", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653768196, "uuid": "33ecce50-eb50-4937-9718-0fe4c26c2c93", "value": "98304:Z5z0eTFhinqjLXQmPcqV8MxdG3bmzSBk6IJEllCZFWW3VE27O6G:0eTHUqHXQKczMXWC+S9JEAn627w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653768196, "uuid": "3a4972e1-76fa-42f1-be9d-65536074f40f", "value": 4222464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653768196, "uuid": "58b09a42-93fb-48bf-bb22-ce52c06250f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653768196, "uuid": "a52a9739-f4f4-497a-b817-5d0d9e6562d5", "value": "794e8cb948a193ee5c57e7b6d2339f07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "328db333-de4e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653718797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653718797, "uuid": "3dc766d1-350b-4934-a8b1-b04585fd147d", "comment": "Malware payload", "value": "73e51db10e94995d7e26087b05454435", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653718797, "uuid": "fb6105e1-2f7a-4bbe-a954-9fdcbd71a848", "comment": "Malware payload", "value": "7d0840e4bb240d9f1d3672d1a1c34b45aa0d62b4b5abd63541e4e57f4631aef6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653718797, "uuid": "f2a94c6a-ef61-4d6e-9926-0698b82d4d91", "comment": "Malware payload", "value": "628a73665777cd7f7451c6fd586fc9aa7ee0a714", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653718797, "uuid": "6bdf54d6-66ab-4e02-9bdc-b22c817ad3de", "comment": "Malware payload", "value": "6f73f453ef9dd8b9d566a97bf644f01f57babc39fe2e3378f86e779f2e531834c6d642f371ab91948aa46d3ce05fe373", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653718797, "uuid": "8a2eda55-4c9a-41f9-9d8a-d66ec9a4a600", "value": "T1E0833BE2A1D8FFC7E5BB62346EE076100B235B58281556409BCC2A1F77226DF3781B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653718797, "uuid": "c6401767-21fa-4abe-bcd6-142ac9a0c0f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653718797, "uuid": "211ad924-3fe3-4f67-be20-dccedf21eaa5", "value": "1536:cLMIPVSTel8ljRWcplgMPocPoJ4TGEWx4/2K:cLMEcacwz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653718797, "uuid": "132bd532-adff-46a3-9734-3d8971064afd", "value": 87552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653718797, "uuid": "6616333f-e6d9-4bcf-93b1-4770a5c3e01c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653718797, "uuid": "b92f0971-ae5b-4429-bd52-a4c9648212c7", "value": "MV PLATIN SHIPPING TBN DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e464652-de36-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653708455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653708455, "uuid": "42108b8f-422a-40e8-80ff-4409f75af593", "comment": "Malware payload (Mirai)", "value": "5322675fdb83ab351165410ef5876b0f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653708455, "uuid": "500d8b2b-b1c8-470c-b343-240613c05458", "comment": "Malware payload (Mirai)", "value": "831879118e2ff584d76a11094f0b102302a571dfff95fb0e7ac1649417daeebd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653708455, "uuid": "79675088-4383-457c-a522-c14294bf0647", "comment": "Malware payload (Mirai)", "value": "6da9cfb14742ee03cc11591fa30103ad50ef338d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653708455, "uuid": "bf4d1e4a-0396-40d3-85ff-fbef5924acb5", "comment": "Malware payload (Mirai)", "value": "fd20cdd48db5da8b404bc9eff41b4f29897662077c13adec514b7f360e63b30197de1e78befe598f7f12645f4eeafb5a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653708455, "uuid": "c2847b89-487d-4f6b-80bd-406b17d2e39d", "value": "T1D2D2E05A2181D58ED680D2BAAF981B303DE81BE3FC8278D7D006F573C9669C07EC29D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653708455, "uuid": "72828c4e-3209-40b4-9887-8cad11cd6235", "value": "768:L9NfivgbdbV/lqcnloZ8I0aZQbWUF20tDJgGlzDpbuR1Je:LTfivgdHZlo+YQbW85VJu0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653708455, "uuid": "347138af-5534-4537-82d0-e75833ff89fe", "value": 30668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653708455, "uuid": "3a559b06-77e7-401e-9166-91e16acb1810", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653708455, "uuid": "5997d9f6-ca3f-4b8d-9827-3bd07b538965", "value": "5322675fdb83ab351165410ef5876b0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9ed6db7-de86-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1653743157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653743157, "uuid": "6f7b5565-1e36-4856-9566-2432fe755ccf", "comment": "Malware payload (Smoke Loader)", "value": "6696ec548d680f30e2b204487aa55572", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653743157, "uuid": "b8c82f48-b2da-4031-a9e1-0d770d7b1b42", "comment": "Malware payload (Smoke Loader)", "value": "846426dfd5e7fb591e4fffe69a272e04eca06a7b8dc69963089b8121bb645e4d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653743157, "uuid": "b926f0c9-875d-468f-971a-29a035f41ff5", "comment": "Malware payload (Smoke Loader)", "value": "1fa16403f1fe59503a7b6b2252d75d7e9a5f11cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653743157, "uuid": "5ea7b9ee-2958-4a9f-b2ec-ab8904894582", "comment": "Malware payload (Smoke Loader)", "value": "bc49a8013033f12dafa042c5939d1572592440037309914160770b0c4f7f4950aa294cb915b0480448e221c8badd9839", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653743157, "uuid": "ce18a90a-3eb3-4162-8087-f5954d4e5973", "value": "T1F4647C107B90D034F3B712F5C976A268B92ABEA15B24C1CB62D46BEE56347E0DC30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653743157, "uuid": "5954a13d-8dd1-435a-a1c5-980f43c7c95e", "value": "54ebcb663ea607f54ee2ca56ede30f4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653743157, "uuid": "5e1bd6b3-9fab-4e3c-8e3d-5eb47bc90e6f", "value": "6144:oauNDpzu+yOPSu01rB2i0YvEpobKhuCLGNB6DBXI:oLNDnP6u01N2iyouY1NB6VXI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653743157, "uuid": "48520b31-a500-4e10-b897-0b700b41b895", "value": 315392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653743157, "uuid": "d8df657a-7de5-4aaa-851c-6899a7a476f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653743157, "uuid": "805eae95-95b6-4916-80c1-f413b2ed13cf", "value": "6696ec548d680f30e2b204487aa55572", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4004c3d7-de4e-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653718820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653718820, "uuid": "8f94d0e0-1784-4c20-8176-69066fc59e6a", "comment": "Malware payload (AgentTesla)", "value": "5a6332ede70ce179ce3d335edde7060d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653718820, "uuid": "35f4313f-b718-4992-86a1-df3b9849a8bb", "comment": "Malware payload (AgentTesla)", "value": "87126e672dcbafa6827503b7c2de467eda7f48367dba3db2fe4209f509c6cf6d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653718820, "uuid": "80a6e9c1-7093-4e2d-af3d-bb7ec4a32535", "comment": "Malware payload (AgentTesla)", "value": "bf5ca4d2b7562384993d42b62d9e608158538319", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653718820, "uuid": "aa62e42e-5a6f-4d91-8c6f-518f8a146347", "comment": "Malware payload (AgentTesla)", "value": "e214aecc88ec22318e3f0ee468a739b8a003e54a8f65dd671c7103b8062d842c543fdb8dd8b0ad4eb976089f3e03c225", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653718820, "uuid": "0f6d0f9f-c20b-4567-9d8b-f2cc988a4ee4", "value": "T14C05E12A7252AE13C45C1BF6C1C3941407BA5A47A632D2C76FCB60C72E097D94ECBB97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653718820, "uuid": "73a8e119-524e-4a69-b127-895c51af5aaa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653718820, "uuid": "5f5d1915-034d-4dd5-aefb-ec45923abd80", "value": "12288:uM8o0dUGSOdLJvO/tg2++2IyTKwj9ZdXwVcwrRuf0lv44mcfMb+q:P8RzSsJvOgq2bfgXhv40Uh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653718820, "uuid": "cde97d53-fefb-48f6-bd10-81d1029838a5", "value": 812032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653718820, "uuid": "da4dfdb7-7f4b-4a96-b168-22990605364f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653718820, "uuid": "0b72b0db-aa01-43c1-bcf5-e56a70a097da", "value": "STATUS DA CONTA DHL - 1606561674.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbcbe56a-deb6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653763749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763749, "uuid": "61f55afd-8ee2-4a28-858d-39652d6dfde1", "comment": "Malware payload (Mirai)", "value": "ece0cf8204aa1a461887f9852fd1416c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763749, "uuid": "c0d17f06-65d8-4b84-ac0d-d9b0ff028ae9", "comment": "Malware payload (Mirai)", "value": "88dcdc47ff61400b67e5ba956cf4d56131f29659311b7a5a77228e890eb31d6f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763749, "uuid": "55a8de21-df86-4440-bd53-acdc0c167f6c", "comment": "Malware payload (Mirai)", "value": "f248c4a963f203b17cb10d1bbafa167786a67f49", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763749, "uuid": "9fc38526-da66-4d6f-b49c-2545da15f0e0", "comment": "Malware payload (Mirai)", "value": "1cbd436ab939ac15fb39aac0ffe6798adae96b25955c9d030c0aef05025e9b341e092513f720063ff351dd65ee463195", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763749, "uuid": "1586f312-3dea-4077-89de-3f563715f59f", "value": "T1B4430895BC955A2AC5D4637AEAAE008D336177E8D2EF322BCC101B10BBC951F0D73B95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763749, "uuid": "6eadf306-a4dc-4ced-95f8-c571e2943e0c", "value": "1536:iD9GeMs4zJlvxiDiltkYXjcsnHCmuOQCuXqikxXmbq:W9GeEzHrX40HTuOrIqDU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653763749, "uuid": "16795b91-c05a-4ceb-8533-4f475b711115", "value": 59972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653763749, "uuid": "73934206-1d58-4450-a765-410b980ff3e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763749, "uuid": "be6c227b-110b-4be8-b887-d31f0981f3c2", "value": "ece0cf8204aa1a461887f9852fd1416c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7881667-de8d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1653746052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653746052, "uuid": "a0a9b076-fcde-465e-86fc-9d1132d48202", "comment": "Malware payload (Gh0stRAT)", "value": "63277cf838b5a314b20a7ed4a296a5ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653746052, "uuid": "4033b562-be55-4939-90c9-ada15ef8a5d6", "comment": "Malware payload (Gh0stRAT)", "value": "8ae634ee697187da41db972138ee0cd915387650870bf7d74f856578514a56fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653746052, "uuid": "7ff1d115-1236-40ed-b831-78201d8e3b1e", "comment": "Malware payload (Gh0stRAT)", "value": "2053c3a224cb7cf323ef3b04efb92afcdb40d2de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653746052, "uuid": "71334616-87ae-4585-b8fd-eda0f0e97e43", "comment": "Malware payload (Gh0stRAT)", "value": "1aba71d3ad18bb17ef890d64c9eafc212484dfc7352548296d72d0442018ba9f781ee1d74ad93208104be646deb9b186", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653746052, "uuid": "dca32d63-36ec-40bc-ba0e-9f43760c099b", "value": "T1D0C55B6327ECC175DB622133E529EABFD8F56530073505C3A1A25A3B9F72081FD1A29E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653746052, "uuid": "be77ee39-5d75-4c55-9b56-fd197abff1db", "value": "a48c89d892cf85298f99cbdf47341837", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653746052, "uuid": "c59cde8c-443f-4085-a61e-faab52c46627", "value": "49152:PfHCMqa08nD+5pawE04jsZa+eLOSHUHpIHHiTk8FKBhG+aAFodOcQvhn+AaBiB9a:3rE8nD+5zE1ia+eLOSHUHpIniA7aAFxG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653746052, "uuid": "4a38f8ca-cd28-40a7-9a27-ad209b1512f5", "value": 2727424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653746052, "uuid": "e8038265-e226-4629-95dc-ddb5fcce9bc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653746052, "uuid": "23497a08-c975-491d-b7c7-e2fe2224172b", "value": "8AE634EE697187DA41DB972138EE0CD915387650870BF7D74F856578514A56FE.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0342131b-de98-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1653750501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653750501, "uuid": "59934d07-e2f1-4dc0-9f35-2c5cbc8579b1", "comment": "Malware payload (Gh0stRAT)", "value": "e6ef8b625cb7c23b6a54df9a255641dc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653750501, "uuid": "593c1a33-dbfe-4c6e-9924-64dcedb9435e", "comment": "Malware payload (Gh0stRAT)", "value": "8b4d93af831e8015390e408e5d3ca39ea69287ed500fdea41457a652a0eb336f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653750501, "uuid": "931f72c4-025a-4adb-814a-66072ac10f07", "comment": "Malware payload (Gh0stRAT)", "value": "7134ed6a7259a062374e8689e8524fd2d9e46a05", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653750501, "uuid": "d2a45c5c-f7b6-4a78-a49d-9f77ea1c2865", "comment": "Malware payload (Gh0stRAT)", "value": "da4c2c07acbe5808d065dbcf90a4f7e83a524d0534c4dbfbf89dc10480d3085de00a72a41f209f14beee841610ebd9b8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653750501, "uuid": "84f0c9dc-bc15-4d8b-9f4d-f759cb4218eb", "value": "T116342371A52F5662C67F83F6DBF945AD7D1520BC4A85C33CB6BBE83B31865C289B0480", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653750501, "uuid": "72f22686-87e6-4b59-969b-8ecd119ce610", "value": "3025522a76a1746e43e19b538461887f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653750501, "uuid": "d59b1835-9aca-42e7-87c7-a996baf07e02", "value": "6144:0oiQjfaEuBfJUTUil/4sPadcpKOeOE8ZLIDZ+A/mbVF:7fjCloUs5adcpX3lIDZz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653750501, "uuid": "2ecb2306-77a9-4fa2-97ea-6112f6fec9e4", "value": 250880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653750501, "uuid": "a78e8d84-cf85-4763-af0c-c74e46ea495a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653750501, "uuid": "02bfa52e-344b-430e-9b2c-c4daaf90fad4", "value": "GAPI32.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3fec051-de82-11ec-8e58-42010a9c0032", "comment": "Malware payload (NetWire)", "timestamp": 1653741375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653741375, "uuid": "4be4b474-d2c2-487d-8613-d2faaaac3678", "comment": "Malware payload (NetWire)", "value": "74be351df29993e42881e61bab1008d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653741375, "uuid": "260845f0-3c79-4472-9d99-f2f668a04fa5", "comment": "Malware payload (NetWire)", "value": "8c0c7af597959d71d3dce52b7d27396cd39451c124dca74516e0aa6c6623904f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653741375, "uuid": "78b7ed62-e3b7-494e-8224-8068f0a76b1a", "comment": "Malware payload (NetWire)", "value": "25e16f1a0cc45629ebc5d1d760f0a214dc1d68db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653741375, "uuid": "81bfebc3-d120-40f9-bb18-2ed58cff0d74", "comment": "Malware payload (NetWire)", "value": "889640457417aabf6ea11351f793e358ea9e9a41e92fddcd9b9b4df64e849dd5f13b23499c07a1d0d6d1c28392f54cc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653741375, "uuid": "057ffb25-2f40-4be7-ad8b-9170be8a2d2a", "value": "T18FB4484A729AD7B3F3109AB92CA7E0DE51237E30DF8C919375EE770E08B1B60456D198", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653741375, "uuid": "ce40c151-9206-41ab-9abe-1d848a1f6bb1", "value": "e929c20be9670376d069bb973d63ebd6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653741375, "uuid": "c8c2ca01-b927-40e5-a280-910510604c73", "value": "12288:qp8vByVA36Me6OKfbO0E+wPWslRKT7jdrcXJdN5:2w4A3cObxs7KT7jGXJT5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653741375, "uuid": "ddfca8f5-d951-414d-95cb-9a9c5cda20ba", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653741375, "uuid": "ed2a157e-eecd-4416-b637-9fb593cc54ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653741375, "uuid": "7df0c99e-ac85-4a1b-97d6-cc2c76779212", "value": "8C0C7AF597959D71D3DCE52B7D27396CD39451C124DCA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe5c9e9e-deb6-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653763807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763807, "uuid": "76c45b83-8592-4468-93c9-071d0020054c", "comment": "Malware payload", "value": "d91f61488c2699e51ca8afc0f9d5416e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763807, "uuid": "5e09b5b3-6466-4ac1-b096-f6f7b40df0b3", "comment": "Malware payload", "value": "8c691df4e6e666df9935efab11541f1e764276ce3ad3c448f89b3151de7a3c09", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763807, "uuid": "2e23762a-4738-4227-ad8a-495e7306bf18", "comment": "Malware payload", "value": "fe7eae484839367e372c0be95582ab442536e9b5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763807, "uuid": "92bca749-f3bd-468b-92a4-f70135c86d96", "comment": "Malware payload", "value": "397f521994794e0974a6ffb70ae105f9372e94ce972ea4d186fb07528d6a7b15ec8eeea3059ec793cc07bbc7f2bcaecf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763807, "uuid": "3b7d47be-8569-4b5d-b893-60b3bee95853", "value": "T170334BC5E183EAF5F8112939306B9B714FB7D57A64A5FECBE39E1633A802702911235C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763807, "uuid": "41e26b60-9ac4-4146-97e1-070589a8a976", "value": "768:NBH7p0qaWIk3ag3ejMNOOxHpHKdd7UAiEUKvoVGmNZx37c9ZNv2w:NBH7p02aguQOOqbYZKvoZNZx3A9ZN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653763807, "uuid": "09ad8412-bc47-4d7e-8bd1-522b3523e642", "value": 54032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653763807, "uuid": "6372bb66-5e1a-4c4d-ba1e-981666740546", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763807, "uuid": "e7b79146-2f5d-498f-af70-a0e186e4c256", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4a3be23-de64-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653728545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653728545, "uuid": "2266546f-843c-4518-a53e-1478c3b2d9ae", "comment": "Malware payload (Mirai)", "value": "78ca9eb97808a4807fef071758287680", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653728545, "uuid": "e768daec-9b16-4477-952f-422618e0a7bb", "comment": "Malware payload (Mirai)", "value": "8c9096baf5bc1a5c61b17576e225e512fcf73be5bdf62482417415a97503c6b8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653728545, "uuid": "3f867ee2-2b48-49c2-aea7-4372bbdc8938", "comment": "Malware payload (Mirai)", "value": "4b07d6466aeaeb5b52f278da483fce352ae2c38b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653728545, "uuid": "8b62397c-a179-47f4-aa73-8118cccc87d6", "comment": "Malware payload (Mirai)", "value": "ccba77f1c72d5d69542caa618866a50664dd266a5b22739947893dd192b0aba56fd2ba7755656e45b7e6316f3311e905", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653728545, "uuid": "d1a99218-5982-4595-b216-9081bd8c41a2", "value": "T10133820A3A798FADF769863887B79D31A358338216E2D648D15CFD000F6034DA55FBE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653728545, "uuid": "6869e270-eb14-419a-aff1-d7305f7348e1", "value": "768:PzZE/VNkNbNwWNWG4C6T7q4aei8/PUUl3yuGfWXxhHatqPLsq2q0tqStqxqzq8eo:WtuVb46On1liuG4HaaSrTuFBcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653728545, "uuid": "4833802a-78c9-4683-b380-41919f8c97e6", "value": 51832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653728545, "uuid": "edab9f08-edc0-4d8f-a313-711004c50b5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653728545, "uuid": "a855568f-846b-4664-afb2-8b101486997c", "value": "miori.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80200c18-de9f-11ec-8e58-42010a9c0032", "comment": "Malware payload (IcedID)", "timestamp": 1653753717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653753717, "uuid": "9d715907-4ce9-4268-8aeb-744e36455464", "comment": "Malware payload (IcedID)", "value": "593816a0bdd8db32624236ff103202b3", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653753717, "uuid": "d49761db-e7b3-4159-98b5-00b2391623e4", "comment": "Malware payload (IcedID)", "value": "903e9a6a911300ad7164ba9889aa7da12e1848fceb4e18ef02b18971919d7091", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653753717, "uuid": "aed5c2e5-7afb-4e00-a23f-c920d6fee8a7", "comment": "Malware payload (IcedID)", "value": "bdb53747629c8d456ab00f856c3453cb9756d887", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653753717, "uuid": "b005fcbc-0d3c-433b-969a-e22d692b1650", "comment": "Malware payload (IcedID)", "value": "a36053241df725cf5d37257349d12a16697eedf9127a7b419c28f06da35ca809472f4bd6d3adcff7ac1bc6e017a8fe2a", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653753717, "uuid": "29df012d-8baa-4357-817f-4dd2f3638685", "value": "T1A995AEB4F6102CE7D66E037BD9D7BED923B327228E97E88941A467D209B3371ED15804", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653753717, "uuid": "3d48825b-5bdf-40f8-a439-2865c9e3498e", "value": "12288:I49cfWTcALiwCeWu2E5u0v1qR/B8r5g1h:I4xQtLuZ5x14w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653753717, "uuid": "fb85d347-daaf-4b52-a6b9-c08386c2b30b", "value": 1900544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653753717, "uuid": "b3e68107-dcfd-4362-bcbd-5057c05c8b45", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653753717, "uuid": "fea0a1a8-ad1c-49c6-bf93-0b609e9fcc37", "value": "StolenImages_Evidence.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8ca12c1-de99-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1653751208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653751208, "uuid": "fa0916c5-11bb-4d60-b03e-c4d130db1001", "comment": "Malware payload (RedLineStealer)", "value": "3fbdf844460430371300862dca04a638", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653751208, "uuid": "e182858c-f5ec-4566-a9e5-d3bb77b5155b", "comment": "Malware payload (RedLineStealer)", "value": "9566ef0986d5c2065cddb538b348874c6c460b9d13f017aca76d2fb4e5ad061b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653751208, "uuid": "63080451-d595-4179-8ef9-813c687a1915", "comment": "Malware payload (RedLineStealer)", "value": "a05576b034ccea63dd56566cb313ad596a6f2331", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653751208, "uuid": "345b09f6-fb1e-4a5f-9b20-7e2e32111e4d", "comment": "Malware payload (RedLineStealer)", "value": "734b6c6e4571581345090147528aadb325c38c9ec72116c6ce245ee83f2d7644bce444de37aab75596a25205f595daa5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653751208, "uuid": "d3697d52-9675-47c3-a683-fd3f0f10eb0f", "value": "T16594AD10BB90D435F1B726F48AB9C2E8B92E7DA1AB2451CB53D43AEE56346D4EC30347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653751208, "uuid": "1bcdf3c5-5079-4214-b00e-8599795fd9fa", "value": "c5df5f515f76bb815fad87fade1c304d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653751208, "uuid": "85ff311e-51e6-4902-943b-487d885bc432", "value": "12288:UmaiEWpXwbUfE/OtkGtsjeVTtTYuFB9M1Zs96oA:2iEqLc/OtrOeFBYQbM1o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653751208, "uuid": "c15361af-0c4c-4e34-bade-09202caf96ee", "value": 422912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653751208, "uuid": "e54306e6-e7cc-4138-beec-9efa3801d641", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653751208, "uuid": "6c0776e5-d13a-418e-a07a-390b6751aabe", "value": "3fbdf844460430371300862dca04a638.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2828694-deb6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653763680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763680, "uuid": "07dd0aa0-635a-4f63-92f7-3e83fcb1ea17", "comment": "Malware payload (Mirai)", "value": "4d0c55e86953af5f97f9f500967f72bc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763680, "uuid": "8c64c5bc-6e93-42e8-9a53-7a2c6fd5fac8", "comment": "Malware payload (Mirai)", "value": "990f97718c1434fc5d4d9423e5056abdd46fe52575979b70aa286042501b07b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763680, "uuid": "947916bd-e711-48e7-8393-39a829b4ba0f", "comment": "Malware payload (Mirai)", "value": "756195857b3bf9f41d8a10a480e8f6ee4e08fd43", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763680, "uuid": "d34e7483-5372-4a86-89c5-2009cf88f76f", "comment": "Malware payload (Mirai)", "value": "102f2ae73badba597bd58c83ec8a810e59c9e87f682682183710cf6889adcffe71760b63be884d65ccdca8671abe5dbc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763680, "uuid": "8c46af8a-a616-4fe6-92bb-21a75c37e19f", "value": "T1B8631891BC918A12C9D4237BFA6E41CD332523A8E2DF3217CD216F507BCA92F0D67656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763680, "uuid": "e3ee6a6b-8437-4a65-8663-20b30e7a1ea6", "value": "1536:quEQDgA8UKAqpjntJsKK+7cmnbC+1lI/XqipHX0Z1wcbT:qpQcA8UKB++Qebz1lIvqC1cf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653763680, "uuid": "fa7d188e-4661-4085-b002-e8952f9d5c88", "value": 70696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653763680, "uuid": "78ea51c8-ce90-4a5f-84ae-9ddb2c41d729", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763680, "uuid": "f2619a0d-888d-479f-b1b2-5ae825e51ca9", "value": "4d0c55e86953af5f97f9f500967f72bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33c949c8-deb5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1653763038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763038, "uuid": "f406c786-259d-4fba-94f7-6be7a70d1218", "comment": "Malware payload (Smoke Loader)", "value": "49115e540a2e35344de380deb058ce31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763038, "uuid": "cacc1725-d34c-493b-ba62-58478e145ac2", "comment": "Malware payload (Smoke Loader)", "value": "9c4ee62193ea9de95f79d441bb533280104d3beb73b5e2109dafab2ee667f735", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763038, "uuid": "80bd4a38-6119-44ef-a9a0-58d3fafcc1fd", "comment": "Malware payload (Smoke Loader)", "value": "24bf3a67a8ba3e4a836f1cfcf3c27eaefe41ba09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763038, "uuid": "b43c6011-2061-4e12-9360-ec83e41cc918", "comment": "Malware payload (Smoke Loader)", "value": "81366e6cf1f8bd3d2f37f8b010e42073a4d331507fa9c87e1f7a6379385803d27b7b2023640c0fca951fabebfc06b0f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763038, "uuid": "4dd1a587-8e18-4b71-a974-f5190cac2b99", "value": "T16F647C107F98D036F1B711F549BA8268B92A7EA1FB2451CB62D46AEED6347D0DC3070B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763038, "uuid": "b8eb295c-996f-4c6e-ad23-9d4cdfcc1497", "value": "084c80339173d4d04ca1ca68fda1b9ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763038, "uuid": "a366d6a2-0f10-4e0f-9c53-01c96020a1aa", "value": "6144:+KMgAlQAnNQdd0xrLKRxucNpYaKqYodHYFkVPuQC0ivl1fW2:zMg0NMd0xvKR3YUTmGVPuQpj2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653763038, "uuid": "283502c0-3611-41fd-9700-5eecb27513a0", "value": 316416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653763038, "uuid": "454cb077-2fc6-4c86-8cde-4903edcc1604", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763038, "uuid": "06047d07-4db7-40c2-ac56-66676369bc07", "value": "SecuriteInfo.com.TrojanSpy_Raccoon_July_28.27902.14750", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ae7d3f6-dea4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1653755829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653755829, "uuid": "ada4c814-cd3b-45a3-874c-40271c17c892", "comment": "Malware payload (Smoke Loader)", "value": "35802bb18cb3d720f760dcf5f7f6c7ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653755829, "uuid": "1c71b370-127a-4811-90ad-54b7f62c3430", "comment": "Malware payload (Smoke Loader)", "value": "9cf9bcfe7de14a35cafc7ee710259a7bac9502a8ca0d7fe245438d977241eb9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653755829, "uuid": "a21d17ff-0b46-4ca5-b21f-bb1d340c16ad", "comment": "Malware payload (Smoke Loader)", "value": "86dc350eeff7dc49310aa00c1fbef434ba9f1001", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653755829, "uuid": "ac2954d8-ac71-4d43-98fd-741e7be49e06", "comment": "Malware payload (Smoke Loader)", "value": "e23e1119506b66261dd990a4c153b704847fcbca19039eb992f3b7bf958578cb9a2f5bc0dede937ca374c7215f106032", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653755829, "uuid": "36db1cb6-895d-42a1-8e0f-68ad0e16cf3a", "value": "T1AA648E107B90D434F3B712F4457AD368B93A7EA19B2451CB62D42AEE56346F0EC3076B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653755829, "uuid": "7ef2d63f-4295-4f40-af97-a8d7678ac083", "value": "54ebcb663ea607f54ee2ca56ede30f4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653755829, "uuid": "edd9589b-70a8-496f-824c-7da881bf409f", "value": "6144:AVYNmpr1XhOPSl0orvWuhYkrpdLCpb7C+iinGEbG0bV9kqWg2RD:AmNmvA6l0orWu/dupn0EAqG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653755829, "uuid": "615c1ee4-9b79-4f81-a0d9-b4ad9853c005", "value": 315392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653755829, "uuid": "2fd82eb2-eeef-4d54-b5ad-056718b2b7cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653755829, "uuid": "ad3d72ac-b9f2-4207-84bf-d407ca90244f", "value": "SecuriteInfo.com.TrojanSpy_Raccoon_July_28.28676.14522", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3937793-deaf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1653760648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653760648, "uuid": "83ad9679-b6e2-4b91-b3c3-cd5a2aff831e", "comment": "Malware payload (Gafgyt)", "value": "5981567a819fe7a3a8d3765d985b8979", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653760648, "uuid": "9a888381-0606-4347-8a97-a02c2fa43619", "comment": "Malware payload (Gafgyt)", "value": "9e22fc14ae8cf4fca550cf585d153645ee4285504986083ee5e2ad25897e89b4", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653760648, "uuid": "7c651136-73ff-478f-9650-14b11d327bb2", "comment": "Malware payload (Gafgyt)", "value": "72ba02fcbffb06db03b3e00081cc036ede8dc85d", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653760648, "uuid": "1a3f251f-9291-484b-a32a-5347a85297ca", "comment": "Malware payload (Gafgyt)", "value": "86251e02e2e4e6e7a4638401cf5eb15ad2147d12566dc4effbfcc795558bd89e978e698d68ceeb181931d409af3e6922", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653760648, "uuid": "e014a9ef-b072-4438-834f-75e8a2106ec7", "value": "T17B04D71666C3CCEDC053D3B45A8E946A75B1F02F863E503367A1EE903F1DEB1A8A6351", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653760648, "uuid": "c6d34e8d-dadd-49b9-8051-863d78cebc3f", "value": "3072:hH2nm96AP7Zoz3pOPDpp3UbsNAqZBltZxp0ndcHPEGVPUoVJDdX:j9NA34dp3Us3lZ2dcHPEGVPUoVJDdX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653760648, "uuid": "02b3164c-3d68-43a9-9a45-391a54067335", "value": 182769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653760648, "uuid": "1f720f60-b981-43dd-8fd0-b375e4ac97a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653760648, "uuid": "6b15dad8-0cb1-4cda-800d-76692a81a471", "value": "5981567a819fe7a3a8d3765d985b8979", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df226489-dedb-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1653779646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653779646, "uuid": "84ad1ff3-1d72-45ea-9dd0-14b85b46c8c1", "comment": "Malware payload", "value": "e79ffcc3a1d0bfa117f04fda77b2bfec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653779646, "uuid": "f65c07d2-a415-4196-90c7-4d96f343f81d", "comment": "Malware payload", "value": "9f97fdeaa2c81fac2afb2a94616144c0773b5bec316ebc114c8d134eccd84cdc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653779646, "uuid": "9813158c-9658-4a8d-b955-43276e58c5bb", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653779646, "uuid": "12fbe75a-0587-4949-9f7c-2739b5ac7cb8", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653779646, "uuid": "c0bc33ae-f0b8-4c23-8769-c6a21d9b4e85", "value": 3560903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653779646, "uuid": "6a0afbd6-3982-44e8-8ab1-e403a08fcb10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653779646, "uuid": "288adb61-d4cb-4683-b419-309b4d363332", "value": "e79ffcc3a1d0bfa117f04fda77b2bfec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e5ca817-de86-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1653742869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653742869, "uuid": "57ec6fb2-af38-493c-9ced-7161c71b9b35", "comment": "Malware payload (Smoke Loader)", "value": "75347aea4e7f9f0ee16934128a6c84e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653742869, "uuid": "9b0c6edb-6aac-4b5b-970a-03e19188178f", "comment": "Malware payload (Smoke Loader)", "value": "a0f0f0d8d7b7e0c7785ba5acfb5312575869e09def18433e43f1c5763a8ad5f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653742869, "uuid": "8037b623-b38b-44c1-89a9-2a42af94bfd3", "comment": "Malware payload (Smoke Loader)", "value": "6b36a6a763f759e655861c9ef13d19c2be959504", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653742869, "uuid": "07b32cd5-4b75-46e1-aaf0-ecc70d0d5196", "comment": "Malware payload (Smoke Loader)", "value": "c51146d1b2b7127e33e7198ed1f20acb6c37b400ff29d40ed5c8175621885ceced5408f4da22021ac2a3287b206462b3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653742869, "uuid": "59377523-ac99-4e3b-9346-a64d31ba75bd", "value": "T1ED648D10BB90D434F1B716F68D7A97BCB93ABEA15B2441CB62D02AEE56346D0DC3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653742869, "uuid": "2f18d961-aebc-48d5-9d7b-29172696744b", "value": "54ebcb663ea607f54ee2ca56ede30f4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653742869, "uuid": "e094569b-22e4-4760-a1fb-e63dcb954c1f", "value": "6144:k88NUpbDWHOPSd0arAKDxYBtpX87GpCOyYMtpb6xk+:krNUcu6d0asKDgXQGr2J6xk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653742869, "uuid": "e346f70d-c7fa-4b4d-a17a-7e59197bd2d8", "value": 315904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653742869, "uuid": "a5650a9f-1acd-4a96-ae91-bd744cbfd467", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653742869, "uuid": "48b2c3e3-48e8-40ed-b6d0-20e6425bc5f9", "value": "75347aea4e7f9f0ee16934128a6c84e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdd0fcab-deb6-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653763806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763806, "uuid": "db4772ac-e1f6-4290-a6a7-56c681e07388", "comment": "Malware payload", "value": "ccb27a9d82c1449d3faf841d6f9ee35f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763806, "uuid": "d91aeb06-17bf-4539-8ead-4935227e6b53", "comment": "Malware payload", "value": "a19df66b98ada902a0c28618533bd415e567138c32dd994847e97353b842242c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763806, "uuid": "7365563a-b798-4f4f-b4a6-913f618ab28f", "comment": "Malware payload", "value": "d00a0f457df638c56287b1a32ba9d808fb8ab36b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763806, "uuid": "dcbc7f98-84e5-4e29-9a48-9df7cdecba01", "comment": "Malware payload", "value": "1208cf4fd37e2cee219ccbcedefb75f18374e569d8c748cdf5c40c798b012c069b84f2125653bc20d944deef6e7e8da5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763806, "uuid": "9df926d2-4253-4c7e-b359-3f1659d91289", "value": "T132F2F141B6EDCB18C92B207D2CBE3B642912A26E387AC497DAD0D4720DD9B343B36711", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763806, "uuid": "3050df89-5570-431b-8d79-5baa5c12008d", "value": "768:KkJbEX9spashUpcicPZd15Jnxp4a2vcRhEc/nbcuyD7UHQRjX:KkBEX9spaR/cPb1Hnx7Oc/nouy8Hyz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653763806, "uuid": "746f2bec-d477-4ef6-b1b9-f91b740e77ac", "value": 36136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653763806, "uuid": "14d40aa6-683a-4cf1-ab2e-b3c5b51bc984", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763806, "uuid": "fb6306eb-b7e0-4752-8c31-5423c42f4336", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a8d2377-de9c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1653752312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653752312, "uuid": "3f9bc0c2-f254-496d-9e7f-0a278e751e7f", "comment": "Malware payload (Smoke Loader)", "value": "067b775d62d47a22aec1dca74d7548dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653752312, "uuid": "0445cfc1-528c-47cf-9cc7-d8a7cdb27319", "comment": "Malware payload (Smoke Loader)", "value": "a28c97b7b0f34b024adbe4373e13ea9079de7092da978affc34855c3d2bc646c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653752312, "uuid": "39afb3ac-2c7b-4d91-b6b2-d2c40da91e06", "comment": "Malware payload (Smoke Loader)", "value": "e4699d8d04bc7c1f3b88e77fd9c9c39aed402716", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653752312, "uuid": "32cc11b8-8eb9-49eb-b886-a954a931d159", "comment": "Malware payload (Smoke Loader)", "value": "7d1c61832a473a7a2695b88773b4412bb0e738af9433500d20bc080960cfd3d14b0fc44851be0368823bd949cd36b9d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653752312, "uuid": "3317bf78-078b-4eff-bbbd-620532a0f6d5", "value": "T1BA647D107B90D035F1B712F849BB836CAA3ABDE15F2441CB62D46AEE56346E0EC3175B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653752312, "uuid": "d214b5bb-5ef4-464a-a83e-b428817f7d96", "value": "54ebcb663ea607f54ee2ca56ede30f4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653752312, "uuid": "d949a33c-6caf-4de2-a626-90bb256cb13e", "value": "6144:RCNB5DUCw+v1L0HrzS6GI1GpCb49mplS0n/H6K:INBBt9L0H/S6kCUIlSA/H6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653752312, "uuid": "6a3583f3-997a-423d-9a9c-179ab50b763d", "value": 315904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653752312, "uuid": "346903a4-0632-4170-b851-3cb9146ab68c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653752312, "uuid": "34358217-93e1-44fc-94f7-99e954f54e4c", "value": "SecuriteInfo.com.TrojanSpy_Raccoon_July_28.13459.15108", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfe4fa12-de9b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653752159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653752159, "uuid": "ebda56bd-6ef7-4325-ba43-1b064ef97bc8", "comment": "Malware payload", "value": "c121e40f3d4bc432580d39c4f228c3e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653752159, "uuid": "a2c82972-9713-49f8-aa68-03670657c5af", "comment": "Malware payload", "value": "a33cdcb674fc729b7bc47a93e0cbe92ee34937d9fc76c6a3a49cfa682dcaa094", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653752159, "uuid": "908099b3-c256-44aa-9b0d-2df730757fc0", "comment": "Malware payload", "value": "6403f0d985c62c9c03a54c9cebbfd618b3ddc091", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653752159, "uuid": "9299988a-c87e-4086-8361-96e889cd2bab", "comment": "Malware payload", "value": "a6d76db7844835dcffcbb8311fca6888d8c7598c2778977720175dc8496699c192890c024d407bfa4222c4de7b7c8c01", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653752159, "uuid": "e0a438a3-3c54-441c-99ff-da2ba9ec1eed", "value": "T155850180BED4CCADE5A50478CB60665CD9ADFC63FF9946CE6310C92BD8F5082693B19C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653752159, "uuid": "efeab64f-7d71-4444-9118-416b6a0b5350", "value": "033fc3209214566af0e06e5863a94256", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653752159, "uuid": "4aef4190-9b93-4bb2-9620-884e0ea51a1a", "value": "49152:/eZBYBfJXAEirULUPwBTZddNv6NKRkNPyafN2mguUH+:/eZBYBfKEnoPsH1gGGL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653752159, "uuid": "b369aa1f-830c-4e73-9251-ed540605740d", "value": 1781738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653752159, "uuid": "7f6a6c0c-263c-40bc-9233-52f189421050", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653752159, "uuid": "5b83c916-c9a2-4ff8-a408-1bd8c4f91f07", "value": "c121e40f3d4bc432580d39c4f228c3e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "164ca0ef-de36-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653708442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653708442, "uuid": "211a666b-e5fe-45a4-8ad8-59a0ffc17ec3", "comment": "Malware payload (Mirai)", "value": "0fdd25bc35400395be100ccb8fac9c4f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653708442, "uuid": "a0712d8c-5ebc-4ce3-9878-8236ba63561d", "comment": "Malware payload (Mirai)", "value": "a638bb09c91a9e2b9929471617e9d7efef5bd9c2888cd02c0ab5a71896436dd4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653708442, "uuid": "d1e3fce5-7d7b-4d8b-8cfb-c0a7e04c5079", "comment": "Malware payload (Mirai)", "value": "83277bda9acdfd444e2161c828d705d2ad3b6354", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653708442, "uuid": "50caa554-38bf-48cb-89fc-63d6271061f7", "comment": "Malware payload (Mirai)", "value": "bae4d66e63ba285f65d6aa32e9f4d9330267e6847638ff2d595c0b9f1cb9b44df7205279f5e0bec8474c930c8213c2fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653708442, "uuid": "591a01b2-d1e4-4f8f-8851-1af7aa89b9a6", "value": "T16733F2719729ECB2CF50C86A7D7317C6720104A6F08833E735650F9A2AFA566E4AD8C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653708442, "uuid": "50aca6a8-87b3-4cd6-97c1-f3cf10b4122c", "value": "768:KQUpsIcqm0/tGY20uDo/SMSuF5k2p9BB99URcfK28Hu9q3UELt41140ORu5u5rg5:xIc/ez/SMSufkKEcgL6114phBLVI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653708442, "uuid": "78d7259a-4cb0-40f6-89bb-211759312b68", "value": 53556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653708442, "uuid": "3287eb04-822d-47f5-9dea-ffec306a0e09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653708442, "uuid": "4b5f1078-d53b-4956-b39d-50aa1a51132e", "value": "0fdd25bc35400395be100ccb8fac9c4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63573cd0-debb-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1653765694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653765694, "uuid": "1f5cfbff-f43d-4459-be7d-5e0e1f5e56e0", "comment": "Malware payload (DCRat)", "value": "5b0e00b40c0312a5bb8c81fa84dbddde", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653765694, "uuid": "802a4653-d4ca-45d4-98dc-46b1d1a8b462", "comment": "Malware payload (DCRat)", "value": "af4a48fb863f2812485bf16b163f3a38356777a5c9dca00c944c65655912d47b", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653765694, "uuid": "b8428511-5258-4f8f-b973-95d7ed481d43", "comment": "Malware payload (DCRat)", "value": "2a8ddb21cf86792798d21812d005577675cd0728", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653765694, "uuid": "b71e8e82-d40f-45a6-ae59-08c03cb5a7cc", "comment": "Malware payload (DCRat)", "value": "6e8d48fb54ac6daeb1a201947c3bb4cf3c723a3d7e126da3ddb9b60230e82d9f8cb90af04997be3d2c13096f759461e7", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653765694, "uuid": "d36e05f2-f668-4da9-8967-e53f6e4704a8", "value": "T1992528027A44DA01D0BB1737C6EF445443A8AD417AA2E72E7EAF33BD25613A71D0E5CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653765694, "uuid": "89a475b8-d2dc-47f3-9ea1-57c331a334d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653765694, "uuid": "a2f1091f-bb66-4a55-b0c2-41ba9e4f1225", "value": "24576:sS9t7z7EzOUN4pIw8+Q/TgY2U6jYoUf9DT:5zSzn7/TgU6U/f9D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653765694, "uuid": "ff35b2a3-150f-40c3-9bb3-42e83979f8f6", "value": 1020416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653765694, "uuid": "e54a115b-0a30-4877-a533-82e0ea07091e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653765694, "uuid": "91b94039-0041-45b8-a567-ab4659823d16", "value": "AF4A48FB863F2812485BF16B163F3A38356777A5C9DCA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d9bfc28-debf-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653767403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653767403, "uuid": "7675836e-f022-49ec-99a2-f246fd5e9748", "comment": "Malware payload", "value": "f80c76db79c0c63dd037eeb23804c7e3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653767403, "uuid": "9a81dbff-36db-4231-9fdb-fa7d98a11a13", "comment": "Malware payload", "value": "afcb4ae25ecf05950dfe855c60a3919473e0f6164257cca351e28045d0275aba", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653767403, "uuid": "f67aef65-5495-4e08-9c5c-52dd0037e63b", "comment": "Malware payload", "value": "b2025eee7935a1f68096858ffe913f49c937d555", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653767403, "uuid": "352fb822-9d38-4a76-8fe2-56aa5fa40b0d", "comment": "Malware payload", "value": "ee0947591bbf3e90079d761995592718881a9e40aa163934061627428036e737d727a27a92824900b947899488b589c7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653767403, "uuid": "01da9e47-daeb-4865-bf2e-d75c5cbb215e", "value": "T126430270623C5BB8887108350D78C5E1787FCFDCA6B623365BD9AD5D448330A5FAAE92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653767403, "uuid": "15821217-ca2c-4af9-880e-fcbf8026b5b2", "value": "1536:7vyZEjG1y9dC+oVzshkOeYWSkCKnbNWCcM8RLsg5t8ywOxxR:7m+G1yBqYJaTcNL9tNwOB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653767403, "uuid": "49d4f700-e9e0-43f4-acd7-3b6c4b6e1855", "value": 57356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653767403, "uuid": "32bc3fb9-1613-40d3-b202-1e67cff450a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653767403, "uuid": "acf46b82-a71d-4fca-8b98-ea938fc220f4", "value": "b3astmode.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa3ba642-deb7-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653764230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653764230, "uuid": "79b600f6-9933-453d-9173-2b7a159c104d", "comment": "Malware payload", "value": "d09abf7df9d86c6126178fb15a22e922", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653764230, "uuid": "012d56b4-8aa7-4ef5-b568-07abb3cb2099", "comment": "Malware payload", "value": "b0560a870fce156bc5a06e001488c5bf620c95b64e312caaedc8761db20133e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653764230, "uuid": "66da5166-a65a-40e1-9da5-3b1926dbeb98", "comment": "Malware payload", "value": "a28cf4fa1df4bf2a072fa670b4a7ec3c5bfb9013", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653764230, "uuid": "731f49e2-c57c-4c8a-9393-bb59f07b59a1", "comment": "Malware payload", "value": "dd7b0cbad861e956d1d171ab7c71de46188d240114ff3d8387ae89aaf2b82910dffcdb7940fe807f957f7d504ba707a0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653764230, "uuid": "7e50739d-ecab-4fa0-bbda-e8067f375cf3", "value": "T10813E124F0814CAEEF9E99703493E7D19BA4B757F51A8E14228DF982427742BC600DE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653764230, "uuid": "331e34f7-cf3e-4f78-8037-7dc1e681bfac", "value": "768:H0VGwr7E+m0qXq11kmp/zLzCN2fgzhOTVt8690o73iNL04uVcqgw09Z:H0VGMANjXqzkEDvfJB195A04u+qgw09Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653764230, "uuid": "e06080b4-3cb2-40a5-b5a2-6626815a764c", "value": 43168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653764230, "uuid": "fd217ff7-1e2d-4abc-8641-544be5b3dba5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653764230, "uuid": "1c88270c-4c9b-4082-bb7d-8b6221c5c8f0", "value": "d09abf7df9d86c6126178fb15a22e922", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e53c765f-de64-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653728546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653728546, "uuid": "ea9c4c8a-85b8-4618-bbca-681194876b7d", "comment": "Malware payload (Mirai)", "value": "06a85d08742389babb5ea995e1762a4c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653728546, "uuid": "7a8f256e-3f22-4bd5-8fbf-570e221ef863", "comment": "Malware payload (Mirai)", "value": "b1dd476bd87acb42dad1e9244b398bb66e86b336e4e03059c97c72b4d42d9d8a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653728546, "uuid": "06747122-d312-46f0-8f77-c67f93047f7a", "comment": "Malware payload (Mirai)", "value": "b4d5e81d71b05aa2485e26ae85586e1c3e1795ae", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653728546, "uuid": "841e681b-c856-4b72-8901-54c4acf97ec6", "comment": "Malware payload (Mirai)", "value": "881f2e2fb10adcfd3ccfc8fd196ea6ec1f61e6b5d34ded5c33931903622a7ed77a20ef63a551101afc9d60c8150888cc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653728546, "uuid": "99d724ef-6948-47bc-8833-5f5b7718f748", "value": "T183E229C2D502E9F5ED1106F010679BA6DF71A53A7A25EB8BF3A93725BC03710660339D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653728546, "uuid": "355d79e3-9af0-4c1a-96f8-287bfbda8e5a", "value": "768:TgY7YJjK9xXcSvVoHKodi/oh/iOBNN3u/rI+x7EEU:L7YJ+N5VkKsi8/iw3WrIg7EE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653728546, "uuid": "ec32ba91-1421-4167-a158-8fd88c74f93f", "value": 33712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653728546, "uuid": "845b9ca4-68bb-4cce-83ee-d2c93940363b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653728546, "uuid": "908df104-2447-414d-b6fd-bf5d151cc756", "value": "miori.i6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4e92750-deb6-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653763737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763737, "uuid": "9b84ad95-50f2-47ef-b45f-0584473e0ecb", "comment": "Malware payload", "value": "0c18ab8c7fa80a7b439234cc898ede6f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763737, "uuid": "e5bbf360-a867-4e56-a1f9-f3040bf28a33", "comment": "Malware payload", "value": "b22032ca35344cd0ad1447ef6393b63b8e12fa97a720585080dbf887477a5ae3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763737, "uuid": "adfb5f0b-5f19-4949-af02-1c0376669ceb", "comment": "Malware payload", "value": "aec23298eb1355fc9ed2235f4dc3301ed45c750a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763737, "uuid": "aa9abe2c-3779-4141-9f4b-9e1aa4173130", "comment": "Malware payload", "value": "f71f4c3760b3428ae346e0c6ebb54dedc327e2f8771a61e9db432bd82092260f02ea325259d24ebec630a430cc7aca48", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763737, "uuid": "15d52d86-36e3-415f-a750-0dda4d195132", "value": "T1D673821ABFA15EF7E89FDC378AA91B4934DC501B21993B75B930D428B64B14F44E38B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763737, "uuid": "cd4d0667-ab74-4eca-90ee-f4918152c0df", "value": "1536:/MqduGFdwxv1k9wg6B3rSPGWypJm3RKZW+7CT1:/3duGFdwxv1P9SbRK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653763737, "uuid": "e7c0656f-7928-4bf4-a3bf-97c2c2bba534", "value": 75872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653763737, "uuid": "b09e8f43-0ae1-4c3d-b745-35e5cbab2b19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763737, "uuid": "eae295ca-956b-4813-b57f-caec27d3f53a", "value": "0c18ab8c7fa80a7b439234cc898ede6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e38bea77-dea9-11ec-8e58-42010a9c0032", "comment": "Malware payload (NetSupport)", "timestamp": 1653758179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653758179, "uuid": "b7b0bf9c-78b0-4dab-8d10-bbf3d5d30850", "comment": "Malware payload (NetSupport)", "value": "06e59bcca37006851032f99abfdc6918", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653758179, "uuid": "7937a051-5052-4f7d-bc9f-71d5bfc3f9a1", "comment": "Malware payload (NetSupport)", "value": "b238491cbf41c1927953a5907b8e1782375602e5a6b62d32dc686fd8e866f421", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653758179, "uuid": "13e82edd-54cb-490b-bfe4-9992d7242fc4", "comment": "Malware payload (NetSupport)", "value": "7fe98e503bf6bb4f2104c15f86b02880ec112fc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653758179, "uuid": "27d68ca8-974c-476c-bd67-5a2cab0fd41e", "comment": "Malware payload (NetSupport)", "value": "2841319a0173d6ffa30a1df122dfe2b5b0f59f87be5a179f552fe91c9391700a4b5e6231405a38c77a681614699e2b38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653758179, "uuid": "bdcd2c1c-0105-4ed9-91b0-055102191039", "value": "T13EC52311F3C825BAC8294B70CDA6D534C37B3D746AB8E40DBB86372F75B19268297B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653758179, "uuid": "8918613f-c703-47b5-bd30-33ed7b015c00", "value": "bf8e93937f9e7494ce0335cf5d059356", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653758179, "uuid": "cb5e434a-974b-476a-90d8-fcc3d7174c60", "value": "49152:/yrIitxv7IehafNELosmBMRdBmmnQI2KlDF+eXU/sJCKeZxEzhReGS:/yrXxTvhalEomDRdq0JWQjpS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653758179, "uuid": "9c3522d4-76e4-446e-a105-dba901352a78", "value": 2660415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653758179, "uuid": "32256ea6-4151-412d-a14e-0b1da8778015", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653758179, "uuid": "9a5b6c66-5955-415f-9f5f-ac5352d04452", "value": "06e59bcca37006851032f99abfdc6918.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78874b42-de60-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653726646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653726646, "uuid": "c58edc89-ab2c-4b3e-88ba-3c90820081e2", "comment": "Malware payload", "value": "276f0bff3b47ad67817a6595ced67a0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653726646, "uuid": "7d734606-2428-4500-9e9d-24c3925eb5bb", "comment": "Malware payload", "value": "b3bed1dd25d3031b2d951cab09c87524e022c3cae334e627e26b68e7fb7b9770", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653726646, "uuid": "88aa99f7-05e3-4563-96a0-1e0ff1311a4f", "comment": "Malware payload", "value": "6cc48bf27e52c9b300e9ed7da7430bce605418e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653726646, "uuid": "8b3e7cb0-118e-4313-bc82-dd2ec873fb9e", "comment": "Malware payload", "value": "039078a44f661f45113cddab3df250f32cd4877ae27a034cc6b59d41be5eb8102d51f02d92213aa1012c1ec098202db1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653726646, "uuid": "ade8662c-8b24-4176-a2bc-6babf1bf24b5", "value": "T1FE163328FE3801F9DB7D447211742041F7E07BB5A77D4A9452EFC4A859B62B2EA2CF81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653726646, "uuid": "4362c239-cb65-42db-90c1-09576a26aa65", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653726646, "uuid": "3a1bbceb-a099-4ce1-9bf3-f0a124a6e357", "value": "98304:rhNtIpB8Y9lrTto00oMnsaICWbFGZdUfdVI7AM8kCBqMBrIbP3W7:EBjDTd0Qa0FGZdUVVvdBrIj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653726646, "uuid": "eb9b3c2f-0c74-4dfa-80a5-ae21bbcd3434", "value": 4222464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653726646, "uuid": "2f70465a-ca9b-4581-8c25-aa772d98e8a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653726646, "uuid": "93576379-c212-428f-b403-997e26430fe6", "value": "SecuriteInfo.com.Trojan.GenericKDZ.87756.5390.19518", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a35856a8-de52-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1653720705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653720705, "uuid": "1e303096-4424-43f0-aac2-867d8fa2f5fe", "comment": "Malware payload (Loki)", "value": "ef36a5b4ab6cfc60657a8d3202c73ff6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653720705, "uuid": "f6865e8e-b9d8-428b-a9c3-c34341a31495", "comment": "Malware payload (Loki)", "value": "b4af4fff61cf428f03cfe550f759d56a6a6a9922aaf00f9954e5fb33c78da476", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653720705, "uuid": "28cc50d9-5496-4618-8295-c1fe3da391f0", "comment": "Malware payload (Loki)", "value": "2aaec95b89491eaa55e4e055429d5e75cdbbca39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653720705, "uuid": "4b9431b1-8a12-4797-8097-4ecd7597b056", "comment": "Malware payload (Loki)", "value": "3450e04e9ec71fc1e3be5792428fdde2eebc9f358479e6acf89c292eda91a34b791859d31b442bb15fe6cabbd967ba11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653720705, "uuid": "afd76101-c03b-46af-b453-81e8c0ed509b", "value": "T1DED40249ABC142D4D869063B4DB3B7247F01BBA2806B9F2F5C93345D9A26BC21EF11DC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653720705, "uuid": "7a597b02-794f-44da-96c0-1f10bba59a73", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653720705, "uuid": "9a5e1f45-023a-4b7a-a195-341340f93836", "value": "12288:lwH22qla5w/yXbxF0lS9tcl2+v0tw/yw9Hxn0ZS7DBWAIMwsbGzKLiR:lwH0MW/IbxF0lSzCcS//Hxn0ZSB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653720705, "uuid": "20efb062-c487-4094-b1ef-d6e6f3d4a8b7", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653720705, "uuid": "7274ff96-aa1a-4aed-9c33-d7be4fe75136", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653720705, "uuid": "ad4821de-7e16-4ef6-989e-fdb3a55a79cd", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eef23ac9-deac-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1653759486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653759486, "uuid": "a3360af7-46b1-49e4-8879-1d016245a2ac", "comment": "Malware payload (Smoke Loader)", "value": "e2af21fe5a4edde508b88163a5023ee1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653759486, "uuid": "6de7b287-2f42-4de4-9172-ba1e24ae35a6", "comment": "Malware payload (Smoke Loader)", "value": "b5636b53b9e9a38ad7f7680d3ba39094907f73ac7b58a0c8adfb787b86245cb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653759486, "uuid": "e3b0241d-7989-495e-bb38-6e1e3c68af1d", "comment": "Malware payload (Smoke Loader)", "value": "e6176da3a1763b48f4a51e0c8ff6d3cae6089cdc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653759486, "uuid": "98c667cb-863d-44e1-8a0e-9280f7d3b050", "comment": "Malware payload (Smoke Loader)", "value": "dffc366916df8ee58b7dc2094840df0faa1157fb0979f8e558b9398d204802d7b961f18e0bb1579bc1a9798a50ed9f1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653759486, "uuid": "7dd05790-d5f6-4e5a-af9f-d70a9fa7ba56", "value": "T113647C107B90DC35F2B732F449BA8A68B93AFDA16B2441CB62D43AEE56346D0DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653759486, "uuid": "89c05f2a-ff3f-48bd-a8d1-6493f2dba637", "value": "54ebcb663ea607f54ee2ca56ede30f4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653759486, "uuid": "a716ad3b-a5d6-41fb-bb26-fa27af109ddb", "value": "6144:x3Nq5rUm0+v1F04rHpWFnI0LpeuLmdvPfEmjsRWsb:tNqFJ9F04LpWF9eyMEEsRv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653759486, "uuid": "8b31c4cc-19f5-49d3-b477-1f206e9d806e", "value": 315392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653759486, "uuid": "42f47168-452d-4a4a-a853-99a07cfe5627", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653759486, "uuid": "b338b985-f4e9-450c-8b37-e6994521d6b1", "value": "SecuriteInfo.com.TrojanSpy_Raccoon_July_28.12185.5526", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bee072fb-deb6-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653763700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763700, "uuid": "ce83031f-4886-47be-8aca-a6b3b985241c", "comment": "Malware payload", "value": "1981f83281c01295567a1ff3045ca6af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763700, "uuid": "9b8b48cd-0cdc-4687-bcf2-5debc63d59a7", "comment": "Malware payload", "value": "b5aa63398885653cb04bddf09f6a1134dc1afe26f72cddebf8615364e4202a8e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763700, "uuid": "be646a5c-b2b7-47aa-bd11-cf346657bbc6", "comment": "Malware payload", "value": "48c83baaf2cf3a1fa59dbcd69182288c249ea28e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763700, "uuid": "a70f452b-cfbe-4ec8-a7dd-0aec7fde8368", "comment": "Malware payload", "value": "c8c03622f6704fd70d975dbf08c65cdcda65d79b501c77bc72b5fb36e84ab085ee82102f5482f7a86357f7bec6ff4544", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763700, "uuid": "d279453f-e8cb-4e3c-a5e1-9f0e5aa60a96", "value": "T1DAE34C46EA418E13C4D5277ABAAF42493323A764D3DB33069D186FB43FC6B5E0E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763700, "uuid": "1e9caad5-77e1-467f-b2ff-042a234c9d2d", "value": "3072:plui7CTwBWdAix2Sds/PUP324DgZ6rUtG80hM/9zT7D:plui7CTuPSWHUP324DU6oG8eM/937D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653763700, "uuid": "a765a144-696f-4aa6-8610-8f29c93bb07f", "value": 144120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653763700, "uuid": "60b96959-ca56-415f-bd95-7ac3c11b91aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763700, "uuid": "73a4cf1d-86eb-4a2c-806a-a34c5078bb26", "value": "1981f83281c01295567a1ff3045ca6af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbf6458f-deaf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1653760689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653760689, "uuid": "80583bf5-05f2-40a3-a7f1-ad0e6b2ada99", "comment": "Malware payload (Gafgyt)", "value": "79d01d52ebdfcb87bc5ede4f93f1e674", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653760689, "uuid": "29a12df1-6f3e-4117-a891-96f8d0ca8279", "comment": "Malware payload (Gafgyt)", "value": "b8287aa7ea121ac35c8265d732ad18e2175694c28f834bb505bef50e832390b5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653760689, "uuid": "c53988cf-d8f5-42cb-b106-5321e6084ddf", "comment": "Malware payload (Gafgyt)", "value": "6e67ccf9f812951d5a7d3cd427086a070ddcc901", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653760689, "uuid": "497ac060-4812-414b-8694-0d0f20b8c819", "comment": "Malware payload (Gafgyt)", "value": "b6d4ff22c551ddc32b6af33975e86788ba0bc89d6a55ba729a896835eafad3813acf6d6141bfc74b5be41ec3e2c3e521", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653760689, "uuid": "bc66c134-8c70-4ec4-9d41-fe1261671958", "value": "T15A34307E2A619B3DD294D7700BF27EF0C2A654A322A2D3A1D23DD6541F7434E0E6F660", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653760689, "uuid": "aad822ef-4fb3-4048-ac88-b1d3e2beb78d", "value": "3072:C2KtBDmSG5uqf929FriJShSalQxr7R/WUqHEgTOGX:bOyDL09uShS97R/WUqHEgTOGX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653760689, "uuid": "1bdc3637-4d46-43c2-86e8-4cc16eb12d2e", "value": 249013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653760689, "uuid": "960da1d2-325d-4f03-b306-2833c210aea5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653760689, "uuid": "8eede3e1-fea3-4f73-973e-bb1228029e5b", "value": "79d01d52ebdfcb87bc5ede4f93f1e674", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8381cf1-deb7-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653764199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653764199, "uuid": "fa887add-a4fa-4bdc-87a1-98cb370f83fd", "comment": "Malware payload (Mirai)", "value": "476773315b7820987f80cfc4806117ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653764199, "uuid": "306c27d1-ed7c-45e2-85ff-4c62a059c42a", "comment": "Malware payload (Mirai)", "value": "b922275e1d3518e812c3531c521a563b6e67e8f23d8f139508af8c36f354e739", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653764199, "uuid": "2f255122-4bd7-488b-a69e-b8ed0f470c70", "comment": "Malware payload (Mirai)", "value": "8824d6e509b4f8040e22c9fb7cb276bc5e528b31", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653764199, "uuid": "29c2fde2-e45f-48f0-a7f8-286c5363f02b", "comment": "Malware payload (Mirai)", "value": "2b0731d3dd0c6f8c80b418767ec81982ee868f869981b67e01e44d660e418fe6a3bdb1cdc6dc66d597810c5bb1528a21", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653764199, "uuid": "84b50658-d7aa-40d7-bfe7-6dad5e00e3d2", "value": "T14223F118B78BFDB3E5B0043E8D4B418B9AD546A553ED303F40E4A19CA99EC673AEC447", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653764199, "uuid": "4b0ab462-74f1-41e0-9a5a-f78598f22f74", "value": "768:AaXUTdiIcQOY8S8WsLsu0FGMm37xfppnE4VS4Go15sTE04UfQj3kPgt/T9q3UELY:zofZ8bOFGMm3tfgMD15r04Njlt/SLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653764199, "uuid": "ccc6ce8a-89e3-491b-8462-7e0a8f8552bf", "value": 48396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653764199, "uuid": "5c144be3-7a32-4afe-9b8a-65df1158e68d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653764199, "uuid": "27b6a3b9-ffbe-4f4d-b0a1-20931768e31c", "value": "476773315b7820987f80cfc4806117ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a9e585c-de99-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653750969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653750969, "uuid": "782c0a01-076b-489f-8a02-ba5c1f67347d", "comment": "Malware payload", "value": "e387adfe154d03ee693acbaf9837ef29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653750969, "uuid": "00959b03-687c-4077-87ef-332acde94f87", "comment": "Malware payload", "value": "bd494dfedf054b84755ca974106405ae6ed49555f931e542b18d92fb1caa567f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653750969, "uuid": "315462ee-b8ec-43c3-b4e3-4c86de5ed7d5", "comment": "Malware payload", "value": "bccf1709659919e80db36f07269ce04767324572", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653750969, "uuid": "db4262e1-e851-468f-969a-169346d3202e", "comment": "Malware payload", "value": "f755961a7b0232d0d074d9ad6b896059c0d37cb0707f8c256c5fb92ae74ba8feadde5b352473484fb97a74d4b3560f9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653750969, "uuid": "e2b89f2a-a429-40c7-90b4-f1a6ebd7a737", "value": "T1E38412162AB79633F11140719BE4D7D88AFD3E2BB516DC4FFB0C2A5823A3A441A81777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653750969, "uuid": "0730cdbd-49e1-48e1-b240-f22846c18d0b", "value": "6715d450ebf6ee95bf798a46601f6874", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653750969, "uuid": "318430a1-7322-4ee4-862e-ed0efa049922", "value": "12288:Z9Zox8a9XqSYVr9N4VxTZmAegx+nir2KGACr/5tz1eH:Z9rs50MPXr2RACr0H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653750969, "uuid": "5be85b13-3184-446c-8add-7ec93a59ec92", "value": 405504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653750969, "uuid": "7cdcca1b-f961-4137-8382-72f5d0eb73e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653750969, "uuid": "e18a65cb-8e2b-45e7-86bb-6622cadcf79c", "value": "e387adfe154d03ee693acbaf9837ef29.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "102b0ed6-dea7-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653756965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653756965, "uuid": "2c9ed2fe-1665-42ab-b80c-31c5e58b3ae8", "comment": "Malware payload", "value": "f6f4aaa05472edd8ae7ddd75b37fd957", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653756965, "uuid": "2a3f4778-c4b9-4b12-88c2-f054b6bd10c1", "comment": "Malware payload", "value": "bd95e05f1864f36e1e59c0ad6b1956cfd5a00a3fa884b2833d777f12639ee9a9", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653756965, "uuid": "613d0359-d50c-4dc4-8994-9198fee5238d", "comment": "Malware payload", "value": "42928fe5534a14a76177b11c606577788d67cbb6", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653756965, "uuid": "72046235-c9fd-4950-8385-f06b2b8f6e43", "comment": "Malware payload", "value": "6d728467bd143ac8aab399f35b11f3030e2140302f815b31576204f2c96f94bbc1197c2026ab2eadf436f48342b453bf", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653756965, "uuid": "7c18bc2f-d846-492b-8aa4-43046124f7f2", "value": "T168B5F193E346A87FC5F7C33A46B9072A85574C668747D3938A75B33C2DBB9C04A81B84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653756965, "uuid": "808f3858-482c-4df5-b5a6-7b3464a36e0a", "value": "24576:Xa+oRB+wqlkWTHOX2kTbIj44QL8NyLpiGras2BrJZ5IB431D1VC3zz4qpb0vETqX:sqlV1dj4t4y9iGOp75Q4315V+zz4o0TB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653756965, "uuid": "a97ca25d-3a8c-491a-8289-6b2f7f7bf2ac", "value": 2309714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653756965, "uuid": "58fadaa0-e208-4415-acaa-723a44f48d02", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653756965, "uuid": "01706c54-e346-4f18-b1df-ee0d78aef631", "value": "base.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1298f07-de99-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1653751195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653751195, "uuid": "dd79f046-3f23-46f0-a675-4f2a68523e2f", "comment": "Malware payload (RedLineStealer)", "value": "c1a9d4018b69245d3c2ac4c013505239", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653751195, "uuid": "9334132a-0c7c-4b60-87e2-59eaa274a06e", "comment": "Malware payload (RedLineStealer)", "value": "be6799c041af7c7ce8529b5ed33d1bff739924f63d4bfc754bc11813978c770b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653751195, "uuid": "98fdcd93-bbef-4a58-a687-61f48e551f61", "comment": "Malware payload (RedLineStealer)", "value": "782d2666aba1ed0cf31f61921260e0e1bfa20f5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653751195, "uuid": "3183b0fd-17fb-4e6e-865c-e18192661b63", "comment": "Malware payload (RedLineStealer)", "value": "8bd3d9025f56b0ccad856ae537af6c6e1179ea9b15de046dbb484cdb4296357b0654d4e8c5a099b4a1238d0a56f3af8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653751195, "uuid": "4e8bf7eb-a6c6-4a25-bc2d-e3f4fe89495f", "value": "T1F3849E107B90D436F1B716F48976C3A8B52A7DA19B2462EB52D43AEE6A347D0FC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653751195, "uuid": "c72f7fd4-349a-4ae5-bb9f-198544e14947", "value": "c5df5f515f76bb815fad87fade1c304d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653751195, "uuid": "ee259e27-4b8f-45e0-a267-ca7903afc885", "value": "6144:FFa7uq4Ro1klIx3GU8loxortPdwlXShytcw3017S5tIl5t:va7yo1hJGU8Kxotd8Xg+5K3t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653751195, "uuid": "4d4ae536-b326-44f7-b3a3-e3b02a1502d9", "value": 384512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653751195, "uuid": "633eb779-0300-4c29-b2d8-b0807cf93d6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653751195, "uuid": "8b76b325-33cc-42ad-8d18-866d55917932", "value": "c1a9d4018b69245d3c2ac4c013505239.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feebc56c-deb6-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653763808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763808, "uuid": "2629e94c-9f9f-4cd2-9f14-383355bb8cb3", "comment": "Malware payload", "value": "bbcacbf2c1c6297ebe491009251201e0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763808, "uuid": "0f6d8702-c29e-4f7a-afb9-ca5cac25f4bf", "comment": "Malware payload", "value": "be754e62eb83af0521494f3d948f3eb6f06a6bf99b1a7ba01b3f4ac42fb6191b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763808, "uuid": "69ecae37-26b2-4472-920f-f95cf0a3f5b2", "comment": "Malware payload", "value": "42399558ab27bafaa857627f2b82c15fe0a5730a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763808, "uuid": "be2d3df0-95d3-468a-bcc7-5d645c4c4f05", "comment": "Malware payload", "value": "19dc72e6b5df85c9780287e648c6b92e41c10629922a2d6bfcee9ce200481c7f239513c78d6955109fb57effd2977d31", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763808, "uuid": "0a704eaf-7454-4981-9afb-a1667075b8c8", "value": "T1AE13F17185E175B0EB348FB4F6EEE9562B32816E72E2312239E0F66175E0C45ABF0447", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763808, "uuid": "21dd92c6-4fa3-4312-b170-76d820dee776", "value": "768:GlbZ+hyocv1nXdZu+5pOzr6wITH6fUfKWeRujcy8NSFt1s3Uozq:G9NNXdrpOy3THkS5muj1Ft4zq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653763808, "uuid": "7aba6fa1-6b1a-414f-82a9-a24b9da5b796", "value": 43984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653763808, "uuid": "bcc0a712-c448-4cbc-8eea-9e5d2cfbcbaf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763808, "uuid": "baa049d0-49cd-49a8-ac44-d8aeabaedb19", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a23a597d-dea9-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653758069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653758069, "uuid": "224f5f77-b45c-4520-abf4-059dc8718b3a", "comment": "Malware payload", "value": "57e79f7df13c0cb01910d0c688fcd296", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653758069, "uuid": "e7a7a5a1-bc6b-412b-bb1b-75a730ce93b1", "comment": "Malware payload", "value": "c23039cf2f859e659e59ec362277321fbcdac680e6d9bc93fc03c8971333c25e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653758069, "uuid": "3edaf0b3-f737-42e6-bfcb-2b6ea5c08a2b", "comment": "Malware payload", "value": "72dc23f99bc6192f6ccfc8456a76eff00adc9700", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653758069, "uuid": "48868902-c3ad-4b47-89b0-57a973bea558", "comment": "Malware payload", "value": "75c902a393ac4e837d4a682421b396b620ef69dda83314eff5e09797e4a4fa35c3fc613fc8acfbeccefa824759fa280b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653758069, "uuid": "e0fdaa6a-01f1-4a42-86f0-1b87c397d59e", "value": "T1E1520A432ACC08F3D7C201B66A7DAB22DFF9DA2979399ED78B9409D83C76AD0D111705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653758069, "uuid": "b3f0ecfb-5dbe-4c68-9fec-ccac3ec17e6b", "value": "ed5c4713532f9db4da309093c51e1e71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653758069, "uuid": "c027d2c3-f0a8-4557-83e0-89b759cd1cf8", "value": "192:atM4PNAjfK0jbbRClEw8CmwxvsENQsPQUeqsP1oyng6Lu4/JxxfnDsPsVL2:atTFiK0tCNmcvsEexUa1JLu2Jxnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653758069, "uuid": "aec89ac3-2724-49f1-9c87-8a32c0817262", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653758069, "uuid": "73c91743-d25d-4695-b307-55a882b9e91f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653758069, "uuid": "758bfd3e-fe22-4616-957d-4bcada41b0af", "value": "webc2-greencat-2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce3e1f10-deb6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653763726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763726, "uuid": "a9c2fa54-8a6c-456c-a668-9d07f0ce2102", "comment": "Malware payload (Mirai)", "value": "05ad3a9540471d3a73fe9ca0f8443b3c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763726, "uuid": "85263a19-2e88-4d27-a075-d56737d7caf4", "comment": "Malware payload (Mirai)", "value": "c42a9857684efa58f60fd497fdb40126a269214f2005cbc01cbfc25968a837eb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763726, "uuid": "29f09da1-bdb5-4f66-a5a3-9b954c7a3872", "comment": "Malware payload (Mirai)", "value": "c320ae42e326110eecb97ebda80853de81cb446e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763726, "uuid": "f12f11a9-fcdb-4422-adca-56b5b50be142", "comment": "Malware payload (Mirai)", "value": "61c590586bb6e945baaba8c316f0cfc84b9e3743bb792fa4a0ab94ffc4767f6026f8f276d24a995e5a5b1372841ba957", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763726, "uuid": "188b035b-fd1f-4580-8eec-dd583a730ebe", "value": "T1B2635BD5B401AE7CFA5FEABE84214A0DB531B74051A30F3BA7A7FC936C721A49816D42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763726, "uuid": "0ccbde53-21b0-4264-bfc8-c147fa13d4e1", "value": "1536:8i0W0YSxyvvEZve6FwNY8NUuVMFyyQR3gggTqC8Ask:SxyvvEBeCR82uaUPfg2nk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653763726, "uuid": "aea9c3c7-0205-453e-89df-c3a0519a62db", "value": 67592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653763726, "uuid": "14cb0a5d-0def-4ee6-a506-b2c7dad830aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763726, "uuid": "ecc8ae15-273e-4fb7-8fd8-4cc8d366628a", "value": "05ad3a9540471d3a73fe9ca0f8443b3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30473173-de4e-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1653718794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653718794, "uuid": "9f5e0630-1137-4823-84f2-f9a3cfc18a04", "comment": "Malware payload (AveMariaRAT)", "value": "873bf5a907923c2cd44f77d0eb1795a9", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653718794, "uuid": "885269c5-e173-4743-a250-8e861d0eaf57", "comment": "Malware payload (AveMariaRAT)", "value": "c6960c66ca516442593d1f6595b382d3c18aecb2636228d2f28a3db199d03c23", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653718794, "uuid": "65176dda-8989-41c1-acf8-763cd47bbf9f", "comment": "Malware payload (AveMariaRAT)", "value": "58229ce4a06e903dc8ce92b9776730c67b2106b0", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653718794, "uuid": "bdee81e7-a436-4b6b-ad96-361584b2ebc3", "comment": "Malware payload (AveMariaRAT)", "value": "4216354d23925156a19eafb69f23998687991356791b8bdea7c1d643d8da0f0aec354d6d51b01d2e5a75b1490bff3b91", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653718794, "uuid": "164858c8-999b-47aa-b35b-5f2e855b0cea", "value": "T1AFC2B022EBD4C03DDD138F71AC3356A183F0EB85AC276B5C648045EFEF22581DA626B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653718794, "uuid": "ae57d43b-0eea-450b-ae55-b286b3eb4c2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653718794, "uuid": "eae0636b-5589-4488-bc5d-18dc91ccf832", "value": "768:OVy6KKX/k8MlrzxDGSutrnz72rccQrHv/k:Of/czxSvacc2Hk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653718794, "uuid": "81db7b90-53d9-4905-ab11-a4cfaf81850e", "value": 26624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653718794, "uuid": "8a81b9a9-cd2b-4952-8ed2-d349412a8b9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653718794, "uuid": "e0f22e7e-876d-4f1c-9339-51a6438eac92", "value": "Invioce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3316b86-de64-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653728543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653728543, "uuid": "f23bb78f-7eb8-4489-9dae-373abcdfc75f", "comment": "Malware payload (Mirai)", "value": "75491ee70a55c9ee0123b1dc5d608144", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653728543, "uuid": "408ede6c-b32a-49d6-8937-8b40af4d7648", "comment": "Malware payload (Mirai)", "value": "c8f5a81d4dba6910b96301f3f358a4753e14a6e969b0d2a624152be380afb66c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653728543, "uuid": "d4023e4a-41f6-44a4-b81f-a71c598f523c", "comment": "Malware payload (Mirai)", "value": "ff4eff4e90cc42266813165fb1e8026d485d3c7c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653728543, "uuid": "984a52d5-5e94-4964-8724-ae7808509200", "comment": "Malware payload (Mirai)", "value": "761e7be3aff3be61e634d2c1756ad529351c7236366c20c057e8d20ae4f33b482d7dc8c9e3bfcae42cf79511f7833115", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653728543, "uuid": "055c5e95-621a-46a6-aa90-d1c0a84602c7", "value": "T13703F785B9D69E16CAD0533BFA0E43AD3B2573DCE2DE7313CD162B913A97D2A0967100", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653728543, "uuid": "88d8b75a-e9a0-4388-adb7-df92e07f66d0", "value": "768:a847C5mP5joDTogEyo5lTPsrwa+CbhoJ40tt4j9puYM:b47O1wloWCbh84k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653728543, "uuid": "b3c34241-9f0a-4f68-b227-793436340dd2", "value": 39388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653728543, "uuid": "17071770-cbce-46c2-8d17-483f8e1a5e30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653728543, "uuid": "378f87c6-ee62-498c-970d-6e561466841e", "value": "miori.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1050a6b-de8a-11ec-8e58-42010a9c0032", "comment": "Malware payload (BitRAT)", "timestamp": 1653744752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653744752, "uuid": "e414a0e5-f293-45ad-88ab-c2d0a0c6415f", "comment": "Malware payload (BitRAT)", "value": "38598063e663dca8177eea66abc05ce7", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653744752, "uuid": "7d277b5f-6f4d-4dc2-adc7-7201e7d43ddd", "comment": "Malware payload (BitRAT)", "value": "c97d0dbc18681570d93646b0445ff41aaff7d7dbf14835949bf9ad5ff340b6d6", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653744752, "uuid": "9fe42d61-0714-4759-b61f-65488d9715c2", "comment": "Malware payload (BitRAT)", "value": "d24859a8b417ae2eaec811718d8ae64375d753f3", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653744752, "uuid": "176a9107-42c4-4c40-9681-d272ec942ec1", "comment": "Malware payload (BitRAT)", "value": "ba7b4fcdc8e1adb9bd042ec671514a3360d6d56dee745ccd877543bf91fdfe06f04b4b1aee828e6191485667faeb6d42", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653744752, "uuid": "326a9d87-5e74-458c-9620-a9e3c5642bf9", "value": "T136259E22F3907833D5332A389C5B9769D935BE102A78AC4B6FF52D4C5F396807839297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653744752, "uuid": "b0cbbf1d-b38a-45fd-a23c-89207ffc7e23", "value": "b3a19c6db5f1f206bed8a9c17a9258aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653744752, "uuid": "7dbae3cf-93b7-4d6b-bf59-dc8b941ddf8c", "value": "24576:nZ0Wm5sKwupnhhosHke5G+bIbGbtVSn523GB0:Z0W8uioJbG3Sn5235", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653744752, "uuid": "6bba4b55-caec-4def-bcc7-7262c000cc21", "value": 988160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653744752, "uuid": "a092a0f2-c2a3-47ba-be9a-64af94fc5568", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653744752, "uuid": "613d0753-5543-4456-9f02-6eaec384d8fa", "value": "SecuriteInfo.com.Variant.Jaik.77513.11584.12359", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3069719-de37-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1653709161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653709161, "uuid": "6e143659-f725-4b58-ad4e-b15821957bd2", "comment": "Malware payload (RedLineStealer)", "value": "294285c5725868f39407de0e0b5189cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653709161, "uuid": "1bdde0d5-9965-4e01-b71b-9daa6af1ad6d", "comment": "Malware payload (RedLineStealer)", "value": "cda951ff0d527b9553ffeb8be56edd870ebb9f79809360d86bcc870a19afc833", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653709161, "uuid": "f5d49a6c-95d0-402b-a015-075daa4d6fb3", "comment": "Malware payload (RedLineStealer)", "value": "d2fd9187cc77cf8869a43d53ef9f3af7badaaa2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653709161, "uuid": "de34912e-f69d-43bf-b635-fa3d2c464635", "comment": "Malware payload (RedLineStealer)", "value": "f545091250024c45c6e822b93c3ff1a511969ea19db93f5979b22b9fb3501d45e1d39f106045a2cd15ffddd53e05b396", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653709161, "uuid": "f269ac16-e514-430b-80e3-9a8104742e51", "value": "T1339733623B74C1F37128D8F9E383C13D3BA5766B1951A4E1B6A9F0061F3F42AD25462B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653709161, "uuid": "4be1ca4e-0828-46c9-a53d-68cdfb8d8e36", "value": "786432:EtRQrr1cmKSbqcLsrqR6SZtiYwu37Az7bzSfnB9942885:uEmmKAq42IZtiY50zefp42885", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653709161, "uuid": "3c120b3d-81e4-42dd-883e-f0728b17b0a1", "value": 41274404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653709161, "uuid": "91ef1e03-20aa-4155-b79a-10dd412a3081", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653709161, "uuid": "1407b1a5-5675-4099-844c-a09dc3c3db68", "value": "starlink.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67b33aa6-deca-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653772144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653772144, "uuid": "98146a6b-0cd5-4b5d-a8a7-396a329ba26e", "comment": "Malware payload", "value": "79a96bb852ef4835ef9b25478f4a2ec3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653772144, "uuid": "d18386f1-4434-4ba2-9f0f-257317687bd4", "comment": "Malware payload", "value": "cea8570dc1cf4b9fdbe95dbd54592ad6165846c37e9fe707d2261b93bf1d8b4c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653772144, "uuid": "8e86d437-55b8-4c96-b82a-9f8167215ad7", "comment": "Malware payload", "value": "086f4a6046d888564f40143b81e378a28dfc8168", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653772144, "uuid": "785c26c6-5a69-45c9-a1e3-467bae3840c6", "comment": "Malware payload", "value": "029e0300e05f16fa06322a640f06f08f0dbabd0926850344bb37315dc75a22032fcdb2feee8c61d74e4bf474a90cad52", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653772144, "uuid": "1bc21577-370b-4942-985d-461004529595", "value": "T19E17331E3EB9BC6FDE1AF6356223BFF74B74AC5996688148AF193E103C6455D8810332", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653772144, "uuid": "0b2a6258-01d7-45e2-95bc-ad2b7fa2a1ae", "value": "ef471c0edf1877cd5a881a6a8bf647b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653772144, "uuid": "566768ca-bb89-4bfb-8a1a-2f0cc4b66836", "value": "393216:TkGaMgOlPDawQsUCpi0SNuLRoqG37EBcIIBoyUkba2yLwJ+D:YGaWZ7CNubGIBaiRy0/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653772144, "uuid": "d8b36f59-9364-4ff8-b750-27fad6742383", "value": 20127232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653772144, "uuid": "3550de54-db29-4312-b519-95b21be867ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653772144, "uuid": "917bcd3d-3feb-4e3b-8e0a-c9e47c7f4a77", "value": "79a96bb852ef4835ef9b25478f4a2ec3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ef8a833-de36-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653708483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653708483, "uuid": "5fc0ebb3-8fd8-4026-b850-63b08c70cd0e", "comment": "Malware payload (Mirai)", "value": "c831c8cf47d4b8bb9f61353aa6fc82dd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653708483, "uuid": "1630a8a2-8035-49e5-a800-41c184ffa0dc", "comment": "Malware payload (Mirai)", "value": "d2815405005e8cefa773712fb8421511ecadae9eccb55c5b03e702885ee67852", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653708483, "uuid": "f0860025-c468-49d2-a5a2-478b3e1f2c1e", "comment": "Malware payload (Mirai)", "value": "6374c333898294cac516b4e5d615eddb9f1a87db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653708483, "uuid": "94f87327-3eb8-48e9-9178-d9e76db8a1da", "comment": "Malware payload (Mirai)", "value": "8fee6db47fb9c0df9f95172794a8916bf35bf26bca13bb734535c4649db194c61ce06cada7d5f56bc9a02e6ad1f5cb5e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653708483, "uuid": "7f88dd8d-b03c-4afd-bc08-e4c30e608312", "value": "T167D2F1C09017C851D389633FA1F9AAFD4AC71C45E979D9A1B715DCA3DB728623870EE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653708483, "uuid": "453f5b24-ef3d-46b7-865e-d57d13dafe4c", "value": "384:MbMBQR6uojSpHk6GyTa0z7ZidWmRtZ8RwqxIaarMDuzA+B+ux8aWNvdAwh4FEm1z:OM4lFxmmZidb7ZgIa6A+AQZWN7h4mYh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653708483, "uuid": "7daf4502-140a-497b-a558-35a0602ce137", "value": 28920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653708483, "uuid": "e0063cb2-b537-42e0-886a-fabb4893b861", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653708483, "uuid": "681a93c0-bab6-4852-8dd4-f425cfcfc1ab", "value": "c831c8cf47d4b8bb9f61353aa6fc82dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "631a5f0e-de80-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653740354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653740354, "uuid": "a403bb31-54aa-45a8-8d33-8698419f5ab7", "comment": "Malware payload", "value": "afa163ab29a135e382db91adb2cb2269", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653740354, "uuid": "f34bda99-718c-4964-bc6f-7c1804702774", "comment": "Malware payload", "value": "d52075d7516b5d884fe60a4eebe520cc011734d3bfd6d8ce5332be8e168b12d8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653740354, "uuid": "c50520eb-dece-4eb9-98da-9b4e239d7f7a", "comment": "Malware payload", "value": "24250e391e7741992d7cdd8ed530502a15caa87f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653740354, "uuid": "34a9133e-eb94-4924-8f38-af5b3efe8daa", "comment": "Malware payload", "value": "698606565cf77d3f5341ffb059aedb5462b12319920854743bc4a068d6fcfd09b7a7456b22f40fed234a731a9eba2bd4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653740354, "uuid": "a8d1a384-dbf1-4995-9d69-6c29f5f78ada", "value": "T116159DBCB642BE9FC527C5B2C9D42C24E760646A531FE207A21301ED9A0CB97DF056E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653740354, "uuid": "09e82ddb-c2f8-4f62-99d6-dcfa556e0ed1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653740354, "uuid": "c48957e3-dc7a-4663-83d0-cc673221ac12", "value": "24576:yCpZmSsx8TkH7oPeZ7O4KI32J0ua2yK/RGG:yAhg6s8ESlnra2PRGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653740354, "uuid": "564372a6-d3b7-462c-b8c8-b1d025ef2b22", "value": 929792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653740354, "uuid": "21fe7198-4828-4779-9158-2f8480f97a49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653740354, "uuid": "7b4ba050-fe6f-4f78-8654-3171c6243a13", "value": "afa163ab29a135e382db91adb2cb2269", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f0113dd-deaa-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1653758359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653758359, "uuid": "f9bd70b8-2f2b-4b07-971b-1738ea24cb6d", "comment": "Malware payload (Smoke Loader)", "value": "a1f450eddb8dc29892334e6c0c98f060", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653758359, "uuid": "254ba94b-eecd-42fb-8443-b0dd01b23429", "comment": "Malware payload (Smoke Loader)", "value": "d77ec45e4f5bf4ae2dbcdada8676eadf8ecf888a92e6197802cd075f4d0cb69b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653758359, "uuid": "05abfacf-4626-490c-bbf3-63c2a5f51f15", "comment": "Malware payload (Smoke Loader)", "value": "1f214dbaab244e4d12cc16f9dbb47943cfdac437", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653758359, "uuid": "b65f586e-d829-4667-a707-35340b06e594", "comment": "Malware payload (Smoke Loader)", "value": "87bc309842c8da032192acd3b56c7ebb9a624cec818d3152321b8f6c9ce6410250ba7038c32f08e413c582654c035d67", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653758359, "uuid": "b6af2122-45bf-43b8-b05e-f43179b81cd9", "value": "T1AF647C10FB93D035F1B701F549799368A52A7DA17B2841CFA2D62AEE96346E0DC3037B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653758359, "uuid": "90fb4c97-0ef9-4e9b-871f-18a285538367", "value": "35ab1c1a8226968453ac17f61f2ae770", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653758359, "uuid": "1241cd24-b565-4e2b-a309-67aec8c373ea", "value": "6144:y348gAWpQt3G308rnGl5Oemp9bmzfGddMctWTlelYw49:C48Oe2308TGlc9KDkdNcThw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653758359, "uuid": "7ef04ca9-018a-4acb-8077-77adfeea4b54", "value": 316416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653758359, "uuid": "6a383fca-adec-4252-ad67-22e91f0f7c3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653758359, "uuid": "ac323674-e898-4a63-8e7e-d0eb06cc1cec", "value": "a1f450eddb8dc29892334e6c0c98f060", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff46a8fd-deb6-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653763808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763808, "uuid": "79c33320-e23e-4d2b-b99c-c8c09c9ff839", "comment": "Malware payload", "value": "ce20e1a90e5c630e3517c451bed76c85", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763808, "uuid": "6ae1efce-7344-4816-a2bb-66cad4d7fec6", "comment": "Malware payload", "value": "db4b687cc15ae2fbd1af1c0f468adaf85b37f54bc0dea07c215976c191f160d9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763808, "uuid": "0d821013-e734-49f4-a9f2-2cd1b0b7215b", "comment": "Malware payload", "value": "0d3d397003d42a3045a4ad4dee156032121c98fe", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763808, "uuid": "9aaf99ce-7b01-4282-b7a8-628b77d3493e", "comment": "Malware payload", "value": "c47212d20ab0729cf26f56488f00251b1b674f7660650b020d3d2f33954d2bf4400e25f2d9cb12d056a3ad8cd81dc8c9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763808, "uuid": "2b79d860-13d3-44e4-91e2-dc2afcd551c3", "value": "T1ED431785B892DA66CBC0527BFA1F018D371553D9E1EA3303DD1C2FA0B28AC5E0E5775A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763808, "uuid": "d191cdec-493f-4e05-8727-1c1165a3b79a", "value": "768:xoEK91u8Kr1Sxa+VmsI0gobft1ecOaz0TLrp68ABYI2k41+yZXNdGqGrGdxhLblk:LK91uf0TW0be3adJsLBgn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653763808, "uuid": "069b895c-8f7d-4f8e-b081-6363455ef5ad", "value": 58364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653763808, "uuid": "f70ff5a5-5786-406f-9c7c-f1f381567db2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763808, "uuid": "e4014aa4-08da-498c-9ee9-f3bd9bfbb474", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "098f62c0-deb9-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653764685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653764685, "uuid": "f3a99719-108f-4749-8be0-813b2153d2c0", "comment": "Malware payload", "value": "56724439f88b35aada4ae5af4e61d405", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653764685, "uuid": "ef3d628e-bea0-4f28-8cff-62201db7422a", "comment": "Malware payload", "value": "db6d728eb2c14624196afecb83a39358e662d6859ea1c1a44217d00396e6d6d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653764685, "uuid": "3f183f69-7740-4a07-8da9-e9a3b42862ee", "comment": "Malware payload", "value": "ab9d667ba9fad0c668e573883980db41393c37e3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653764685, "uuid": "675f17c5-bd0b-4ba6-aaef-4e7596c61b7c", "comment": "Malware payload", "value": "b03429c3576d5248379902b02e30c34951951cd66e76892e4e4e211c5eb606b81fa0a1fdfe285335bbfc4d0e7c2c4a07", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653764685, "uuid": "17382505-279d-41c4-bf48-be93c5f1cf96", "value": "T183A35CD7FC00EDBDF809DB76455B0A0AB130A3A10E921A33B2536C67FD751A45A27F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653764685, "uuid": "5deff23f-e6ad-40f9-854b-5cc77941f263", "value": "3072:YeTU+/zqy/nqnOk9ymXiI6sViyt0oWrThjyJ3oG:YOJqIqnzymX/mytYrTMJ3oG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653764685, "uuid": "6ba82f86-f706-450d-81e5-79bcd3a006d9", "value": 106620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653764685, "uuid": "9243c580-8c3b-49fb-ac4f-292cdebba7a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653764685, "uuid": "709c6b18-d9d6-428f-aba4-9aabaa0c3b9d", "value": "56724439f88b35aada4ae5af4e61d405", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee644a4d-deac-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1653759485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653759485, "uuid": "dc2d0e14-c7b7-4111-87db-f7ab04a4fa61", "comment": "Malware payload (Smoke Loader)", "value": "4a5682f91d63a4bb4d31e19f2ec5e00f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653759485, "uuid": "ef516a76-6d98-4abf-8d4e-2a5504ae59bf", "comment": "Malware payload (Smoke Loader)", "value": "dba2c259ac529052522bdd58420882d35fe5a6144cfb7ab3df911585818d7ab2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653759485, "uuid": "8a495afb-83eb-458b-94fd-234044b70963", "comment": "Malware payload (Smoke Loader)", "value": "397fff5cd3b3c1a46c2494522bfbd3636faf04b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653759485, "uuid": "296df458-b4b3-4c4a-b02e-d721215e8767", "comment": "Malware payload (Smoke Loader)", "value": "5ab5b94e88c0d699ff9fd1d73fbbfee4800da1d9df7815dfaea5244e75f8dc1cfba8c43a8fd709e9c3d1f1b5dfd24ef3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653759485, "uuid": "e9022f7f-511a-407c-bb32-544bd932f68e", "value": "T135646C007B98D334F1F716F8467EB368A92A7DA1EB2451CB62D42AEE56346D0DC3071B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653759485, "uuid": "06714f52-27be-4f80-864f-aaa81af4748b", "value": "54ebcb663ea607f54ee2ca56ede30f4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653759485, "uuid": "5e6eff3f-3ab2-48fb-ab5f-775f3855de15", "value": "6144:HHND5T0yQ+v1Z0nrqSSEIAmpi2Dy2YUUwLG7Wjub:nNDhN9Z0nGSSHiqkyKb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653759485, "uuid": "f66f415d-01f5-492c-bac9-5aa155f56352", "value": 315904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653759485, "uuid": "4ebd403a-17b2-4a95-a52c-7a413f88949f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653759485, "uuid": "4d234e87-6548-4e45-8191-34dc8ca07c4f", "value": "SecuriteInfo.com.W32.AIDetect.malware1.1308.16744", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c427c7f9-de4d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1653718612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653718612, "uuid": "a39b0118-d6f2-4095-b7b3-9247f666e345", "comment": "Malware payload (Smoke Loader)", "value": "32681cc516dfee01eebc16e056f4352e", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653718612, "uuid": "40db6e8e-82d9-4ae5-b8fd-7fe4a1e175ae", "comment": "Malware payload (Smoke Loader)", "value": "dbba1ee9800e1b4960732e07db4a5de0f7505065197acf8e09311a7d75eec5b9", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653718612, "uuid": "fd7b1968-8b5b-45a2-9ec8-0c6944f1ae4d", "comment": "Malware payload (Smoke Loader)", "value": "0216dddc9b131e90ef562a81ba366a8abb14503a", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653718612, "uuid": "c7ad942f-efdc-4ba4-bfd4-0c19bf310fd7", "comment": "Malware payload (Smoke Loader)", "value": "564cda57a4d48eacff0f92e257f985b7d8ed9a1ce4dddae32520aea9473939db2c5270561d13e9aec7a734d816a0f5ed", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653718612, "uuid": "b718f51b-189c-4c03-a135-24e3f3b32f12", "value": "T10154BF15B6A0F831D0522E305866C7B12F3BBC32EA74A547F7506B2F2E73380A6B5756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653718612, "uuid": "9ab8ce22-f121-419c-baee-2a49294ed507", "value": "b628ca1d73aa557d205f2b12ac720564", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653718612, "uuid": "07aa1e8c-ae6e-4f3b-94cf-d4a0d1a5ac89", "value": "3072:JFjIKFSLMDlh2CvDpzx3itEbKKIsP70KXEDgeZqJysxkgaBChEpZa9uD6Vdyhk:8KFn5zj3iJKI870MEDjZqBigavwVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653718612, "uuid": "849b836c-8cf4-4a6f-a044-87cdd230e298", "value": 281088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653718612, "uuid": "e54fa4a8-72f8-4ffd-8b92-3d842eb227c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653718612, "uuid": "4da3f054-893a-427c-bfdb-820fb2c9063e", "value": "32681cc516dfee01eebc16e056f4352e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0086153d-deb8-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653764240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653764240, "uuid": "e6705740-f0fa-4ef8-a6e4-67720cd1c5bc", "comment": "Malware payload", "value": "56aa31745ace5446878fb585a93f9d43", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653764240, "uuid": "786f887c-9578-420b-b33e-0d9681169a46", "comment": "Malware payload", "value": "dd53b92012f1fa51a39ffc2207981bba046bb139d17fb9ff3191f12bd2ceeed3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653764240, "uuid": "f7178a20-0d2b-4d2b-ab36-72c8da70d57a", "comment": "Malware payload", "value": "a4531a5254fdb6e17665fe389ead23520a7ac74e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653764240, "uuid": "90c21f33-b555-4e66-a9da-17c2d7813398", "comment": "Malware payload", "value": "9437bfd593822149bd120241ce60832417d37d9bd53a4178407f463bef8bc4e9c581da22628c65c107261893a6e8019b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653764240, "uuid": "088164c2-27ba-4e20-871d-33031e0f4385", "value": "T148939419BF610FF7ECAFCC374AA92B45248C641A21A87B767934D818F64B24F15E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653764240, "uuid": "668b1c95-8cca-42cf-9b47-1a03cf337d34", "value": "768:Yikg2VZWdCXszYdFxuhQKB3xp8RZ64dWqdvTvDMyLXyVd45S+W/f6Jan2AIktAFJ:ba4doEYrxuykuKXwgJibwNmK9ZCkvG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653764240, "uuid": "c68e2d51-81f4-411c-9f75-52141dc0fee2", "value": 92368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653764240, "uuid": "62d1354d-2615-499a-8198-604aa86b72db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653764240, "uuid": "b41a26dc-25a6-4d3c-81fe-177ae2ca1fc4", "value": "56aa31745ace5446878fb585a93f9d43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaf3d03e-de4d-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1653718570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653718570, "uuid": "d351019b-d2a1-4fb6-8d21-cd19886da43e", "comment": "Malware payload (RedLineStealer)", "value": "81460a6569b59cab4495374b13627171", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653718570, "uuid": "eaa95949-db8a-4b2f-9c8a-b2f2d8eee807", "comment": "Malware payload (RedLineStealer)", "value": "dfb47ac5c6506de2784975017ce352e2a0f32b21edf78016b2685ffb5a3036eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653718570, "uuid": "86a16f36-118e-49d6-bfef-c20837a0b4c4", "comment": "Malware payload (RedLineStealer)", "value": "dfeae00b098f81c13d4df975d9addac70b3e4e42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653718570, "uuid": "7974cda5-086f-4de2-9b4d-ce0960515f21", "comment": "Malware payload (RedLineStealer)", "value": "f378c38a4a3f1e5ea3f41b4cee3fa37e287554add9e6ba56cc74a4bfd7f82d947083f081ad51d9b5909cc5d76731cd7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653718570, "uuid": "4a704e72-9356-4c42-b56b-261a689f622c", "value": "T1C5365C713ACE9566D37B08B5B9B2D913A73473A25900D90DB49CF06D4BB3E215F83B0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653718570, "uuid": "df550424-5cef-4acb-8f3f-4c85e48f6b62", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653718570, "uuid": "1378b4fa-ecc7-4786-bcd4-b0f91e824d46", "value": "98304:8pJuTLbaEIME0yiwvhZY41tAtQ2bxw0dAT1FXGvJv:gcT/aEIM5PwIrQqxv2bXY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653718570, "uuid": "aa7ffad1-7e3c-49c6-88dd-322fbca67133", "value": 4864512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653718570, "uuid": "d3036c42-64a4-49a1-9e1c-979db87bc3af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653718570, "uuid": "46f9be7a-4e49-4d27-b573-a62671dc2f2e", "value": "81460a6569b59cab4495374b13627171.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6740c267-de9a-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653751528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653751528, "uuid": "f2d6d067-d2d5-4a59-9c31-803f0dfb238b", "comment": "Malware payload", "value": "da61f6400ffe4e331a268a61c54a7ab8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653751528, "uuid": "d7a2b6d8-f502-4f6c-ad85-fccca2e0f295", "comment": "Malware payload", "value": "e0d1a13886600ccac304b28140c0ca790953a5e030271fb7e5c27cb3fc81dd4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653751528, "uuid": "a2ca6cc6-3aae-4e09-b855-937e39143f23", "comment": "Malware payload", "value": "afbe03dd04fdcd00e827114e7f0034957e8df968", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653751528, "uuid": "2c86f8c3-2377-40d8-a0a6-9fc391ffb3bb", "comment": "Malware payload", "value": "abc3618d38bfc5d41c49ef7b148fdbd7b7e96d4b7a2c8650a38815b15e5dc393bd960a45017caba394727ea076e2046b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653751528, "uuid": "ff241c56-350e-4288-ae09-a2cdf0156c59", "value": "T13C278B92360AE1DFD88A07B4852BCD56A9AD87B55B100CCFAD6C74797E33CC016B1CB9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653751528, "uuid": "9d9878e2-307e-42ae-83c7-8e95269c4eb7", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653751528, "uuid": "5948a576-80c2-478d-b432-2097665a169a", "value": "49152:8fd/TVZkt0QayVhb+ibUDXXiTFgdjhFIRmRYG2Rc:8f5VZ00Qayzb+ibSXXKIHIRWYGl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653751528, "uuid": "d2760ee0-4255-4fca-8bba-5389b0670cac", "value": 21507584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653751528, "uuid": "747b7e10-59cb-47bc-beb0-bee41df6d995", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653751528, "uuid": "cb71ff1a-8a18-4443-a2c5-1f3776969ccd", "value": "WindowsNT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07cd1c13-dea9-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653757810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653757810, "uuid": "b3f46ae8-6c71-46b4-88ee-c6cee02d724f", "comment": "Malware payload", "value": "725af7d92f466c0a5c426ef016a8d934", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653757810, "uuid": "b268249b-e1b3-4ff3-b8a6-6d1f26de9353", "comment": "Malware payload", "value": "e2b02fde93a14f9338dc489e25c75225514eab77b52c0d3db6634502181c4d56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653757810, "uuid": "81b46450-cad1-423f-ad93-90bb3e89b31b", "comment": "Malware payload", "value": "440b8cc8798e3125c8c7cf62d462b2111ce73c1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653757810, "uuid": "90fe489c-7ae4-4a86-be10-cb4e37ab06d0", "comment": "Malware payload", "value": "e1c47b08098336496847f04d49e1ecdf2edcf3208540130ebec518afbad81eca04ffb6d9f89bf9172b1e81fd330f475a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653757810, "uuid": "22620f21-3d7b-4584-8555-ff5b107cca8a", "value": "T19E77330333969029FFB752739B6A341767783C950433942F23A81C7AAE7517223BDA67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653757810, "uuid": "0256c78f-1608-4395-ad93-7636471c6b7a", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653757810, "uuid": "ebd82615-490c-4feb-81e8-25a8cee0d6cc", "value": "786432:fek5oQ4k4rkls9zIBbPNNn14YUK3ZFReA/4giZA:WxQ4k4rklSzIbXMewA/4XZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653757810, "uuid": "ba8f82dc-2c8c-450f-adc3-489b912467f4", "value": 33883648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653757810, "uuid": "a4f5c52f-f8a7-4e5b-b0c5-ca009bb61ee5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653757810, "uuid": "abd761a2-c8fb-4f0b-80df-ba873557041b", "value": "paloalto.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cfdf1c7-deaf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1653760637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653760637, "uuid": "6a19a911-d328-4fd3-a361-38595eaabe77", "comment": "Malware payload (Gafgyt)", "value": "eac68f1a143c560b0950c6e4c8381589", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653760637, "uuid": "c1d898f8-3b42-47e9-be13-34e27924aab3", "comment": "Malware payload (Gafgyt)", "value": "e3ae8d60266115d6ad585e1c73ee2005005877580c0a6b3020d1e01d80f9ab7c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653760637, "uuid": "77dd4e93-8a1e-44ef-8f2e-bcdac48117e0", "comment": "Malware payload (Gafgyt)", "value": "5b8ce78c8d97d9365ec7480675f928f2b5b26a43", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653760637, "uuid": "967967bd-659d-4f91-91eb-6f8033487915", "comment": "Malware payload (Gafgyt)", "value": "ba963df3ab274d2b46368bba687862e819a98a74bd0a16dc5baf5db8d1eab67edd4e55fb75b58e81ec82d3c5b68f0fb3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653760637, "uuid": "e95532a2-79f7-4c22-9d53-844299b8c5a4", "value": "T12F24C80198B05B5FCBE397FAF755B1CE723247981F83330AD71C5AB413C12EA9929296", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653760637, "uuid": "a6daae29-31c4-4bda-823b-3d1b8c80ccbe", "value": "3072:ZW6j5PcP0CaNeMKM04dXdb6TIYAljoLi39IaGdx6N0/9kixPOdVmN3KoVyDOH/pF:ZW6EnlaqweWk7Ym95LB+P5myW492hSk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653760637, "uuid": "f7de295b-63d2-4da9-b9e5-e0ce02ffb3cd", "value": 215436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653760637, "uuid": "b24c4ed5-b5f9-4bcd-9546-f06a33e30935", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653760637, "uuid": "2c12c0d4-0d0c-4a5c-9830-03bc32f493c6", "value": "eac68f1a143c560b0950c6e4c8381589", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e955c032-de98-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1653750887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653750887, "uuid": "b1588927-9ab8-4da1-a0e6-91ff89b8a784", "comment": "Malware payload (RedLineStealer)", "value": "7ea4d6c35e1cf515ed5746fb8b69cb2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653750887, "uuid": "23b7bb44-f20c-4bb6-a310-1f0a2898dd94", "comment": "Malware payload (RedLineStealer)", "value": "e532003cd65d204c29d7351b34aa41a543c72709927fb4d5fd2a453dee0243b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653750887, "uuid": "be6b3b23-accd-42d5-b52a-90209aa084aa", "comment": "Malware payload (RedLineStealer)", "value": "0d7488d1848f2b0f5d654c8c27002b1c8a6f81cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653750887, "uuid": "4c6cd924-a28c-4cee-a838-523cef0e685b", "comment": "Malware payload (RedLineStealer)", "value": "d56bca3ec059432bb5ec101a635d15b88e30383e2501ee83b7a899b1da13df7596f92d66fbb26634cbffc544dd2634d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653750887, "uuid": "ad2caa82-83f2-4ced-af03-304c001c8f90", "value": "T1A494F2017390FC35E0512E345829D3A26F3BBD71AA345947F784A70E2EB3390A6B2757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653750887, "uuid": "946748f4-18d7-4028-99f6-ec9a8bd63950", "value": "0acac4443de067252ddd4cc5a26821e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653750887, "uuid": "4d555c72-5343-4c54-8570-308f0b3268af", "value": "6144:o9ab36CCd0fA8ThZb/VJlgHrCwKbqbZvOeRSfM+0XOigavwVf:hCSb3DVJSHrFZOeRS0Xj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653750887, "uuid": "3a1cf259-f058-499b-b25f-9bd624931a87", "value": 411136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653750887, "uuid": "f62e184b-75ed-411a-aafc-10189c0c4c93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653750887, "uuid": "8592294e-7ccc-40c6-8289-216077b48bad", "value": "7ea4d6c35e1cf515ed5746fb8b69cb2e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd456207-deb6-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653763805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763805, "uuid": "ba2f4cad-1a4d-45d1-94e1-c998274f93f2", "comment": "Malware payload", "value": "6537db126126dbbdb57746e31fe6fab4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763805, "uuid": "ecd1a83c-0208-47f7-acb4-a5b413fe3a78", "comment": "Malware payload", "value": "e89ee07f3cf1f996cbc417fe2d192c08510ce93a0a8524c13df6dab8dfd0eb48", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763805, "uuid": "eac0702f-0d37-4e81-9a3e-a41510aa6d1e", "comment": "Malware payload", "value": "b41729ab7f9da3966cf13509ae42b71df5d853f2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763805, "uuid": "689c436a-263c-43ac-b9c5-6530d475b824", "comment": "Malware payload", "value": "1c5e6f967fdc5fbb46174369faf5761ddc76e777d46f286dff861f00db8a7c5e914a35ba72ff0c93bfeb3a06bb8abbfc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763805, "uuid": "9fda0501-c01a-4ecc-b2c2-5d3d0ccb73fc", "value": "T10B534BC4E587D8F9DC0109752077EB3296B7F13E2124DAA7D7DAAE23AD02E42D11328D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763805, "uuid": "47a197c9-9d4e-4a4a-962a-4eb75921dea7", "value": "1536:1kbc71BBduThxDrIgIPChkDFIemE3lFQxR1grd:1kbc71LduThlrIgIeoFIDE3XQx7Sd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653763805, "uuid": "64396a61-90f8-4b55-a5cf-024dcf1ea19f", "value": 62268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653763805, "uuid": "4a45f99b-d536-4d1b-855f-a359862bcc5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763805, "uuid": "85c81306-d642-4ee0-b3b0-d62f8b0bf6bd", "value": "apep.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4c9b75a-deb0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653761107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653761107, "uuid": "099c36b7-6cdd-43e2-a320-e855a5c09414", "comment": "Malware payload", "value": "0288619435124cc89e310acb4b000241", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653761107, "uuid": "d867f5f9-16cd-4dd2-9572-f558ba2b8db0", "comment": "Malware payload", "value": "e98da632ba713ed7f43a70d15354bc3105b8bdfd85b90f8fa5a2ac7d6050a91e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653761107, "uuid": "9bfd7497-4458-403c-8d21-5a322f1d4c33", "comment": "Malware payload", "value": "29aefd4c95c79835b13e62cc85e09108705c4044", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653761107, "uuid": "c0dd716c-c60b-41b9-be9b-ad74f673d5a7", "comment": "Malware payload", "value": "2cfb89a8382936426a757482d28f08ddaf85958300fa80aa9314c93d763cef3ebb3bb19206d994c05f505bb4da4b9e6f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653761107, "uuid": "0508695b-eae6-4caa-9ee9-af157bec6662", "value": "T101E31AA38A25CE32E1031675226BEA7053B394FB6DC7D894F34AFA7448C34C5B990B5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653761107, "uuid": "22817a50-e871-4b2f-8e89-f8228a501bae", "value": "3072:wWqHXI3doZ+Uen7RIhhc4EwdrMOlTG9cvhphT2nnw0KiTa0PfbftpT1:8wRCt3rTlScvhphT2nJKiTa0PfbftpT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653761107, "uuid": "ba045433-b9ba-4a71-889b-5a7254a86a3b", "value": 157006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653761107, "uuid": "4840ffd4-0750-48f7-8229-4c2790cb1881", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653761107, "uuid": "5476e4eb-6a67-4023-b10f-9ec96d0f6fc5", "value": "0288619435124cc89e310acb4b000241", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e077d18d-de30-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653706204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653706204, "uuid": "002040ee-42db-40dd-b465-033ea6a8b049", "comment": "Malware payload (Mirai)", "value": "12a46cc03240ee4fddaba8bb5606e19b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653706204, "uuid": "fda4bab7-c468-41ac-a2ab-116f00077650", "comment": "Malware payload (Mirai)", "value": "ea1ece104a7ff43b1a8a59d710faea61d0e19a71989a2cbc0e74676de4443f34", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653706204, "uuid": "06df5cb0-6270-40bf-98cb-058735c40ce0", "comment": "Malware payload (Mirai)", "value": "1e1d751d4dc17c8f00295fef2596794805091de9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653706204, "uuid": "e834f5f7-964b-446d-b6f8-29c0f80e5aca", "comment": "Malware payload (Mirai)", "value": "0eb9f08aaf8002a530df8cdac165e3af7f054cec8b95bab390ff8f5b4687932d11437d275fed782fc158427442ce25fd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653706204, "uuid": "de7a3379-aa06-46b4-be49-a064f2b42b98", "value": "T197C33B46EA408F03C4D51776BADF424A3323A754E3DB73065A28AFB43F86B9E4E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653706204, "uuid": "cebdcb51-87e8-4459-a95e-fac8b30f8546", "value": "3072:Wry6y9NbB85iY8jjVyL89dUw+K1kmUufpEM/9wqz7Ih:WryX3BAiVyL89dkK1uufqM/9FXIh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653706204, "uuid": "5fe1ab10-de85-44d9-9241-97b068ce5512", "value": 129597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653706204, "uuid": "230b5867-ef11-482c-8563-a6479589adc3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653706204, "uuid": "da2d20d0-7faa-4326-8d64-d849bd0b91bd", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "790ef348-de2c-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653704313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653704313, "uuid": "a0a4e606-402c-4723-b907-a0225dea3f36", "comment": "Malware payload (AgentTesla)", "value": "732943a498bd8cab11530cf027a17ee1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653704313, "uuid": "2fec23f1-3cc2-4d19-9875-455a819bec59", "comment": "Malware payload (AgentTesla)", "value": "ee49f3d4c142ced06e9ce1d55cbccef59af45da7b21c123ddaf51c997b55f83e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653704313, "uuid": "49600e8d-d228-4004-a74c-5cafa8653565", "comment": "Malware payload (AgentTesla)", "value": "bb4aeed0b2b58997eeb86b110101105c64091e48", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653704313, "uuid": "8ac33487-74f6-4cd0-82e1-014fd8d894ac", "comment": "Malware payload (AgentTesla)", "value": "c5c421d85c286aa9f57b4c60970b4326df3bb1da8103bf9117d3b6d65cbc8d2975a97866d8a819876d0c95b77b4e316f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653704313, "uuid": "3301b8a3-f432-4960-bfe6-29c800afc5ef", "value": "T15905E06D72668E23C06917F9C0C3941413B45047A133E2C77FC6A2D62B66BD9ADCDB8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653704313, "uuid": "6737b3ca-8b44-43cd-b8a1-8f48537d680d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653704313, "uuid": "517e6dc2-4b56-4274-b666-c1c169c9e33a", "value": "12288:H4iww5Fxg/cChndObJjmtz0wK5Y4H6Bp4dVGVRzN7z1Dz4:NwOF+c2dMjQ0wcYQ6BuHs/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653704313, "uuid": "b78940bf-6088-4180-a59e-462196c341bf", "value": 810496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653704313, "uuid": "6424d0d3-e84e-4c8b-a853-b700d47f2e4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653704313, "uuid": "66935492-9125-40bc-ba3a-85084b91d5e3", "value": "Payment Slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05bbcb07-deb5-11ec-8e58-42010a9c0032", "comment": "Malware payload (njrat)", "timestamp": 1653762960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653762960, "uuid": "ba7e0136-47ca-4e16-990a-37a608fb96d1", "comment": "Malware payload (njrat)", "value": "45bd37108c28f98957bdda9374eefdee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653762960, "uuid": "4ee6bee3-fc4a-4a8c-bdd1-1d82f90d1a42", "comment": "Malware payload (njrat)", "value": "ee58d6e5139d443b98ed97abf899269a81598bf0f44ccc0279857bdf7da24c57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653762960, "uuid": "dc5d29ba-81a9-43b7-88b0-16bd53cb633f", "comment": "Malware payload (njrat)", "value": "31f7761d6db9cae6f2a2b6078d00e6b1c6a92183", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653762960, "uuid": "b5636e71-b3e2-42cf-b670-a183fc25c745", "comment": "Malware payload (njrat)", "value": "f1c7e58db6033b9ffcfab31ad6c26169d828881c2a2e80e77e355881ad414e62a3ea757d0db32bbef7dc1d92a5f837cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653762960, "uuid": "cdbf465d-d3bd-4de1-a004-9e9a706285d5", "value": "T1A3B21A0E3FA98866C57C1774C6A5965003B491470423EE2FCDC564DBAFB3AD91D8CAF8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653762960, "uuid": "5a1d2f83-1510-49ef-8543-e7bb7e3d2ea1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653762960, "uuid": "56824380-12c9-4ac2-8ea2-8d914d3bc5df", "value": "384:mQ+ILgIbOprgPsUOSU0kB1kd6dg7GYh/JomRvR6JZlbw8hqIusZzZ8X:ZLL6MVU0NRpcnul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653762960, "uuid": "84c8c774-1bcf-447b-abb0-096728e00485", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653762960, "uuid": "728f3670-f0ee-4642-824d-129a912e93ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653762960, "uuid": "263ab8a4-26b8-4391-96a3-cff994232f28", "value": "EE58D6E5139D443B98ED97ABF899269A81598BF0F44CC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb2d747a-deb8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1653764661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653764661, "uuid": "4c991519-d4cb-4b78-87b7-df990b82f4fb", "comment": "Malware payload (Smoke Loader)", "value": "b38dd20e83cec0a0c336cebf6ea3d850", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653764661, "uuid": "d60422a3-ba85-4246-baa8-32296a3ff9d9", "comment": "Malware payload (Smoke Loader)", "value": "ef25e8102cdf23f1f46a052683cc781cf4cbbe69b6dc744d3b0e88c9e088c673", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653764661, "uuid": "100b28fc-e55e-4bb2-a23c-0125ee455163", "comment": "Malware payload (Smoke Loader)", "value": "c8a79ff5a6a2daede31c2d22dc9e80747dd32c30", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653764661, "uuid": "1d882abf-e2a9-4733-b7cf-88695103c3de", "comment": "Malware payload (Smoke Loader)", "value": "370e30a4c475c97e622af3226c52a2117c364c7231885bc4f4e533ccb408e186e8e8261bc8b657bcf6999de86ccfcdea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653764661, "uuid": "8dc94dd7-b154-4aba-908d-6b7de760c9b0", "value": "T16265BF226D9248F2C376167D4DFA52D758277D0128F896CE6BE01F8C4F396713B392A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653764661, "uuid": "4f7d8c28-7f01-474e-975e-497f4477062e", "value": "2f4c02871b4a56edf3f831d87d2c2e01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653764661, "uuid": "c40e30cf-959e-4708-81af-30300e646a16", "value": "24576:uAUSrNwFuzcn0ebzCuJuvXH4W3T88U18NfTTraGL9:ucQueauIvI18dT/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653764661, "uuid": "5fd9e3d8-98e8-45c1-8e9b-197bd8ddd47c", "value": 1420800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653764661, "uuid": "e6ad6f42-78f8-4ab8-9c08-2aadb87f7e1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653764661, "uuid": "bc6823b7-4cd5-4341-83e4-a7ae664af91d", "value": "b38dd20e83cec0a0c336cebf6ea3d850", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85c81b3c-dec6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1653770477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653770477, "uuid": "4eaed735-980d-4bf5-91aa-a5fcf60d87cb", "comment": "Malware payload (Smoke Loader)", "value": "71dd78e4117f547250a05874f78ff33a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653770477, "uuid": "aaea94ad-0a88-490a-8491-002cc6973aa8", "comment": "Malware payload (Smoke Loader)", "value": "efb9e20826dd83c3a14d91b7b0c4103b6c7c943107b1e35f6ac69156fa8972e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653770477, "uuid": "3157f8ff-6dbc-4489-a316-ac87321a093c", "comment": "Malware payload (Smoke Loader)", "value": "76d0f7b59e68c19c3ce900d2fdfb746f31d49a47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653770477, "uuid": "7429b367-12da-46ca-8002-5869a785a2d7", "comment": "Malware payload (Smoke Loader)", "value": "c5e2afd6b28df6185a101bae4f07a2099e74f4bf8972cd80ff22a6f2fcf50f73ed282037757047f5c2629e0300a2feaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653770477, "uuid": "6b58acaa-c349-40e4-aa88-192b5461b1d6", "value": "T183649E10BB91D034F1B702F949BAD368B93ABDA15B2091CB52D43AFE56346E0DC3275B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653770477, "uuid": "f389b703-204a-4c8e-b24d-ed7ea46759a0", "value": "35ab1c1a8226968453ac17f61f2ae770", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653770477, "uuid": "974bb241-a743-4fea-87c4-f7fecf2f4e10", "value": "6144:U34IgA6lQt3G30nr4Cq6OWPp9bmaLCUv5FulFcggKB:Y4Iue230nkCqK9KuZwLDB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653770477, "uuid": "de2defb2-9be2-4986-8f87-dcaf50e7a3f7", "value": 316928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653770477, "uuid": "af2276ce-dae0-4f70-aecc-c70dfb3a43b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653770477, "uuid": "e1191c00-bb72-4a5f-ae14-67252704d84f", "value": "SecuriteInfo.com.W32.AIDetect.malware1.28628.28267", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b11f1dc1-de7b-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1653738337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653738337, "uuid": "27dba95f-4b57-4398-8b13-3b5fdc73bc3d", "comment": "Malware payload (SilentBuilder)", "value": "5d05cd7af54c6e81308f1ba8ca4fac55", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653738337, "uuid": "7b4331b5-08a8-4b37-9841-14ed726db66e", "comment": "Malware payload (SilentBuilder)", "value": "f0f1cdebab171e9af48c9531e54f0f1eab72dddf6bd8af13caef0d7919d1a7e6", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653738337, "uuid": "5b829263-f492-4b2f-9a87-0e186eee2c5a", "comment": "Malware payload (SilentBuilder)", "value": "76b1030232e8603bc4b059a615547ad099a1d359", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653738337, "uuid": "3ba9468b-6df0-4d3d-a1db-b590c5143fe6", "comment": "Malware payload (SilentBuilder)", "value": "cdc1adf7f2ff60b8f1709df3579c799dd6baffe119c173953c58bfa562ecab19a254c45615dd4ec895d29e1aa85deec5", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653738337, "uuid": "8f719a0c-12dd-4101-9f1a-87701bf9007b", "value": "T1AA634B59B76A885EE9198B3048F747D62323FD308F6F0A433259F3926FB9590670390B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653738337, "uuid": "05f4a9a7-a7dc-4585-9801-08e06146e82c", "value": "1536:OhKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+4+hDcnTLiQrRTZws8EV:uKpb8rGYrMPe3q7Q0XV5xtezE8vG8UMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653738337, "uuid": "feb15418-31ad-4e4b-909d-d37efdbffca0", "value": 72192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653738337, "uuid": "7a0a2c44-8081-40b8-baed-b6ae708d4dc2", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653738337, "uuid": "161c28fb-1652-49c5-ac2d-9ff1ce8ded51", "value": "39325.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9486a5d-deac-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653759450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653759450, "uuid": "b42d5987-3e0c-44a7-8e9b-dc8d6590f866", "comment": "Malware payload", "value": "14bd8a7f56dd3a8b4bd0f697a3a4afd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653759450, "uuid": "60adaabd-560c-4804-8732-10c9bb3043f6", "comment": "Malware payload", "value": "f132ffc8648d38833244e612c58224285e85e863a35c872490690217c082e59c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653759450, "uuid": "61cedec1-cc30-49fc-887d-3f139f6ef62d", "comment": "Malware payload", "value": "fb136d777173fb6674e585ecf842d025756d6423", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653759450, "uuid": "a3001e36-c0e6-47c8-8ea4-49aa9c87ca77", "comment": "Malware payload", "value": "acb5964ffaaf5030f8f1db868c7ae529c1ebda6f4185c74a9296384c4b37afaa89df902a89de7bc7089671ea5f4f89b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653759450, "uuid": "380da35d-1fcf-460b-b253-dd756d985971", "value": "T1EE349D10B5D2C072D872153209E4DB759A3DFD314BA69EFB27990B7E0F342C0AA35A76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653759450, "uuid": "ee247841-db20-4a16-99ab-a659e1655d03", "value": "ba3dd4f7e156f3bf313c414679996af3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653759450, "uuid": "76092ff1-0203-41cc-a5ab-fffdbc22daa2", "value": "6144:dnvXUi+nAvph+ISUquAOrQqjmEGuyx2Xa:d/r+neVQqKzgXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653759450, "uuid": "d616e13d-d2d1-442e-8bc9-2ed9132bce02", "value": 242232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653759450, "uuid": "eb7dc5f1-cc44-4a58-8d1d-35c4c097ea11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653759450, "uuid": "8cc9e776-5feb-43c3-bc53-73a4637672e6", "value": "SAFlashPlayer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f5df80e-dea8-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653757527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653757527, "uuid": "5f9498ba-4039-43b7-a05c-802379786c4b", "comment": "Malware payload", "value": "9198ad1e9bc309b1dd71a5f0cdb76df1", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653757527, "uuid": "a5ffe087-4229-42ea-bec4-f3a40a8501a9", "comment": "Malware payload", "value": "f13ac0b04207652d9ef1094ce3504e791df223bbacf6e07dfb162d4e099d7105", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653757527, "uuid": "250255ee-c898-4f10-aab6-bfae6850afbc", "comment": "Malware payload", "value": "813a2d52482255afa0fa780c39b54229e51c15df", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653757527, "uuid": "35416e28-3648-469e-b0ab-13f02a44e986", "comment": "Malware payload", "value": "0c7802996615e0822cd8344b7c955a47f27c709dc385cd446f8dd04aefb9e6ad63a318d474d8754023b671aff26d67b2", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653757527, "uuid": "92d0ddbc-71be-4ea3-aa58-e4b6dbf5e52d", "value": "T14FB5F183E346986FC5F7C33A46B60B2A85468C658747D3978A75B33C69BB9C04F81F84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653757527, "uuid": "2e2df179-8eab-42ee-96e4-e52fc7f3351f", "value": "49152:sqlV1dj4WXk3xfz22nMyDktmtwiZCSmKeRz:sqlVM3x64umtzexRz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653757527, "uuid": "ae51be2c-6385-473b-8998-012d5bdb314e", "value": 2309714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653757527, "uuid": "28450282-aa91-46f9-b160-c8dc6d9ec9f6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653757527, "uuid": "eba2bd23-19c9-47ad-974c-a80aa2667361", "value": "base.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c73f3c9e-deb6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653763714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763714, "uuid": "2fe3635e-23d9-4f96-b523-2878aa300c6d", "comment": "Malware payload (Mirai)", "value": "7819200906c717c57a01eb4650933b66", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763714, "uuid": "d2549f49-7892-4e83-b0ee-42268e9ca8b3", "comment": "Malware payload (Mirai)", "value": "f3f72c8a3bcf686358246b400a0e0238d3558480a960e460703d2e9038a2a65f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763714, "uuid": "8eff1abf-0e17-4fc5-95d4-6d3b24b819fa", "comment": "Malware payload (Mirai)", "value": "6614ee975c0f07de76e5e40765e91b76e6c10a64", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653763714, "uuid": "001f6b12-e3fc-4775-87ae-a952ef84f12c", "comment": "Malware payload (Mirai)", "value": "7c44f350b84d17c235cd3d029a5858469a5d7e77cf86699b274b4351b91bf33c6a08c0f95fe44ac7eeed683e20319e3c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763714, "uuid": "03e28eec-0bb9-4d07-9313-4adf53bcdd02", "value": "T1FB434BD5B401BDBDFC56EA7A81120E0AB4307A2541B31E63B767FD43BE331A4AC2AD45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763714, "uuid": "83629ce4-ff4f-435a-ae79-4d04a1dae6f4", "value": "768:neBmnX2BQeoExFTs919bSjFpIqN1PwguXQV4xyDBw/bs0/8Wnv2GY:nCHLoEFwNbSHwpXQ2yDBMbsK8kM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653763714, "uuid": "2c556d5d-7a9f-4258-8b9c-c9a00d50108a", "value": 57992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653763714, "uuid": "3707adc5-d758-4034-9f99-37e73e7ed97b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653763714, "uuid": "449efc48-7d10-429b-8086-3aa7e62e0633", "value": "7819200906c717c57a01eb4650933b66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "959ff3a4-dec9-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653771792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653771792, "uuid": "7113b6cd-8253-4a2b-b503-b12498ebad6f", "comment": "Malware payload", "value": "b56a52effc3f70f117e3045c3fa52fe8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653771792, "uuid": "b0fef3f9-3d4b-4b9a-8477-a1a0ae225ccc", "comment": "Malware payload", "value": "f4248f09778780307d68ed068ed5cdcea48ea1c13555bd7bb05ce7f641017833", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653771792, "uuid": "1df6126f-3152-4a70-a46d-43eb4d115706", "comment": "Malware payload", "value": "95e8fddfe412626b645a01bfc7dc0cb2d3c8ebfe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653771792, "uuid": "f08a5e69-842a-482c-88f6-a4dd3a9a2ae5", "comment": "Malware payload", "value": "745561d184092dbce4824d41941a426544550b99f69e63af872418b08f54248d709f08c33fb085440f2e7f0ddc78ecac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653771792, "uuid": "6534c8ca-68a0-47b5-bf61-647c25f53e7d", "value": "T1A903098169FD88EBE52C4A36D4B2A00C872CB50BD9DEDA573DCA33054823FD6CE56E15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653771792, "uuid": "e7a1554d-f99a-4a93-8bfe-7e2c335cce04", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653771792, "uuid": "0e173313-8744-4bfb-ad2e-c57ffc0bdfa7", "value": "768:rzGh6XY6NLXIXopuvliLRyVPGMMMDMMMKc:eyNDsvliLUeMMMDMMMKc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653771792, "uuid": "87f88696-c8fd-41dd-9c04-87ac149a35db", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653771792, "uuid": "3604eb34-bbf0-4bb2-832d-ad24f819d817", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653771792, "uuid": "caab07a2-cce2-41e6-b779-a227a51557f1", "value": "b56a52effc3f70f117e3045c3fa52fe8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d758b412-deaf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1653760735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653760735, "uuid": "a791cab1-3019-4295-acea-a5a3a3fe63b6", "comment": "Malware payload (Gafgyt)", "value": "b0bcf78429b187d3fbc6e02746a4f190", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653760735, "uuid": "e2717824-04d0-48e7-9627-853ee5b49547", "comment": "Malware payload (Gafgyt)", "value": "f438aec324a25078299f3b0f24719e4038cabe4765d5ee3b1ae4aaabca42f0ba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653760735, "uuid": "11481574-e70a-4f85-bdca-34663bcd9995", "comment": "Malware payload (Gafgyt)", "value": "8dad53bf1fb76251ffc135764a9ff1e142822126", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653760735, "uuid": "2d5b5c1e-350e-457e-8d18-b45df144ae83", "comment": "Malware payload (Gafgyt)", "value": "c9efa5cbca5552a6d34030dd2029df225ad70618a3fd92cc2328b0aff76a55bb9ec3d97b49dd9a0470a802f66996498b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653760735, "uuid": "e6281883-5fed-4fce-8fbd-968c5baf2296", "value": "T1FF14C844AC64576FCBE3ABFBF70472CE727647991F833309D72849B013C16EA9529292", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653760735, "uuid": "6a09b466-8885-4b16-940c-6743848481f6", "value": "6144:UqWN4l0gqnY9gitmljfo7oFbQ9gOv1SqX:UqWWKgQi4Lo7oFbQ9gOv1SqX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653760735, "uuid": "6a6aec42-7cd9-48b0-8423-4e81a3364f68", "value": 202710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653760735, "uuid": "d56a654e-5016-4f06-9eb6-7f651ae734a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653760735, "uuid": "29d6d14a-4db8-4426-a1a2-acd2346a119c", "value": "b0bcf78429b187d3fbc6e02746a4f190", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f42752d4-de68-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653730289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653730289, "uuid": "45f4462e-1074-46bc-a5b3-c057e8147602", "comment": "Malware payload", "value": "db8fd9067e9131ec598f7c392d0209bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653730289, "uuid": "8b8e445e-82f5-479a-bed4-ddce08682fc6", "comment": "Malware payload", "value": "f467b88cfff5f6d9f15ce22fb5d519ee4c62285c3d86ac7f1dbc234ccdb58764", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653730289, "uuid": "39a26fba-2f7f-4e6e-98af-503987c5ebe2", "comment": "Malware payload", "value": "7428556e15e00815355be4c4e1b93381038ca8ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653730289, "uuid": "351a40c0-60eb-4df7-93b6-922fa96028a1", "comment": "Malware payload", "value": "47458e6d7c89bb7d8bc6978f68d31962826db5ab5cd84132b07d3882ddf6552a56cdcfcde242be2506ad0913a0b19ef2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653730289, "uuid": "e8a73923-ebab-4269-a7e7-4cae9817969e", "value": "T110064B21FACB40F6EA031D3144ABE37F6734A9054724EBC3EA50AF66F9776921D36109", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653730289, "uuid": "1d29ca68-486e-4b5c-9964-42335c69c7e6", "value": "49152:kYrQ3qYnBlzydEPO2zRTqjcPaTpLxR+w4FGAd4jiXvk9lK0VF1:kY2pLuE/zRLaTWGY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653730289, "uuid": "8f23b2c9-3ad3-4035-aad0-507696a97209", "value": 3936256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653730289, "uuid": "9f661516-c95f-4ff8-980e-8b35096e26f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653730289, "uuid": "4cf2c866-dcdb-4ff6-8a45-f08658b0f231", "value": "SecuriteInfo.com.Trojan.Linux.Kaiji.7141.32448", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0527c700-deb8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653764248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653764248, "uuid": "a7107969-702e-4a8f-83f4-99a5d9b653c6", "comment": "Malware payload (Mirai)", "value": "7c7973db0dc4fd08400bdbecf717cd5c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653764248, "uuid": "44c0edcc-c1dc-486e-92aa-db6ea0a6fe91", "comment": "Malware payload (Mirai)", "value": "f608d71d3eb62e8bd07eb8a6d52cca5f74ac0452748ae65c813bd309f3b05820", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653764248, "uuid": "9c184497-64f9-4454-8bc4-ef54ff4ed29c", "comment": "Malware payload (Mirai)", "value": "29427577d09c085e9a13df1cb59004a6a02917d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653764248, "uuid": "a522a850-0dc0-45fe-9aba-dc9dc1f96d6f", "comment": "Malware payload (Mirai)", "value": "e63978b8b9525724a03dc4a1373f2bc908f03a13f564f20999e9216a9a97ae3729690bd6566d01a758dd573f96ecf0b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653764248, "uuid": "46446115-9fe7-4aa0-9499-78b842e12626", "value": "T110533B02326C0E57D1A61EF4693F17E083FEEE9116E4B685664F9B468636E731089FCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653764248, "uuid": "bfff809e-975b-4dc8-a6cb-a70c2310f9b0", "value": "768:ypWBiA7/paqC/Qk3WzRDT8NCzh6VmMUiUFI632X+aG8+z8OW3AINVOtWAFbr11:AI/gQkGzq6xM94h2AINwtW2/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653764248, "uuid": "3843d2b9-a784-4ea5-ba8a-c5af773e299b", "value": 66700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653764248, "uuid": "afc75ed2-e874-478b-bd9d-b51e9fe8b6b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653764248, "uuid": "285e4917-fb11-4096-9616-8fa650a3dcef", "value": "7c7973db0dc4fd08400bdbecf717cd5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d515ca6-ded3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Amadey)", "timestamp": 1653775858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653775858, "uuid": "f8d99774-ca5a-413a-99e8-77e67be7fd2e", "comment": "Malware payload (Amadey)", "value": "a401a80813d5151a8c25caa46ef63982", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653775858, "uuid": "938242f0-ada1-41cd-b726-a193bd1886a7", "comment": "Malware payload (Amadey)", "value": "f8458174c4abdd56f7fb6e07a3c16d95d908fa5461ebd5a8425c60480b8c3b57", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653775858, "uuid": "c91eee8c-87f9-4253-b68c-3349ab2b2f95", "comment": "Malware payload (Amadey)", "value": "9ef27184158ebed6313993d769a07197befb4800", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653775858, "uuid": "e23e9d79-8176-4673-9011-fcd70826ab7c", "comment": "Malware payload (Amadey)", "value": "343b3f4ef0ad2c46e32e8d35d0a3b95b29823450f11a660c5c1320f1f6a5ae7a7fd44639eb52b189c0632985e58f5c5a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653775858, "uuid": "641ee58d-79ed-4b5a-b995-2c03a94c4926", "value": "T155D533E2D57C9DE9F30239BBE09CDF8516A22C565133A2D4820E33D355D50EB6A93A3C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653775858, "uuid": "1323e264-2358-4250-8b4b-98156e807c93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653775858, "uuid": "a44faa61-5bbd-40c5-b120-8bd6b3e93b08", "value": "49152:SkDErrjlZWSlWau4ABWcpVG9/4QxoweOkPeYaCtUkhL/t:SAaySQauzYckhxoVwCV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653775858, "uuid": "499fa203-0c20-4b44-a4fe-7958a18306ee", "value": 2819584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653775858, "uuid": "3f45647f-7d3e-42cd-84db-33d9ac72a04a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653775858, "uuid": "ec1c99a5-0cdd-498b-9637-11677acad569", "value": "a401a80813d5151a8c25caa46ef63982.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f312d357-deb7-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653764218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653764218, "uuid": "24e7e859-d397-49e4-84e9-e4245118c6a9", "comment": "Malware payload", "value": "0ecda58c41d668ac970be39d3c4b2910", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653764218, "uuid": "dba24ede-375a-404e-8b91-68551cbdab86", "comment": "Malware payload", "value": "f88940d74348dde3d566db474b05622f0d91a4c0df6772e5c2d07dc5bf48985c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653764218, "uuid": "4ee2b1e2-26eb-4ada-82d2-1f817eb1b83a", "comment": "Malware payload", "value": "3202e31b8503a76074cefa98c5ccea51fe859149", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653764218, "uuid": "8c174441-543e-4e9d-b794-26b2dbdf7a71", "comment": "Malware payload", "value": "2e8305bc40b5cee4d6fd07c6f30107f02b983d9097e1a0c3913b6a9639bcaa9ec910a88a2a6c5119e7cb8e3547bd5fa1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653764218, "uuid": "6f412269-773c-4bda-93cd-8e8a62b21e72", "value": "T1A623F12CE073A881DD9D0CBC659D1F6A59F636C2712B4746C3298CCA7EF094B69CA5F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653764218, "uuid": "fa5ccc4f-9886-4ff4-9cb5-a7d9cc3d4e12", "value": "768:yzBZar6YlpWwimFN2O1eAQyyRlYbBH25KRsKCOLCZC0a1EhGlgSpCb/P91xlsP3Y:y6rTFZ2O14PReb525PJ0CsH1EogS4/Pn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653764218, "uuid": "642c79a8-3ba0-4138-b2f8-3665d5c3b619", "value": 46716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653764218, "uuid": "50d96992-4a6f-4e87-acc3-b7822c494ca3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653764218, "uuid": "b15e4da9-32b0-48ee-aa26-ed7a9bd18021", "value": "0ecda58c41d668ac970be39d3c4b2910", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0376d03-deac-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653759488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653759488, "uuid": "03e6a6c7-b44f-43aa-a748-b007c1966889", "comment": "Malware payload (AgentTesla)", "value": "9388acc1560b9eddebf2a2d55245cdf2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653759488, "uuid": "07827e7c-f66d-4e05-87ea-b0a282348f86", "comment": "Malware payload (AgentTesla)", "value": "fa7e1282b7858bf798858208e52a0114d5d3f41e3c676d00f1ffcdcc0a329412", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653759488, "uuid": "627eb5e1-43b2-41f1-9034-3cf2d4db35a1", "comment": "Malware payload (AgentTesla)", "value": "977acfd6e28828709a041d10b80e8880215e7e0a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653759488, "uuid": "29cd5d37-4938-421d-a4ec-9b2ca66f6f97", "comment": "Malware payload (AgentTesla)", "value": "eccce41ede6c2c703b91a46a92d85004f9d218ac47516af172a7af79a0af11c2ea2a741dc529aa8e2061e645ece58ac9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653759488, "uuid": "d352e54d-abfe-49a7-be18-bf4e2ae27cb9", "value": "T1E1E4F1C4D767EE76F06863B3716481182775261D80E0C23AAEDCB0DE74B6B461DFAE06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653759488, "uuid": "0e4a9597-dfdc-4d96-a02f-9609a8f8ad2e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653759488, "uuid": "85ae8ca7-6b03-487c-b437-53c8c711e9d6", "value": "12288:ix+9owwo9MraLIh0g17EmKPnBieRao+S/X/+ZeiAVkbHoR:ixmowr+ash0gRL+VD/X/+DakbHoR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653759488, "uuid": "72b59b5b-c237-4540-99e8-9daa26475a2e", "value": 680448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653759488, "uuid": "1a22254b-7d1c-4861-87cd-d5d3584f8d39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653759488, "uuid": "f41c675b-04ad-4c62-b6d3-14fc50b00708", "value": "SecuriteInfo.com.W32.AIDetectNet.01.26904.20811", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "190c6246-de99-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1653750967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653750967, "uuid": "52f566e8-e7a4-4c55-b093-75f3d8bd8bb5", "comment": "Malware payload (RedLineStealer)", "value": "3516ffc8b520d9b1c52781b6f52ee29f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653750967, "uuid": "92fc9e95-04d5-450a-b452-b642c1a86011", "comment": "Malware payload (RedLineStealer)", "value": "fb63e82f9803b9cab3f7e4bda5a570baff699393565d5f0e4ca13bd2bec8a925", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653750967, "uuid": "6d939902-15ad-4a92-a17e-fbb41f5b05a4", "comment": "Malware payload (RedLineStealer)", "value": "68bc2ae4f25691a7adee3ccba49a51a853011cef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653750967, "uuid": "d45c4154-7832-4228-bb9d-623643ea80b9", "comment": "Malware payload (RedLineStealer)", "value": "b7d7c337541d0740f58245532160eb9add1844d12308af232c50e4d1d7d6513cb2c4e82e7ec5881aaa5b34454c9758f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653750967, "uuid": "ccdff0e7-0d95-4242-a337-8f1f9ce81f95", "value": "T1AFB50A13AA8B0E75DDD23BB461CB533A9734FE30CA269F7FE608C53599532C4681A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653750967, "uuid": "ff88b01f-6936-4fd4-83fa-d0dfd484a325", "value": "0629c55152d38b4029f7de8a08e08d5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653750967, "uuid": "09387832-00fc-4a71-bd48-0fdefcabc010", "value": "24576:5rj7AZHrc2Uj7sly+mO1YfO0qK0QTID1fr4F8AYuQ5p3h35s:124X7+1w/ID8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653750967, "uuid": "e17aef97-6085-4611-84ad-6e826e438c58", "value": 2278855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653750967, "uuid": "e43bbe04-680f-41f6-bb74-5d89a9afc927", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653750967, "uuid": "e8840aa9-cab2-484d-8d90-c765decef5cd", "value": "3516ffc8b520d9b1c52781b6f52ee29f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91b1a93c-de99-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1653751169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653751169, "uuid": "77ab0d50-f592-4ea8-b217-50b221c1ee78", "comment": "Malware payload (RedLineStealer)", "value": "511a206e1a7aec27140e21057f07be76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653751169, "uuid": "b7fee037-799c-4e04-9d39-6b35fc2fa1e2", "comment": "Malware payload (RedLineStealer)", "value": "fbcaf5b60af0453db1ecd976a98b3c943732571e1f9634b1bd303511ed8a9d55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653751169, "uuid": "7d1984a3-2e52-4b24-818b-d85ad98c9ab1", "comment": "Malware payload (RedLineStealer)", "value": "f09666b3d440f2744635906143b42e9e18fa7c7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653751169, "uuid": "9c93d9dd-bb25-40fc-91f9-6ccbd87d97fc", "comment": "Malware payload (RedLineStealer)", "value": "c05885784b2f758b334ad91b171dc9e6aeeed70eade10f118318ee998c4829ed41a55e643775a196faa7bb39c067b1f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653751169, "uuid": "b94a62cd-9edd-4cad-955b-6990e68b86ed", "value": "T14A94BF11BB90D435FDB712F48879D3B8B92ABDE1AB2441C762D12AEE56346E0EC30747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653751169, "uuid": "decc4ecd-4630-476d-bc5e-4a841d6d2613", "value": "c5df5f515f76bb815fad87fade1c304d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653751169, "uuid": "ec712dd2-df6d-42ed-b4b3-1f9eb57032a4", "value": "12288:naYo5+CJHUtaRIxZoTB3HeUSXJW1GuKnY:aYoTWgREa3+dJW1m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653751169, "uuid": "4fcdf8ee-064c-4af8-afc7-3cc127b92333", "value": 432640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653751169, "uuid": "e82b0ab5-cbd7-46f6-9bff-6bd6cfead796", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653751169, "uuid": "9b670dcb-226a-45d6-a534-20624d1a0f65", "value": "511a206e1a7aec27140e21057f07be76.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ec4fb7c-decb-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1653772585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653772585, "uuid": "02f7e3dd-ea7d-41e6-816e-8ace16070aed", "comment": "Malware payload (DCRat)", "value": "9ac0300e0e4cb1f342d494a289357a8b", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653772585, "uuid": "ead3e116-3526-48c7-88df-7ebfd8b4e840", "comment": "Malware payload (DCRat)", "value": "fc67aad6255fa422c4a2fce9e60ae2567bf0169a71d65d33805d890ed357dbf7", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653772585, "uuid": "ea2be1ac-abd3-4767-a853-e680160ccec2", "comment": "Malware payload (DCRat)", "value": "39b265bdac16c8279287b3811a6f504a514300ff", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653772585, "uuid": "a8c44975-1066-4dd7-83a1-e7dc38c6a9a6", "comment": "Malware payload (DCRat)", "value": "8e5d40022ef9c20a69da9793a35f7cd5daec0f3f091e150b0af36556dac31a05c33bced28182cf6446381ea1eea2f26d", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653772585, "uuid": "bfd22be4-62de-44d5-b06f-fdfc2be3a181", "value": "T1AA0587342EEA5029F177AF7D9AE43596DA6EB6A33707994D00B103860723B42DDD063F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653772585, "uuid": "58eab172-890c-4254-a5c7-335c01b3e654", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653772585, "uuid": "83d93a7f-9e61-46af-bd92-95ac814c8d84", "value": "12288:fJzI4FlY4etTebeRVrwM32mMI/w5nH6Bi4rvSOaUYRpxqTEE4VvE5/s3ytQ3oc8o:fJzHFlgvRDmoEak4WHx3x3I6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653772585, "uuid": "ff0d1dec-d462-4f6a-94c1-da6503d485c0", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653772585, "uuid": "34b87e21-a3b7-4ab9-9118-8289a6063b61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653772585, "uuid": "0dc25e2c-20a4-4454-8a67-0ce300e6d1c1", "value": "FC67AAD6255FA422C4A2FCE9E60AE2567BF0169A71D65.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "611db4af-de80-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653740350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653740350, "uuid": "840cbf9e-1610-4026-be84-989f1dcbc09b", "comment": "Malware payload (AgentTesla)", "value": "f2d02fc0f3ab88d4e8c7fee26b571f25", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653740350, "uuid": "fb464801-6f1a-49cc-8616-614b2b4bcf24", "comment": "Malware payload (AgentTesla)", "value": "febf62563c26191450477b615b767baf7d468520d09364fe14678225808dde67", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653740350, "uuid": "4f8d1b64-a926-4d2e-ad36-56fc4ebdf897", "comment": "Malware payload (AgentTesla)", "value": "966d4db4e2e1a09f6843666ce847af3214ed0026", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653740350, "uuid": "08b31824-6bc6-40bf-92ab-42680762c93c", "comment": "Malware payload (AgentTesla)", "value": "5d20367302c8e97ec10d0d218e0aa841355faa2c62683d898297d50128eef4045e2bd3ab59716772acbf7cd73adb6e7a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653740350, "uuid": "c080e651-7bc3-4604-8ff7-cc9603079fa1", "value": "T13FF4F11072E95706E6BA8BF415A060905FF73D1AB676D71C2DC730DE19B2FA18E20B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653740350, "uuid": "b47ecc9d-76f2-4cdd-aff5-880bab1df797", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653740350, "uuid": "a6048f3e-7cfc-4eaa-81ce-63134e5ce42f", "value": "12288:02iNzbHoVz4gh700p9eesbdXQ4YtZB2X884WUEg80rFYnUya:015bHoNnjp4esOHD2PgxFYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653740350, "uuid": "bfadc9ef-410d-4ca6-8c53-bf68c6fccab9", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653740350, "uuid": "bfd77011-510f-4154-98d4-1e6167b0c29e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653740350, "uuid": "8494f78c-77b3-47eb-807a-dbf0b4d756df", "value": "documents of 20-2185-2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }