{ "Event": { "published": true, "date": "2023-03-26", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-03-26", "timestamp": 1679875381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "1e998bf4-e01a-4a59-a418-4b419e303a09", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daccae3d-cbb4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679821314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821314, "uuid": "7e23fc0b-7b1a-4741-88b1-3ead761d25bb", "comment": "Malware payload (Mirai)", "value": "d3f08094672ef313ce06088e97b4c1b0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821314, "uuid": "6774c1b7-7b0e-4a84-8a4d-04587a58de85", "comment": "Malware payload (Mirai)", "value": "0102a047a3e24fdd67d1b2b8ccbc0fb69b851bdbfd171a521868d56286ec35d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821314, "uuid": "9410464a-5191-4016-823c-9325996dfaeb", "comment": "Malware payload (Mirai)", "value": "20ed232fb1b7fd407b8ac17ff9c3f64e239f788e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821314, "uuid": "30cffe5f-14fc-4ec8-b0e2-1c9c943525c4", "comment": "Malware payload (Mirai)", "value": "0827bd662db4a1e94ceec4472e3dc49ca81042d760ea55bd883d082009cc81041dcd3e59210f449ac26ef043c929dd52", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821314, "uuid": "7dd40ab7-b3b7-43c2-9c83-99b24fc60567", "value": "T149A3821B7FA00EF3EC6BEC3799D92B49249D541A20987B79BD30D814F24B25E59E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821314, "uuid": "fc4a439d-1289-4b68-817d-3b34b2a7c95b", "value": "1536:MPnUY7yDr03iR+7mHhVCgk8smw9WfpdZXTytEQ:MPnUY7qr03J4hV5pde", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679821314, "uuid": "1c80af4a-fc82-4f00-980c-07febf048add", "value": 104576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679821314, "uuid": "9e83ccea-2bea-4bae-aa08-eda85a3f82f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821314, "uuid": "0923679c-cc37-4bd6-87aa-e9553cc2a44c", "value": "d3f08094672ef313ce06088e97b4c1b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0537ba48-cb72-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679792609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792609, "uuid": "0f49148b-8f24-427f-bea8-7f429ec45311", "comment": "Malware payload (Smoke Loader)", "value": "5689008c1acb4ca318fac7b63d27422f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792609, "uuid": "6a99df5f-dd06-4f40-b7b1-d8bddc29c7f2", "comment": "Malware payload (Smoke Loader)", "value": "016101a10fa5cd4f908075fae3b9c87283122bda98fc52f1bbcc19abda7c2ffd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792609, "uuid": "5f6e46a6-79fa-40b1-8906-849e6b60d875", "comment": "Malware payload (Smoke Loader)", "value": "e530935b9df00df2ef2295a3655d73c301803a5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792609, "uuid": "c8284ca7-7571-46fa-8ce2-ff282fc14a52", "comment": "Malware payload (Smoke Loader)", "value": "ca8fa1924212fa1b0b67cc314ec4a301da6a75e43551463d9eb7f0aeacc1b22dd9cc8942e63e08f458faefddb0b54334", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792609, "uuid": "289653be-99a6-43b7-9e6c-eeab34557390", "value": "T1D6546D0253E16820E75387328E2AC7F82E2EF8615E157BFE12559B3F2971FB2D162705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792609, "uuid": "f0984463-94b1-4256-9e9e-cc49dae545a6", "value": "9c7e5bcbfd5f0ae72cc015cb41d480cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792609, "uuid": "3dce85c1-f0eb-4234-b9fd-f44b7d8ea426", "value": "3072:Cf+1ZxPuRem+RA2vYcm3aDaQ/AkcVMp1ZNPZsTGGrMpFBf5Ge2c4Vj1ljCJQN0f1:bQemsE3aDT1vZQqjPuduTfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679792609, "uuid": "254c2bfd-5cd7-4dac-bea3-a17b82f44b82", "value": 279552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679792609, "uuid": "d3e82980-392b-45c4-a9fb-14247418fed1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792609, "uuid": "773fa1cc-e9d3-40db-9a9b-f5c733ed6248", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3720b585-cbca-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679830488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679830488, "uuid": "adcf3beb-ed66-4fce-a846-438041f6253f", "comment": "Malware payload (Smoke Loader)", "value": "7e99f804517fe8da7f50d4860f839c0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679830488, "uuid": "beb75a65-7232-4720-8ae1-1f9576a828f0", "comment": "Malware payload (Smoke Loader)", "value": "01a01f2115f0ab650a022a5e1a3a01dc1b1c75f3291b48e4f3c4c8e182050df1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679830488, "uuid": "12e3a850-f510-40d4-9134-2f378a1fd186", "comment": "Malware payload (Smoke Loader)", "value": "546651a54a0500387d8b3c05fd2b09c2025342f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679830488, "uuid": "084dd575-bd34-4af5-8249-5f358ecde3f3", "comment": "Malware payload (Smoke Loader)", "value": "339b7e22e3905f4fdf47c98c74e2c824a39b14845c6710a63fc87b9cacec85a9140e2046de5161cf441a89f9d19114f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679830488, "uuid": "05fe45b9-28eb-490e-b8ef-154e2615cf3e", "value": "T1DF546C3252F07860E562D7338E2BC6FC2A1FB9619E167B7E17895A7F09702A1C172335", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679830488, "uuid": "24df5dee-ef5f-4abe-8974-e038d36a64aa", "value": "c5c75c5b6a7ab4fe20f346e6d5121c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679830488, "uuid": "fc9ff047-949b-4a4a-9f4f-ea576908c8d4", "value": "3072:i3MGy2m0tTutUZIoY2Uukk5bZjOurFP0SiVEePpMGyEU8/opNN4TJY:KB8cZY2LVrFP0CGyEU8/WNN4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679830488, "uuid": "9fdadc36-bb54-4c95-947c-64805b2dc3b9", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679830488, "uuid": "be61dfe2-dfa2-4f99-a827-c0baea015688", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679830488, "uuid": "7e25ae13-793c-42be-b191-1b131a86bc93", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaa4fe47-cc2e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679873739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679873739, "uuid": "f34fe03e-8513-4a61-9950-cc48ea94339d", "comment": "Malware payload (Amadey)", "value": "b4a3b88ed2ea05c0f7765ddf29932589", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679873739, "uuid": "822e0264-e60e-4565-a197-96e47c513f19", "comment": "Malware payload (Amadey)", "value": "030bbce7d3b72a04844f1c73d756a2d5cfabde58c902214c36ccc1737b1759d3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679873739, "uuid": "101a3559-f393-4d64-bec1-5469c91a166e", "comment": "Malware payload (Amadey)", "value": "bf05d109384aebcb5890950315773cc91a33e255", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679873739, "uuid": "f72a39db-bbc8-41dd-82aa-bff5849d7d91", "comment": "Malware payload (Amadey)", "value": "fd42046b6f2baedd690bb894291be0b90958ea51b81637976b0460e16ea5ce924cde2a8c0ebc76278393634aebd9a051", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679873739, "uuid": "073c3cb0-fd86-416c-8add-541941c258df", "value": "T1072523026BD8A176F83023704CF90ECB0B3ABDE75678971F6394989A1DB3558693235F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679873739, "uuid": "7676dab0-23d9-4cac-94ea-270797fa43b8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679873739, "uuid": "56e37786-76f2-4936-8ae9-c1e22febc6a1", "value": "24576:gyOMh1zMZ7td983wlz/HmpQKQux6SH4Xe:nduRHqwlzgQKQuZ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679873739, "uuid": "84dc95b7-7d8b-497c-8c64-838d66dae950", "value": 1051648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679873739, "uuid": "8669265b-b1c7-4cd6-ab10-1d268a137d4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679873739, "uuid": "0053a038-d8c5-4f71-82a7-013f21c11248", "value": "b4a3b88ed2ea05c0f7765ddf29932589.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d44b9959-cc2c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679872843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679872843, "uuid": "984f2fda-493c-4f0c-9130-63717de3e87f", "comment": "Malware payload", "value": "4c872384cfda5a0e075ce906e038751d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679872843, "uuid": "564fa6c6-00cf-4771-a507-69f0776d9dea", "comment": "Malware payload", "value": "03c174e6757abf8a3661990e8a5b1911e471304188603c859b92dd3c1ae0b8a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679872843, "uuid": "0028d180-af14-4357-96ee-1c8768e5ce55", "comment": "Malware payload", "value": "2fce62ed2213443347234471fd820a5235b0e83a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679872843, "uuid": "f521fff1-9045-494b-8eb4-b85ef89ae7b9", "comment": "Malware payload", "value": "0f07652c20005c0785402ad5dec17f9ad555c222dea2e5d2e59a55d9e30a6039f5703f7c9a316c12e687d26a560e5e1a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679872843, "uuid": "9c2cba7d-8a39-4760-b74c-7bbc2d446650", "value": "T1C6A32992B901EEB2F44A963608D34B347370BB954F531626725F396BAF362D43C27B09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679872843, "uuid": "695cf844-db53-4833-bd6e-e92b61c03358", "value": "3072:oYWJDWdSYRgTyhVewQ4UT/nvZCU4jZc5Z7A:UJDWdSnTyh1Q4UznvZCU4jZc5Z7A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679872843, "uuid": "74554061-bdc8-406c-8253-712cd9de2590", "value": 107230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679872843, "uuid": "42fb396a-a7de-47cc-b2c6-873fd19870a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679872843, "uuid": "96935f01-6ae2-45b1-89ac-03e7c0b1c80c", "value": "4c872384cfda5a0e075ce906e038751d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14c76b1f-cbc2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679826995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679826995, "uuid": "f25aa60f-e09e-48c8-bffb-2a9c8b8830fb", "comment": "Malware payload (Mirai)", "value": "7ada43d8311e83724c50aec070409584", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679826995, "uuid": "bd65cf70-0a04-46ae-9989-e11b2a39e64b", "comment": "Malware payload (Mirai)", "value": "0665e794613d18a12b419bed57aec92e87d0c578daa663057ef4143c58a3765c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679826995, "uuid": "b192dcda-6f36-4944-b1fa-7253a0a6264e", "comment": "Malware payload (Mirai)", "value": "3703a02d42eed547bb68cec009ad0e3435c9537d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679826995, "uuid": "bfbcd8ba-d1f4-4ca8-90fd-37b9d3dbd2d5", "comment": "Malware payload (Mirai)", "value": "2a8081086bee5d8d55e441f7a598cc7788b49fc422ba93b67f42aa71ea72f5eef650d5f584db2363aae66a64385ca81f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679826995, "uuid": "3eb92d7a-49ad-475e-811a-55018e0aefa8", "value": "T170542A46F6D8A72BC3D223BAFA7A0B6F33358648A79672155D3016743FC27587B36024", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679826995, "uuid": "afbda224-ef56-4e6f-8e30-b5595729bdfe", "value": "6144:KCui818ejavN7Fo/qU/aUvvNl92LMhyYuj:KCkyejat67kc2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679826995, "uuid": "53f059e9-5c60-4dff-b4e9-7b832fadd631", "value": 281949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679826995, "uuid": "9256f897-4f7b-4c2f-9667-1cd546f87ea0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679826995, "uuid": "e976cacd-a4ef-4bcc-94a6-2e76c99bed4c", "value": "7ada43d8311e83724c50aec070409584", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a51d76d7-cc02-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679854725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854725, "uuid": "c5f1596f-6b5c-4a52-8b3a-97b49163ce06", "comment": "Malware payload", "value": "9aa970a8daa0d41f2a44f35d2c45d1fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854725, "uuid": "8d89fb14-ec96-424b-bfd0-11c4cbd881be", "comment": "Malware payload", "value": "06dd84506e9e1ba03deaacf128aa3b8ceda871238c1c224adc70bf86882d2023", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854725, "uuid": "ddd28d08-4b7a-4a81-a7f7-951595da1065", "comment": "Malware payload", "value": "5b10668fce81ec1c5cd07e9466a31e203c6246b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854725, "uuid": "df30d445-1c0a-4d32-8a3a-ad2a8e9f1134", "comment": "Malware payload", "value": "77208344ce6214fcee0fae004320b1dd8524e6f485b5ceaffb4c8b69c8addfb2bef0d4782fecb9f12891393135f8f81f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854725, "uuid": "113f1b48-6470-469d-9b9d-89aedaf23edd", "value": "T10CD58C32BB049136E6D211F1C90D1BAF494CA53403B940D7E2D53AE969E0FE36B36B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854725, "uuid": "b8fcffed-c692-44ba-bcac-cce7138bd365", "value": "612edbc3b53f6e607818891b34ab969c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854725, "uuid": "61f5c48b-a92c-45a4-9080-b1bfa46f56bd", "value": "49152:dIeRAyC+m+cBR//7E1Cisg0F/dFPTpbodt4RnaEqG/GwY6eprZdHfIW:BR1CDCsLZ3PTpbodmRa0+w4hHf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679854725, "uuid": "a5615b2d-1085-440e-b42f-a0a7704b76ce", "value": 2792960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679854725, "uuid": "4c57406e-6a14-42db-854f-6f2ee43a1b74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854725, "uuid": "522a1394-97d2-45d1-8275-4231f61de6ca", "value": "9aa970a8daa0d41f2a44f35d2c45d1fb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99564b32-cc02-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679854705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854705, "uuid": "77089caa-a9d2-4392-bc6e-fc147a3d29e9", "comment": "Malware payload", "value": "ee67531537d7cb10743add98f66b484d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854705, "uuid": "c64d9925-4f04-4c7a-948a-e1abef09c509", "comment": "Malware payload", "value": "08d9b4410d63b2b3fd06a0db9bf25849127892000bc9b0863975fda700851d44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854705, "uuid": "d239c6bc-2dcb-41b8-b98e-2a5625ff08a2", "comment": "Malware payload", "value": "7556afaaa837df96358a025584434762072120e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854705, "uuid": "6e3d227e-e582-41e5-affd-4c553ca54d01", "comment": "Malware payload", "value": "81c1e78ae4319c696ec32a1365b362e04fdf48c5742346581572beaa7a63a94bfb3ec45933a0651d3c8ffac7855876d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854705, "uuid": "302c85e9-393a-4820-a416-83d03bb18fe6", "value": "T11366338BE9C552FFDA1A86B06CBDC4125D4A7D97F078742D35B188E89BB712B70B0123", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854705, "uuid": "fa088717-3689-445e-a9c1-1b4fa8b4a2ef", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854705, "uuid": "a07d6128-c0e7-494e-939d-b2931dbaad78", "value": "98304:3W13mLni/5bhO58kstEdxyL+JLiJf8ictNAxfxkLJsrwolpUt0m/i4SNoi9m7:YssNO8VyL32fGLJUwo3US1R9+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679854705, "uuid": "7a45364d-1d14-4bbf-bfb4-243cdfb18ae5", "value": 6513060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679854705, "uuid": "7d1169e0-5856-4e62-9f21-eb064ebd301f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854705, "uuid": "21242f32-b18c-40bd-a9d4-7bb6ae456090", "value": "ee67531537d7cb10743add98f66b484d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf1903cc-cc11-11ed-88f6-42010a9c006e", "comment": "Malware payload (Chaos)", "timestamp": 1679861237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679861237, "uuid": "2f396d72-f0af-41c9-a2e3-6b59ec99acb2", "comment": "Malware payload (Chaos)", "value": "bcf73d0b807d66634d7d25f399fa8ffe", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679861237, "uuid": "aa89b0dc-16ff-4b28-b425-c5ec5cb88d74", "comment": "Malware payload (Chaos)", "value": "0bb2957b2b8ed0a1c458da6edeaf5a48b2c1ecdd7d7ed33d00749ef1f5653b1e", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679861237, "uuid": "3b74eee2-8ac7-4343-8759-b91022b89014", "comment": "Malware payload (Chaos)", "value": "3db3790b46e2d430374f6c40e7ce25e633696b75", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679861237, "uuid": "18bf0620-b290-4a20-8113-94a71e2fff1b", "comment": "Malware payload (Chaos)", "value": "923e29feb1ab24958b7db04b94ccfb58832ad6214bafaa211f69c8bc850ceca77565a62acf4016724372e68c26b6cc76", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679861237, "uuid": "d6d8cfb0-30c5-486d-9110-a3ee6fbcded9", "value": "T1809386A1B667DD98E85A0FB10C76922001776E4DCCA9D50D30EE3E2F767335328A2D5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679861237, "uuid": "5374da06-2129-4c73-850a-7f7fb98ab3a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679861237, "uuid": "bca410a9-aad5-41e5-bf6e-f9fe70bac851", "value": "768:Hqo2MgNp4wBAQr9uNev2SU2Ip4jBqltCF0AxEjenoB69+Fx:Ko2g0AQr9usv2SFHBWAxEjc+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679861237, "uuid": "22284719-c7db-4fba-8c34-d782cb31ea84", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679861237, "uuid": "dd8d1e5f-3feb-4706-acb8-8050cbb92e67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679861237, "uuid": "949aa439-f52a-4541-bb04-73a3c92061a5", "value": "2023-03-22_bcf73d0b807d66634d7d25f399fa8ffe_destroyer_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "534962e1-cbb6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679821946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821946, "uuid": "c635eacf-8960-463c-a9bf-29c57e3b5fd6", "comment": "Malware payload (Mirai)", "value": "2b5b6afb048bc8ef5a14fd85a5d47ccf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821946, "uuid": "3dd69bcc-4182-4f90-b6fc-df841ac0479d", "comment": "Malware payload (Mirai)", "value": "0bea740b60c6789d4b9bbf52ec4762aa128241bc326a70bf5efcdbe861382efb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821946, "uuid": "1b2668cc-4266-4b96-bb57-91575ea3a4a4", "comment": "Malware payload (Mirai)", "value": "5d228382365be171c05734e4eca59f7d1e0f3699", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821946, "uuid": "f282b060-7a45-4bce-bd81-a42dac46d486", "comment": "Malware payload (Mirai)", "value": "31871e6b5ac14dc8d8a9a57b095474230672b1dcff1d8329a8012c6e5914d63e577594f4ed8f9b19875a6b947fddf0d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821946, "uuid": "9d7c3a54-4403-4d3a-8b90-0f3c80d4aa93", "value": "T1E083A41E7E228FADF76D823147B74E25A79833C627E1D245E16CD6012E6034E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821946, "uuid": "e0e635b8-6543-464d-bcc5-584eb7a3a9d7", "value": "768:yKldWlqYPr8/UZ0ItRhYG92UoNtlPdO1d695QNioH6U+zwMi14ngbUXJTYLSybwZ:yNn6Ue22Uo3OKq+zwb4nt5feSn9W4c4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679821946, "uuid": "bace5ab7-b2d7-4631-ac0c-2ffec9943d51", "value": 84764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679821946, "uuid": "cd8a1b8e-914a-4bd0-b8f1-e1cc843ad212", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821946, "uuid": "f87a8557-7ff7-45f8-b865-8e3c87728237", "value": "2b5b6afb048bc8ef5a14fd85a5d47ccf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c64adf48-cc04-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679855639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679855639, "uuid": "cbe64c11-c3ed-4b46-ba23-46dec1b66385", "comment": "Malware payload (RedLineStealer)", "value": "a9f1d139268416c799550a0741aeadbb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679855639, "uuid": "bbf0b51c-9785-473f-ae94-746a084e7354", "comment": "Malware payload (RedLineStealer)", "value": "0cad2cfc06b38439809d62e1c5ca38068fce11b1442dbdb4eaa32e68c2914b55", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679855639, "uuid": "c1e3f4fb-2967-4473-8385-7c36ae74a590", "comment": "Malware payload (RedLineStealer)", "value": "a2c3f3ff9443023114b94add4f7a30c165edd50c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679855639, "uuid": "16244b99-184d-4939-8de0-7e8163bf4bd0", "comment": "Malware payload (RedLineStealer)", "value": "46902d933a448f2998e304bb7b24e493ae7fe77fc01a67b3c721ef1af2bb08c23c6f610549e91e4b4527600ca10a7917", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679855639, "uuid": "f67cf56a-3fa3-4e00-8c9b-6de707e19826", "value": "T1CFE4231397F59532E9B617F098F716C30B32BCA1987897A73791988E0CB39806476B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679855639, "uuid": "a6981fc9-737d-4173-8256-764398dce960", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679855639, "uuid": "c3d25786-96e2-4bde-960f-db5fe79bf155", "value": "12288:9MrQy903BCHk07CUdCa9RW4mTc73ZR+OYmMJuH64N4k4kk+B6q9wcK:Ny5XeU00+JuiiDDK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679855639, "uuid": "bada4046-618f-4057-a7dd-c0fd57593d3c", "value": 702464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679855639, "uuid": "d5032354-5b25-4715-af90-39a57d3b33f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679855639, "uuid": "a3231b8d-b658-40b1-ad63-bc9a15eaf407", "value": "a9f1d139268416c799550a0741aeadbb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af3b6f9e-cc18-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679864190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679864190, "uuid": "1414fc42-0937-49f0-b386-f712db8bd410", "comment": "Malware payload (Smoke Loader)", "value": "31b1392625e830d8f99fbe2175050e02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679864190, "uuid": "28ecc787-7c95-4498-9547-3ffa00fe3790", "comment": "Malware payload (Smoke Loader)", "value": "0f931e984c46fc75191a17436514595218d8b88b73ad84f9ff68131cb463b387", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679864190, "uuid": "b9983c61-9859-4823-be4e-c95f12366fb0", "comment": "Malware payload (Smoke Loader)", "value": "6c7fab787e8b521cdc4d8cf1c69035232296fee6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679864190, "uuid": "dfb8f58c-8149-4ecc-9ad5-1eaa8d718c38", "comment": "Malware payload (Smoke Loader)", "value": "4093a5231fcc2da09b6b92d3312949cc67edc05e27a7197cd0e002bc5002fc33b99b3d8537eade03b0ad5062934d91a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679864190, "uuid": "34052dff-7f61-4684-9ba4-de68d9d4a922", "value": "T18B447D1A93F47860E5734732BE1EC2F42A2FB8205D577B5E3649AA3F09707A1DE62704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679864190, "uuid": "3684f76d-34a1-47f6-9561-004b77e2875d", "value": "e995a4cf6af4dc2215ec1060df8374d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679864190, "uuid": "f4cbe9f4-4da9-4cac-b400-971327a6e88a", "value": "3072:tO8LBhA+dFK2teEZsmN+7GRBCnAU98CqS4NsQ9p6WDAKN6mvDZ2trDBn78F:/hnU2tessm+AU9GSrQ9p6WDg+FQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679864190, "uuid": "ef5a3604-2586-4787-9feb-56f9df28304b", "value": 275968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679864190, "uuid": "ed315be2-d721-48da-b89f-068df0238bae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679864190, "uuid": "1a71b16c-c03e-4061-b682-65e451d37450", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f01b70ff-cc16-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1679863440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679863440, "uuid": "025b1555-5629-4177-8cac-e1e18a1d1132", "comment": "Malware payload (CoinMiner)", "value": "066793cde98c8983ec676ab7e848dd4e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679863440, "uuid": "f464473d-faf2-4b35-93c0-0a046e8e105b", "comment": "Malware payload (CoinMiner)", "value": "1062c7e1e883e164b85d224cefa62450e507f056fcf8924f133ca9b65abae360", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679863440, "uuid": "c6342767-e4e3-487d-90e8-7f31f35e39d3", "comment": "Malware payload (CoinMiner)", "value": "1d35175f44ae52a6238dc9ddd3acc6f6af8f5639", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679863440, "uuid": "e08a2201-3c9e-44c1-8692-da9a17eca5e8", "comment": "Malware payload (CoinMiner)", "value": "4c8a740ef1fc50f3d151da9470d560d1b1d251c131e55376b7336c5ee6fd511c7b56d1b7704150016fbda1944ecacadd", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679863440, "uuid": "fb72032a-598f-40d9-b586-c5d85f34a746", "value": "T1D2447C2E93F46860E1374732BE2EC7F82E1FB8214D177B5E2649AA7F0A71661DD61304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679863440, "uuid": "44d96bc7-3131-482a-bc1a-cc750125242a", "value": "e995a4cf6af4dc2215ec1060df8374d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679863440, "uuid": "300584fa-5243-4859-b4bd-11492cf143e6", "value": "3072:+3BLbpwA+dFGTOxXqS+jK+N1nfBFDR24YYi0Fak7mxqZkO5njIrqokdkun78F:wwnYTOxXV+jFM4c0V7m4d2qokd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679863440, "uuid": "06413193-4c1f-46f0-81d6-1919f46ef4bf", "value": 276480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679863440, "uuid": "78691873-bbf9-4453-8014-fdc2ce4ae4b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679863440, "uuid": "6986381e-c3f4-4f13-8458-b9085eaf84c1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "698ae1b6-cb73-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679793207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679793207, "uuid": "28d4666b-dda9-423b-972c-7d1d08b9c2ff", "comment": "Malware payload (Smoke Loader)", "value": "35feafb1a357031bd7a71f75ff70e0d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679793207, "uuid": "657cfd68-cb23-4b0e-8354-b78436dc7598", "comment": "Malware payload (Smoke Loader)", "value": "108c18b44cd583640881697678081f56c7f96a7a6e1452ed073637e9e4772daf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679793207, "uuid": "35309456-a0ec-44a8-afde-78360149642b", "comment": "Malware payload (Smoke Loader)", "value": "358e6363bef3ce81deac6fd5647106ca5fc30d37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679793207, "uuid": "2e4c9f4b-70cc-4bff-9c94-4beea97c9b94", "comment": "Malware payload (Smoke Loader)", "value": "0da98fde22f995f1b415ab6da738f55a8e49dbdf4dfae2579f9099d1223c5212a7f22ac0c620b3e4a7301534b5311f6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679793207, "uuid": "ed4173af-f7aa-4507-b814-dd14d6cb21b3", "value": "T1A7546C0253E16820E75286329E2AC7F82E2EF8615E557BFE12549F3F2971F73C162706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679793207, "uuid": "7f0d120e-a4ce-43da-bbd9-ae3d18741d4a", "value": "4ab2a4d536313c74a2690207bf67c9d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679793207, "uuid": "25ab1df8-73dd-496c-ac53-09ad6214a206", "value": "3072:CUxiMPZRylXXAKvgFZOp9K3GcjrhEPl18z6XjbMpJh94pxHY+ZyuggkaKiCJQN0o:ZNylHUu9K3jVz6TIwxHYYyuggka0Tf2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679793207, "uuid": "cdd3ecb8-7959-44d0-bac8-5846ad0b3c02", "value": 280064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679793207, "uuid": "3f94a2b0-a1e5-445c-aa4b-deb9112052e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679793207, "uuid": "c8c52bd3-bc14-40b8-8892-9cabf424df21", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c00df8a-cbdd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679838711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838711, "uuid": "0512cb93-8f22-4e40-8c84-204da983324d", "comment": "Malware payload (Mirai)", "value": "128b4439eaf1a678a573bd59433b9b24", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838711, "uuid": "1d66eae5-914f-4021-86ff-ee0836896571", "comment": "Malware payload (Mirai)", "value": "10c7558d17cc52691a843884621a2b5119db0444ece73d04dc8365628854eced", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838711, "uuid": "a457efda-c607-480b-9fbe-b5558aab0839", "comment": "Malware payload (Mirai)", "value": "a9157072e5dcca66ec6b97a512e910e34aaa2360", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838711, "uuid": "8c81987c-7c37-4d98-b688-5fbee08b2771", "comment": "Malware payload (Mirai)", "value": "07cae628f25b72f77961548c2763bf8c4050365c94f6a5ae08809f8dfcb8a267482d6bc6675d5c23f18fa3254439b8b1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679838711, "uuid": "8287b2eb-163b-47b4-b5eb-4e80f441ed6b", "value": "T19DE31806F8004727C2D16BB6B39B038D77225FA99BDB335199297DB02FE0B591A395D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679838711, "uuid": "3a2d61ce-50f3-48d9-9ab5-412eeb193240", "value": "3072:ahRHih54YD1GMwxv5R07rxcZ39ARetJ8add9Qzhsnyq3N64DhgxnQXL4CQSU5Wv3:Ly0XxotARetJ8addQiyqN61QXL4CQSU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679838711, "uuid": "a0285003-efb8-474f-b4f0-6b614450fa99", "value": 150825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679838711, "uuid": "3dae82da-6c9b-4792-89f7-414ec777e6fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679838711, "uuid": "cdd7af5a-9436-4613-91f5-90d652eae95c", "value": "128b4439eaf1a678a573bd59433b9b24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9b9193b-cbcd-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679832049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679832049, "uuid": "bfe69b9d-cb90-491f-ac4a-7539c9787009", "comment": "Malware payload (RedLineStealer)", "value": "7e51812850f1eb7eee1953eee183eb75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679832049, "uuid": "51fdcc93-fcb9-4737-8ffe-d540b4b8ce2b", "comment": "Malware payload (RedLineStealer)", "value": "10e49a3361f4f1e607c93d1a564c98a59751285a5a5d4c0e84c2c8febf5b8a8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679832049, "uuid": "8f22556d-d9b0-4ebb-bd4a-f022d827db4a", "comment": "Malware payload (RedLineStealer)", "value": "e6c89fe75cb607db6e59b4025f3cd00f9025eef3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679832049, "uuid": "24bd7df2-c739-418a-9874-06a1681505c8", "comment": "Malware payload (RedLineStealer)", "value": "38944131adc595309902b4f27145ce336adb94217e58af21c0d18137e35ec1b419ca30c5608575eab0137c0e00febb13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679832049, "uuid": "7cd4823e-a69f-463e-8220-403223f41268", "value": "T15B546CF0D3C78E72F43FCCBECD8F1592033C9E9259940A86A8569EBC0141499A7A7D97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679832049, "uuid": "16c1a4a4-96ec-419b-905d-dfbcdb6c544a", "value": "5efb9ab375d470b5b9cb24c90592e4dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679832049, "uuid": "752dccfd-db2e-479a-a4f4-33b881a8a88c", "value": "3072:GvQfb2nN9ZuK3OgUyCK/y2ChX6XkHGHU5CvLOz2wX8OZ12hmLa0TjzN0jgQfcjlt:G4CN1NUyn+qFvjwX8OZ124510jt6OK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679832049, "uuid": "ef9fcc3b-01a1-426d-af55-76fffe1b2466", "value": 299632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679832049, "uuid": "a140b19c-743e-4714-be8c-a3a4b6bbb914", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679832049, "uuid": "78b333c3-1b89-4bc3-8619-a6f721a9d2ca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23edb97a-cbc2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679827020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679827020, "uuid": "fcef7c85-db33-41bc-9101-c6d3fec8fa73", "comment": "Malware payload (Mirai)", "value": "f2887ffb45e4a7b250bbfc20bd8e62e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679827020, "uuid": "b40e99ba-21a0-4fa6-9db3-c5d2d0a4a10b", "comment": "Malware payload (Mirai)", "value": "11d43821d7ea5a90dbb0ed166d1eb48bc0a6e18ef5c3da2d7aa75b35ff52d259", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679827020, "uuid": "99b50769-9f06-48ff-9b73-50189c09772a", "comment": "Malware payload (Mirai)", "value": "1fb433513db44c698de2733f6d13322321ae2fec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679827020, "uuid": "31c07a21-865f-4de0-bae0-b5cc551ac896", "comment": "Malware payload (Mirai)", "value": "c58db01a377c2e33339026ab655ab40c62295777003a3b06b1910e761f2c93bfc8aaa8fb9d5ba41f85891a263589c2fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679827020, "uuid": "14987139-ec90-4dda-8868-64431f8332a9", "value": "T1C0534A21A8B92E13C0E5F57B22F38324B2F5570E24A8C66E7C360F8EFF1855065476B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679827020, "uuid": "6b90dbc8-5a72-406e-8286-6dc9bb9c7e8a", "value": "768:o7qtsAOUAoEq9zeCghD4ms78RI5uyIttuZmp5B6WlxOO+h1UqFwM:gqtsGABSzeCU4R78RI5PIttLl8hj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679827020, "uuid": "37a3b19c-e6a9-4a1a-b63d-e886fa09e066", "value": 62476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679827020, "uuid": "a63b2a19-8e1e-454d-ad4d-66840541963c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679827020, "uuid": "58aa27ff-e70e-46ed-91aa-2322ec503bdd", "value": "f2887ffb45e4a7b250bbfc20bd8e62e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed98f2b2-cbb1-11ed-88f6-42010a9c006e", "comment": "Malware payload (NetSupport)", "timestamp": 1679820057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679820057, "uuid": "2b7bf1df-0f98-4a7f-95ba-40d8ded9e9a3", "comment": "Malware payload (NetSupport)", "value": "359dc605a71b25b69d2e7673202c79c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679820057, "uuid": "27e43612-465b-4694-8b7c-ec4b22708afa", "comment": "Malware payload (NetSupport)", "value": "12cda2b4c69e83ff66a7e583597e6182cc95211c305829b586301906e6351949", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679820057, "uuid": "495708a2-cb7e-4d3e-936d-3f3da2698cf4", "comment": "Malware payload (NetSupport)", "value": "e915fd1a5f8483991069cc41abf872489faa7a19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679820057, "uuid": "56215b82-7cf8-4d91-b88d-5c3d9af6d93a", "comment": "Malware payload (NetSupport)", "value": "e1f301f35e44ee11083b2ddcce6221c941646db5d0c0fb1ca5f9b0497150d6f6ddd5606fde5255ca477832f86db3820e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679820057, "uuid": "0f9f625d-57b8-4f2b-9634-593e1f75b1d6", "value": "T1EAA533923994F171EEF94030EE2751FE8E70FD36DAA8A4437B647E4939705A3801B693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679820057, "uuid": "66a85fce-9ee0-464c-99e5-52ceda15686c", "value": "dbb1eb5c3476069287a73206929932fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679820057, "uuid": "161bd22e-d02e-4f03-ad32-11fa17ba3d6c", "value": "49152:tt6iaPw71zyI2im0OoGZ3/uHOo8PWVjnJEZGVuuRkKsN/CrgjNQ:tt6iaPw71zP2ib7TaW7EZGUQvsAONQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679820057, "uuid": "eb1f54e5-6975-48d5-a0e3-5cd06a24b618", "value": 2242826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679820057, "uuid": "672d879f-975b-4d5b-8f52-0c1e031e231d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679820057, "uuid": "e259e94c-a565-41aa-a3a0-0c9274d057d5", "value": "359dc605a71b25b69d2e7673202c79c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ea947bb-cb75-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1679793940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679793940, "uuid": "ea3ff277-1b79-4fb9-8820-4d7db32065a3", "comment": "Malware payload (AsyncRAT)", "value": "6df5779b33f1d8b340629b54e1577417", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679793940, "uuid": "81cb497f-30d8-4513-b368-d70d8c0a7465", "comment": "Malware payload (AsyncRAT)", "value": "1383896f2ff5aeb8b5441ca84559cff12f36180140effe2c793c6cbc17cd7c11", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679793940, "uuid": "eb236329-704d-4606-ba69-1c7db20a9126", "comment": "Malware payload (AsyncRAT)", "value": "3a92fb229eca78049c1f8036d8b1883af93eb79a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679793940, "uuid": "de00c2aa-be66-4963-a18c-bfde4ff675da", "comment": "Malware payload (AsyncRAT)", "value": "3ea61a8fd2e769ff660e5719372523c58065439a60d212e2fe4633fd2d007138bdff766970ce8ea4a42e790a9d30fbe0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679793940, "uuid": "f69af75d-9bce-4756-b36b-5717ef22d769", "value": "T1A4231A003BE8822BF2BE5F78ACF26145467AF1A73603D54D1CC4519B5623FC69A426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679793940, "uuid": "8ed6efaa-6808-4a64-b9ae-f484bce4de79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679793940, "uuid": "0cf931cb-6fb4-4e96-a7fb-37f963a3c103", "value": "768:vuwCfTg46YbWUn8jjmo2qrDKjGKG6PIyzjbFgX3idZd8Yje/aeumBDZSx:vuwCfTgp/2OKYDy3bCXSd4Yje/FdSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679793940, "uuid": "602865ea-a7b9-4b94-ad38-cd00570e9679", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679793940, "uuid": "1d05396a-4ca7-47c2-8cc9-1262a0063a07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679793940, "uuid": "0b50d1db-e8e2-47c8-8019-f2b508c07306", "value": "start.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "475a410b-cbc1-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptBot)", "timestamp": 1679826650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679826650, "uuid": "dda42774-cc15-4586-b448-f4079afb12af", "comment": "Malware payload (CryptBot)", "value": "677f1cce8dde03b9b196cc190c297151", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679826650, "uuid": "41b7a78e-033b-4d4a-b5fe-c077cb1a13d5", "comment": "Malware payload (CryptBot)", "value": "13a1209698c56df1cacb4e0f88cac8f54d154b1367b66132dcbdeb57d141705a", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679826650, "uuid": "d83d07ba-aad7-4dd0-a195-b4113e06bd39", "comment": "Malware payload (CryptBot)", "value": "5de570a7b3d511424ea1e79b2058c8f0a895313b", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679826650, "uuid": "8bb14fd5-1dad-4b91-b032-4e95386d19b6", "comment": "Malware payload (CryptBot)", "value": "8ef3eeb1b2339c5c89d918892af43303133553ca49588e16e6cc5847311a98bd43ea545c89cade340a334f1d47c8b1f4", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679826650, "uuid": "e2c7454d-b486-4860-8791-4c06f68bcd01", "value": "T1A5862352597C01CAE1F54836A41B3EDAB1FEAF6AA302C4F960D6A7D03533F81981E477", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679826650, "uuid": "3148c065-9437-4d9e-887b-6a17c0347328", "value": "7d59f1d82b84e111e9b6c1196cc48fca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679826650, "uuid": "3faff297-4a28-4c80-87ab-b4eaaf06e221", "value": "196608:ah7WJVYPY5YO3zN/8WQqftACMLXTtPsRQfF6XTcd:U7o5jNUqfaFLjLAjK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679826650, "uuid": "6c1922d5-eee5-414f-8933-ee83fa0d1982", "value": 8120320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679826650, "uuid": "2bca7fb0-fa07-4eaf-ba88-14fdc7251376", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679826650, "uuid": "b6771eb2-757f-4340-9d79-a9c1a4dc111d", "value": "677f1cce8dde03b9b196cc190c297151.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "461b16d8-cc12-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679861437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679861437, "uuid": "71e35057-a123-441a-bff7-a8963fef2f6f", "comment": "Malware payload (Amadey)", "value": "1d8e948bf0a9c13677ef1f27daeaea98", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679861437, "uuid": "4f2f5d97-9873-4966-b5be-6d215170cf2a", "comment": "Malware payload (Amadey)", "value": "13b5ef24472eb8dcdb12adb23ea8cbd08285ac279fd1246aceb4b8adfcaa30ac", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679861437, "uuid": "377cb97c-29f9-42cb-b985-6059d5b802fe", "comment": "Malware payload (Amadey)", "value": "5f157517268b9d13d0f27334211a4baa0102204d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679861437, "uuid": "4f5df791-927f-4ff4-81a3-89ddde9cfeb7", "comment": "Malware payload (Amadey)", "value": "e24f21479cc121f550187045b2b1dac48ff8f93c57b8bc4327359a5197e68c63c311becc22fff80c4dd98fd73fd5d288", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679861437, "uuid": "cffc8788-aa27-4b7f-b45b-a99c5e0dc8cc", "value": "T154252307B3E854B3E9752B7048FB06475A37BD414D284F5B7751A86B4DB3280A83AB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679861437, "uuid": "1dc68c3c-9e99-49d9-a791-0c67d04f7490", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679861437, "uuid": "116d045c-4d39-4bbc-aa9b-72f73272dca8", "value": "24576:JyXOMGY+JH6rv2upI09QZs5I8SIqVru8aH1GTWrDf/iWeBBk:8yXJH6reurQZ8PqVqlVGCrDf/iWeB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679861437, "uuid": "711f0be2-3d1b-433f-bf88-4add0574e50c", "value": 1056768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679861437, "uuid": "ac5a5d97-8a32-440c-8e10-aa525c414227", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679861437, "uuid": "07713d8c-0982-4095-9cee-0a7a0dd9bd90", "value": "1d8e948bf0a9c13677ef1f27daeaea98.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bf14b9f-cba5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679814739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679814739, "uuid": "1d73cbdb-0faa-4fcd-bdda-231cc0afd871", "comment": "Malware payload (AgentTesla)", "value": "093594b4ae105107a3ebd11a140adaa4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679814739, "uuid": "ed207496-fe70-4372-8043-e56e43a0bd4a", "comment": "Malware payload (AgentTesla)", "value": "15b0f8e2aed7ee2ada1092022c44479d911c860804a28933fb98db80c2c560d2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679814739, "uuid": "8d1fea4b-66bd-4aab-95cb-3dee93ae1616", "comment": "Malware payload (AgentTesla)", "value": "c70cf1b8d03bad7e68e40d76693ce77effbf5f10", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679814739, "uuid": "2e5ab63f-d0df-448e-9a79-70f604b2901e", "comment": "Malware payload (AgentTesla)", "value": "323a53007a99d80c2877eaa684e48aa93a38d76e35f74aa8ee9e39a2e60fddb4948931d27cea87e0b4c74df3145aa01f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679814739, "uuid": "c8b68fae-dcea-4689-a54b-d5d7c862a391", "value": "T1481523547FBC0E21C37E13B92778A0CDD2B67A2B9B58E9A55799818DC5CE61802313F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679814739, "uuid": "4995e90d-c378-47b2-bf0f-9664ca8c7d7e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679814739, "uuid": "7ded70f3-9e06-4f9c-9190-71e61d903fd0", "value": "24576:2+45JMD6nRKs96f70/XHjmZRCZgPdr3zL:2+xu40X5KFr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679814739, "uuid": "7850e86d-15dc-4894-8870-ae2f9d213607", "value": 905216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679814739, "uuid": "7df19c3c-e688-45fa-b263-864f932f2c63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679814739, "uuid": "bf6ec41c-4b04-47f0-bab8-351007bdaced", "value": "New inquiry - Qingdao Wisdom International Supply Chain Management Co.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29ae1514-cbc2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679827030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679827030, "uuid": "75e19f34-8898-4ccf-af90-576747ba8ed5", "comment": "Malware payload (Mirai)", "value": "1be47ec3bb7e059d0290e6caf77089d7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679827030, "uuid": "83934c8f-c956-40b0-8f6b-7373c3178f9b", "comment": "Malware payload (Mirai)", "value": "173393702af1c1bdc6a89341cdb24d14259a04c6215bf32935f564abe03c9214", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679827030, "uuid": "1861d47f-9442-4e1c-b0ff-3d25e093883a", "comment": "Malware payload (Mirai)", "value": "ef15267168dae2bc3de2cbc9116e725f1a87e3a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679827030, "uuid": "320d1c2a-8666-4335-8c25-98e45a0724f5", "comment": "Malware payload (Mirai)", "value": "7aab7dee2c0d9db895fbbbe4abb7a9458bbeebb5920432d4f660a2b2323caa77a8271ceac28c158d35e5f44a54992821", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679827030, "uuid": "7f3ceff4-3b70-42d2-a576-3c83919b1060", "value": "T10C342989FE18A72FC3D227FAEB5903CE33398658B7DA72115C31197477C6B24A627124", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679827030, "uuid": "a59c5564-2ab6-423e-a01e-d7e6c0eaa39d", "value": "3072:plvRwtZgdv6GMBngDD/nYbGLnSw0EHfYaE2L/t/nRRUr11jFs6RDpFIMsjbr:/vRwtZgdv/p/lRRUrv5s6FF4r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679827030, "uuid": "9c28d7cf-abb7-4be1-8be8-675f9d01d630", "value": 235663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679827030, "uuid": "b9200dfe-ddb4-45ab-8f02-8a3f4cd2db79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679827030, "uuid": "2410ca5c-fb0d-425b-b4cd-dad6512fa357", "value": "1be47ec3bb7e059d0290e6caf77089d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ef6dbf5-cc15-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679862821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679862821, "uuid": "e920f376-7377-47c3-856d-7d02c20e205d", "comment": "Malware payload (Amadey)", "value": "2af8eaa48a29c8f797e235ef1fa8f6b6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679862821, "uuid": "baa67015-5b12-4001-aa22-8d26a298f1c1", "comment": "Malware payload (Amadey)", "value": "18dba3322b369137fa5b4ad91a7ee6b2e420f08914c51dd27eceaeb39d7cb6cd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679862821, "uuid": "ab24c2eb-7d0e-4453-b286-f133600b3c42", "comment": "Malware payload (Amadey)", "value": "ed47aca3c4336827a1142412e98bb6eb6a210de3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679862821, "uuid": "04c2e15d-3e51-4767-86c4-607fe4873b79", "comment": "Malware payload (Amadey)", "value": "6d9fdd047d76de48f28d6bc32d7285976a83ec299a706d2b5dcc26ea04bf61c6fe4563faa8336e2db08ba868fa6c8921", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679862821, "uuid": "69cec070-a3e3-48b4-a3a1-fe6f65fe8587", "value": "T165252307EADC6032E8B9277058FA03530B37FC564C6593AF1B976D4E1CB26D169323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679862821, "uuid": "7115dde1-5d31-423f-a616-838542b3b614", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679862821, "uuid": "a707bbd4-6fd6-46fb-9b73-7ca1608996c7", "value": "24576:HyYIZh1Ln374SWDoClOJP8lZT6AirPdt0Rv3URr/T:SL1DMSIBDTB6QR/U5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679862821, "uuid": "38093571-119c-459c-b064-a0350b4b5465", "value": 1056768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679862821, "uuid": "ffbb57f9-8c12-41ee-bd61-5847a65349f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679862821, "uuid": "d13024f0-e097-4e0a-8081-8f30e0890071", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fe9dde9-cbd6-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1679835603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679835603, "uuid": "efacacc8-bdc8-430d-821e-16040e0a7560", "comment": "Malware payload (GCleaner)", "value": "6d285058a6d02424698eea4b9f85d069", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679835603, "uuid": "177ca71b-b92d-45df-a7e7-cdaf9850091d", "comment": "Malware payload (GCleaner)", "value": "19ae03c7f06efdcb94dab279f478f4256498c0a7501c327aa1cb13247f74f2b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679835603, "uuid": "942bf1ab-0f99-43aa-aa4a-15bd3cb0b3de", "comment": "Malware payload (GCleaner)", "value": "32ba680c41cce1b585a7d1c9ac504a784e15cfaa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679835603, "uuid": "eac4e1f1-1f9b-44ea-b8c9-7114e932888b", "comment": "Malware payload (GCleaner)", "value": "97f7574982527db8935afb309c07f7e542544bdf66543a74d4ef9d3d15f8892acc34a89412c917426ca6879a105ceb32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679835603, "uuid": "31ae6b00-ed58-421d-bb9f-b1c270aaf638", "value": "T1A595338BD3E4047FD163D5B18A59809DC9B333AF487C0595D2BCEA0E1F2E7886996393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679835603, "uuid": "c4d3e67c-9a03-45c8-b7e8-309b684f96ec", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679835603, "uuid": "8a45d327-3eed-4d6e-96b9-f1aaabd7efac", "value": "49152:EGlJfsZuP/EPpXL9NU8odlm4Y8ZrH1835pX03L5dlLYp:5JypheJsv8ZT1o5pk1PYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679835603, "uuid": "c8b051c1-9e8b-48fe-96de-03d5e67fddfb", "value": 1995567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679835603, "uuid": "84a42387-4a3a-45c2-a6d9-ca3c0ebefb37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679835603, "uuid": "cca76994-1571-4ca9-a6ee-dd041203ff99", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "577f93cd-cbdd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679838703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838703, "uuid": "2064eaa3-e656-451e-8091-fc6f4fafb6c9", "comment": "Malware payload (Mirai)", "value": "93fd2ad8cafe4e0ef58d2932ea1bd85c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838703, "uuid": "ddd56e98-5eb0-41b5-8100-da2af456c948", "comment": "Malware payload (Mirai)", "value": "1b9302eea9733138ff0448c122d1be1583fa0229e902a2ea8ee0cee52be0d852", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838703, "uuid": "d394d3db-61ea-46a0-8541-69e1d9af8c58", "comment": "Malware payload (Mirai)", "value": "1f30e78844e28dd746cc4cfc26a44bd48eef05f6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838703, "uuid": "d3e6fbc7-b35e-48b1-a546-d741803924a0", "comment": "Malware payload (Mirai)", "value": "236193c3ed7eba13c0d1da2e8cb43769f370f45e74486632e856962f7c73e78d3a86d634b365754441d8ade6f229bba8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679838703, "uuid": "9350e437-3338-4693-a39b-7d3d02167804", "value": "T18A04E91B6B618EB3D81ECD33029A1601108DDD6B45D93BAFB6B4E95CE76A84F05E3DC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679838703, "uuid": "c206d543-2db3-457d-a414-5c13b62100e3", "value": "3072:C0umqfmbFKXBCetJ8add9Qzhs1RIKPHsqdfi+KqLwZi+LUk:C0umqkFuwetJ8addQcRIGTdfi+KqLwUO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679838703, "uuid": "c8913982-25e0-479c-9433-5e6ff975f60e", "value": 174955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679838703, "uuid": "cafb5545-12ae-4641-bde1-e5785584d763", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679838703, "uuid": "00942a55-1d6f-401b-8410-ca1e4973d122", "value": "93fd2ad8cafe4e0ef58d2932ea1bd85c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ecf3902-cbea-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1679844352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679844352, "uuid": "77b66e6b-e6f2-4267-80a1-bd7391cb64ac", "comment": "Malware payload (Vidar)", "value": "11f82e84e17670912b1f93c827ed7f35", "object_relation": "md5", "Tag": [ { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679844352, "uuid": "8a4a9be2-e48b-4804-8809-0f181580012f", "comment": "Malware payload (Vidar)", "value": "1c9264473281f0d5144912a8c05d803697c7da8707cd5607017e6936d2fa1588", "object_relation": "sha256", "Tag": [ { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679844352, "uuid": "fda89945-7ede-40d5-90ca-80260224f961", "comment": "Malware payload (Vidar)", "value": "d5f4e666ca2b2cab3451ff784659cc22b4957a49", "object_relation": "sha1", "Tag": [ { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679844352, "uuid": "59bf7245-0918-458d-8271-51db6fbbd750", "comment": "Malware payload (Vidar)", "value": "3bfc8e00167000633efd0c636867e8a5b78249cae4b39649d68a09ba6613ca27d4f491757de0819cc6651e5c23f99a00", "object_relation": "sha3-384", "Tag": [ { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679844352, "uuid": "7d15a2bc-679c-46e1-87e6-beb606d19742", "value": "T10EF4AE57F7C7FAB0E6BE827A82B1851C527774520260A78F674076896E23392493DF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679844352, "uuid": "1782d182-59bb-4e40-bf2e-9ca7f9452c74", "value": "a31761b5a590c4c499d5f4a347d75c12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679844352, "uuid": "c1434b1f-1edf-4bd0-b6ec-4b7c25d2c630", "value": "12288:5n/zDvGHAykHSzLW/4+8bzbBSreMdCQ4gLuUkvSK/7gFK/UqW53:dzbGHAzHAjX1yq3vSK/rcL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679844352, "uuid": "c0bcb2d0-2ea4-49f8-82ec-d6b9cb567537", "value": 735744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679844352, "uuid": "54727be5-8e6a-415c-abae-cc76c3cb140a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679844352, "uuid": "76e7773a-b73a-431b-998d-d7de7a7fa2dc", "value": "SZOI-Wyciek-20-03-2023.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56f83800-cbb6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679821952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821952, "uuid": "85885ae8-95e1-4881-9e25-ef1bd229ae87", "comment": "Malware payload (Mirai)", "value": "e49319f4d017fe567ac36f46160e4c47", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821952, "uuid": "6d465817-61dc-438c-a2df-3bb019e2c247", "comment": "Malware payload (Mirai)", "value": "1d25bbf47382e695e4008c4d601865897d91f8cf3269cde6e7405f117c5ccfea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821952, "uuid": "3a78f146-c216-4709-979f-6330be658ca4", "comment": "Malware payload (Mirai)", "value": "ff40525e02fe17be67dae8669be44936b35984b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821952, "uuid": "68429e1b-fb93-4fbc-a9a7-4553c7898754", "comment": "Malware payload (Mirai)", "value": "56ce345ab69953576de723ebef71b32b2e237bd145208bff9b188ab22478178a41087f8da457b20a960177340ce77fdb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821952, "uuid": "e9131988-4c3d-4835-a408-5d5e319fb0cd", "value": "T1CD833A15A87A2A27C4D4A63E11FB8755F2F6370E14B0866C7D360F8FFF14680794A2B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821952, "uuid": "ea31c46a-dc8d-4dba-8a1a-5e529587d915", "value": "1536:JfBxRXGJ17DJ+Omhhe/odTlYOXZVMB42NYqAUyba6Ad6N:NBPXGn0ew5pVMB42NYqAUyO6Ad+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679821952, "uuid": "1aed7320-67bc-49b4-9815-2fc870e97063", "value": 82952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679821952, "uuid": "67180e8e-e102-464c-be30-e4efd94adc9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821952, "uuid": "d52645c8-6674-445d-a102-b68ab1050233", "value": "e49319f4d017fe567ac36f46160e4c47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb6ae895-cbdb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679838038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838038, "uuid": "02af8701-e3ac-465c-abac-cf5446fb11b8", "comment": "Malware payload (Mirai)", "value": "e969bdb7928f9948cfd0abf825f5be1b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838038, "uuid": "eb907016-4096-497e-ac83-0c13171866d9", "comment": "Malware payload (Mirai)", "value": "1e401b104ae7595671b89f49013d23ef6253e22e07c9444b3ca110cc9386457f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838038, "uuid": "645bfb6d-9473-4e00-906f-2ebdf8455d58", "comment": "Malware payload (Mirai)", "value": "2c90fe6d7f5fae7df18aeac00eddc9ec5a116924", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838038, "uuid": "58ad3399-84bb-477f-93b6-765767d4cc16", "comment": "Malware payload (Mirai)", "value": "a7cedbccd98c2580c0dd9cac7b4a7a7bbfc0937deef63447051a6ac4c527a1857aeb8cef4b3baefe18ffcfa2caa77ca1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679838038, "uuid": "e345885d-c60c-4000-9a2d-d81a92d9a3dd", "value": "T19FC33BD7D942C5B3D40209F2226B624A4622FF3B485B5AE6F71D3CB4AF318897225FD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679838038, "uuid": "66bd22ac-38ea-4e3d-84ef-a867ee5215f7", "value": "3072:lZj9Do+aP0YsQpZ+7uetJ8add9QzTs+zcg4NKcXeGcgqGK:lZ/Qr+7uetJ8addQLcg4NKcXdcgqGK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679838038, "uuid": "18804b0f-0941-4150-895b-60d626b014aa", "value": 125343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679838038, "uuid": "4196b226-6fb2-49ab-ac0e-eb04b776f22b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679838038, "uuid": "14d1778f-2d55-4908-a40f-e1b12481c761", "value": "e969bdb7928f9948cfd0abf825f5be1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "486a706f-cbfd-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679852422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679852422, "uuid": "0ad99358-cd3a-4da2-93f1-ed29a1d54e5e", "comment": "Malware payload (RedLineStealer)", "value": "354c85a42efa4053b0dcaec9feb41be3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679852422, "uuid": "b5820569-6ce9-443c-908d-650efb13a6b9", "comment": "Malware payload (RedLineStealer)", "value": "1e440e94a5664226435188e81b308971a4982a7c7c130c69f90ffdb21df9c926", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679852422, "uuid": "a0904636-da16-4246-a6ea-5ccca18c982e", "comment": "Malware payload (RedLineStealer)", "value": "4f05959c72e73ed28d40436010218f72b46ffdbe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679852422, "uuid": "6a86cab7-25a3-4b15-ab87-1443b6cc820d", "comment": "Malware payload (RedLineStealer)", "value": "8dbc4a06963da7d8cbe0fa46319940331acd3809750a639a961da798ea1ec78d1d786132f78eee31fe2582b7fad19fd6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679852422, "uuid": "d317002e-a28e-4b83-9417-a9484354d333", "value": "T1AFE41202A6F44532D9F5637058F61293173BBDD22CB8826B275A6C5E0CB33D0A576B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679852422, "uuid": "5e0588cd-c68e-45e6-a4c0-181a1711a765", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679852422, "uuid": "61e12d2b-5f98-47c1-9c7e-fbd842d7fb92", "value": "12288:pMrSy90t6ss+VnNqL4GEjlX8eoNK6xR4O2UtcL:Tya6vmpFuDS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679852422, "uuid": "41d10e7a-f68b-4190-a531-ee8c49e7187d", "value": 701440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679852422, "uuid": "fb4b49a1-ff44-427a-a9cf-2829c58f2a7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679852422, "uuid": "a9404ff8-0673-4832-af22-f3410b4a5c13", "value": "354c85a42efa4053b0dcaec9feb41be3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "894f6e85-cbfa-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679851242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679851242, "uuid": "95953714-6821-4447-a761-9ae3efbfa263", "comment": "Malware payload (RedLineStealer)", "value": "ab8eb8019befbe7fff1a723818a379e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679851242, "uuid": "7c306cf6-f156-4ca1-9b69-4648139eaf68", "comment": "Malware payload (RedLineStealer)", "value": "20fb6ad957974a5e836e3cd93bb8426f43049dcd223077fbd969bd1bc33434d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679851242, "uuid": "328698e5-b6fa-4d41-b7f0-bdac4a2a7acb", "comment": "Malware payload (RedLineStealer)", "value": "c7ea69ff4490f2c7aa745f0e9b2444b57dbed863", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679851242, "uuid": "0eacab33-f2c8-400e-8db0-c35adff07a37", "comment": "Malware payload (RedLineStealer)", "value": "ecf540ca4089c98c196f11ceb54480865379a32d5b152a80b7fb628f293ee6f05dcabb436753880b81f3b732b1a993c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679851242, "uuid": "3a59bbc9-5b2e-4c14-a37b-2c7a3c483c86", "value": "T1FE547CF0C3C74E72F43FCCBECD8F5596033C9E9259940A86A856AEBC0141499A7A3D97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679851242, "uuid": "1a84591b-ffbe-4cbe-9742-2bd1d3bd1fb3", "value": "5efb9ab375d470b5b9cb24c90592e4dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679851242, "uuid": "176eea04-a8f5-4ba9-ae6e-57653c29c398", "value": "6144:gYCN1NUy4+qHvLwADFcF3NYy/AjCGQ/K:zCN1NUy8H9I36yojzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679851242, "uuid": "708b60eb-e85b-4e3b-93e4-567f4c399fc0", "value": 299632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679851242, "uuid": "daee12a8-7f96-4e19-ab0f-d4a22f8d8e2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679851242, "uuid": "a365a1a7-465a-4a60-9e0d-929e5d7efb65", "value": "ab8eb8019befbe7fff1a723818a379e3.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0201ca73-cbd7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679835983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679835983, "uuid": "e7f67858-de3b-40ec-be59-4d77a8d994c0", "comment": "Malware payload (Smoke Loader)", "value": "409a224494cfbfb53acda58d2d183da4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679835983, "uuid": "b6dfd59b-98ab-46a5-a9ba-bcf3051f9924", "comment": "Malware payload (Smoke Loader)", "value": "210c955ea98aa1c1dc347afa8291867d0088d25014edd445bdc6640d034d22f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679835983, "uuid": "7d2d8692-ca8f-4b13-a320-4add329fd233", "comment": "Malware payload (Smoke Loader)", "value": "4013fb48f2ec7a412b4049c251c4ee4ed0795912", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679835983, "uuid": "b49e6800-5716-43c7-b586-bac72d71c4bc", "comment": "Malware payload (Smoke Loader)", "value": "0a4e8365f8b3f459978d375d2c6b47ad36df0edab68ada79c36e8988f83bd5b06706169f43a787337526ac67b6a87ccb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679835983, "uuid": "07cf221e-6e03-4f8a-91f9-3630a1024ebf", "value": "T1E6546B3263F07860E562D7328E2FC7FC2A6FB9219E156B7E12595A7F09702A1C172335", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679835983, "uuid": "22f3ba4e-51c1-4bc1-b861-e189be9dc60d", "value": "c5c75c5b6a7ab4fe20f346e6d5121c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679835983, "uuid": "4ac60625-836a-4dad-8dd9-04ceff2552a7", "value": "3072:k3jUGhlvjuJpJK0zuggOuYOPbZyiBp8QorPKneJBsaH7cmU/XpNN4TJY:sbB0aggLEyeJBsaID/ZNN4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679835983, "uuid": "47120452-d400-4658-81a5-c3dc8bfb5afa", "value": 280064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679835983, "uuid": "caedbab3-2172-4c46-9e43-9de21a36f527", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679835983, "uuid": "1ca6092c-d211-4d94-bb4e-430e1bc25979", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67f9e4c7-cb75-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679794063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679794063, "uuid": "c7c3d133-622f-4c5d-887f-2bcec955fb48", "comment": "Malware payload (RedLineStealer)", "value": "82f64b63a279dcfefb2b2f3270c23170", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679794063, "uuid": "0778fca8-8baa-4ba1-af8d-9449cf29f0fb", "comment": "Malware payload (RedLineStealer)", "value": "222e5137c1cafea7a4dac40844a4b6cf618545436ebc21a64e39fe54328a98ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679794063, "uuid": "8ed19be9-8b17-400d-822b-1c47ed4a2d0f", "comment": "Malware payload (RedLineStealer)", "value": "09ca761249813bd5ab8503c4702b0ef6ad7b86e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679794063, "uuid": "b5dbf01c-14ff-4628-b900-3a2f6862ffed", "comment": "Malware payload (RedLineStealer)", "value": "a817a98a7327cd4086c75fae4b7b9ce6b970d585c8345a6aff5f21c2950694a9d91f296c6d8ab332727873a871a62b08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679794063, "uuid": "5b5d5494-b1e5-4f6e-a076-51ec6df42242", "value": "T1FBC53356C47A8D09DD1F5FB2290DCA9E83BDDA1E43C26D5268935C73074BA6BFF82021", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679794063, "uuid": "1a5f5248-7f89-40c7-94f1-8e0b387de628", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679794063, "uuid": "300c2352-faec-49b8-ac54-562ee5a1d25d", "value": "49152:7IG2nNP8e92uQwR6BQzkuBGCDeGTcIq28Pb6WiBQgZydL8DbKpAHbKCmy:7IG2P8IhQwMOzTsCyGTzrEL0QgQdLfv1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679794063, "uuid": "4c39ac88-cfb5-49dc-ad85-8df82da097bc", "value": 2675824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679794063, "uuid": "c298ac97-2924-48ec-a321-73a548a82b0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679794063, "uuid": "2bcf4a38-b6f4-4def-8ee8-89addad4b678", "value": "SecuriteInfo.com.HEUR.20771.28957", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1f9507d-cc2f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679874047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679874047, "uuid": "6744c39a-64f3-4d8a-b59c-5a4062837c11", "comment": "Malware payload (Amadey)", "value": "b4fe277ec85e3084d23fcaa668dfc0b3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679874047, "uuid": "827c9a5c-a4b7-4fa4-bbd0-9b5415112173", "comment": "Malware payload (Amadey)", "value": "2267b8157a975f8c3c687dce27c5212de7f0d1800c0baca7dd568d5644a12b89", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679874047, "uuid": "28ff9596-cbf8-485b-b50b-8daa14accb84", "comment": "Malware payload (Amadey)", "value": "34ba1ad9605cf4c87a2272a5e39f0d4ef726b5e4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679874047, "uuid": "6e881126-fe32-46b0-9f76-238157956000", "comment": "Malware payload (Amadey)", "value": "cedc9d642903ec0e7d58bad1c42a70c0573a7e9d5721d667444230d7214bab8f61e86e289ab91aa808acb3031ea1d233", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679874047, "uuid": "2f2b6ae7-7eb4-44bb-ac96-10c71310d5e0", "value": "T19A252323AFD84433C4B913B18CFB16830A38BDA158B4976F6798DA6A0D77D94A131773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679874047, "uuid": "fdfe2d62-0058-4608-924e-fa9fbab777e3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679874047, "uuid": "f47e2fe3-ae6c-463b-93b8-fedfb1f8d06f", "value": "24576:AykcnRlxNThPirJ1/ztLQ/4iGyGehAp7t0hPZOWJPzH3MG0WIfJEE:HkulxNTFir3zZQ1RFApp0NoWJPz3fnIf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679874047, "uuid": "5452e7a7-3e13-4848-900e-8fe0f4fcb1dd", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679874047, "uuid": "0088c47e-fb5a-4e0e-abf3-86cd17913daf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679874047, "uuid": "558dde96-4b6f-4b41-8239-4673a868c622", "value": "b4fe277ec85e3084d23fcaa668dfc0b3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ecbb26c-cbc9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Fabookie)", "timestamp": 1679830152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679830152, "uuid": "55f89cb3-a850-47f6-b8ae-fe6901e0ad5b", "comment": "Malware payload (Fabookie)", "value": "0a77653eb6749fad4d0dfefe5819816e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679830152, "uuid": "ad088edd-9db7-4147-876a-198f8b6fea38", "comment": "Malware payload (Fabookie)", "value": "240765219e29cbd4f16dd03816f195e14917b2ca0c6ddf35bbf26343a87c8434", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679830152, "uuid": "a966635c-7455-4fca-84b2-fdbe10ea51e7", "comment": "Malware payload (Fabookie)", "value": "3f798abe1b5141f6541b86705b369a99519f6ae3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679830152, "uuid": "d917fe6c-ea84-43e0-bb76-106a0d8f01f8", "comment": "Malware payload (Fabookie)", "value": "1917410b03a97ebd62d29d71c8a1689bd646f875cc2fdf457d44175790e4db4a59e401b63a75d857f10bfd2b31c610f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679830152, "uuid": "0a2c2adb-029b-4024-8c68-40c2b7d95c38", "value": "T13AD4DF81B39095D9C8B88430C693CA71CA317C64DB28569BB7D4BB6F2F32AF16537316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679830152, "uuid": "b6a0b1c9-20e9-4827-ad52-3f10586a30c5", "value": "4673ad56625d375f2efee239af061364", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679830152, "uuid": "b6300094-de74-409a-85a4-7d6c1f772f0f", "value": "12288:G72WP3/jlx8Xr3lRkRc4YFwjsWOfRg6gtPbcTTn7qxerx7:qP3/fWr3/kRc4l6g6gtPbcHn7q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679830152, "uuid": "fee23247-a5d2-4676-89c4-929464f70173", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679830152, "uuid": "b49f1fcf-2a63-4c13-a501-073f59c797eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679830152, "uuid": "89464375-d0dc-49f9-a608-2cb1b1092682", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d6d9a38-cbdd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679838686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838686, "uuid": "dc25311c-021e-4417-8fc4-cad8461e00a3", "comment": "Malware payload (Mirai)", "value": "90af3d476fce218a82c1c216c5e638f4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838686, "uuid": "b33cb577-bb61-41b8-afb7-5baa9c8be12f", "comment": "Malware payload (Mirai)", "value": "24429082d21b28f6363b88aa8e6b730fd1c31eb896bc125f4e2b290caf052ed2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838686, "uuid": "602ead6c-47d4-4f97-b902-f86a856b4a0d", "comment": "Malware payload (Mirai)", "value": "f17c2a370d046cbe43333808d7724dc1f235e672", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838686, "uuid": "7e5615af-56e6-4f93-9bb3-f1365c9d6d44", "comment": "Malware payload (Mirai)", "value": "d3d8063dcb49adac21be215ffc3a70fa97a7f551bccd7822531fb08680702b5c63ff72e06cb66fa22a676abbae0accec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679838686, "uuid": "b86c91dd-c3cf-41bb-aabb-4271002a35aa", "value": "T1E3D34A6BA61C0793C45789B12DB733E097AAEFB305D621C1E80EBE805B719752236FD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679838686, "uuid": "6550ed0d-b8ca-49fc-816e-fba96c5fa649", "value": "3072:5Jod7FbuAqr7QevgetJ8add9QzhstjhZ6bqKQibhgBik:5JW7VXqnQeYetJ8addQI1Z6bqKQibhgH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679838686, "uuid": "75b3b47e-c959-4ba4-bd0c-9cb3ddc69070", "value": 137945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679838686, "uuid": "60b26c94-056f-4161-a790-068a55a43c72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679838686, "uuid": "9926273a-5b93-4848-b9c1-737a54039dd7", "value": "90af3d476fce218a82c1c216c5e638f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "525046c9-cb88-11ed-88f6-42010a9c006e", "comment": "Malware payload (WastedLocker)", "timestamp": 1679802187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679802187, "uuid": "c23026d4-8c57-411d-a218-bd08fa57e885", "comment": "Malware payload (WastedLocker)", "value": "2bf8e0f5e1a64f12b61bbaf128f7bab2", "object_relation": "md5", "Tag": [ { "name": "WastedLocker", "colour": "#EA2EA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679802187, "uuid": "7a132b26-8155-4b55-86e9-4adbcaa3a93f", "comment": "Malware payload (WastedLocker)", "value": "26ebdda500de80766d1d4d080d608d6e3ee48a78401c1084f0c2399f1605c7c2", "object_relation": "sha256", "Tag": [ { "name": "WastedLocker", "colour": "#EA2EA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679802187, "uuid": "04051aee-4e30-448c-8f73-537cb048c4aa", "comment": "Malware payload (WastedLocker)", "value": "29295711239ccc21fcd21e95c0ce5f4f3a436490", "object_relation": "sha1", "Tag": [ { "name": "WastedLocker", "colour": "#EA2EA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679802187, "uuid": "7c4a61bb-9586-4128-a222-f96a88ba3337", "comment": "Malware payload (WastedLocker)", "value": "2239237574db020df578a9f9be4169f4c88040a424e3d2700afb9bd08d906232863142c4d9ac40d87ff5923d719b7095", "object_relation": "sha3-384", "Tag": [ { "name": "WastedLocker", "colour": "#EA2EA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679802187, "uuid": "774682d2-bc15-4060-8038-1e1ffea9319b", "value": "T1B9B55B01BB514129F9F702F78AFE60AD552DBED00B2890C791C826DE8A6ABF17D31753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679802187, "uuid": "f638257f-f6f4-4931-8357-68dccbd54b7f", "value": "66a8e6934e2bab8691fcfa27605a7bf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679802187, "uuid": "e1aa4779-2f6c-4671-97cf-a4eeee69e06f", "value": "24576:uh10vI967ywUjBdwrcXCCVNy7tGpjfIWBz6Caw/05xoEu6sRv1:uvuI90rOktGpjf7//0sExst1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679802187, "uuid": "416e8334-0c45-40a1-b722-4107be0ad2aa", "value": 2414592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679802187, "uuid": "8f578d0a-695a-4ff0-ae94-bdf87bff24ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679802187, "uuid": "18ec9770-b9c0-4ac4-9723-59afcda5c46b", "value": "26ebdda500de80766d1d4d080d608d6e3ee48a78401c1084f0c2399f1605c7c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30100741-cbb6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679821886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821886, "uuid": "a4fe6267-0315-4c39-a5fe-8accbc0a03ba", "comment": "Malware payload (Mirai)", "value": "561b538ceadfab60a82cf1225dc961ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821886, "uuid": "b1b2cdb9-4469-4aae-8cf2-38dc690b66df", "comment": "Malware payload (Mirai)", "value": "28507162c0d9b69cec4c4ae5aa81da7aa53b62dd9a12319f18bd85f2c0fbe479", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821886, "uuid": "56a97e22-8e84-4beb-b668-dd49982eb60d", "comment": "Malware payload (Mirai)", "value": "71137ee32186181baa443637d6d0b69ee0411504", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821886, "uuid": "e8e3ca0a-5946-42ba-aa7e-4e78e38f7bba", "comment": "Malware payload (Mirai)", "value": "c691cfa964dcfd3d791f98a6c8e7b50d9521953fcd28c29091d89ece0628e4088cc671ea20d7fc3da90c8df0007dde20", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821886, "uuid": "4e6aa544-9cc4-4026-8fb5-3652a6bde950", "value": "T18A633A21BA761E2BC0C1947621E74B25B6F147CE26ECCA0A3DB20D9EFF709446503AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821886, "uuid": "951a664c-cedb-43c5-90a6-1d5eaf6633be", "value": "1536:9UWRdbiXEFVqJGmRs5az7SUTwzQf8G75bqHtvtttA+W:9HRf4xzOUT78GVbga+W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679821886, "uuid": "7f78a2d0-b2ce-49e7-b3ed-55680239b852", "value": 67392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679821886, "uuid": "d6b1c87b-5232-402b-a0ad-8ed559ca9d3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821886, "uuid": "87625c6f-4907-4246-a749-ec62e521aceb", "value": "561b538ceadfab60a82cf1225dc961ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a4c4130-cba3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679813716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679813716, "uuid": "74d27f9e-f374-46f2-b765-45e6583d4fc5", "comment": "Malware payload (RedLineStealer)", "value": "be8f8a5ef7727288afbf1a6b5dfe94f6", "object_relation": "md5", "Tag": [ { "name": "212-113-116-143", "colour": "#077D6B", "exportable": true, "hide_tag": false }, { "name": "cochang", "colour": "#3EAEE3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pw feiyang", "colour": "#B19D12", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679813716, "uuid": "16744234-d49c-4e64-b4cc-75bd4041e056", "comment": "Malware payload (RedLineStealer)", "value": "29f7446a47c3f5309d27dd305129eadf5ef05c0d012093b0f7a9dfff17bc0b17", "object_relation": "sha256", "Tag": [ { "name": "212-113-116-143", "colour": "#077D6B", "exportable": true, "hide_tag": false }, { "name": "cochang", "colour": "#3EAEE3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pw feiyang", "colour": "#B19D12", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679813716, "uuid": "1115bef9-c052-470c-a63f-ae3543996218", "comment": "Malware payload (RedLineStealer)", "value": "0a35dd54bdd6fd1ab706834efd7b1e5266cc3c40", "object_relation": "sha1", "Tag": [ { "name": "212-113-116-143", "colour": "#077D6B", "exportable": true, "hide_tag": false }, { "name": "cochang", "colour": "#3EAEE3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pw feiyang", "colour": "#B19D12", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679813716, "uuid": "971f7ce7-0e8e-4933-a0fd-50b50e1e6ffd", "comment": "Malware payload (RedLineStealer)", "value": "433a7f45635e4e654ad57cbddbdbe2fff1293958063a54a26d354bf3c882c952104c5324c39af18364e4dfa27214d648", "object_relation": "sha3-384", "Tag": [ { "name": "212-113-116-143", "colour": "#077D6B", "exportable": true, "hide_tag": false }, { "name": "cochang", "colour": "#3EAEE3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pw feiyang", "colour": "#B19D12", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679813716, "uuid": "5217b861-21f9-4098-8161-e7955521735d", "value": "T13F6733220BF92D7206B67A396E998B0337218AFBB790D401A075B40F627B775CD547CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679813716, "uuid": "efb5a652-ce89-4128-a583-7d6bfa0d2344", "value": "786432:Ny5nkyB0yMzKrhe/v3s+p2+UhVV1OXV/viu:NDJWVKPlp3mVV1Ol/viu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679813716, "uuid": "378d57df-3b71-4617-8329-5f20608f1a6c", "value": 30087463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679813716, "uuid": "c7812887-65ca-467f-b124-02541fff19af", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679813716, "uuid": "4f9909d3-3da7-45ee-bfab-2c70a274e5df", "value": "My video call with celine764 At 3 minutes and 17 seconds showed me that he is indeed FEIYANG.mp3.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00fc58bc-cbad-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1679817942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679817942, "uuid": "bfbe4b3f-39de-49b1-90fb-fd2953aa47b1", "comment": "Malware payload (njrat)", "value": "5846a4f316160ded59379aaecc48de08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679817942, "uuid": "f8603d0c-3560-48b6-a437-664b8dd0846a", "comment": "Malware payload (njrat)", "value": "2ca10a991b5151eb236b4faed3a08e7f44153286b53dea588f888dc0174af8a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679817942, "uuid": "474b7783-757a-4432-9a4f-4930307a133d", "comment": "Malware payload (njrat)", "value": "b5af1332a27e9e7a70b85dded3ee294a7b6b2446", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679817942, "uuid": "285ef4f7-077a-418a-9dda-42a796fc86ab", "comment": "Malware payload (njrat)", "value": "eb4bd40ef58cb292c38b41c4fe2653c1694ee1eabdc3df23dc219931197449ced65ca4a572e99618c5ceffc35657fd17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679817942, "uuid": "37e01084-220b-4ba0-8ad0-bad4721f3f93", "value": "T147A3A76C3FADCC13E19BF87421606D5BC5F2A6561292402CC9BEBC6737DEA8365221D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679817942, "uuid": "7660c1f4-e2d7-449f-9a97-24707f83ae88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679817942, "uuid": "9f80652b-2828-4879-acee-8cc217c852ce", "value": "768:NAY1lN7oYUGF6DrM+rMRa8NunC6tRJghs:NAY1vcdGMc+gRJNV4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679817942, "uuid": "bf695939-5f71-4db8-b6a2-8ceebe627761", "value": 105984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679817942, "uuid": "fd6135db-b787-45b5-91df-8035a5df39e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679817942, "uuid": "ffe46ca2-91d2-482e-8522-97e0ca9d3ffd", "value": "5846a4f316160ded59379aaecc48de08.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b84c5ad-cbfb-11ed-88f6-42010a9c006e", "comment": "Malware payload (AZORult)", "timestamp": 1679851541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679851541, "uuid": "a4ff6902-faf0-4578-962b-482cf18cdbef", "comment": "Malware payload (AZORult)", "value": "83e267e5024a25d7e3abbcd6ee2bc9ac", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679851541, "uuid": "54074aa9-5801-4a09-ae30-696374bbfe4d", "comment": "Malware payload (AZORult)", "value": "2d991a35845409eb5d8b37271b0c650c4a2c56a9203973b71c161a03f8d5a254", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679851541, "uuid": "81d93ae5-2013-42e2-8d5f-aa8989413af7", "comment": "Malware payload (AZORult)", "value": "8067415b150d678301f2962a3d2eccb18d35b9b1", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679851541, "uuid": "14593b70-3ae4-41bc-b334-df0b611e68d7", "comment": "Malware payload (AZORult)", "value": "efc076118ebc45020756fbf61c2dd06de6a00e9c292dacdfa18103f8dcf12942b27c8bbea91da6d29b34adb1e842bcff", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679851541, "uuid": "7b12c348-ae2e-40c9-a8b5-ad636a875849", "value": "T13A747C01B7E18034F6B716F955BE63699C3D7EA01B2094DB63C01BEE9634AE4AC30727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679851541, "uuid": "d8c9d99c-ec90-49bf-b19c-816e02d7fa6f", "value": "422be7ceb0741075b525cf62c58cfd4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679851541, "uuid": "56903e52-dc47-4e4e-bca3-259c4db2787e", "value": "6144:RoG66yQ3f03PsPXdThVc7xY+i8KVmuQSujWDJiv+cxfPIp:RT6RQzdbcu+P5noJQzxK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679851541, "uuid": "c6bb84ab-517b-49bc-9fed-4c5c4ae0c996", "value": 365568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679851541, "uuid": "5b7ac1f5-955f-40d3-8724-7aa36e841b6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679851541, "uuid": "68074e35-26c0-4c94-93b8-9c5c4d0ba328", "value": "2D991A35845409EB5D8B37271B0C650C4A2C56A920397.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b93861b6-cc11-11ed-88f6-42010a9c006e", "comment": "Malware payload (Chaos)", "timestamp": 1679861201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679861201, "uuid": "cd4d5830-78b7-4263-9edf-e61307336c16", "comment": "Malware payload (Chaos)", "value": "790cd1ca1e1e862544d527a807a1e6b1", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679861201, "uuid": "5fd04f80-ace4-4740-9cc5-3255828e820d", "comment": "Malware payload (Chaos)", "value": "2e6f094748124800d8cf6bdb28bb8aa4caa066923cf3e9778dae8bcb2b6e85ec", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679861201, "uuid": "dd9329b2-6bd7-4c12-a5e9-272026d0c2e2", "comment": "Malware payload (Chaos)", "value": "2ee282a9f6158b0e60bf338c1e354e4667bc36b4", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679861201, "uuid": "8156d9a8-4d98-4d63-9bc0-13616bdf5c12", "comment": "Malware payload (Chaos)", "value": "f0d0951b4e7292e89ec043cac2b5d096e7df072903841e722f0ec65eaf1660e60aef3a647f4e8ee35eacbc57517bd68f", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679861201, "uuid": "1e582916-cd30-43e0-985b-c693d8656cab", "value": "T10013A7282BFF482DF2B7AF385FE07496AB6EFB236E1AC45D004502460517F84DD906B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679861201, "uuid": "6411d62d-9b31-48cc-a09c-84fe458c4a4b", "value": "768:zqj7UWPjjkzEr9npTQi/zRUNWv39Hf6F0BkfLSV3F8Ftqel59CHAOLw0:ej7ZjjkzEr9npj/WN4/6F0BkDSGtqeLm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679861201, "uuid": "639d014e-6f32-4a75-a0c7-239f4fcdfac9", "value": 43516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679861201, "uuid": "ab56f46b-9be0-48fe-907c-452184a6220f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679861201, "uuid": "19717383-b950-416b-92bd-013efe5e1b04", "value": "2023-03-23_790cd1ca1e1e862544d527a807a1e6b1_destroyer_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4c2dee9-cc2c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679872790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679872790, "uuid": "3bf61e68-8d85-4589-85a2-3ddeeca92333", "comment": "Malware payload", "value": "bd488a5eaa10be08a5b0f9138ada7bad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679872790, "uuid": "7f5cf337-5e55-4618-8313-acf8bf9f02f6", "comment": "Malware payload", "value": "2f6ac03d251cce37ffe68e3f73fe0541fb0b3ead18afb2a43add8251e55e1976", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679872790, "uuid": "db0163e8-bf17-49fc-9aef-866969091134", "comment": "Malware payload", "value": "562a45a9eee2524209d56f4850d386fc7871b234", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679872790, "uuid": "95431ea9-cf8e-45ae-9ff6-f82f806d7f79", "comment": "Malware payload", "value": "b02c25a12cb000439e28675d09c1d29182da974d65b72d4884596467509b947ddada7a2f726156e25f2bee584e703b3c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679872790, "uuid": "031d665e-dbe5-42d8-98b2-3324673477b4", "value": "T1EF835C86EB82DAB3D19319B507AB87200571F8772E2BCF45F35C3CB4AB15688B21576C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679872790, "uuid": "a677e3bb-c5d7-43c5-9f14-994a1b219702", "value": "1536:8RCJyUfejauswudVchqXV0uHMfuFuweLtkkAQnPwJUkit1O5u1m:8wd2udV4qlbsLwAtkBQn4JUkiXO5u1m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679872790, "uuid": "17b37815-0991-45e5-b238-1409819a3a19", "value": 87750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679872790, "uuid": "0245a5da-0eaf-4bc2-bf30-f26e85e8ca6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679872790, "uuid": "fc189dab-9c80-49b4-9a21-4ec991a4a570", "value": "bd488a5eaa10be08a5b0f9138ada7bad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bf42566-cbdb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679837717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679837717, "uuid": "1de679ec-714b-40b6-b263-7e20e5c956f9", "comment": "Malware payload", "value": "f3538868a43ea5fc88fdf2c46b01ed49", "object_relation": "md5", "Tag": [ { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679837717, "uuid": "5656c7b3-f7d1-4f3d-8f21-9ef1a5d26806", "comment": "Malware payload", "value": "2f8f6a0f1d7c9b1fb3f7162ba32a83e77e72d18c54c5da7f9086e3c31049df18", "object_relation": "sha256", "Tag": [ { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679837717, "uuid": "07c98d00-a9c7-46a3-aa5c-0764b1649c84", "comment": "Malware payload", "value": "ec457507ca9f93d3b5d0c416316bb0b2983b5792", "object_relation": "sha1", "Tag": [ { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679837717, "uuid": "cafe44e5-b36c-4538-ab1b-78edb49b7445", "comment": "Malware payload", "value": "6a424b30459690d0cf1870afd3799c8db3a36d84be84642437edbe347318c64e834b962c473d35f7418bbe3e758c9a03", "object_relation": "sha3-384", "Tag": [ { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679837717, "uuid": "1d3a11ab-4522-45bf-8ff8-091c73d2827c", "value": "T12C5488DB677E3C9A4D473A7CD7926A83AF8A14B00172508FFDED5929F0DB1398070929", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679837717, "uuid": "d3e61068-74d8-4410-82a9-f4be47bf4d2b", "value": "6144:BKJdfteBu5E0WFnNyg93XHlr8dr30/zPO5OjIcsg6A3Alva1fLY/Owbi8SYPT17L:CWtVu9Bc95wrhz11Q2bL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679837717, "uuid": "29276ab8-9bfe-469a-be20-ad6d91898240", "value": 283197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679837717, "uuid": "01a1c4e1-3dc4-4067-a6af-74b6632f4f8e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679837717, "uuid": "1d42c3c8-504f-4967-8ffb-6a8494f4121e", "value": "debug2.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3541fc0-cbf3-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679848279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679848279, "uuid": "0182bcd0-19a9-416f-992b-4f889f510254", "comment": "Malware payload (SnakeKeylogger)", "value": "44d5b7f05eaf67f8c48e6ee5f4ac5b10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679848279, "uuid": "ffcdff4a-a3d1-4601-b342-0de61f347d33", "comment": "Malware payload (SnakeKeylogger)", "value": "3108a3fcb44794c0d76370e03236aeaed5883eab03bf13c80aa421a2b7a77c4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679848279, "uuid": "9bb09c91-d4d3-44a2-9db8-582a00fcf1fc", "comment": "Malware payload (SnakeKeylogger)", "value": "97c66412a2c0d4928ce8b9c95475e3b3a4074e76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679848279, "uuid": "7da5dcc9-9345-4782-aafc-e35bbf00c747", "comment": "Malware payload (SnakeKeylogger)", "value": "6fb11c9462838570a73297537244fa1517ada713ac73e1754c85f1c850c72b1a2c50baaf8924b12b544f2e8e11b66081", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679848279, "uuid": "afa4d6c7-9eb9-42d1-a2c8-9d51c5828e72", "value": "T1984506343DEA502AB073AEAD6BE87B9ACDAFF6732706642E105103CA4613941DDD153F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679848279, "uuid": "80657155-cc7a-4457-a339-d02b72669250", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679848279, "uuid": "f2ab04ac-049f-40cc-8d7f-e5dbcfd6d8cc", "value": "12288:8y1Q2ngMtm9+0CSi1a/7rEw7G/1Gjdues5j38eFp5bo0+4g58UTVaOJj5BSo4iVo:Eu5LauGgB6Wj1+CyCQgl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679848279, "uuid": "4bb48847-44d8-4739-815d-91dd777bb60d", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679848279, "uuid": "949a365d-3fa4-4f31-93ab-6752dfa1da83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679848279, "uuid": "d91b6758-f2b0-48f0-a92d-d13514875430", "value": "44d5b7f05eaf67f8c48e6ee5f4ac5b10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6538a6f-cc2c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679872765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679872765, "uuid": "2ea6a476-fceb-428d-ae61-3456d7b38977", "comment": "Malware payload", "value": "cb76460d7a7e4cd8846f70ebaf50b584", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679872765, "uuid": "82074508-0bf3-40a3-9018-26b231d58b63", "comment": "Malware payload", "value": "3133bf04014214487d9973c99412d45c16ce8bbfa65285a6dca08ff20d2f763f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679872765, "uuid": "bba40c44-0ca6-456b-89d8-465a4fabed8d", "comment": "Malware payload", "value": "e4c33029a91f2a0661b7ed4e84aa5adde3a13be6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679872765, "uuid": "4c0fb967-7dbd-4921-9e5f-5011d77ab78c", "comment": "Malware payload", "value": "b68d871efa391f05451333da01ea9295c9004fcf326bb020d97196d3a41d8330e1dfc74a0b5ff8db7757bee78b2bee1e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679872765, "uuid": "62ad8170-cbf6-4969-8203-879668dddb01", "value": "T1D6A34A43371D0E67C1BB99F51EFB23F087A6F86216626180B51DBE8A0333BB46416F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679872765, "uuid": "be4745d4-6eea-4eb4-9aa4-a21530c1b310", "value": "1536:H/4DdLlRoNOsQj325Q2UO0Do7IchVJ4C/bHB2B4vHgQCU4jto25Z3A:8Y8W3UO0DQJ48bMB4vHgQCU4j225Z3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679872765, "uuid": "0e0e362e-439c-49ad-9d95-21439adfb226", "value": 102653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679872765, "uuid": "00b0f212-9dba-401b-a518-07c686dc84e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679872765, "uuid": "1a92d008-ca9a-4b73-94bf-c88ef1caa816", "value": "cb76460d7a7e4cd8846f70ebaf50b584", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12dbc96b-cc15-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679862640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679862640, "uuid": "f0f2e73d-34ad-4740-9a85-2375f6fdf494", "comment": "Malware payload (Amadey)", "value": "2411653655b03e21b87a7684d6ab1539", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679862640, "uuid": "431395f3-1b27-4347-9da6-ada3aede3b47", "comment": "Malware payload (Amadey)", "value": "315210b2e4a9d0e072bae919377ff43aa9e8834313335cabef4a048b48a8bbec", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679862640, "uuid": "dd1241d4-50ab-482e-acd6-54ce3b27dc51", "comment": "Malware payload (Amadey)", "value": "2a296c22ca1f499fb8735fcae8c2be6064a4cbcf", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679862640, "uuid": "250f5163-4dbc-43ea-88f4-d0696fc86f87", "comment": "Malware payload (Amadey)", "value": "d89a1f007ca38844dd24672e63a78a55e4885227e34f9727e4e3fe72b00dedceaff1f5de59e295cbeaa1666e9a33c75d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679862640, "uuid": "02eb6c02-c6dc-47e4-8a73-6c7073611c5d", "value": "T166352303AAE87173E4B627714CF905831E32FCE15928E22B7352998F4CF2594A9B5337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679862640, "uuid": "ca57c6fb-e392-453b-8e11-c0f4739fb988", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679862640, "uuid": "cb3e39b4-5d06-4f0e-80bf-205a4fbab43b", "value": "24576:3y5Hm2RBA5C5+L/sb/perCZcbxEhP2H9M/U1ef:CN8tkb/peWONc2H9a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679862640, "uuid": "78579fb7-e6b5-4c74-b8bb-ab3ed29c0144", "value": 1061376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679862640, "uuid": "d1132df8-b378-430b-99cb-0d82043ac216", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679862640, "uuid": "f8f6644b-2bc0-4d15-921b-d98b8c4b3771", "value": "2411653655b03e21b87a7684d6ab1539.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9369f461-cc18-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1679864144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679864144, "uuid": "5f778e82-ae12-4f83-be41-28ac1db9733b", "comment": "Malware payload (RecordBreaker)", "value": "9883ae323ef224d0d385c7dbd47fd6a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679864144, "uuid": "182c1897-0bca-437d-afa0-81f050e56679", "comment": "Malware payload (RecordBreaker)", "value": "384e85cbf23722a5152fa3c4fdd0cc18f27a6df5ee128ed604ff29c410874fc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679864144, "uuid": "a4ed4fde-43e1-4931-8f64-ef505eaf2921", "comment": "Malware payload (RecordBreaker)", "value": "c199caebfe079a52348a61aad8251d6a5cd629e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679864144, "uuid": "bc49e73a-0136-44a4-af4c-1ee5d58d1c26", "comment": "Malware payload (RecordBreaker)", "value": "a08cb10fdd9587eacad69d6d101efb0962fc6f58133777194ab5453a83f45f77821938041d400ca93134027b994b9c61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679864144, "uuid": "f162b9dc-07d3-4dfc-937b-2ea42f1bddb6", "value": "T116E6332722680150F8F58936E43A2EC377F42D7BC755AC3835DDEDE70C26A549A0AB63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679864144, "uuid": "d3d0cdcd-4696-4350-b27b-fad408c28f31", "value": "e0224bb1f86777b26682b150d90a08db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679864144, "uuid": "76f7e963-0a34-49d8-9698-0d69bcb86141", "value": "393216:598/PPL7D4qsuco+RVy2E5140lqHbNUu3GouP:598/PTYq31TqHT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679864144, "uuid": "a5537551-8f02-4ec6-925a-579ac9c5cf0c", "value": 14222336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679864144, "uuid": "27cd5a77-f330-4f1b-aa9a-f2d14bb96f56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679864144, "uuid": "f234e5dd-93b8-4b0e-9940-be54dbd11f86", "value": "9883ae323ef224d0d385c7dbd47fd6a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e67450dd-cbe3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679841520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679841520, "uuid": "b19a7604-0d40-46ab-ab1f-9436ee76ef2c", "comment": "Malware payload (Smoke Loader)", "value": "652685c8ba9a7aa68011ae58ef4ba00c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679841520, "uuid": "8750f8eb-0002-4240-84cf-149013397f4a", "comment": "Malware payload (Smoke Loader)", "value": "38787f7e57bc6977e4c2ba92d208d29777dabafd4558a13070dd422449aa1c48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679841520, "uuid": "29d9c2ad-e81b-4a0b-9d1f-e2eb06fa181f", "comment": "Malware payload (Smoke Loader)", "value": "6dcfbd4f8cea0f732038bb36d12e42875d974a65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679841520, "uuid": "53f62e66-32be-4d63-9c61-c6ed58ef973e", "comment": "Malware payload (Smoke Loader)", "value": "f580a15fbfcbc2d66e74f8a33536e22f0016249a4bb14ec7b0198797e672312cb1d03dc13d4d42a5d113726ee0e37bd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679841520, "uuid": "1673f045-8fbe-4044-96a4-33a417d97acb", "value": "T14C546B3263E07860E562D6328E2FC7FC2A2FB9619E157B7E13559A7F09702A1C172335", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679841520, "uuid": "b864548b-670a-41b9-9f4b-a7e601333cca", "value": "c5c75c5b6a7ab4fe20f346e6d5121c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679841520, "uuid": "b3dd9454-56e5-4329-a809-b2cb75f4ae9e", "value": "3072:e3zrCktY3urayKuR1ukF4bZjcQsjS+tFDg9zV8/Og3lSgwae/CpL//c5pNN4TJY:8AOahuRKl+txgBV4OgNJnpL/mNN4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679841520, "uuid": "49e5a2c9-f9e3-41ff-a83f-c4447d5e6bb2", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679841520, "uuid": "23be0717-d1e5-4bde-bd06-1e78f72d8b9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679841520, "uuid": "8b7a380e-5e3d-4782-9d27-3d0978cdf487", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e0726b4-cbab-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679817266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679817266, "uuid": "2f924766-499a-4235-9cae-e43d641f9fbf", "comment": "Malware payload (AgentTesla)", "value": "3e75206304f53375db0bee8132d5f170", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679817266, "uuid": "b3f4d32b-d1fa-412f-bc24-a0492f653e88", "comment": "Malware payload (AgentTesla)", "value": "38895a67236a2ad5b6ca5c73e1d3f9b8d7c3aa1603014397716f360261949853", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679817266, "uuid": "29bf54a9-c698-411f-bdda-fd6e6662032d", "comment": "Malware payload (AgentTesla)", "value": "a0a03282a44a433d8e7f442a0831c2b1bc3d16bb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679817266, "uuid": "db086b1b-090a-46f2-97b9-57cc73598b1c", "comment": "Malware payload (AgentTesla)", "value": "fa01b1033b8c3adfdb841f8bacf57e76c0b449788ea405d8cc46b76cbc858a8246a05222616ecbfb5a40173ac0b063df", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679817266, "uuid": "a34d0816-570b-4cd8-a8e8-fc36367ab12e", "value": "T10ED44B391EA97711F438E3758BE08023A2E067C7BF11CD1B2DE70B4D4F5295269DA92E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679817266, "uuid": "2883f1e3-7b45-4def-853c-1765283e7334", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679817266, "uuid": "d17ab3f0-2b94-4cf3-987e-4bc8cdbe80d4", "value": "12288:h/RZMG7uI1nkoKFfcDIS/nJdbTLZ75P32Gh:TII1koKF0DbdHl9OI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679817266, "uuid": "b044afdf-77b9-4d3b-9ba9-751794fe008a", "value": 638464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679817266, "uuid": "f2cb7fdd-1767-4257-8bc5-3d5c3463613a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679817266, "uuid": "19887c75-8c73-408e-ab1c-543a2ea73c59", "value": "PURCHASE CONTRACT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47494a14-cc01-11ed-88f6-42010a9c006e", "comment": "Malware payload (Nitol)", "timestamp": 1679854138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854138, "uuid": "ebdb2944-955b-480e-9efb-4e2a277c0934", "comment": "Malware payload (Nitol)", "value": "bd1cd372a0623edbddddf0f4f3cc569f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854138, "uuid": "cb3780b2-f6ed-4156-b420-2dfd580bede0", "comment": "Malware payload (Nitol)", "value": "389c0e627c0212dce951e475243b1a682b76cce1aa83ba11299515b6a19e06e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854138, "uuid": "81dbc24d-7449-4c05-ab43-7fe8726e950b", "comment": "Malware payload (Nitol)", "value": "4d088cfcba452018860a9950964ccd66aeb69b29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854138, "uuid": "c076e07f-47cd-4a83-b550-c7846b5531d9", "comment": "Malware payload (Nitol)", "value": "51938f184cf8f06bb3e81c2254d23a43e1067e219ef65bbf183c751cc1cd03bb9a0843a84a5d2ba220eebb7e3e671fc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854138, "uuid": "ff620d26-f849-491c-978e-fc9b41ce33da", "value": "T1294523211A860026E6D5AB79CF5BD32BBD3A6C4501304A07D179D23FED243E276B972F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854138, "uuid": "2ff35632-f3af-4742-bf6b-103e61208e1e", "value": "2fec0a0b5a0b15ab1d7ec3c56dc7ca16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854138, "uuid": "20015cf3-3f7b-4f0b-b1e4-11bbc1ab7f9b", "value": "24576:GHoxHzQNzyzbxg6D3WI9So2C9rRvzA8J:KohzQRkO6D3W42CrTJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679854138, "uuid": "9c6ace01-ca84-4354-8c37-0c55b75cb034", "value": 1204224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679854138, "uuid": "63648bcc-0d19-441b-9811-afc596f6645b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854138, "uuid": "fc5ffcd0-11f8-479c-ab76-81df5980be83", "value": "bd1cd372a0623edbddddf0f4f3cc569f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71a1b34f-cbee-11ed-88f6-42010a9c006e", "comment": "Malware payload (Babadeda)", "timestamp": 1679846048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679846048, "uuid": "4c796f4a-6295-4cf1-9dad-cd1023367083", "comment": "Malware payload (Babadeda)", "value": "709002961b4a3d18185690cf820c4758", "object_relation": "md5", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679846048, "uuid": "23cb45df-24b2-43d2-bcee-df02382ad570", "comment": "Malware payload (Babadeda)", "value": "39d024d9d590f29e0e522f1e41ac4e5c7bf67ebd261b3fa939b6e0ee883acc59", "object_relation": "sha256", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679846048, "uuid": "10a773b6-5f20-4c59-9622-ab52c1567783", "comment": "Malware payload (Babadeda)", "value": "9e45ade994f2d711f12fd1bdd24c76c29190d919", "object_relation": "sha1", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679846048, "uuid": "dcc3ff3c-0370-4902-856b-13f1ef98b875", "comment": "Malware payload (Babadeda)", "value": "1b1c9ba2fd3672f65a4484d9d1dffa165098b5fd87a8c4898ef452a7f3e40f57c3025b65daf5b9530746d9ad95573edd", "object_relation": "sha3-384", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679846048, "uuid": "3ddc0931-8af3-4742-a824-070dc4d4f4be", "value": "T18385A7D80F6C4C96F182FC763675C2229D3948C9864A607ACD195E2BE1BBCECE0C7D65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679846048, "uuid": "5210f34d-6656-4a4e-90f7-ea847dee6d6f", "value": "2c5f2513605e48f2d8ea5440a870cb9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679846048, "uuid": "c0d3ff92-8c51-4e72-856d-b407ba7c39d7", "value": "12288:JoSWNTJ4Yo1VFnA4r5rraOVokssOcnh2tbbLqhS8aKxk:JoS2TJJo1V6u5rraOVouOcn4tbbR8aqk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679846048, "uuid": "fe540952-cc5f-443a-aed7-9e3ecf7c7913", "value": 1756672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679846048, "uuid": "6b382da1-125d-49cc-9dbc-743feda9c9c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679846048, "uuid": "3801f840-34fd-4ffd-bd1d-64b1164b2e82", "value": "HURR-DURR 4.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73075743-cb99-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tsunami)", "timestamp": 1679809543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679809543, "uuid": "a2c60ea3-add2-4782-ad57-4a5e8086483e", "comment": "Malware payload (Tsunami)", "value": "7db7b8a842ac074650619e6ae89c5ff3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679809543, "uuid": "df2fb903-79d8-44b0-b2bf-d31487f44140", "comment": "Malware payload (Tsunami)", "value": "3b65d645e10460a316e29664bd130092727f5ad7da9919c2a249496c21440983", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679809543, "uuid": "a1ac44d7-839b-46c8-afaa-9b4c4a0db912", "comment": "Malware payload (Tsunami)", "value": "2087cb31dc40db2c059a7d8f279c8f61d626a3d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679809543, "uuid": "19d58ff4-6ebe-40da-bab8-06be14210425", "comment": "Malware payload (Tsunami)", "value": "127a55faae617de647dcee1808c26153fd6ef46a42473623661121b6bee22f9dc428b42e29d91b579bdbeb787d953a93", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679809543, "uuid": "2afd23f7-651a-472d-b4c7-33d24c8f07c3", "value": "T12AD3A50BAB61DEB3D85FDD7705AA860110CD945602A96F6F72BCDA2CE74B94F08E3C50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679809543, "uuid": "ebc7131c-9d57-4a37-b655-052b52522e34", "value": "3072:Gua7022NgEMxxyke6EV6T/qGDmj4Lq/WoleA:Gu922NgXx3e6EET/qGDmj4Lq/WoleA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679809543, "uuid": "0245cc3a-ff26-4231-a7d1-1ccd6611e539", "value": 131688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679809543, "uuid": "7402d285-0c4f-4bcd-8d83-c3666cbfb71d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679809543, "uuid": "21fc870a-262a-4dc0-9460-ac3e2b1f8ee6", "value": "7db7b8a842ac074650619e6ae89c5ff3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0968263-cbb4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679821270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821270, "uuid": "ace906e0-653c-4e8d-957e-14dde5dad3c3", "comment": "Malware payload (Mirai)", "value": "dfbc247329673c49ed20baee2e25ecfc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821270, "uuid": "90f7a06e-be89-4774-9168-c716c74f03cd", "comment": "Malware payload (Mirai)", "value": "3be534cb8a97228b28031ecb5c41929dae56f49a95f58bf4ea68459fc017bcde", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821270, "uuid": "9b7388bb-5f3a-4134-835d-87ac61864f05", "comment": "Malware payload (Mirai)", "value": "bdf536ac0ede6e29f214211a3a099b587cee0bb0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821270, "uuid": "5915b141-4069-48ae-b736-06ea13a0fd3f", "comment": "Malware payload (Mirai)", "value": "e1c25886f6449d29118c1bdaeaad660544596ef7532f4d90491ec79b68bb65dc6fe0d624cd2c519bd829fde570433b91", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821270, "uuid": "34d16342-a4cb-4bb7-bf2d-0b7246b3fac3", "value": "T12B03F755B8829A77C2E1137ABAAE4A8D337063E8D2CF7217DD214B607AD511F0D23F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821270, "uuid": "44404daa-84db-4d96-91ae-a74e8085778c", "value": "768:8gucgjbSwG55mONnTDSTBkElFenwRjn95jTZCSR3bD55PvgMH6ocSm/NBwW:8fbpG55hTDSljdBxNFR3TPHHnmkW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679821270, "uuid": "4eb79311-666d-4815-888a-d0da2570b5ad", "value": 40852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679821270, "uuid": "50aaf444-b8e3-435f-9cfe-29c288524d36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821270, "uuid": "1bac9a00-d52f-4eff-8670-a895a926faff", "value": "dfbc247329673c49ed20baee2e25ecfc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9e41d28-cbc0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679826386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679826386, "uuid": "ed787b47-3c23-45fc-bd4a-6f9a74adc1bb", "comment": "Malware payload (Mirai)", "value": "703c59fe96c562b80b9dd373251a3766", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679826386, "uuid": "31ef34df-6627-4c67-b9ce-67bc3500eb80", "comment": "Malware payload (Mirai)", "value": "3c8f2aabb803da98027ed436395181ae900ffb8a0fe5b4f625854d0f38be4ff9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679826386, "uuid": "ebd8fe64-f9b4-4bad-a754-ba20835bac58", "comment": "Malware payload (Mirai)", "value": "28af15cd64779e1964fd41f8b969efeb8f77fdef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679826386, "uuid": "aed5fdea-f1ed-4b12-a965-033909deb76d", "comment": "Malware payload (Mirai)", "value": "48a717c84ed7f96002514b2bf89c453d8cce19a6a4c9cdb1eddf9331b78fa1f10569acf8b0772e957b090d82486c2131", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679826386, "uuid": "d50591e8-d89e-435d-82ae-6789a63e1827", "value": "T13073930ABF650FF7E86FCC378AE91B45248D641A21993B7A7D34D418B24B24F59E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679826386, "uuid": "49091602-1236-4bea-a0c2-dda897c73804", "value": "1536:P2Vu+dSbFTBJRc4gRGUUpbVpsDuPSwteQHBZ:uVu+dSbBBLgRGlpLe2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679826386, "uuid": "db5a8754-5ef5-4836-a4b9-1f5341b6fa76", "value": 79868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679826386, "uuid": "1cfc4dec-3c12-4069-8ebe-c398dc52f74d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679826386, "uuid": "cff02fb4-23a3-46c2-bf91-ccda9996a3b7", "value": "703c59fe96c562b80b9dd373251a3766", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1a80787-cbdd-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1679838935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838935, "uuid": "5a2a63e4-4370-4684-a6f1-6371ea38ba5b", "comment": "Malware payload (njrat)", "value": "706fd9eb22adac23c973248375c50a02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838935, "uuid": "e8ad91e4-5543-4dab-91ae-982613bbf6db", "comment": "Malware payload (njrat)", "value": "3d8b2bc3fdba588bad1e6ee74050de7a31e386088636bbedf72f2285d3dc819f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838935, "uuid": "79045fb9-2bda-43b2-817f-a5e5e834753c", "comment": "Malware payload (njrat)", "value": "a2eb4719961cebca7a1e0ede2397c7e11e91a068", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838935, "uuid": "bfbc0c39-121c-4724-a4c3-5f5d0037cfd9", "comment": "Malware payload (njrat)", "value": "164cd742bd4d0c3d23f015edfd91830dc557db6be9ed0206894c50b43cb058c1ac2062237f12e38e3773bf16dbee5a61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679838935, "uuid": "15d3ff50-ce7d-4e88-a6ca-a389e7dcd1bd", "value": "T122C2E76C37B68232D2EE067E4562EA5143B5D44BF233EB0E4CD998D94B5B3C60A41FE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679838935, "uuid": "b5fb93ce-0633-411e-aabb-b966c6b69412", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679838935, "uuid": "f44aa6c5-aff0-4ef6-8ec6-58823711ff56", "value": "384:hLOlYHHeIYTzJRcbg8iEPrthZMVAQk93vmhm7UMKmIEecKdbXTzm9bVhca66Zr6s:B2ZxJm8VA/vMHTi9bD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679838935, "uuid": "212fc252-4115-40f9-b7cb-e32f88d9c047", "value": 27648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679838935, "uuid": "55ea5403-f0d4-4731-b1c2-819181c16a1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679838935, "uuid": "4452095c-1ae4-45fb-b77a-d5cc87f16d80", "value": "706fd9eb22adac23c973248375c50a02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d11491f-cbf4-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679848457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679848457, "uuid": "dca53266-1d3e-408f-aae4-914ab34df818", "comment": "Malware payload (AgentTesla)", "value": "755d17162f2b8c414969b79406e66343", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679848457, "uuid": "7d7e3588-2a01-4e64-8286-29adf36549de", "comment": "Malware payload (AgentTesla)", "value": "3db061e8ab14d7827584ec103733d3fd860986a5f7dd72ef4213e04d8c274245", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679848457, "uuid": "739b0a2a-76da-4ba7-be3f-c328f7ae55ab", "comment": "Malware payload (AgentTesla)", "value": "7e031cbb048a2fb56472c688833e6f558753086e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679848457, "uuid": "1e0c891a-be25-418f-8e77-f35469b23689", "comment": "Malware payload (AgentTesla)", "value": "315c0af2fb679a67f6a4f324a38a22600ad418d1c72c1bda95bb280176f95a832d293e577be731830380c38ab167ee91", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679848457, "uuid": "e1e075b6-d3df-4b78-8ef1-faaadd53eaa7", "value": "T1E2551203D445DDCBD0AA8374BF2379E6460DBC7261F972C22844776B1B32E9B864B26C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679848457, "uuid": "e904c74a-71a1-4d60-99b5-fa09a130aad0", "value": "24576:uLKhWQmmav30xUSSMMednEqP6bvdXXXXXXXXXXXXUXXXXXXXXXXXXXXXXZDSSMMT:uLKwQmmQ30SMR6OMd/6VzXKpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679848457, "uuid": "e501cd7f-fdd2-4f7f-b0dc-9d26a4c59540", "value": 1337344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679848457, "uuid": "f49b15f0-e053-4d77-8ead-bc5d3010a6f7", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679848457, "uuid": "ce43de1f-4838-4467-b072-da4c259f287e", "value": "Order Inquiry.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9443754e-cb73-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679793278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679793278, "uuid": "941a2022-6f36-43c7-94d3-2c2aa403b6af", "comment": "Malware payload (Amadey)", "value": "296ae66b66833f95a296c6137e19d48d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679793278, "uuid": "e58b5318-94e3-42c1-a251-335e09acedac", "comment": "Malware payload (Amadey)", "value": "3f254554cff8dc2b0365505917ebef45c430936bceb0c91b2ad69a9ff276d36f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679793278, "uuid": "5d57c10e-5fad-433e-bca8-7555756f4f14", "comment": "Malware payload (Amadey)", "value": "2eef5083609f01fc3f8f1b1dcadc9b2622bd1d56", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679793278, "uuid": "16812a6f-c460-4dfb-afe9-024c35307bb0", "comment": "Malware payload (Amadey)", "value": "cb739a01604058204bcbab5cf0b7a71d51607a7dad497eee25c7db9a5994b08272e9d349ae70fc11961e0f5912f9336e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679793278, "uuid": "aaaea2b7-f74e-4c69-8a94-84fdb9f88ff5", "value": "T1DE546C0253E17860E72386328E2AC7F42E1EF8615E157BFE12599B3F2971FB2D162705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679793278, "uuid": "523c8280-5e43-44c5-bb65-5098519aab07", "value": "4ab2a4d536313c74a2690207bf67c9d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679793278, "uuid": "af88dc6a-59e6-49c8-b165-788a6aeb8882", "value": "3072:C9L6okrCRs30bAFv0Lapk8GfrhQYgUKJkT1DLCD1Sg9uCvAbvXppuaVuRU7CJQN1:YRs3oSpk8UgUKiT1/M1SknAFpdeTf2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679793278, "uuid": "3498f76b-8d8b-4bd2-bffb-91d8ebc58f6e", "value": 279040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679793278, "uuid": "bba78bc0-4098-40a2-9680-a04ac1c6d875", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679793278, "uuid": "28ca228c-7647-4bf6-adbd-87638bc1db94", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "523f1238-cc01-11ed-88f6-42010a9c006e", "comment": "Malware payload (Nitol)", "timestamp": 1679854156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854156, "uuid": "f0bd670b-074e-4a94-8b1d-183fae37f517", "comment": "Malware payload (Nitol)", "value": "1695bb54d473710584deaea09824453d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854156, "uuid": "2e60ac90-0c10-46ed-aa18-ca8352dfff0c", "comment": "Malware payload (Nitol)", "value": "4065b126e2bab0d42bc96688134c686d610a6bdf3eebeef8659420704f650987", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854156, "uuid": "2388bab9-1c01-424e-bbd0-3b29488810b3", "comment": "Malware payload (Nitol)", "value": "ae6c0208b51ebb24b13af88cab7123480c07beab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854156, "uuid": "da936382-4b74-49b6-b447-93245514d18d", "comment": "Malware payload (Nitol)", "value": "7257dd79f4e5fb26f30795ee96a13c3c9b259100a8ca26c5cefab263b48e4f9a268e61835e87e74444b082bd5dc21f3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854156, "uuid": "5bd6f25e-bf8a-4ca0-b9c0-f69d01b3fa50", "value": "T1F2F423D2094368C6C3425A783E73E45E67E81A006B9DF62396E9FD8D79F1DC3E5A0390", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854156, "uuid": "e1531066-0ce1-4ed8-9bf9-fc57cb0ccd2d", "value": "c3d7a1b36acac9169aff477ba8424f6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854156, "uuid": "874e788a-ba5c-4644-aa7c-baa4dd38a0ad", "value": "12288:JxrE/92MglVjlqb3mb/niyWUF5pJNu5e9KXkkMGN7oVGOUwbz/YBrU3s/A1:JdqXLW/iyWUFv0O8oVPUoYBKf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679854156, "uuid": "38cafda3-cebd-4ee9-9afb-7c729c7cbac4", "value": 774144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679854156, "uuid": "a6235562-e1c1-47fe-b72e-b517c8951dc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854156, "uuid": "bddc5659-1618-42c6-9136-e43c26d36355", "value": "1695bb54d473710584deaea09824453d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddd3f2a7-cbdf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679839787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679839787, "uuid": "2301eeb8-3642-4e94-aa43-833b730c390a", "comment": "Malware payload (Smoke Loader)", "value": "cbf0b5ad9b04b05a29801569c35e2a80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679839787, "uuid": "3db58783-685c-4058-a5fd-d28a560f644a", "comment": "Malware payload (Smoke Loader)", "value": "407b7978d56e8808cc8615d041d9ab8b6491032a99c9979caeb73e8721dd4edc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679839787, "uuid": "0487fa06-c769-4753-a377-838d56420c09", "comment": "Malware payload (Smoke Loader)", "value": "b2e8d7645e8e4b0b4edf72fd5f90569eb46e2542", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679839787, "uuid": "d8c44600-0f27-474e-8d4c-f5ef69d6a7cf", "comment": "Malware payload (Smoke Loader)", "value": "8f66cce1f8dc839a0217cad8eb6969cd667e0c126a3129031f6cd4ab8260163c8a27fdcbfe694f22b8033c7c4a8f913a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679839787, "uuid": "b9994f60-3833-4662-9359-6a6e1c680e49", "value": "T16D546C3253E07860E562D6338E2FC6FC2A2FB9619E256F7E13595A7F09702A1C172335", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679839787, "uuid": "705ea06b-b57e-47a1-8b85-c6037dd34f11", "value": "c5c75c5b6a7ab4fe20f346e6d5121c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679839787, "uuid": "448babcb-bf8a-46db-9bdb-6206ab964e5c", "value": "3072:Z3do2E9NTud8WxIYW0ukE1bZvfP1FYe9Ipm3Xo4vY0FArRQE/wpNN4TJY:GhXW+YWTogY4g0mFX/eNN4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679839787, "uuid": "58acac3e-9c52-4043-87ee-325376eea1b7", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679839787, "uuid": "2c16faf6-08ad-4d7f-97b4-36343f44c5f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679839787, "uuid": "9ca80bfc-b1bb-4386-b28c-049045025a6f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3b4a664-cb73-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679793358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679793358, "uuid": "c9217d27-a0fb-4ecf-8803-baf55012ee5c", "comment": "Malware payload (RedLineStealer)", "value": "49d8e7ca9bd1b83df1bb1679f4b9ca42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679793358, "uuid": "a20c0c36-d41c-42a0-8196-c2c1bca40c09", "comment": "Malware payload (RedLineStealer)", "value": "411aec7329a99e6fc358db1bb96439e9cee23d87d863994c2ee2b14a7c1b99f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679793358, "uuid": "9b02de97-7490-4266-84a8-e0b25daac090", "comment": "Malware payload (RedLineStealer)", "value": "f6d292a6ad8903c3eaa67784fea60d352f0d90a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679793358, "uuid": "270f21c5-af1b-4fda-afc7-73022f1874c3", "comment": "Malware payload (RedLineStealer)", "value": "2a42faf78d312aa10dba6f9e7e4dd4f88b446a0ff1c2ce10ec47dc43e83970985a4de018e922d3d93a34087ae4a193cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679793358, "uuid": "05bf7aa8-32f9-48a1-b156-6f1054c2a2fa", "value": "T13684AF1253E56820E76387329E2AC7F42E2EF821AE157BFE16549B3F1971F72C162314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679793358, "uuid": "cfcc61b1-f4cc-4e03-8ce9-8a6ba46847bb", "value": "5bf64f0a1a526a4cdb08b53a545d3838", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679793358, "uuid": "73bb58b2-fdae-452a-8fde-399a1aa7c697", "value": "6144:AQYIXAEaik8hRi1B5pqh8fFfdBqcMukD8ZSuBWRkTfz:AQYjE/k8hRkfe8fRtA84jRSz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679793358, "uuid": "3231338e-66e9-4fde-8fb9-13667b7017b9", "value": 387072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679793358, "uuid": "84dbb446-f754-45fa-9170-8c63c262a9a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679793358, "uuid": "af2ddec0-bfd2-4119-a983-c7c3fc8ca647", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b1c5f64-cc17-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1679863539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679863539, "uuid": "3525c2cc-0f5d-4897-b0f8-4b354cc23e18", "comment": "Malware payload (DCRat)", "value": "9781aaa439fcf85da08d40c5c3e3909f", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679863539, "uuid": "83633438-1d29-4224-806b-1fa6531e5e5b", "comment": "Malware payload (DCRat)", "value": "413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679863539, "uuid": "f59b865d-b469-4b28-b23e-2ec76236fb8c", "comment": "Malware payload (DCRat)", "value": "edd84aae94017cdde7dd564d2791c6389f98c01f", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679863539, "uuid": "7790ed14-715a-4be4-b215-f28e1f27550f", "comment": "Malware payload (DCRat)", "value": "bf8e59034529afa64ead414b3a081d4a5b5d3d2771fd3d23c1e07fd93f5624f7b500784bf14b4f082a7f18e80db22b14", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679863539, "uuid": "47285589-74b8-488a-84cf-fb1e9c31f4a6", "value": "T159D5D002BE44CE01F0991A33E3EF46484BB499456AA6E31B7DBA37BD16123937C1D5CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679863539, "uuid": "74f0e8fd-ee24-415e-b148-dc3905bffd48", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679863539, "uuid": "7bf5e4eb-de3a-4de8-ac6a-064d4f0946fa", "value": "49152:VVqaWggE8cLbTM0Qpx80y5tq4JyiK+RzzO/twfoLFAq4JNpFLP7:zqLggl0QpC0qt/JyV+hz5foLB4Jn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679863539, "uuid": "81dcebc5-d044-4447-b3d2-ef52b6725495", "value": 3009536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679863539, "uuid": "8eb0f5a2-ad23-4873-b14e-cac52ce056e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679863539, "uuid": "37f7fd52-f465-4b4e-9165-9883cb18ec9b", "value": "9781aaa439fcf85da08d40c5c3e3909f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddd746d1-cb9a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tsunami)", "timestamp": 1679810152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679810152, "uuid": "ce7da0fd-68a1-49ee-8fb2-d58716f96002", "comment": "Malware payload (Tsunami)", "value": "3f7e9047d0fbb7bdb9ea9f48f82e0196", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679810152, "uuid": "af89a137-af0d-4e3d-8ef2-1304bc2620b7", "comment": "Malware payload (Tsunami)", "value": "4255ef4bfb99f58cdf97bf7bdb01210855be2694222dc103e2deab58cc92e19b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679810152, "uuid": "d032cb3d-4785-4474-af77-447b996777eb", "comment": "Malware payload (Tsunami)", "value": "9bed081a21e2457f5dc6ed412b2261a4332da323", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679810152, "uuid": "37eb7c1f-dbd9-4c88-949b-816d6d534114", "comment": "Malware payload (Tsunami)", "value": "75f411fd3f3811d8fb4955e965c7322d5167fbee0246f2c2b3e8d250eec2fc3ba12403ffe3d72add47f7bda01f09082c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679810152, "uuid": "5ed21dea-8b5a-4986-a379-9ced44665016", "value": "T125A3290799A28EB7C156AEB625EB9930075FF8510B0F1A85753CABB8430F9CE790D374", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679810152, "uuid": "16a3edd1-177b-42e1-8085-8ad1895cd0db", "value": "3072:9d25+V8wRKfG/czCeYM+I9yJCU4WRC5ZeA:9d9zLcWeYWyJCU4WRC5ZeA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679810152, "uuid": "1a041b92-dc8d-40ae-8fed-c8f6e1820c68", "value": 98536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679810152, "uuid": "5885e45e-5516-49f9-b246-c20a4d52fe6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679810152, "uuid": "011594f1-3fbb-4bfb-a246-1a2224a979f7", "value": "3f7e9047d0fbb7bdb9ea9f48f82e0196", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c745891-cc16-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679863058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679863058, "uuid": "486f8f4d-6468-465f-9d2d-cffafe3225ce", "comment": "Malware payload", "value": "c25637fbfe2385e67f42378ccbd68474", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679863058, "uuid": "697d7ac7-daff-4255-a0b9-9f9942569e01", "comment": "Malware payload", "value": "425c0e99221b064d1577ac907a4803d14f4e67a305742aa2c1e80382b967831b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679863058, "uuid": "6fe79699-ff32-4b5c-b221-2dece3442d07", "comment": "Malware payload", "value": "b6821b4141131e428f8c54c1f5e2d840724569ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679863058, "uuid": "719d732e-084c-4292-9cc9-5ed89adcf314", "comment": "Malware payload", "value": "757f564a6d05ea1575c4345ee1ab391ac4a1963f5bb841cc6782350defa795efac0764e525f68bbaf86623e524475afa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679863058, "uuid": "44437872-f068-4168-8a9c-bb925f22e51e", "value": "T1AC65C033FD928C99DB2D9378A0CB97916238FA828E339707555596317E87BD01ECCE09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679863058, "uuid": "c8b5add9-9550-4c7c-b671-723bb6a99f50", "value": "04605125b4aac7d1cf589457480d2d6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679863058, "uuid": "2343b2c8-924d-49b8-ab72-329575807239", "value": "24576:GZ0deUIxg6AZLNsVHdGujJKX1uH9cBaGn6iMNo/FDHEj3TBechhH2y5DHEj3TB4o:65UIdwLNsV9G+KXhT9FDHEj3TBechhH0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679863058, "uuid": "ae9e31bf-ee8c-4357-91c9-17bb241cbe77", "value": 1428162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679863058, "uuid": "79a0178e-b119-4780-8c54-6a16430194dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679863058, "uuid": "72c0e4c2-a217-478a-b0b8-0ded3d9e3c77", "value": "ef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74af58db-cb75-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1679794084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679794084, "uuid": "8bfa2f8f-5959-4ee7-b3c3-1b1e05a4d69c", "comment": "Malware payload (AsyncRAT)", "value": "06dff227eb1af54bfb0c50fc2affff9b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679794084, "uuid": "f3c9f061-e227-4334-b198-29f462f26cb6", "comment": "Malware payload (AsyncRAT)", "value": "4473deda804fd3e81f339e24a0cae78595940139eb776fec8f002a1874b04d30", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679794084, "uuid": "0f6d8814-8c33-4bd0-b4d5-910ad2a65526", "comment": "Malware payload (AsyncRAT)", "value": "b6e7415383e058088e4e569480154f019c5e7f62", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679794084, "uuid": "2cb083a0-a036-402e-980a-3a0e5e731139", "comment": "Malware payload (AsyncRAT)", "value": "14bf6ac53e29f0f44372d36f97be98edf47b5526c9f91cdf339fac34e6a54928f6ace2fa1b00a3cb50e6409a6dd402a0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679794084, "uuid": "ac184d5d-8085-46bc-a50f-17121887f280", "value": "T1EEE4BF42F785D8A1D4A906718823CA2406B3BD2695344A2B35EE7B5F3E323C32677D5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679794084, "uuid": "76a38e39-59a3-4a87-ab4d-79ccbcdf0067", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679794084, "uuid": "6a7b3b89-a202-4c4c-a1c6-abf03b803d5e", "value": "12288:iOLsHy9G6DMz39G6DMzgMMHMMMyMMMZMMMVcR9bzeXOMMHMMMyMMMZMMMVcR9bzK:fQ+GLpGLMMMHMMMvMMZMMMKzbKXOMMH5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679794084, "uuid": "9c4d0faf-ca41-4d89-a7c9-7984a36ee48d", "value": 713216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679794084, "uuid": "514e4df5-f2cc-4b39-a7f5-c748eb3679e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679794084, "uuid": "200604d5-c7f0-48d4-8e0d-15d4ee35a18c", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "481b8f5c-cbdd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679838677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838677, "uuid": "65617357-6964-4ab3-b5ab-8c3d488e21a2", "comment": "Malware payload (Mirai)", "value": "6d854405eb037ac40fe4bd8a92c66d2b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838677, "uuid": "269c67aa-cdae-4692-bd71-5e01988e0e0c", "comment": "Malware payload (Mirai)", "value": "452283722ac99ba38c20f8306c72ac31f96670941a24dba1b4dde25b47211b19", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838677, "uuid": "488a4dad-c4a5-4020-bddd-f8abf510d2dd", "comment": "Malware payload (Mirai)", "value": "ddbe39afc55a1bd78416395d18b58b887bb6e618", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838677, "uuid": "2b979b9b-284c-47b1-a2b9-adb891cdbfab", "comment": "Malware payload (Mirai)", "value": "ba46b659c9143439ae738edd073a71ef9f2b1f0dcf2f74e4e28d436eef6c773b17dde77c903212229387496037cec167", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679838677, "uuid": "2d17afeb-5b05-4170-af5e-dc5bb700b0ef", "value": "T1A4E33B372B230D63C084547112E32331AABADFAA38F953D7E9947DA86F359443166FD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679838677, "uuid": "dd1058b6-1bcb-4d7f-b67c-07d4506a76b6", "value": "3072:2jd4VmwYboPSjZRFOutJ8adPF4KQThs56POxPK9kYokb07bySQ0VGngf1k:2Z4VY4S4utJ8adPF4f1K007bySQ0gngy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679838677, "uuid": "3d8456a9-ac8d-4e76-8733-87f19b9e0b6b", "value": 152200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679838677, "uuid": "308c7e42-b974-4047-8802-a0578aaef1f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679838677, "uuid": "307ba3bd-7565-4a0d-94a1-100b2d9725f2", "value": "6d854405eb037ac40fe4bd8a92c66d2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "878106c6-cba5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679814732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679814732, "uuid": "cc1e0fad-d4e6-426b-a3cd-7e2615992d67", "comment": "Malware payload (AgentTesla)", "value": "03961ec13e873ea13a82e35dd2b7eef2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679814732, "uuid": "2e4ee5e0-acd1-4f71-94fe-c766c40f414f", "comment": "Malware payload (AgentTesla)", "value": "46b839046472b0ddccd523646b37a8e8bd01deb3b40cf7593dea187612058134", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679814732, "uuid": "649a11ec-1706-4e68-949b-fe78faeab046", "comment": "Malware payload (AgentTesla)", "value": "e60ef558fd57f071667547d96ed73f44e825a410", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679814732, "uuid": "5ca520dd-1669-40dc-8bac-c370573867df", "comment": "Malware payload (AgentTesla)", "value": "420b54731d9f099bc34e9d0fb070107bad55dea72bd72ce823753e1bcaaf01828abcfefa33175dd50a3d9ff48ebefb15", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679814732, "uuid": "5976a916-9875-47f5-826e-fa6407308ee8", "value": "T121052361FFEB1D4915AB60BDAB3C24D5EC67BF661A2634E0B36EC35CA64D13C0827091", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679814732, "uuid": "ed8ac0d1-99de-4548-96f0-27443c8b856e", "value": "24576:+33cqG8K/A5kpdJMFA6HRiUJWfX0PXdjYTRu7OXzJ3v/7:g3xG8K/A5kpvGM+NJCDJ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679814732, "uuid": "9033d538-2411-4fa2-95d7-66b72aa9c07b", "value": 841727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679814732, "uuid": "6a6e1058-8789-4c0e-8ada-0741b41f2b43", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679814732, "uuid": "5fc7a6f6-7018-46bd-a91d-d5d990dc0ec0", "value": "New inquiry - Qingdao Wisdom International Supply Chain Management Co.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77d2ba91-cb99-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tsunami)", "timestamp": 1679809551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679809551, "uuid": "841e4b8e-7221-4bd9-b048-4febecf309a3", "comment": "Malware payload (Tsunami)", "value": "dc0c64b43970e8b3ec19eb7739151046", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679809551, "uuid": "2c83fe28-c6aa-4a1c-8c9f-a4a872f2b212", "comment": "Malware payload (Tsunami)", "value": "484696e94096aa115d747b30dcf999de1f47d3091d4a3b08c3f1e9c130c5f7cb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679809551, "uuid": "03938db7-971d-4a11-a174-a73379b3f3d6", "comment": "Malware payload (Tsunami)", "value": "4b516e6d57574dfb08292a7ea96c4006b3fa920d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679809551, "uuid": "17a0e9ce-078d-4c38-9796-b597d510a166", "comment": "Malware payload (Tsunami)", "value": "582dd48ded5ece24716325bed04b1aec327e348dfacafe8019203bca9f597c46e32c6efc8a1615c517d65c083d9be219", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679809551, "uuid": "fecbfe70-0953-46a7-8ff9-4ad33d7fdf72", "value": "T1EFA32A45F9118727C2D23BF7FB5E879D3B355668979733117A2C3EB02B82B891E29210", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679809551, "uuid": "29ae51bf-f0e7-4c90-a317-3dd43d28ee52", "value": "3072:BMmHu8xuz+AvOkeY0ur/a+WL/1RQOn2fxHoA:BMD8xyvFeYzr4L/1RQOn2fxHoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679809551, "uuid": "6cebbbf9-8e2b-4b5a-baae-a781dd98c7ad", "value": 107340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679809551, "uuid": "92cf8c2c-b7c1-4bba-9f39-ac4f20635b19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679809551, "uuid": "c2ac5732-a16a-4320-82d2-b902d3979753", "value": "dc0c64b43970e8b3ec19eb7739151046", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22829601-cba7-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679815421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679815421, "uuid": "8abea25f-2d8d-4243-93b1-901123dbe6ec", "comment": "Malware payload (SnakeKeylogger)", "value": "df1035698712e5b1fa55251aa5065691", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679815421, "uuid": "becea05e-af37-42eb-8292-7801d0a94d5f", "comment": "Malware payload (SnakeKeylogger)", "value": "4952db48053c48e241bf6dcc0362c160eeb22d6ceedd9b57298b37659851c9ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679815421, "uuid": "32008eaa-4469-4a5a-b98c-78762451c106", "comment": "Malware payload (SnakeKeylogger)", "value": "2bc3a105cd283e74aec5817056f4b9caaedf2808", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679815421, "uuid": "82bb3d70-94c8-4093-8f47-7ce5fd1cdba0", "comment": "Malware payload (SnakeKeylogger)", "value": "0daa16694344159275bbd27c1bd2e33e35472931011292b8a5bf79b8eb156f597909e46be2d956388b44c3b5a9cf1f41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679815421, "uuid": "bde7f8d7-6f52-4f15-b3e4-5808afea3871", "value": "T12A158BC273B291B2E89F4254153865CD5E39B14B3412F12B5F37BBB0A2212BB7E6F146", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679815421, "uuid": "85c6696f-63b3-4fb2-a64b-76611aeca02a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679815421, "uuid": "fa2253ac-4f2f-437c-9178-e501d4b3da8a", "value": "12288:KvvaxYBlqnpyOkqDpDKNHYjw0cfUcIzsy/M46fZc300OXPY:c8K4npyeFmh0c4vS0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679815421, "uuid": "0dc33047-e771-4bf8-9223-5a2ba4119dc4", "value": 953856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679815421, "uuid": "5ed7cbff-cad1-4c1d-85aa-352749933575", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679815421, "uuid": "9de324ce-7f5f-4415-94c9-add24ff9ffef", "value": "df1035698712e5b1fa55251aa5065691.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "543a4632-cbaf-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679818941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679818941, "uuid": "4e14037c-244f-48fd-bd1b-c68e22d99c84", "comment": "Malware payload (RedLineStealer)", "value": "0f5607f3d670669f041b56b17ec8754c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679818941, "uuid": "41fff811-bca7-400d-ab2a-1dcd873e7355", "comment": "Malware payload (RedLineStealer)", "value": "49ba569d19d9e7be5cc875edb12673e5837ab2df4321b607ad44fe23de7463a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679818941, "uuid": "fefe45c7-9590-4855-9086-d7db18c2568a", "comment": "Malware payload (RedLineStealer)", "value": "06a3463c20310be5bdfa3b2f2c01f68a9e5c3c12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679818941, "uuid": "81cc2982-bc53-45d7-9da2-416ab28a7306", "comment": "Malware payload (RedLineStealer)", "value": "999e425fbc35901ae569bbe42a09726b57f8f4c0ff399a9271feba3a45385e892f97787ab382dd9e78d85c0ad6f46307", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679818941, "uuid": "0aa693af-a9a3-4436-9056-feb211f53298", "value": "T187544A6263F9B8D2FB814C38B1E07997400978991E308E1EFBD4179657F42A31ADB9D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679818941, "uuid": "7ee0e964-1830-4f9e-b233-8f98178c537e", "value": "03a003b2ab5e4e0a5303d82cb2f0927e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679818941, "uuid": "47c46d03-b0b6-4d69-a60c-c7b4f9e79747", "value": "3072:hlmxsFVOuy9KhySdBpzXvsxhk60MCN3CfHJWfQLjvx35TcNyF5nszKFs/Fw7bux:iluy2N609CJxx6NQali7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679818941, "uuid": "04cdb4bf-6df6-4d79-981a-c3f507f5fda1", "value": 304752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679818941, "uuid": "78b8d5db-2e84-477c-8e3b-4e6a4643ddd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679818941, "uuid": "e0913e77-6a33-451c-a6e5-c587511c2fa7", "value": "Free + Manual R 26032023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69621c16-cbab-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679817258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679817258, "uuid": "a6b2916f-f4a4-4585-abef-8856e244d0f1", "comment": "Malware payload (AgentTesla)", "value": "7066c820c1f541d0576faa768caca59f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679817258, "uuid": "c1d34fdc-cd00-4b4f-837b-b6f8a7d9e748", "comment": "Malware payload (AgentTesla)", "value": "4a5d5fa65ec3b7105b81a61e70773dd999aed27566c4dcbadf7269fd2a39b8b9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679817258, "uuid": "55c3398e-1a24-4d02-a2dc-23d848c72b2d", "comment": "Malware payload (AgentTesla)", "value": "1511fdd6c91239ff14436543b6c87604bc497cfe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679817258, "uuid": "894aaa9d-5967-47ce-8db0-17ac27088a35", "comment": "Malware payload (AgentTesla)", "value": "09eace23b31159a58618f4eb8175f875f8cd602271a4a035c8e826f79ba10d15770cbc323b18ddb92659264e5c7b831c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679817258, "uuid": "3d115140-1448-4af9-93ab-77e4b1067d7f", "value": "T159942351AFC52898DE98F94156453C0691BE2EC7A4C0AA898F1D75C793CB1EC833B93A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679817258, "uuid": "3aaf4c59-e216-4e10-ab9c-3bbad70be9b6", "value": "6144:6DGS76qFO5u3S1zlhPssHxfQwZ2DM72uSVxXvMnQT5iL7+XM2kmE6LeSK+:6DGS77O5pNfQDIS7JFdbpLRK+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679817258, "uuid": "e5c3ec68-a94c-4cb7-abd8-c943b5e47bbb", "value": 435758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679817258, "uuid": "5826a10b-7262-4543-9a92-6e3abc081a7e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679817258, "uuid": "212171ff-5ea3-46d6-bc9b-34d52f575eef", "value": "PURCHASE CONTRACT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a51487f3-cb72-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679792877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792877, "uuid": "ea3a6062-49f3-4ad5-9e05-4b569a1e96a8", "comment": "Malware payload (Smoke Loader)", "value": "9750b1cb115db1aebf6ff1661fd68695", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792877, "uuid": "4dac54a7-4756-4f9e-bb20-9b7b61036b62", "comment": "Malware payload (Smoke Loader)", "value": "4d860c64fdbd923596610cf34592b6f60a84744e9ed7ebc259306242a1903eaa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792877, "uuid": "0b739218-fd6d-44bb-9408-0b931c5f514d", "comment": "Malware payload (Smoke Loader)", "value": "4cfca7d009718001cf113da9dd43ccb00468f53f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792877, "uuid": "3430de2f-c517-41d4-bfe1-d24f0a4e1d3d", "comment": "Malware payload (Smoke Loader)", "value": "3cc948cffc4d5cffc2d108d87e2bb403a7bec904161b0340c43dcae4ad89403cf100321526d6dfe293636175d828da35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792877, "uuid": "d4442881-8140-4c89-80ee-a0a93597ae68", "value": "T1C8546D0253E27420E76386328E1AC7F42E5EF8615E157BFE1655AB3F2971FB2C262305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792877, "uuid": "e4582d2c-a744-4872-8081-5db0956e6b54", "value": "4ab2a4d536313c74a2690207bf67c9d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792877, "uuid": "8e501d25-29ae-4363-ab42-89ecbd3e6c81", "value": "6144:UHaLLg9aD78NGQn23tSzxlmc6gmukTfz:UHaLLg8D78UH3tS2c6sSz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679792877, "uuid": "ae8f136e-7c32-4a81-a388-6e1aa02e2140", "value": 279552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679792877, "uuid": "40bd5ef8-f06c-41fe-9174-e7a525c17e6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792877, "uuid": "f027eea0-1e6d-4372-8315-b40b98c68bfe", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f807109a-cbf3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679848421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679848421, "uuid": "1b59fbbf-9330-4f22-bc7e-39b7f4bb2a9d", "comment": "Malware payload", "value": "c8bf8aabd6e2977478558a3907ecee01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679848421, "uuid": "e4d743d9-3b28-4730-997e-fd4a38931e90", "comment": "Malware payload", "value": "4eaf953774a436783639dfd6255849ba86f7ca21141dbc1bddb8edb1712b0b2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679848421, "uuid": "f6936652-96aa-4140-ac0b-f69d49bb606c", "comment": "Malware payload", "value": "439191680d97ad4fe8137ba46f2728d987ca7d7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679848421, "uuid": "f857aa9e-6b14-4c3f-abb6-47db53e68cbc", "comment": "Malware payload", "value": "bc5022375ef4d05e1720ee3df8403a3fabb9e0134b3d5cb1ab85cf8ed278c100945636a6ad324c6db1728f7f972844d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679848421, "uuid": "7c2c0142-3e0d-48ff-b425-a864a90cd425", "value": "T11C5623E313780169F4D1CD3D853BBDFE74F6035B9B829C7899EA59C22C228A5A213D53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679848421, "uuid": "e28bcaba-eb01-418d-a2fb-f42d7b5b03e5", "value": "895e5e6e037e9108574fb94ed614d804", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679848421, "uuid": "2220a99d-97ea-4aaa-b982-5cd7a8d9a679", "value": "196608:y1qbwWwiMiPF+x68kh3Y9TFNlDgKS8okdMSOX:CqbwWvPEs8S3YTXUKS8oVX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679848421, "uuid": "bfde4050-e5de-4aeb-89ed-8695212dfe7d", "value": 6315520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679848421, "uuid": "c4dcbc0d-01df-4df5-b361-50993c29e25b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679848421, "uuid": "cf441a13-8c0f-4731-8f2b-3b4815ff14b9", "value": "c8bf8aabd6e2977478558a3907ecee01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84ab8378-cb72-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679792823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792823, "uuid": "b9f8aa5f-be84-4470-9215-cca70d880a92", "comment": "Malware payload (Smoke Loader)", "value": "b277b8b30848e3e4da38e7b333831a3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792823, "uuid": "d9f87529-8f3d-460a-8fa1-37e2f840145c", "comment": "Malware payload (Smoke Loader)", "value": "4efbff539d573429209a98d59fa69959f303be5f84f9a21835c0c1ac8c4f905a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792823, "uuid": "e828ef48-67dc-441f-aa0b-417bc5b0ba40", "comment": "Malware payload (Smoke Loader)", "value": "68c3ea6bcd8ce6dd0064baa9539ac8668b98c62c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792823, "uuid": "9a8e9cd3-fc78-4c83-846a-b8cec9dad357", "comment": "Malware payload (Smoke Loader)", "value": "a91eed6e04cc3ab83bc14f1eb52e9bf28ac5027ea026d353661282df1697a9359a1585612ee31d4463de9eed9344c009", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792823, "uuid": "6b2e1728-8e26-46f9-a60f-bd24b6b784be", "value": "T1D5547D0253E16820E35387328E2AC7F42E2EF8615E557BFE12659B3F2971FB2D162705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792823, "uuid": "3534f40f-540b-4408-a29a-b2518c417c6c", "value": "9c7e5bcbfd5f0ae72cc015cb41d480cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792823, "uuid": "521255c5-733d-45fd-9372-fae3912f3b37", "value": "3072:Cv+VfhPIRxreRAWvp8G3aja/AkcVwn+/S0XHHaFDA5AQInsAhtMjCJQN0fm2Rh:jYxrMl3ajOoXHHu2AvxTfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679792823, "uuid": "9ca34bfc-48ff-4c9d-88a8-c24c42a474dd", "value": 279552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679792823, "uuid": "c3307eb6-8f74-45c8-9767-185fae0eabfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792823, "uuid": "217e99fc-460c-4a10-ac26-19befb2d9366", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c583dc1-cbc2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679827007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679827007, "uuid": "c05340e9-d18e-4622-8096-047a31474da8", "comment": "Malware payload (Mirai)", "value": "9ea955ec6b172e7f4d37f1680bec860c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679827007, "uuid": "410a3942-555d-4b3b-a5b3-d10e2358fe10", "comment": "Malware payload (Mirai)", "value": "4f8952f70a25a6646664a3b8465a9cb5284f7d16c95f742c1a1ce8d20a238649", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679827007, "uuid": "0fcb54d9-7a8b-44fa-9a2d-d6e6565b1e6a", "comment": "Malware payload (Mirai)", "value": "35ac77ec2f51604bd58739e5dda4ad8d3974a79b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679827007, "uuid": "bc77c697-d1d3-4dbf-876c-2441d3b4df5b", "comment": "Malware payload (Mirai)", "value": "9629b429eec51d9d3ef75a27b2b18bd39e9dd38f4fe7fd29e18834b279daf9423afc59d66dd39594a90ae5eaa0517624", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679827007, "uuid": "e37677fb-133a-48c4-814d-c0da7ca38136", "value": "T1CC54A3797B21BF2ED7B892310AF62FB0D31550C636A1D250E27CDA14AEB124C5C9F7A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679827007, "uuid": "1575b84a-d78b-42f8-b9fb-b2177c9a9155", "value": "3072:cnY4OW9wRy4LadBiJc1UwJWbuv7cNMTGl3R+j2FWeWAMgB6cs0ry35n5ZOP0R:dLF6Te3s0ry3XrR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679827007, "uuid": "fbd4720a-8011-4ad5-a462-e4a8d351a1a1", "value": 289669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679827007, "uuid": "82a663f2-ba09-4408-b2f0-028246e39fcd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679827007, "uuid": "8a11fd74-4a8c-4edc-af40-bc6220eee7f2", "value": "9ea955ec6b172e7f4d37f1680bec860c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acc82385-cbf3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1679848295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679848295, "uuid": "fc2b1137-dad4-4870-8a1f-0bb71343e8c8", "comment": "Malware payload (RecordBreaker)", "value": "09e5c6db3ddafacd61fd8231a55b08ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679848295, "uuid": "365f1cd2-033b-4527-ac19-dbd3965b2ef1", "comment": "Malware payload (RecordBreaker)", "value": "4fd0c9d8fafa4d4f81d0d70ca966e7921c4736c4dfef9051af3fc1ccf20f3966", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679848295, "uuid": "074b459b-84e7-4222-902f-1b9b67394d31", "comment": "Malware payload (RecordBreaker)", "value": "a4444b5029718fcf540a92a8d7f7cf55dd462198", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679848295, "uuid": "321fa774-5745-47cb-a0c3-e84d7632aa82", "comment": "Malware payload (RecordBreaker)", "value": "855d045495b3f9ca8891efe180b9ebe24957d70d87a5838e9316cb190cbfb5a832cfc2469f67f9706d35c50c8b3e1c44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679848295, "uuid": "f54da410-44b4-4748-8c1c-81b160c3929e", "value": "T1AA065BA4CC1D37CAF3D68736E801D874AEA00C6BD9EE1027F0A39B51103B796569DB79", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679848295, "uuid": "466abddb-b38b-4cd3-a1bf-16c5dfba1217", "value": "00de631d57481fec13b7898c99324f13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679848295, "uuid": "72ef8b44-0ce0-4a63-8c00-6e3a7f0facdf", "value": "98304:3Vde8FivCeGDRsiSc/XBgZrzyWGgRSL6O2jSk6adBNWuz+VRD0MbQT:HZFwAur6XBazEgRSSjS5aT1z+/D0yQT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679848295, "uuid": "f94e52ad-1847-4aa3-a246-31ec035f9710", "value": 3976425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679848295, "uuid": "0afbb626-ced7-4dbd-bb50-9cd763e911d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679848295, "uuid": "76027e84-29eb-471d-8d47-1b56597bbe30", "value": "09e5c6db3ddafacd61fd8231a55b08ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60ba5988-cc01-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptOne)", "timestamp": 1679854180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854180, "uuid": "09103f2a-441b-472c-8078-1417ca4a8eb9", "comment": "Malware payload (CryptOne)", "value": "6a89e377c6b99cf6174d1db0de8db25f", "object_relation": "md5", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854180, "uuid": "fd9e5181-f91e-470d-a6ff-06f27741cb49", "comment": "Malware payload (CryptOne)", "value": "519510caedff27797bda5a291f497c909e1683b0e4c7d02de78d256a21d587a4", "object_relation": "sha256", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854180, "uuid": "19f6c63f-f59f-42d9-9980-bf8dbb0d6dba", "comment": "Malware payload (CryptOne)", "value": "a524512cf125ceb21e33ecf33f756062a5a18b6c", "object_relation": "sha1", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854180, "uuid": "2f97e7d2-c8d8-4877-818b-c028f239f488", "comment": "Malware payload (CryptOne)", "value": "338c249baf00aac9ec3f760b0e089e6fd02dce9bd221eab349613eda09184db36de9723263245967233873462006c052", "object_relation": "sha3-384", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854180, "uuid": "0a39c037-b4c1-412b-805c-85e628065bed", "value": "T161551212BEC48571D5231D345AFA9631AA3DBC201B72CADB93587B2D6B700D29937B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854180, "uuid": "0fadc82e-690d-4329-a00f-4efdf3664c46", "value": "e92b2275a730f59940462780c383a1b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854180, "uuid": "f1b3d5e8-53f5-4872-969e-814f888cf061", "value": "24576:VLeTtjJF5HrKuM7V4q/zNkf1KChBHoYkqwHiIALa4OB4bkm3B5gsYXjGl3zIQ:VLYgH4q/zK1KuphQHi/La4OB4I8OsYXS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679854180, "uuid": "9a0bf6cf-8884-4bd8-ba3f-eb75500d5b3f", "value": 1287845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679854180, "uuid": "adc4d37d-dedc-4d68-961e-3ebfd6710bc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854180, "uuid": "e20f11b9-e09a-4c2e-ae65-ace7aac0d7c6", "value": "6a89e377c6b99cf6174d1db0de8db25f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14ecb73d-cbb6-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1679821841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821841, "uuid": "b67373c6-5580-4c09-a89f-8725eff0a436", "comment": "Malware payload (DCRat)", "value": "0a3346f8e23808d303382d4b64b8524f", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821841, "uuid": "2dcce490-279b-4555-8ac3-7ca15bf827bd", "comment": "Malware payload (DCRat)", "value": "54d7bc30cd4f413106c5b57e5b29ea7ec560fccafdf08a4b8d7182715f4a3f94", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821841, "uuid": "87263256-69c8-4e83-b532-a27de9e285af", "comment": "Malware payload (DCRat)", "value": "2fc25432b9a10c911a238800091fb786454e371e", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821841, "uuid": "9a7042d6-e195-4496-b7e1-e4b4bd6ed9b7", "comment": "Malware payload (DCRat)", "value": "dc063cf3c7821840abe263963047dc31ae65512ad8dbb2c5404d52a417270acae5dcd668cc63322c5be620a5c40d4371", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821841, "uuid": "a26ceb7a-b354-4f47-847d-91b8acae514b", "value": "T1F985AC3D39B79AD2C238FA3386E3E520B6BD84923303D959D9D61AC44F412827DCE95D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821841, "uuid": "671a923f-67ed-4cf4-953b-61ea9e4eecd3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821841, "uuid": "5efaca5e-e24c-4095-b910-09a7a290d5d0", "value": "24576:lTBTsIBMNjnNNOhAe/S0o16wqw1fxocelLqd2HkPPcKbcI6Bw7Azuu0+k+51rFkP:+4lqcKsesqu0Lk9ObVS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679821841, "uuid": "941d63bf-18df-4977-a33d-4372b2117d2c", "value": 1708544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679821841, "uuid": "d283ded7-2075-48a5-a500-72f46923bf44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821841, "uuid": "33d98ed3-3b54-4621-a2fc-a3a919c91f75", "value": "0a3346f8e23808d303382d4b64b8524f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2558afc-cb71-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679792523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792523, "uuid": "9370356c-f5fe-41ab-ab42-35d54fa90031", "comment": "Malware payload (Smoke Loader)", "value": "97ad99508a6c91af94602295e8709cd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792523, "uuid": "925d5bc0-8b86-4555-a871-e17d98563d52", "comment": "Malware payload (Smoke Loader)", "value": "567b477f8a75af271720492be85bc38087e0cd6e9e45085bd52c451679858ad1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792523, "uuid": "81391855-63aa-4df2-9fdc-654af3c83585", "comment": "Malware payload (Smoke Loader)", "value": "5c644ca575af6e99aea1ebcea76b8c0c2120d0ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792523, "uuid": "70c5cfcf-e2b6-4ded-ab9c-8d4f85728e4d", "comment": "Malware payload (Smoke Loader)", "value": "a79df75d3173ce779bfcc92c3b9211674e91cd670f9008e00dcea6f542b03e5b413ce32439f256b03ab4294ac876a30d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792523, "uuid": "12fa36fa-0605-47ec-97a2-2c8fe4b6949c", "value": "T1EB546C0253A16860E72387328E2AC7F42E2EF8615E157BFE12659B3F2971F73C162715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792523, "uuid": "76f9d386-ec35-4831-90dd-6f43b63f6a24", "value": "9c7e5bcbfd5f0ae72cc015cb41d480cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792523, "uuid": "0b96aba2-6efd-4efa-bba5-542857aea8bd", "value": "3072:Cn+xfhPIRxreRAWvp8G3ajaQAkcVwcTnbEYgEranztFoZ09q5wcl+07CJQN0fm2X:zYxrMl3aj0/gFnztWRF+tTfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679792523, "uuid": "d2159d27-a561-4278-ac05-a684030aee06", "value": 279552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679792523, "uuid": "e54e88d4-ae91-41de-9ac6-47907de1c3b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792523, "uuid": "3e340d94-d93b-4c11-bc96-ae1c3f14ce1b", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e998290c-cbdb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679838089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838089, "uuid": "a85c7a6a-540a-4071-aa4e-afab9c4374aa", "comment": "Malware payload (Mirai)", "value": "d60d307a2eb4476db0bf765facff36d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838089, "uuid": "cbbb8898-53d9-4f21-85b0-a2cf3eae8bda", "comment": "Malware payload (Mirai)", "value": "58aa6bc06328c5e83243169b4782b89b2c1853ef7b5866ee5339dbb1ef221671", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838089, "uuid": "9c8c9f04-ffc8-4049-bedc-bb04068e7b2d", "comment": "Malware payload (Mirai)", "value": "94f62e3bd62f2a8d5b8e8d8e3fb2e2b1ff42e2ed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838089, "uuid": "5040c444-aa0a-47ec-9d6c-c812a491766d", "comment": "Malware payload (Mirai)", "value": "963c97a5ba5e0ffd3e8753723ff334363b02b1c1bd114d6ad92ff7248f4546e21249c39df07d20e03e3fafde2dccca5d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679838089, "uuid": "2d9f2867-322c-4efd-8c98-2cffc1bedbe2", "value": "T168C33AC79641C5B3D00209B222AB67054522FF3F099BA9E6FB1D7CB09F305866236FD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679838089, "uuid": "1bb9220b-102e-40b5-a8ef-d477ea32e041", "value": "3072:Jm1sYwWSN4u4vlU3NSbetJ8add9QzTsjzBt4NKcXeGcgqGK:JEZcEi9SbetJ8addQgBt4NKcXdcgqGK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679838089, "uuid": "66641eb8-64ac-456d-8822-6f57a84c7f36", "value": 125343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679838089, "uuid": "4461ba5a-c207-4228-909b-85476dff2745", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679838089, "uuid": "5fa8ec45-50b6-4aba-8943-5387372f33d9", "value": "d60d307a2eb4476db0bf765facff36d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df1f699f-cbb4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679821321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821321, "uuid": "39e5fdec-034d-41a1-84fa-c075813d4c4c", "comment": "Malware payload (Mirai)", "value": "75fef8516253e1754bdd9119b02a30e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821321, "uuid": "fa067cc4-661f-4eb0-a860-296ba1cbd9c4", "comment": "Malware payload (Mirai)", "value": "5b029350f272ebd90c5bc1f11a9aa64844bceb514b91be18c8bc2e5e6d3308f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821321, "uuid": "0d4400f7-4d23-4b1c-bdb8-c19727261762", "comment": "Malware payload (Mirai)", "value": "8f32b4cbf698c48ffb9c5ba44b8e67586b452254", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821321, "uuid": "7073b70e-6276-4fc3-8d39-76eed803fd1e", "comment": "Malware payload (Mirai)", "value": "8c849216353e2e5c2707fe546fc2713d975312d1baf7d805999e1740e792ceeb8440b03f6c286591d1386b02289dfb5f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821321, "uuid": "66e0e012-054e-41d4-80ab-20d21972aeb6", "value": "T144630982BC41A72AC7C01777EA6F109E3310A7DCD1DA3646CC254BA47ACAD1F0D67B96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821321, "uuid": "7b3e1b6a-bb3e-4321-985b-757ca4ff182a", "value": "1536:MN9sBqfBGxmj4T70zIE2EffxYd8B8t46SlWwsC:M4Bqf9uuhas84hln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679821321, "uuid": "f941d6c7-5822-4e54-be19-7c220cf89ad2", "value": 70888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679821321, "uuid": "b172d942-ad68-4a18-9669-3d6067564ba5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821321, "uuid": "cbe8317f-ce99-465a-babb-8c41d6a0e2bd", "value": "75fef8516253e1754bdd9119b02a30e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6201af09-cbb5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1679821541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821541, "uuid": "99922817-915b-410f-bd1c-075d8242de10", "comment": "Malware payload (Loki)", "value": "4a620c7d92a973300bbfd5a51acdbf32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821541, "uuid": "9e6deec1-374f-4736-94b0-2fd3472926c5", "comment": "Malware payload (Loki)", "value": "5c8cebda365a042d04dc1734322b809fdb56e95f0a7ce0b7bd3e141ebccc07bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821541, "uuid": "6d95fe2e-e67b-4610-b1d9-3540f73e523e", "comment": "Malware payload (Loki)", "value": "cb293cf035f0dd72942a3b9f8eaa9a59c834fd0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821541, "uuid": "f7799fa1-9c1e-4ec4-aa65-ca69d8722374", "comment": "Malware payload (Loki)", "value": "d8cfefb23b2cc8367d6abbf2fb5030077bb6029abf9e8fde850177a60ee678fd8fd79a60f581d786ea688d7f305e2870", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821541, "uuid": "ea74163e-2181-4b56-a7f7-d9d970812fd6", "value": "T1F40512153BE14F53C6B947F809E2D08027B67F2A1722EB4D1FD671CE053BB588A92A53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821541, "uuid": "c60c196b-f849-4533-8a94-7090604d7e54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821541, "uuid": "1dd776ed-cd3c-49e0-b4ea-b6ab744c68c0", "value": "12288:scmJU0eAitih7g2N1BKzKo+tVWfgxSjh6+TcKbB43wCO5g5c+ogHzl06/TgTU4mJ:ftiVgCEz+rtUg+QrwdWc+Hl06MF4L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679821541, "uuid": "aa942880-7081-42d6-94df-683a9027329b", "value": 856576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679821541, "uuid": "630ee975-b59b-4618-92d2-0dfc989d77d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821541, "uuid": "5414c996-341a-4a97-97b2-e7ce8f8211ac", "value": "4a620c7d92a973300bbfd5a51acdbf32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac80fe72-cbb4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679821236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821236, "uuid": "ffde32b1-fb1c-4b89-bfa4-fc28d929cfb8", "comment": "Malware payload (Mirai)", "value": "75897614d40d90b6cfd9d7e40eb5c110", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821236, "uuid": "dfb26982-a617-410d-b3bd-dc6ec9f7aab0", "comment": "Malware payload (Mirai)", "value": "5e0ba7c6eee88ea2c691c8beec423dcad613c1fc5a30c32010d80f1dce7c9b4b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821236, "uuid": "014cfd91-bbfc-4203-99f2-083b6b1e70bb", "comment": "Malware payload (Mirai)", "value": "7bca8257dd63316d2b07b9b141c0eaea36593603", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821236, "uuid": "0810189e-b387-4c59-8674-8ed8f0ece57d", "comment": "Malware payload (Mirai)", "value": "66beef8f6a963ea2f433824f4d3c0d39299e503f49c804ece9e8f58cb5b323eacc7272aa85a554dbb8e0a1577ea24a94", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821236, "uuid": "53311326-144a-4808-899a-0ec78d648d4a", "value": "T15A83D606FB510FB7DC6FCD370AE91702348C598622A87B367674C868F65B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821236, "uuid": "32e558f5-b32c-4c6c-afda-386181f0c367", "value": "1536:zo7EaMmgTlOZ29bjG7j1I0Z4D7uESkHYgWE0:zo7EaMm7+ba7jy0MPZx0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679821236, "uuid": "c6299c94-081a-4c6a-932b-f4acd1fe57eb", "value": 84764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679821236, "uuid": "03c8c403-3c37-44d0-a8ae-85b65278cd6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821236, "uuid": "14b9ccf6-caa7-4a6c-829d-3a668f43aa15", "value": "75897614d40d90b6cfd9d7e40eb5c110", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d9f9799-cba7-11ed-88f6-42010a9c006e", "comment": "Malware payload (SystemBC)", "timestamp": 1679815386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679815386, "uuid": "5c78b50f-f756-485d-a4ef-1de441b88a55", "comment": "Malware payload (SystemBC)", "value": "171460a017024e874e3bfd84221f3a88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679815386, "uuid": "6a209fd6-45da-4c1e-a9ba-5ff3e6dbbf7a", "comment": "Malware payload (SystemBC)", "value": "5e19e7fc39a959eae012efb699bca70cfca8591da0d4e893699d8c2f47abd99f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679815386, "uuid": "2f1c0129-b8bd-4890-9ef9-b306b4e8a29c", "comment": "Malware payload (SystemBC)", "value": "5dc5c62289872fc020821249c12af52784017d78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679815386, "uuid": "83cfa6fb-b654-4794-81ad-31015b8de602", "comment": "Malware payload (SystemBC)", "value": "f3f784cc3aacc069c603b73e6e4f29db2d5b689093feb0cc84b01af51ba935b98de84fa65539bffeb7f28680c7f3e4ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679815386, "uuid": "b3fc5b1e-0423-4195-b7da-1fee542a5fd6", "value": "T131745C0253E36C20EF1246328E1AC6F4261EFC619E5B7BAE174DFE3F09741A1D562716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679815386, "uuid": "4631e336-0925-4509-afeb-54c4fc45c3d5", "value": "cd10f4930e443428517f91868d83e9a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679815386, "uuid": "8f1055bd-04f3-43dc-966f-6caad0278e1a", "value": "3072:esrgSP1xi3JtLnDY7KDXItvL5S/09GPd6xWdJJ:9u27i9/0UeW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679815386, "uuid": "aaedbd8a-c427-412e-b72d-ce9936a3807f", "value": 368128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679815386, "uuid": "d9bf27af-16c8-4797-bd00-e4164eebb7d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679815386, "uuid": "a9d58e9b-e96e-417d-8ad8-19dff27c488a", "value": "171460a017024e874e3bfd84221f3a88.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cf564c5-cb99-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tsunami)", "timestamp": 1679809533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679809533, "uuid": "d40cd405-01df-437e-b216-d4090b28e274", "comment": "Malware payload (Tsunami)", "value": "f2e6dbc30a20ad25240e11aaabc888a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679809533, "uuid": "92c9ec6b-7c92-433f-8b9c-cd5eec9a09df", "comment": "Malware payload (Tsunami)", "value": "5f4a5f8c6ef02f76b5d21981c4093294ec243535dfe1142a807fa5623a6c6576", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679809533, "uuid": "6b53d724-d20b-481a-bf75-a960ad47dfce", "comment": "Malware payload (Tsunami)", "value": "12bb7d3b39242633ff703b09c4ebd171b2f40205", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679809533, "uuid": "3241a594-6861-4067-b32a-0d209cab8899", "comment": "Malware payload (Tsunami)", "value": "a1c53cda56fa4b17d041a4865c4b0fb9d69f6461735b1040dd77bfc1e14f9d57119b8238bbe85cecc574cc908aa02296", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679809533, "uuid": "4121234f-b665-4f29-82d0-4fc60cbca5f9", "value": "T185C33B05E5528767C1E227BBB75F865D33221F68C78B33257A2C7BB42B81B9E1E39110", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679809533, "uuid": "bf950556-ff78-46e4-93a0-3df42286a28d", "value": "3072:YvGS3Lu/zHaId0+43lV5kokeqbOI6ZNmy2QyESuunz:YBi/LaK0+MkneqbOIumy2QyE3unz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679809533, "uuid": "6de2b982-51e7-49aa-82ff-eea831dd7ac9", "value": 128912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679809533, "uuid": "c38f7c89-6291-4178-894f-66f6a1117a9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679809533, "uuid": "d8cc796d-56fe-45ad-9f61-8d55fe0e2ae0", "value": "f2e6dbc30a20ad25240e11aaabc888a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c488cb78-cbb4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679821277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821277, "uuid": "d2ca2a2a-54c4-4a81-b418-0d56d5318afc", "comment": "Malware payload (Mirai)", "value": "def23a9fb1f1729e7c19fe3337960fc0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821277, "uuid": "1c5fdc6e-54c9-42dc-b043-24b8f8026be2", "comment": "Malware payload (Mirai)", "value": "5f71960235650dd3a36654261cc5f995e41f15038ac7b0abcd57dd379e220d55", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821277, "uuid": "56f985e7-32f5-434a-9995-18895cf94054", "comment": "Malware payload (Mirai)", "value": "710b76d9caaa82165ba934a6ed2d2db141935756", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821277, "uuid": "ad0831ce-480e-4ba9-bd56-30277d5c0445", "comment": "Malware payload (Mirai)", "value": "1cfc522553b86433f528c0f07355276315ee6fb24f955f82ba3c413c86f208cd288c60485ce2e38fbde5c62e4342cac6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821277, "uuid": "0ff18a48-25f2-4791-90e8-c52e67c9ad1e", "value": "T12FE34B86FA409A13C4C51B76FAAF41493322EB55E3DB73068D185FF43F86A5E4E23606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821277, "uuid": "2405d179-d00b-4f22-8cd2-0d8854d3b993", "value": "3072:3Ly1Be7DMGlbJdPYqN11u4jXXEOav0YQgfhakX+M/9Kb6l:7ye7FlbJpPPXXEOavNQUakuM/9U6l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679821277, "uuid": "3c68c7df-c95a-44a1-83c2-e44e55809c49", "value": 152548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679821277, "uuid": "ba526454-aabf-4da3-bd6f-9c4b7c3aaf19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821277, "uuid": "f978ab91-d1dc-44b8-90c4-3e2a5ce99e97", "value": "def23a9fb1f1729e7c19fe3337960fc0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ea835d0-cbd0-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptBot)", "timestamp": 1679833239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679833239, "uuid": "334206c4-cb5d-41b2-ba0f-2bb74782bd9e", "comment": "Malware payload (CryptBot)", "value": "4f0a91af8045adc9f875216f4c265b80", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679833239, "uuid": "980517f3-4671-427f-bfeb-02eeb99a0c36", "comment": "Malware payload (CryptBot)", "value": "5fa906e1fd8772c1fe0c2395ed85ad4dcbe5b4295ad6c536efc43ae0922f631c", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679833239, "uuid": "bc60f341-fbd3-475a-ba3a-7b24f25b4c79", "comment": "Malware payload (CryptBot)", "value": "d639d550610dc7767b6e08784afdceb2b25d8424", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679833239, "uuid": "76c0ac7d-7ef4-434e-90d0-35d421fa7e5b", "comment": "Malware payload (CryptBot)", "value": "549e5508d06f1bbfd8cf7e995e6ff78f610571f3919e9a592aeba38dbc4c175670b4ae8eecfa44c34214b7ac183c8f35", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679833239, "uuid": "2dbf7ce6-4b08-4b71-a507-4fae8b108f54", "value": "T11066234E71B4058CF0AAC83A8127FDE8B2FA0D578540AC3C79F87A8539325E5F616DD6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679833239, "uuid": "145922b1-4e13-4986-a9d0-40310f68d377", "value": "7d59f1d82b84e111e9b6c1196cc48fca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679833239, "uuid": "5ab4e2c7-65dc-44ab-aef1-94e811f89fd0", "value": "196608:01y3hi5Hwu7/nvdGt0MKd1zw0OYd88Afx2AQk/soey:syRCXJLDkYd8Jxf9/sny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679833239, "uuid": "1b13b165-9a4b-4d3a-9223-4632076d0d51", "value": 7087104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679833239, "uuid": "294639e9-b5a3-4055-82e7-5a2fd8beadb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679833239, "uuid": "006f1e34-1870-4a53-b4f5-a24bff38ccc3", "value": "4f0a91af8045adc9f875216f4c265b80.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e6372cb-cbcc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1679831413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679831413, "uuid": "94db45f4-1c32-4ebd-aa2e-48f54be61087", "comment": "Malware payload (Tofsee)", "value": "550ffab815e89f01499d2897e2d0d1df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679831413, "uuid": "84a37945-e939-416f-900d-c2f779202b63", "comment": "Malware payload (Tofsee)", "value": "5fb3d642e500b3be1397e5501a4de799ab98b023e2dd704f29f736a5b6e4139f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679831413, "uuid": "871bffb9-1053-425a-81ee-9c76b23c6dfd", "comment": "Malware payload (Tofsee)", "value": "460463c599eb1fd3407557debce5a728675055f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679831413, "uuid": "1d32ec45-63af-4b7c-b34f-443b789cde35", "comment": "Malware payload (Tofsee)", "value": "59711207666f21f48143e26040000a1d925484ebafec84a9f4c9fc4128cefc82f181917b32e1262dce5c1fdbadc998b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679831413, "uuid": "b9d436e3-7a25-4052-88b2-051ba690b484", "value": "T14D546B3263F07860E562D7328E2FC6FC2A6FB9619E557B7E12495A7F09702A1C172334", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679831413, "uuid": "eedd3143-d375-492a-8a67-915ee034c266", "value": "c5c75c5b6a7ab4fe20f346e6d5121c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679831413, "uuid": "7cfcd5f7-df7f-440b-a7ca-fc9e110834c0", "value": "3072:C3dDCQS23ud0j4qnjuQfIbZvvei0MdnT/4B6gHQ0y4jvXU7Q/YVncpNN4TJY:x2c08qn4eiLx74UgVy58/s6NN4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679831413, "uuid": "5516b0e2-aa0b-407a-9d4d-c9428439cffe", "value": 281088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679831413, "uuid": "6e5b5670-6474-4748-bda3-c27a49da7a2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679831413, "uuid": "d8a3d62f-72a1-4248-8338-68a458797350", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e843623-cb76-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1679794503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679794503, "uuid": "42c549f4-c331-43e0-9569-87ce1856856e", "comment": "Malware payload (njrat)", "value": "7069ba596d91f3e1d04253370cc382e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679794503, "uuid": "33903140-5777-43f9-9e61-3a3ea0401117", "comment": "Malware payload (njrat)", "value": "60ada32d8edca7f1095d59b3209c51979ab155bd490cd2339d236bdff23c9720", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679794503, "uuid": "64198f5e-39a1-460e-8460-89705e31f733", "comment": "Malware payload (njrat)", "value": "b92071b2ac6a3f3b2f613ebb133d09481781d9f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679794503, "uuid": "65a60cf3-51f8-4296-b175-4b06cb3e5da9", "comment": "Malware payload (njrat)", "value": "529041c69f8482b55b0693224c3789288ff66bb00b84a61260ee3a7b78d22dc088ea325d9c6e2330bc2241cd63fc5016", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679794503, "uuid": "c9198057-f41a-48b5-9f2c-5e0c8a3f1415", "value": "T13F033A4D7FE18568D4FD067706B2D41207BAE14B6E23DD0E8EF664AA37636C08B50AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679794503, "uuid": "cd2c1d4e-ecc7-4af9-baa8-61eade15cafb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679794503, "uuid": "c30fea67-4638-48ec-bd18-57124dee8795", "value": "384:gYnq1rCiMH3jBVbJsy8P5MbAoxv/vvQ6kxOrAF+rMRTyN/0L+EcoinblneHQM3et:Hn9bJP8P5AAiH1kErM+rMRa8NugOt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679794503, "uuid": "83be70c1-5f0d-47ea-87a1-e7afacdf7593", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679794503, "uuid": "824eead7-9af1-4dbe-99cc-b1319013cc6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679794503, "uuid": "701a186b-6fea-40ed-a4eb-69f47d78783a", "value": "manycam.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15242890-cbf4-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1679848470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679848470, "uuid": "e9d91d46-4188-4b41-9eb2-765d3f0b44b9", "comment": "Malware payload (AsyncRAT)", "value": "78fe34aeb7f09d2ec138ad164f3db724", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679848470, "uuid": "3d8b659d-3132-46d6-8864-5cbf83e0a7db", "comment": "Malware payload (AsyncRAT)", "value": "61e9ed29484b8aaa84f3a4059e632ffd19b4d852c47e769394b6c2c2b9272b5b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679848470, "uuid": "11d98655-4c23-43db-b925-1f300c91f2ba", "comment": "Malware payload (AsyncRAT)", "value": "c00eef68328c4883656c30ffb10aa9e85bd22796", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679848470, "uuid": "b513ee0a-4d24-48e8-bad7-6605a6bc02a1", "comment": "Malware payload (AsyncRAT)", "value": "a5c4c6b7f3cf617e433ad371d13cddcbec452b5f0af451fdaf549c5284677dfcfc8202109287fd8b678a4867d059a7d7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679848470, "uuid": "9756067f-5347-4f12-a68c-9a32bd421b92", "value": "T115535D007F99C926D6AC4AB4EDF3124006FCD55B6217EB5F6CC040D96AAFBC649026FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679848470, "uuid": "8cc46b96-b9f0-4bbe-a836-26083c66d246", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679848470, "uuid": "f8dcfc2d-2de8-403c-9b58-a01b962ccfcf", "value": "1536:9Ep5r0eNa4OhfmwPS8zQ00DuriBphEVbbagNYY1wi:9E7r0eNa4OhfmwPS8zQ00DlLhEVbbagT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679848470, "uuid": "9c4d80cb-ff3f-4dda-900b-6bd5bc0296a2", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679848470, "uuid": "443e3ef7-748c-40bf-82e6-3391da36f28e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679848470, "uuid": "4e1d7629-a3a0-40ef-b34c-97a1c992fcb9", "value": "78fe34aeb7f09d2ec138ad164f3db724.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dc5b5af-cc01-11ed-88f6-42010a9c006e", "comment": "Malware payload (Nitol)", "timestamp": 1679854149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854149, "uuid": "e7fa7dc4-01b5-44b3-a6c3-c18ea673b55b", "comment": "Malware payload (Nitol)", "value": "f227423c346d9027d1e657253b83b2c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854149, "uuid": "742464f2-80dc-40f7-aec9-98215ecf87c6", "comment": "Malware payload (Nitol)", "value": "6250f56eae18dbb7a98496675a44bcc1ddcb2aac03a707b10e9c1628bb956b29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854149, "uuid": "395ac48b-967b-495c-b0c6-ecc62e29d0c2", "comment": "Malware payload (Nitol)", "value": "ca7242b3247e19c0ab78950876a1d608fd108143", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854149, "uuid": "7f507c3e-7c02-4250-9fc4-44a84116cc78", "comment": "Malware payload (Nitol)", "value": "81a886b5a645ae2e4919e3aa97309cc6552707c992b8141e3427fd4cc63545afa07696d94132f459372bed559e2e4cf0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854149, "uuid": "d71fb0d5-816a-4da0-a3ca-018d8ef460e1", "value": "T12B1523521F960320D6F35EB785F6962EBDB5FCB099028536C3E1D518A922F80BC3593E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854149, "uuid": "387d6d3c-ef50-4666-8367-5e686bd257b7", "value": "d9b701043ef797b1f104f4c2237f5639", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854149, "uuid": "5c6e40e4-e189-40b7-a08f-efc75d2bb1d7", "value": "12288:VORFtqmkNMULIUMhAbzzj/+qijhZHaL1Dg//6rIbeMOdIoHqL6V7DR:4zsbMhAbbmjn/aI6NCoHqe5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679854149, "uuid": "7c6165e3-c2ad-406f-aa2b-16352bba905c", "value": 925696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679854149, "uuid": "37a33110-3dbb-44b5-8b38-5144a258b2df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854149, "uuid": "6741f557-9204-438e-b82d-7234ab441090", "value": "f227423c346d9027d1e657253b83b2c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96d315b0-cba7-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1679815616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679815616, "uuid": "d0a166ae-1c52-4306-a4e4-c395ac258c88", "comment": "Malware payload (AsyncRAT)", "value": "1f96941dc2540d33d143719ec73bb9cc", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679815616, "uuid": "6f2ebfa4-2d2a-4c78-a5cf-e67e3304f41a", "comment": "Malware payload (AsyncRAT)", "value": "6385b31519c35421fe238e9e51ff6aee15c9e3719eaeb1d86aaea0b074be687b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679815616, "uuid": "d9dfa7cd-90e1-4218-8fd4-8edd44ca8454", "comment": "Malware payload (AsyncRAT)", "value": "c89543d4efcb4e8f74a2716dcb9bb2fbd2f94cee", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679815616, "uuid": "154307c9-549d-4352-bd20-232ebe9b6f81", "comment": "Malware payload (AsyncRAT)", "value": "3187a321376f77c0e8226e625310b4e80f801a6424c19fedd51abdb65baccdd4de2e3be69d5595eb493bb885ccc57761", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679815616, "uuid": "d1708923-5645-4dcc-ac00-bb574e8b96bb", "value": "T19E855CF21293FED8AB2F2D44C04439409C01286757AC969CFDCA2A9793E5574EF9DAF0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679815616, "uuid": "581c7c58-d267-426e-a487-3c998b130d8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679815616, "uuid": "606cea3b-4647-49be-8502-6de4da95eace", "value": "24576:LR9Ot09OX7l348A5NyRQ80zEbiRRCRnOO8v6JnOk6PzdNhCQa61NEzMvPJgqqaF6:hz+Rn0tqaWxuGND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679815616, "uuid": "1381c3b0-484a-40b7-bec8-41d1bbe9507a", "value": 1798144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679815616, "uuid": "a4eb5ba4-0e7f-49fd-9c45-20fefa5da7d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679815616, "uuid": "e5310244-6747-4d89-b1c1-d5363e06a7a0", "value": "1f96941dc2540d33d143719ec73bb9cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0de80fb5-cc23-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679868644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679868644, "uuid": "c96ef206-ca9e-48cf-9a77-e7b21381635e", "comment": "Malware payload (RedLineStealer)", "value": "f56d10cdfeae319ae1c295cb6e40ecb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679868644, "uuid": "9ce09d0c-baf7-49a9-aba7-32d5519ca69e", "comment": "Malware payload (RedLineStealer)", "value": "6573162f612754c9eab66e38cf9887f9ea4e3ce678058a1c133644e41c192d99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679868644, "uuid": "859f56fd-e15a-44ac-8fae-154bf6895e4b", "comment": "Malware payload (RedLineStealer)", "value": "97526d03b25d1ca5229aba1135099f821d1ea5e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679868644, "uuid": "cb4d3cd3-f01f-4f69-8a37-3d741fa55a8d", "comment": "Malware payload (RedLineStealer)", "value": "e8ecd090e7b429c561c96e54820fd0cdba3d5b6d1b2183641e12601526e837d58c360e9c856e834e2e1cfa69e199ed01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679868644, "uuid": "59024aa2-9c79-4a14-8c20-b9addd7aa3a6", "value": "T10E25235A7BD48423D8B1237458FB47931A3ABDB219B14B2B2B4A6C5A0D73948F533337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679868644, "uuid": "d35f5408-bfc0-40c2-a1b2-084fe81b69a2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679868644, "uuid": "28c08033-dec0-4be9-9ee3-ecabef7406df", "value": "24576:gykr7P3/puDNHKvUpksSdYaQV4sr7Gliexo6/yM:nknP3xunpk1ZQ77GlI6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679868644, "uuid": "adbee792-416b-416c-a014-9239f807b7e7", "value": 1052160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679868644, "uuid": "10bca6ea-1ba1-4850-a8e0-62356cf94771", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679868644, "uuid": "b8ad74e8-5bbb-417e-90d0-766206c7ae03", "value": "f56d10cdfeae319ae1c295cb6e40ecb6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beef1011-cc2c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679872807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679872807, "uuid": "2ae276ec-17fc-4a6f-b04a-c0cfa3734c61", "comment": "Malware payload", "value": "95c29547b0a4341d1f829bdf96c920c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679872807, "uuid": "b99ac3f4-4462-4fb2-bb44-87fbd769b3c3", "comment": "Malware payload", "value": "6590a35bea87343378cf2769e9a512a44ed62fda91d2b82767cc441dcc9751fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679872807, "uuid": "75fc3338-8434-4b12-b0bf-5d169f6557d2", "comment": "Malware payload", "value": "1c2ccd753c397211c81d9129afec955e2623e17e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679872807, "uuid": "a25a03f8-e849-4065-8e2b-2f4fc3eadcb5", "comment": "Malware payload", "value": "544af03f869aeb3f7ca0a866e1f7ca80c2033df5a70843ef11b2bffc1ad6bd3e8441450cf77fc22afdda475ac74c6983", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679872807, "uuid": "03d45f42-5a9e-4e97-897f-8762135c2e9a", "value": "T1DCC33A05E5528767C1E227BAB75F865D37221F68C38B33257A2C7FB42B82B9D1E39110", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679872807, "uuid": "a1e83c9a-841b-43b9-80bb-616cda0ef08b", "value": "3072:4vGq3DOjzBFaQe8a832VVUwk8qvONCMoccJmy2QyESuunz:4p6jnaB8a1Uf8qvOjImy2QyE3unz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679872807, "uuid": "234ff845-7a0d-4ab2-b3c9-d73dfd70c69e", "value": 128904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679872807, "uuid": "cff54ea3-08d3-44cc-b53a-a7feed6bbb01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679872807, "uuid": "349e1f57-0bf3-4b49-a88b-25da4ba6bd0a", "value": "95c29547b0a4341d1f829bdf96c920c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ace44313-cc2c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679872776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679872776, "uuid": "7ea0e711-04e8-40f1-b855-6b27aa3e53db", "comment": "Malware payload", "value": "758347f329579bedfb8714ec2f498f95", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679872776, "uuid": "6a3e88f6-40e6-4a0b-a5e7-eec00b7882ae", "comment": "Malware payload", "value": "65a309ab11cd67c5b85b4ab4040267c5b6e717fa4550406386fd8606395eb9f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679872776, "uuid": "4fa42f3b-5bbe-45c1-a92b-ada0d1f465c3", "comment": "Malware payload", "value": "6f26bc0e44261ebfbbc83df5bc8fd59d848da5d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679872776, "uuid": "e93ab4b7-0d73-4ec1-bcfc-9ed777dbed20", "comment": "Malware payload", "value": "58d340f52456ae071941ab5cdc7cd235efb3c21f4340a980f8450e58547e94e54da38ef361fffac6eddf829bb8b81c52", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679872776, "uuid": "10f6ca39-ec34-454e-8e1b-9da643cd72d3", "value": "T18DD3936A3E21FBBFE268863007F34FB08795219626A19785F16CEB185F6138D0C5F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679872776, "uuid": "7ab57cd3-b5fb-437b-a609-3dbed37122cc", "value": "1536:S4FwRwb6fntG/azrdgmZ73YfYXZGEazvuKU4cozTz6GidlV0kHL/2WihdwIo7zy0:yY9rnDH/Rhhd48m6eGDmj4Lq/WoleA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679872776, "uuid": "32e5b903-37d6-4415-864e-83faeab9e0cc", "value": 131688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679872776, "uuid": "4cbc8934-5053-414c-9e70-e11c39b19720", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679872776, "uuid": "2e8fa028-da5d-485f-ae31-0a1ad5b5e310", "value": "758347f329579bedfb8714ec2f498f95", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0336ec12-cbaf-11ed-88f6-42010a9c006e", "comment": "Malware payload (N-W0rm)", "timestamp": 1679818805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679818805, "uuid": "5c6b2c1f-8e23-4be9-84ca-75e051458525", "comment": "Malware payload (N-W0rm)", "value": "2102317c3f6d1c132ddc50f1011142be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679818805, "uuid": "9ee32df0-4ca2-48e6-a54f-e6e30a75c96e", "comment": "Malware payload (N-W0rm)", "value": "666e11a1262fb9da2180786bd1a7fe60525360518d2c151f86aaee4081de2ac1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679818805, "uuid": "fb266bf2-43fb-40f3-97d7-1a93789a78bb", "comment": "Malware payload (N-W0rm)", "value": "07ecb5b6cc0fa27ec1f71e594c2f17b279c92578", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679818805, "uuid": "f1c8d3f2-5e03-4894-ab36-b1c20a138b89", "comment": "Malware payload (N-W0rm)", "value": "be65efe6561f39f4322b416688c043546631aba18d3687dc6f702bfe52b7674f88b863b77eeb1567040b1ef0baa8b55a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679818805, "uuid": "089b7835-0c6d-4877-8ed1-74e4e84b9699", "value": "T1EB352311D6E84567C9791B7168FB0B830F36FC728E748227178A792B8CB3944A4753AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679818805, "uuid": "7678b988-23ea-476b-815a-afa48bca91d2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679818805, "uuid": "f9f2ed17-8f15-4d2e-9593-1a1a754fd2fc", "value": "24576:kymdLLYuEmWiE3JGLpCcnLjAKtqk3hlAJv78:zgZItgCzKtT3hlc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679818805, "uuid": "1c6746d4-4b24-4888-aff3-72afc6485b86", "value": 1061888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679818805, "uuid": "ae22f0cf-b439-4ec5-9466-2aab55d0aff1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679818805, "uuid": "3c9aba8d-e412-4dd7-b6b0-8e3c63a9bcef", "value": "2102317c3f6d1c132ddc50f1011142be.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d570ce1b-cbdb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679838055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838055, "uuid": "4ff885eb-4362-4574-b868-9224f78dd0e6", "comment": "Malware payload (Mirai)", "value": "708e9dc944fa9e36b62881d6ac08c8aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838055, "uuid": "f41fa39f-6431-4418-a024-0686504bb3bb", "comment": "Malware payload (Mirai)", "value": "673203aa86c58b8c5d2af610ba59e61800e390eeea0e8e6c02157b8f219a40ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838055, "uuid": "07abed2b-51ed-479a-92e7-e1106f6954f6", "comment": "Malware payload (Mirai)", "value": "989889488d7643a777e613223b0e7f78150c8d21", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838055, "uuid": "85a477e8-93bc-4a38-8c19-be59c858cee9", "comment": "Malware payload (Mirai)", "value": "e8a91a120c896b57010409a6c20ad232ee60b7d3e7632d74a22679c1965bc42c02847d90709c5f65a7af22f99dbd06d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679838055, "uuid": "c2883b9f-d2f2-477e-a4c8-36843296428d", "value": "T190F34B06E4404663C1D22BB6B79B528D77231FB997CB3311D9287EB02FE1B9D1A3D990", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679838055, "uuid": "26f2129f-5d36-43e1-ab75-2161d658c8c3", "value": "3072:pQrBzuvjgC/m/uND3wGiTagGFBhGzH/6fdetJ8add9QzhsxNjeus5EymyOQ0LOXP:pTwG8a1FaL6fdetJ8addQ0NjeiymyOQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679838055, "uuid": "c3a80e56-8394-46ee-9b44-e9ab5a6bdd82", "value": 164446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679838055, "uuid": "109ec8cd-23c4-401b-9fea-7dacdb27e873", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679838055, "uuid": "6f34611d-32c9-4332-83e4-86dd2da268c4", "value": "708e9dc944fa9e36b62881d6ac08c8aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff141e52-cbde-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1679839414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679839414, "uuid": "a0259108-1f91-4032-b33b-b3af15122b91", "comment": "Malware payload (GCleaner)", "value": "3afb78cf48f92bdd9b6401e60448f9a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679839414, "uuid": "bfcecc9d-6c54-427a-8e9d-7c8ffa8c854b", "comment": "Malware payload (GCleaner)", "value": "6b11b9e834fc528b136446cf38003678b2d72f16e7eca64781ae88b45fdbd5ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679839414, "uuid": "1f0a70bc-9964-4ad7-8ac0-b35929dcd952", "comment": "Malware payload (GCleaner)", "value": "8a8d142b740e5c2770c4e26f241a87c3126d5eda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679839414, "uuid": "6a1142b3-bd73-41d0-89d9-da926271dd0f", "comment": "Malware payload (GCleaner)", "value": "7f0245744f3d7cbfe81d78039c497db9ded401737d80e9252b0dbd1b52343dca4e005a85646f971caad69c4aa5a27fa0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679839414, "uuid": "7d47eea3-e761-4bba-a04e-a8b4a86164b2", "value": "T19A953302C3AE7974E0F39FF07E148B00E76366974E28209E71D8DACD5E76AA2455D3C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679839414, "uuid": "3cf654f6-2f80-4eeb-8bf1-c6612546c0fb", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679839414, "uuid": "106a86b7-4d01-481b-8338-078670a51a7c", "value": "49152:EGlJfsxRu1HWDYSB35d5F1POiN2KhJ6PbX0xsySL8dy3QfwV5dlLYp:5zHWDYi5d5FZOC2Kh0PGBGUMQ4TPYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679839414, "uuid": "99e6778e-ba61-4e90-9027-434c0c0bca41", "value": 1993155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679839414, "uuid": "0323b945-88f3-4191-8940-840528d82277", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679839414, "uuid": "193aac19-7e57-42e9-998e-fcb22939eb0a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ef35328-cbb6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679821911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821911, "uuid": "20df22ab-79d7-49cd-a0f6-04efd4a6ce7b", "comment": "Malware payload (Mirai)", "value": "6ced1756de715aa87b2a5d21d57ece12", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821911, "uuid": "1698637c-629f-4be7-a867-992a4a82f389", "comment": "Malware payload (Mirai)", "value": "6b51fe41c676293dbc6c883ae17c7929b9026aa798deda95de66121e60c09a8f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821911, "uuid": "b615de76-9815-439b-befa-1a2afbca09bb", "comment": "Malware payload (Mirai)", "value": "9ef4629767adafa7ac2b04c7ec4d608551ee514a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821911, "uuid": "8074e6f2-22e5-432c-aef0-30df4cc1ff16", "comment": "Malware payload (Mirai)", "value": "a6882fe0ed706d4d4aa2525a632dbdf1f67f43223dc457c79091ae9d0b6707bda753b3fb0c150543b3f757078d19db94", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821911, "uuid": "1d0631bf-b9fa-49b4-84e8-0764519afc2c", "value": "T19F7319782585F22CDAE680B8F4532AD519120A083FDC91E36887143BFF70B5DB56DE5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821911, "uuid": "0ee2717f-eb88-4029-842f-a139cfca43ac", "value": "1536:kXr/KCEaJzUuv4++aP9ilVCYJf/VBIVCCfy0K9e8:iKCEmXlCzu1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679821911, "uuid": "aa82a899-898b-4dff-aaa7-428a3209fd6a", "value": 75136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679821911, "uuid": "a1fd4112-e8c9-47c2-a52f-4cd2d6cae498", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821911, "uuid": "2f380d70-acf7-4a80-be1b-eae043aa6cb0", "value": "6ced1756de715aa87b2a5d21d57ece12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15acd6e2-cb73-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679793066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679793066, "uuid": "e8ead4ef-9b4a-47bf-93f6-32881c9d48de", "comment": "Malware payload (Amadey)", "value": "55f8995052b631e0d1f6d9fc97f0bf91", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679793066, "uuid": "9d27434b-1cc4-4341-9871-b3e871af7c82", "comment": "Malware payload (Amadey)", "value": "6d2c8591bc85cf673b9fe7af0ef20e6da8558f2580f9576a67ba6a2217d6b17b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679793066, "uuid": "ac00eca2-0033-4170-8387-3bae1a9d33dd", "comment": "Malware payload (Amadey)", "value": "d3f28265d5737cfe64fe124a84c14d4717ea4af4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679793066, "uuid": "8085fc5d-6bd8-4173-a8f1-cfa7c99263e2", "comment": "Malware payload (Amadey)", "value": "255219107ec0a64a533dca87e1c3d4599087d081acecf0f91b00bd409c352182596dd0364fd97cf5dd24630a406b0475", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679793066, "uuid": "170556c0-4e93-40bb-b240-33a5c082e950", "value": "T1B2546C0253E16430E76386328E2AC7F42E2EF8615E557BFE12599B3F2971FB2D162305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679793066, "uuid": "d132dacc-18b4-47e4-8738-4072b0e3bf01", "value": "4ab2a4d536313c74a2690207bf67c9d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679793066, "uuid": "3a07354f-5ef2-4039-976e-5056e3b6b8b5", "value": "6144:owadOwWR0yI1H+k3eT99Q1zXlbFQ7cTfz:owadOwWqy4JOT92lHQOz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679793066, "uuid": "cda6337c-9eed-4a9e-ba86-07a7a1e22d77", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679793066, "uuid": "f226b358-5514-43f7-80eb-bfa91c7ed588", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679793066, "uuid": "cc3065f5-5a33-4d47-b983-ea707209e2c3", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc7c60b3-cbf3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679848375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679848375, "uuid": "2ca9a18c-70fc-477a-8060-7aa6f63f1f06", "comment": "Malware payload (Rhadamanthys)", "value": "7b9742c442c28ca29907a0ffcaca47fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679848375, "uuid": "d64ac733-63a4-4eeb-a143-378a6ff12492", "comment": "Malware payload (Rhadamanthys)", "value": "6d615929475897b42f7bbc9ae8a5fdc591a15a08ab4696dbabb3ff912fb5cbf9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679848375, "uuid": "c2b4264c-8d82-448c-b880-affad7fa5c9c", "comment": "Malware payload (Rhadamanthys)", "value": "d59023f60d89c785da29165a5df7d8b80f790d87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679848375, "uuid": "995c63a1-f970-47b2-900a-29cec6d13ab8", "comment": "Malware payload (Rhadamanthys)", "value": "4432f84e1827016d056c6294a42d7b4ff10e07b68cbf375d68ccf3795536845a5a1fb73f604fa4c028bd9ae57790fb88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679848375, "uuid": "7cdebee7-0c3b-4836-9b9b-68759c86a5fb", "value": "T16E64C02373E4A8A3E680C8F864E166B2C41D39741770818BFBC9076A17B46F356FD697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679848375, "uuid": "8499e7b2-ca8a-4751-a05c-d897547374c3", "value": "03a003b2ab5e4e0a5303d82cb2f0927e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679848375, "uuid": "4536ea00-d640-441b-9863-c33fb59ede8a", "value": "6144:/DB9/8sAqMQ107vvjmokAxGnHZIkIx1P7:bB9/8JE1OvCixGnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679848375, "uuid": "1851fe47-76ef-4030-b431-f409f8d4f731", "value": 309360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679848375, "uuid": "38f7dc2a-cddf-4687-9278-96b211c987be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679848375, "uuid": "206089cd-0873-48d0-acdb-6e6edc20b7bb", "value": "7b9742c442c28ca29907a0ffcaca47fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a79bfa1f-cc02-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679854729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854729, "uuid": "47baef46-ba27-4a1c-8167-73f84604da6f", "comment": "Malware payload", "value": "3066cd6c7e5b7bd6eb4b18563688459e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854729, "uuid": "69824c80-3c0b-4df7-9626-fe15465ee64f", "comment": "Malware payload", "value": "70d1f0e0b11e5c3bfacd385e1e6fea5c76f28b110bbaab1ee897ceed83a27002", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854729, "uuid": "14047060-a839-4df7-ac1d-4f9f1e63f33e", "comment": "Malware payload", "value": "d42a3ace82aaa9670cbbe37d7440240652401c4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854729, "uuid": "8914fb7b-ed1f-40e6-a5b9-884e0121d1fc", "comment": "Malware payload", "value": "9d83fa4580df0395bfca456ecb976d20376d0c4b6d98b8f6c0a7c9ef7ec399ea3dde491a159f47c94d489cf47593b260", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854729, "uuid": "7b8d4ead-109a-41dc-b70a-2eda7571454f", "value": "T1A965F155103E13DAD6BDC570AA07649F7798ADC4A72CCFCB689058A623231F9B37F290", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854729, "uuid": "89e97ae1-6108-433a-8da6-e4fbaaf9013e", "value": "24576:VeeYql/FhIMp2uujwvTRa3j0Q2TVqck0BGy1zZDbyB68vT:Vv08Ro21BU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679854729, "uuid": "747752f1-ed75-4989-8636-7850cd16f35c", "value": 1414949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679854729, "uuid": "27c7ec44-88f6-47ab-a5d6-dc9c3a46e625", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854729, "uuid": "e79eff99-df8c-4011-9cd0-cc25696d7f02", "value": "3066cd6c7e5b7bd6eb4b18563688459e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de14a075-cb72-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679792973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792973, "uuid": "fc786237-1d5f-4158-a1a2-dbdd937b84f6", "comment": "Malware payload (Smoke Loader)", "value": "9c46bcc65ac859223b355662e6b59f82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792973, "uuid": "9250600a-6ca1-46e6-b0a6-21c00daaf83a", "comment": "Malware payload (Smoke Loader)", "value": "75e31dad44627d7e583e9728dc8988818b3a0f96d34279934704dbc5405887b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792973, "uuid": "237e46b4-e165-40fc-91f2-d316fd02103d", "comment": "Malware payload (Smoke Loader)", "value": "acf72f69755cf72138ade3c58f7ed1b7af387609", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792973, "uuid": "a54b7234-219b-4e7d-af0d-63c06ba87005", "comment": "Malware payload (Smoke Loader)", "value": "c807eedc4383b2ab70c881cbef1f8868a2f6c89a047cb303cad67384a0bc4a23ae682eee9a793ddc307f02af1117d869", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792973, "uuid": "10c21a4d-342b-41cc-b001-d8980938f869", "value": "T18C547D0253E16860E72387328F1AC7F42E6EB8615E157BFE16599B3F2971FB2C162305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792973, "uuid": "f50a3381-8ad5-4628-bcee-5c0ecf60d15b", "value": "4ab2a4d536313c74a2690207bf67c9d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792973, "uuid": "89f516bc-369a-455d-a93b-c3e44aa441bc", "value": "3072:CNG+FPLR2EW1XAMvbbiFmF9LrhAmmPBRLRoa1NTTOYGVrzma5ZCJQN0fm2Rh:N+2EW9YFmFABRdoa1o3Gm4Tfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679792973, "uuid": "433223a6-a97c-47cd-bd4d-2c33cd50860c", "value": 280064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679792973, "uuid": "3253a8dc-4ea8-4465-b232-e93711eb5376", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792973, "uuid": "1d5b23f8-c88e-4222-8a51-5b5c658836c4", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5089c25-cc02-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679854832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854832, "uuid": "d5ad2d60-41ef-4497-8784-7a4e33056c7f", "comment": "Malware payload (Smoke Loader)", "value": "4cb907abf1db2b4b0fe03ed3c65097e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854832, "uuid": "397cd0d3-ab33-48b7-b208-a6b8f4f0a8a0", "comment": "Malware payload (Smoke Loader)", "value": "761c71f8126a6f6cb6c40f60492d463a2614e63ed6434a67d6998dccdd5aad70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854832, "uuid": "67def459-f04d-4d22-974c-56a2f7380957", "comment": "Malware payload (Smoke Loader)", "value": "0224f76608e3d02a7c92c9552961c381a3e3638b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854832, "uuid": "f204a7b9-71cb-4d0c-92ca-177c593827ee", "comment": "Malware payload (Smoke Loader)", "value": "2dbb692a01e1ec1a712429970b66668076dd463feca57fb5c4f3e820f79bea26c3baac60d5d473a113944c0cbdcdecae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854832, "uuid": "76d22fe2-66e3-4b57-89b1-d5dbeaa5158f", "value": "T1CD546B3253F07860E523D6328E2FC6FC2A6FB9619E656B7E13595A7F09702A1C172334", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854832, "uuid": "706767cd-a460-4e89-bb5c-34000a73bee0", "value": "59edcf4038e73a659a2ff6e04ad467ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854832, "uuid": "3dfaf49d-9927-4689-9465-299eb56e53ac", "value": "3072:Crtp5aAZ6ZYe93I20MR8sS1LQ6yIB4k0BmuAoftk4996w/npNN4TJY:fAca2t0MBYGk0BXh96w/pNN4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679854832, "uuid": "038993c4-3e86-4d90-a801-134662ed96c4", "value": 281088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679854832, "uuid": "25c85693-b1c6-4959-bb2e-5625949af463", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854832, "uuid": "a08b8395-54c6-439f-9fc2-9272efaf6ff9", "value": "4cb907abf1db2b4b0fe03ed3c65097e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6d43530-cc1e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679866807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679866807, "uuid": "542b32ab-24b0-453c-acb9-66224fae221d", "comment": "Malware payload", "value": "e08da72431a91099ef721333af8f2a4c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679866807, "uuid": "7b8de3cc-4476-4953-80fd-a322f66dfb9c", "comment": "Malware payload", "value": "788008b98d8bff8f880b888c29ddddfa7b02e1a49243caf97ee3af8d3646e890", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679866807, "uuid": "81b98dcc-9358-4953-8d0e-176fa5a7d6f7", "comment": "Malware payload", "value": "a95cbd614399f02377372ccaeccc86205b5f3018", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679866807, "uuid": "8b949a37-9d85-4254-a83c-d1f18be28d46", "comment": "Malware payload", "value": "9911758f7f5f599b6c6a4b5ec2e3c0cf632018b8aacaf6b0116c5c094ecb805217efcb344a1060eb53323efff97f8664", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679866807, "uuid": "64a79c80-544e-4846-af52-03f57e8d0f6e", "value": "T123D622C9F35A982FD8BB18714DAA93A503464C4682836B6FB188720C19B75E44F7DFC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679866807, "uuid": "b54219a4-5deb-409d-8267-d527a6d3eaad", "value": "393216:4tDkk+VVEKKlj2Ey/phVxrjcDt+tC5Qs4NkbokoTRFbBKlru:/k+V5Sfgpj1stex9k+RFlf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679866807, "uuid": "d4fb4469-d423-4a21-b3f8-56b2092df8a9", "value": 13695913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679866807, "uuid": "19c96f58-fcbc-4a51-b9f4-4c11acab1dea", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679866807, "uuid": "e31addcd-07fc-461e-ae54-7f75d0308fad", "value": "skeptictyson.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1723c9e-cbd9-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679837216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679837216, "uuid": "0fcc93ca-ec22-4115-9620-e81dae852c17", "comment": "Malware payload (RedLineStealer)", "value": "d680bba3d9207b75f696767d029439b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679837216, "uuid": "5a6bf222-9d48-4956-b95b-268718a732ed", "comment": "Malware payload (RedLineStealer)", "value": "7aaf04040e8a288cdda12125c8e8c601220ec6480bba4822a136f4095c37a4ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679837216, "uuid": "966c8569-75ec-4ca5-9bd7-1d0e95e169a1", "comment": "Malware payload (RedLineStealer)", "value": "8e21bda97791d6ce539c36bedee296467a42eeba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679837216, "uuid": "284ea346-85ad-4704-831f-6a11e712c993", "comment": "Malware payload (RedLineStealer)", "value": "d2685527091a4b26ffb365e60f5ae109658fe092022caa07a3c25b76aca27c0f827d9543916f447876911360f389051d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679837216, "uuid": "1c1e01d6-8d95-476d-99cc-cd675caaea34", "value": "T18584AE3252F07860E562E6328E2FC6FC2A1FB961DE5A7B7E13455A7F09702A1D532334", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679837216, "uuid": "6fd9f913-11c1-4a97-904c-bc4d3bee5e05", "value": "c5c75c5b6a7ab4fe20f346e6d5121c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679837216, "uuid": "c1388499-a992-4c2e-ba9f-1a5843097f49", "value": "6144:rGbKYa3qCQvmWzgMWc2L/555sOqc8igD+D0+clP96FOc/VUNN4T:rGbKR3qFO4Wc2tIcDgLEUN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679837216, "uuid": "ecaf77c4-7dbe-4c0c-b2a1-597cc013fc54", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679837216, "uuid": "4b607c43-774c-41bc-bf94-9e02dd1f12c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679837216, "uuid": "7976c4fa-9c35-441e-9192-b0801e999b28", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be94264f-cc2a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679871947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679871947, "uuid": "57d49297-cd7d-4df4-99c4-427abd1ba9bf", "comment": "Malware payload (RedLineStealer)", "value": "379ee3c09d285463770ee4dcefb6e666", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679871947, "uuid": "c48dea8c-a942-4123-bbfb-d30e75c02881", "comment": "Malware payload (RedLineStealer)", "value": "7d6e4a6d983bcdde36c4a000f4c5fdc5cc47302c732b865e6d75c4b5a7210c37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679871947, "uuid": "2a510e82-dcd5-4cca-9416-f251011f2107", "comment": "Malware payload (RedLineStealer)", "value": "455b7b0889ec40fc59d09da58f5e3e420bfac7d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679871947, "uuid": "3519b62a-72f2-41f6-9195-880954a36a66", "comment": "Malware payload (RedLineStealer)", "value": "69ebacff8d226420bd71ce66616ee2ec0b19a96134dcee7959dd9920efb11084639ec6f16d9d5462f6e8a308339fd548", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679871947, "uuid": "74ef7a82-8716-44b2-8a86-9fba275bf738", "value": "T1E42523466BEC80B2D8B627B144FF078B0735BDE19D74526A5749A94F0CB3B68153232F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679871947, "uuid": "928d59b7-5bcc-447d-b95a-67bb9e467c41", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679871947, "uuid": "2e5d397d-9abe-4a80-b3ea-0fdec0c25c7d", "value": "24576:myWSiSg6g3BEmPCaOMWxiYEQ32UsUKDFFDMs4p/MMl/:1xCuAC5MrYEw2UsUKDFFAZWMl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679871947, "uuid": "cc47c560-ccb7-4eaf-b08b-37d0bb404a7e", "value": 1053184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679871947, "uuid": "ef3cc9b6-9b24-4884-8b76-23e500725fc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679871947, "uuid": "92b65b70-fdf0-408c-b341-fa2b3bbf4fe3", "value": "379ee3c09d285463770ee4dcefb6e666.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c1b815b-cbb6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679821933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821933, "uuid": "d6931ba6-531a-4e63-a9eb-cf52f15d5c78", "comment": "Malware payload (Mirai)", "value": "2d265fd31f3edd1363f78013e7d38f29", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821933, "uuid": "b926e16e-6d54-4ef4-b6c6-ef85f13768b7", "comment": "Malware payload (Mirai)", "value": "7ed7b4b810365f2fae60930d82c283dcce8cb001e818e6db5d45874dec8e519a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821933, "uuid": "11bcf5bf-3f63-49cf-862d-171d2a2b117d", "comment": "Malware payload (Mirai)", "value": "712f5c47b37d2cbd8ce2a60dc851102322ecb7b5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821933, "uuid": "cbd5a0d1-585e-4f08-8fc8-60a5867aaa0d", "comment": "Malware payload (Mirai)", "value": "197854dcacd34924aaba97f7639746cfe7e280aefc7e0306abfee064c8da548fced15a5879bdc297600e6e99d9bbf3f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821933, "uuid": "1063f5fe-e361-4f3d-88ad-e09486defbe4", "value": "T10B635C0173588F0BE5AA1EF9283F17E183BEEE4025E4F184660FEB5A4235E375459F58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821933, "uuid": "f4e337db-0497-4ae2-8c96-7440e1200088", "value": "1536:9k22c9znkATsJZanMJBOm9y+2V5cGPlehaXl6:9ksOZJOizUcCeR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679821933, "uuid": "aa4fcb85-c801-46b6-b1e3-6052bbaa9fab", "value": 72952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679821933, "uuid": "8e52c5fd-9f62-408e-aa07-63dd1de76506", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821933, "uuid": "b00dc448-20e9-43c2-ad72-0c6056fa78f0", "value": "2d265fd31f3edd1363f78013e7d38f29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a136b5a-cb72-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679792778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792778, "uuid": "542f0745-1049-4fd9-a154-a98d138a7d72", "comment": "Malware payload (Smoke Loader)", "value": "f93a64f8bc1d20292149595c0b054d7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792778, "uuid": "64a8f228-2b38-4c36-8174-158fba9136e5", "comment": "Malware payload (Smoke Loader)", "value": "7f00e127edbbe95f09246df8e9768d0641a0f0434918f1b355c79bdbec552184", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792778, "uuid": "46d44e9f-3939-4088-83d8-5fd36fb170c0", "comment": "Malware payload (Smoke Loader)", "value": "69dcd08fd5505245a60bb59ebefd9a0853a5fd75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792778, "uuid": "76240238-d49b-4a06-94c1-fa307dfd9c01", "comment": "Malware payload (Smoke Loader)", "value": "6fc32694b42b289ec9dc8f8b6df6b7b5a0087d3705add9691219237e5cecdfd154da9b678678f150c224f98b0927bbf0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792778, "uuid": "e031fdf6-4532-4781-8257-df53f58d0153", "value": "T139547D0253E16820E72387328E2AC7F82E2EF8615E557BFE16659B3F1971F72C162705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792778, "uuid": "5ac88a36-c7ed-4605-afc0-a244b9d46d96", "value": "9c7e5bcbfd5f0ae72cc015cb41d480cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792778, "uuid": "607f81d1-c9b7-4d9f-96c5-852c57d1fcd7", "value": "3072:Cl+7Dw/eRF5IhAUvfao3uB67AkcVkX0Jfd24+kFu57OZ6NMcS5NtYvb9CJQN0fmG:zbF5yx3uBlf8Zkg57OZ6/G3YTsTfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679792778, "uuid": "70ca5f9a-4824-4282-97da-11c18dbe24b3", "value": 279040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679792778, "uuid": "c6779007-701d-4cad-8e09-0a13ddb3f232", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792778, "uuid": "16f4e1f1-51b2-4f98-978d-2cd9eb2734b3", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "249f569d-cbd0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679833034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679833034, "uuid": "032bbdb9-1a5c-4b03-98f7-af2c34c6b684", "comment": "Malware payload (RedLineStealer)", "value": "a5e8adc15439b453d6384c5989a26da1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679833034, "uuid": "44f490d7-2c39-4e3f-b297-94a414258190", "comment": "Malware payload (RedLineStealer)", "value": "80794c431727d75760b56c8a9fa8fc2b5532de2bf1fdba7b998b2a7399e2b79a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679833034, "uuid": "d809073b-61d9-4083-8389-6ef9922a5f13", "comment": "Malware payload (RedLineStealer)", "value": "ab9673194719300a8286a67d95ff8dc04b2d627d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679833034, "uuid": "1810ff1e-d4ae-45f1-a505-f752962279e1", "comment": "Malware payload (RedLineStealer)", "value": "193bcc01c71df3fc48b4311a58f34cf05f5f76324165992323608ab147e380d1311b3572e008add19610f48e1f2ca624", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679833034, "uuid": "ca1751f3-d9c6-449b-8f0c-e2fd618fd2c9", "value": "T11F547CF0D7C74E72F43FCCBECD8F0596033C9E9219950A86A856AEBC0141499A7A3D97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679833034, "uuid": "8f0d185d-861a-453d-98cd-0af683621fdb", "value": "5efb9ab375d470b5b9cb24c90592e4dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679833034, "uuid": "84d08b32-a321-4885-a9a2-203ab09c2f6b", "value": "3072:mgZ/fb2nN9Zu0/OsrHKE/ypChX6XsHGEYhvsmrewHxRSwRSLLa0T0/djgGtK/Yx:tlCNDtrHu+qVvGwHxRSyE50/djBK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679833034, "uuid": "fbd239ca-e5d4-4221-9da7-8c53dd135b59", "value": 299632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679833034, "uuid": "7c15f1a4-e96b-4182-b078-a2e1125461f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679833034, "uuid": "b529cfa6-7f31-4ccb-b734-669c6340655d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0397bf35-cbe2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1679840710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679840710, "uuid": "d12ca4bb-7d54-40b2-95dd-437519da8e0d", "comment": "Malware payload (Tofsee)", "value": "bb56c80680e59414b05e9b99ac73e212", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679840710, "uuid": "66e117b2-5815-4e45-a0ea-76259aaa7e18", "comment": "Malware payload (Tofsee)", "value": "8209beb6b60aadf651bb251bbd11d695092f01ff0577c7f7280b27ecd555b26b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679840710, "uuid": "41e989ee-3b6f-4de1-bd09-d3d443d9aa73", "comment": "Malware payload (Tofsee)", "value": "6c899c177242f54f5ace5d54e2a874a8e9366b56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679840710, "uuid": "606d26fb-cc8f-4dad-8e9e-4bd93c4b803c", "comment": "Malware payload (Tofsee)", "value": "41f9a13dffc4f31b8ef51488906c1ee2203d2866679a41aca7eba61bc18ec24acb405a33a5c77aad298bf5f776ce14c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679840710, "uuid": "0881b25d-9cef-4d16-a8c3-ae66da225d31", "value": "T1E8546B3262E07860E563D6338E2FC6FC2A1FB961DE197B7E16495A7F09702A1C172335", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679840710, "uuid": "08544cc4-4b12-4060-bbe0-13d4bf795932", "value": "c5c75c5b6a7ab4fe20f346e6d5121c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679840710, "uuid": "83ad563e-4d21-4616-bc3c-54ed092a959d", "value": "3072:936aWhjzzu7BpaY8yuQiAbZ+sN3TcJqiwog2DGqnJYyyvs/zeFy/ULpNN4TJY:I3OBsY8XsywoDGCYbazh/eNN4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679840710, "uuid": "dcf57a2e-0274-4e03-92e5-5cde9e1b4d75", "value": 281088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679840710, "uuid": "632c2805-aad4-4fa9-adb3-2ca018f9bcc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679840710, "uuid": "66775c18-077a-400c-8920-3ec0e7174b0c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3504d6dc-cbb6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679821895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821895, "uuid": "33703720-3632-4949-a441-a92a8ef0fdec", "comment": "Malware payload (Mirai)", "value": "57ad23449a0bf35eabff5abfdcc39ea2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821895, "uuid": "0a5d1325-28ca-4fc1-9262-045ebb3ed7a2", "comment": "Malware payload (Mirai)", "value": "8267978320f1de60b6797b949c795f1561cb5c34ec86b5dd4ff50be054f54ecc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821895, "uuid": "2bcf79ae-0659-4cd3-8e0f-95a9d7c1376c", "comment": "Malware payload (Mirai)", "value": "6edfea882cee96f7083b30fca027bec92b0797af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821895, "uuid": "0a8e88d5-81e3-440a-acc0-1a47c07786a4", "comment": "Malware payload (Mirai)", "value": "71a262e9acc1cb6b79cbac3c21ac0cae3a1e2fadd3c78dc9a30b69d5eba2753cfce0634301b720fd2472197576e5e0e7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821895, "uuid": "af747344-aa51-4f62-ba73-f83e2682569f", "value": "T17D73F756F8814B22C5D5127AFA2E118E332317FCE3DEB2129E206B2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821895, "uuid": "0acfa276-c3fc-4f21-acee-e128b545b3f7", "value": "1536:2ln/8E8NnQ1eDPV7PLbt2fm+pKaqW0VI3ipeY0vtG/L5iYIWJ:ZEInWUhcLKaCeY0vtG/LARU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679821895, "uuid": "676752fb-e256-4224-9e55-9f4d3f739ae8", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679821895, "uuid": "8f226d27-336b-430d-80e4-53b66430c2e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821895, "uuid": "028df366-215d-4c66-85d7-773357a9fc10", "value": "57ad23449a0bf35eabff5abfdcc39ea2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "725764d9-cb89-11ed-88f6-42010a9c006e", "comment": "Malware payload (LockBit)", "timestamp": 1679802670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679802670, "uuid": "c9f970ff-ca82-4068-8a26-b111f69a405b", "comment": "Malware payload (LockBit)", "value": "d4e42db322dbda25cd2eeeff34773ca8", "object_relation": "md5", "Tag": [ { "name": "Decryptor", "colour": "#968A52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679802670, "uuid": "8934b3ff-2a95-446c-8c67-882f3b140868", "comment": "Malware payload (LockBit)", "value": "82f27070eeed223bcc645b1ae47aa9309ef353c1cf5b79141b712ab36e5c55ba", "object_relation": "sha256", "Tag": [ { "name": "Decryptor", "colour": "#968A52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679802670, "uuid": "fab3c97a-3218-4235-9a58-8925eb19ec7e", "comment": "Malware payload (LockBit)", "value": "85413fbc874a1ba8455c1cc5d44cf505159db878", "object_relation": "sha1", "Tag": [ { "name": "Decryptor", "colour": "#968A52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679802670, "uuid": "a49b30a3-bede-4a13-b4d6-c37e4b85e047", "comment": "Malware payload (LockBit)", "value": "84294b05e9e59fe2f3bf1429577955e125979d010ddf8e1765d8cc50a44db127be034084eb626c5830777ee7b5292977", "object_relation": "sha3-384", "Tag": [ { "name": "Decryptor", "colour": "#968A52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679802670, "uuid": "3306357e-e00a-4bdf-9076-0fd93c4a678e", "value": "T1EC435B00B171D1B1E06691BC1E29E6B19939FD385C35D6227BD43F1E3A3C0A7EF1266A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679802670, "uuid": "6fc27c71-c91b-42d1-8319-2d322e49fa75", "value": "4585cfc85e0cd554d6b5d4bf1bb3d5e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679802670, "uuid": "bef41848-6abd-444c-b7b8-3df3888a7e2f", "value": "768:GlD2N5KCJD5rkdDRib1Xf0854EC3E9zpKMMYj1MYgFMRx:EAkCJD5rKDRib1F54ELp2Yj1M7MD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679802670, "uuid": "58e28f32-67eb-4342-8333-2d2f66f940ac", "value": 55808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679802670, "uuid": "2771c1f8-e2cc-43b2-8f2e-dd9a9dadf31e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679802670, "uuid": "f5168426-d6c0-4beb-b33d-0fe911ceb46d", "value": "LB3Decryptor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30ab88c0-cbbd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679824894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679824894, "uuid": "15090275-86c7-493f-9d35-a9ae1e5b4383", "comment": "Malware payload (Mirai)", "value": "b4e65440f343219e236149a93aac2d05", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679824894, "uuid": "c8e2423a-5c24-4419-be83-db9c08de2eaa", "comment": "Malware payload (Mirai)", "value": "83c7b4ca92ccd4822c3e2879485427af6535005ac4846c97c5ffac488e7ebb95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679824894, "uuid": "8bdc1007-1df0-4523-9513-83398064a025", "comment": "Malware payload (Mirai)", "value": "4472998db80b8395d21dd4a3d6482314e0407991", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679824894, "uuid": "1cb6b6ba-e6ec-4717-8c27-e0b2353624f0", "comment": "Malware payload (Mirai)", "value": "153e1de5c55208d9be6bfa6034bb5d1e2c34cb72a6df173ec68b7186d1f85b0995269e80aa07b8e2019883719c8113d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679824894, "uuid": "55f5072e-8490-43a2-9e5a-1f0d2ee6ad82", "value": "T1E1435BC5D563D9FCDC1019393077FF725676E93F1028EAC7D7A8A932A982A02D80729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679824894, "uuid": "a39468f6-dc0a-45ac-9f10-5a99f93a6dd0", "value": "1536:d6EwVWibZ6uzpNrmvFtWbF0AWCTZVZt+xc:QVWYZ6uzv4FKF0AWoZVZQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679824894, "uuid": "735b0781-4924-49df-a931-dc44bb0d5c5b", "value": 55840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679824894, "uuid": "4f2aea9c-cace-4c63-9823-9c31ad43256c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679824894, "uuid": "092eec64-0fb0-481a-9665-a03c0f12e5cd", "value": "mirai.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f3aaf4d-cc2c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679872754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679872754, "uuid": "3a7134aa-c6b5-4e06-a5a5-d3871c98afa5", "comment": "Malware payload", "value": "c52c8b1958d076e3545f31251b76adb5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679872754, "uuid": "3718a4c7-83e1-4266-bd6f-5337c7ca64c0", "comment": "Malware payload", "value": "85cbeced4d53526b94815b894e09199f8f5f7d4c889643ad1cb23aeaf2f7619f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679872754, "uuid": "93429a19-0380-4653-9218-af4ad06853e2", "comment": "Malware payload", "value": "6da502f0e61e01ff17147ced653f6e1bd20318f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679872754, "uuid": "c1236747-b297-4ec8-b8f6-018f20d8a070", "comment": "Malware payload", "value": "a3a6f53d636975c765ed7160c3f737bcf77214ee7cea5e89ca628a7d086c894ae18ffb41c91fed07e0ac7df698b6aafb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679872754, "uuid": "58e4baeb-c105-4a3e-aeec-ade94a461b93", "value": "T16A931985A743C7F3D4A31ABA02ABD66E0635F8399E259F4CF31D3DB45B139C87216224", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679872754, "uuid": "1857bff2-a11c-4064-9d69-0a83019248fc", "value": "1536:r2fgDhEY0B/NNaDfM1bRWALsMR9TgDrTBxLG1weLtAgL/sPwJUkit1O5u1m:r2ff/naDtbMR9TgvTrKwAtAgL/s4JUkr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679872754, "uuid": "273ec4fc-67c4-46b9-8d88-8591790e7500", "value": 89062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679872754, "uuid": "848b0754-ba89-47da-bacb-32e4bee42f76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679872754, "uuid": "d4916f58-7bc7-4ea3-917a-430b67e1ffd6", "value": "c52c8b1958d076e3545f31251b76adb5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed8657d1-cb9d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679811467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679811467, "uuid": "f4b4309c-e9df-4fab-8dc1-23964320cf2a", "comment": "Malware payload", "value": "abb0f2fd52d66df7a2ef4d52930e2923", "object_relation": "md5", "Tag": [ { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679811467, "uuid": "1079a82d-9749-45de-b973-94d38018974a", "comment": "Malware payload", "value": "86657238844bdf549a68a1de0041de1f9a2e1a6e4dc28ce8c267f7be33cf81b0", "object_relation": "sha256", "Tag": [ { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679811467, "uuid": "9851fed7-2fed-407e-b3e4-01afe724f666", "comment": "Malware payload", "value": "679050350e369f8dc2c4ab21a2128310ac83a3b2", "object_relation": "sha1", "Tag": [ { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679811467, "uuid": "8d853505-61c3-49f1-ad94-c950ee9a4978", "comment": "Malware payload", "value": "525926c84fc0471cd497da8d9e3766414131d3333e63f5b347eced36376c9b7a56391b5d0b78b64614864f409129d804", "object_relation": "sha3-384", "Tag": [ { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679811467, "uuid": "28dc9519-1bbe-4b96-8db2-b0a83095a2cd", "value": "T12C3407C24C4081284B57F476C85EB91472A9D4F6FB04B828DDF9A4844F1FF29E369EE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679811467, "uuid": "2b41eb9c-38ed-4e68-b404-6a959a06e948", "value": "768:YoalxPFRuP99SZoHiBkjHw0/qLvaYu6/bVyWcot3:Zal8V9S1J/hXcoF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679811467, "uuid": "adbfaebb-161f-412a-ba7f-1b66d268028f", "value": 248818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679811467, "uuid": "593c2078-1fb9-4e08-a0c2-472d062dce8b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679811467, "uuid": "caaf5369-3e90-4e71-ac14-e3130e4ad37a", "value": "curriculum_vitae-copie.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41d6326b-cbdd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679838667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838667, "uuid": "f47e6a7a-2f5e-49bd-8d7a-61ec86508866", "comment": "Malware payload (Mirai)", "value": "b422eddb0f0d92c7cb22b820914f9cac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838667, "uuid": "44267561-4ad8-4409-afab-99ea51c989cd", "comment": "Malware payload (Mirai)", "value": "8806c8f83a22f582e54ab9ca75387e5709ed21fef0671d8cec4a695e5913101d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838667, "uuid": "50795be8-1ca6-47f0-8db1-6becda4afbd5", "comment": "Malware payload (Mirai)", "value": "1bc6a4dc75986949a978a706b9d28eb21c09756b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838667, "uuid": "2b89bf90-943f-453c-a67a-23eb877c7915", "comment": "Malware payload (Mirai)", "value": "8e988d8c97e579ce59244ea5197f41c1b53f386b93319c19c3aa38cc39f21ee55b8550a1a6fc915fbe783766eb4d0c59", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679838667, "uuid": "9c5c5611-0f6f-436a-9f2b-ab02d92e5ac2", "value": "T145E32A06FC004627C2D12BB7B39B428D77225F695BDB3351EA297DB02FE0B991A395D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679838667, "uuid": "9c3d8711-c19e-4a62-99d6-31378b94778b", "value": "3072:ihRHih54YD1xMw5v0R9E1EscBsVetJ8add9QzhsISc6SgD1Xu+3ZX4TtQ6W8GoQq:8L9E1hUsVetJ8addQxv6xxZX4TtQ6Wvq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679838667, "uuid": "67288c32-6c59-48b6-a308-b5cf6308a94e", "value": 146439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679838667, "uuid": "577f7290-04b4-4974-96a3-2d6ee2de7353", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679838667, "uuid": "9754b0a7-fb02-4a36-9c17-0fef54fa1256", "value": "b422eddb0f0d92c7cb22b820914f9cac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d90f1093-cb91-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679806279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679806279, "uuid": "805e95d4-0b9b-48d8-8d29-578ded82d61b", "comment": "Malware payload (RedLineStealer)", "value": "14590ed407ac3137dfebf6e577738b6f", "object_relation": "md5", "Tag": [ { "name": "212-113-116-143", "colour": "#077D6B", "exportable": true, "hide_tag": false }, { "name": "cochang", "colour": "#3EAEE3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pw cochang", "colour": "#2C2E71", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679806279, "uuid": "dea87577-9933-47dc-bc83-3367bdee98e8", "comment": "Malware payload (RedLineStealer)", "value": "8849188015f3e48dff6985bd0b823fb744da1e65e7ac93fed19e370e3af419d3", "object_relation": "sha256", "Tag": [ { "name": "212-113-116-143", "colour": "#077D6B", "exportable": true, "hide_tag": false }, { "name": "cochang", "colour": "#3EAEE3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pw cochang", "colour": "#2C2E71", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679806279, "uuid": "d2d9bdf1-c753-46d7-84ce-eba973ee8ced", "comment": "Malware payload (RedLineStealer)", "value": "4c57d1fdf4b14bfbfaee2adefe1a186bb48b7fcd", "object_relation": "sha1", "Tag": [ { "name": "212-113-116-143", "colour": "#077D6B", "exportable": true, "hide_tag": false }, { "name": "cochang", "colour": "#3EAEE3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pw cochang", "colour": "#2C2E71", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679806279, "uuid": "e6f81e3e-464f-4e70-90cc-4228f8e8ed64", "comment": "Malware payload (RedLineStealer)", "value": "d4a9e3a24eb23e75083f9a7038470d4318097765a95f5e1a298173af00044150dea4d37727e74bd186802c0f7c258371", "object_relation": "sha3-384", "Tag": [ { "name": "212-113-116-143", "colour": "#077D6B", "exportable": true, "hide_tag": false }, { "name": "cochang", "colour": "#3EAEE3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pw cochang", "colour": "#2C2E71", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679806279, "uuid": "4042c008-b74e-42ed-be70-239f350f2587", "value": "T1076733F7EA8E5AB4708B206D78BD6793489D7022E7316DF703CA434D92B9871DE84C58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679806279, "uuid": "f6a750d7-824f-496a-8cac-54a61e0c15be", "value": "393216:PdRMyQ5nDRugTM6ZWK4GV+Pws5TttG9/yaxC67GHh6FKLNhvNzkRZO9DXwhT+GbK:PYp1nM6WO+1TOxeMFkNJN40DAhKGbEfH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679806279, "uuid": "c57fcc07-c894-40e3-b0fa-1eedce07921d", "value": 30073571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679806279, "uuid": "e7811615-074e-4c02-9a51-561f600878e3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679806279, "uuid": "9f5f46dd-c833-4d89-8f74-c2ad3fe63d7b", "value": "Analysis of cochang private key leak event on March 21, 2023.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86514f5a-cc2d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679873141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679873141, "uuid": "a6e72e28-48ec-421c-868f-2a727862b9a5", "comment": "Malware payload (Amadey)", "value": "e99ed5cc4506d117cd2502f7b56b779b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679873141, "uuid": "a54f8900-d1b6-49a6-8be5-026b68b4d2a2", "comment": "Malware payload (Amadey)", "value": "885cd71a5c8ff7e020f3fae0d6b09ae4e6738ef102df163105dbbba7cb0095ac", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679873141, "uuid": "62d97952-23b6-46b3-819e-4defdc3044b5", "comment": "Malware payload (Amadey)", "value": "c2a68ef6f451a8c20ef97d35c3abf76224f5b555", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679873141, "uuid": "2ae88b10-6a7b-4d14-8109-a6d55dda6645", "comment": "Malware payload (Amadey)", "value": "77244e387a8053ccff377c49855433ab1b005aad3cb1f0497256363e2420c0ff34265b809bf56f6ab4709c9b52922cfa", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679873141, "uuid": "0f6cd40d-f569-4149-883c-08db8247dbe7", "value": "T119252303AFE44432E4B2277048BA07930E3DBDDA1DB987276B86589E0C775543572BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679873141, "uuid": "75c16167-b113-47dc-9496-79992b7c7534", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679873141, "uuid": "7aa77921-f45f-46e2-bab1-7124d48ef4fe", "value": "24576:qybY9AmZ1gVXITtKI3fq0RO6f3akDuDYXOIyxkm9yD:xbYSO1TtKZ0Rz8DyOIyXo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679873141, "uuid": "3de855e7-ee0d-4ecb-b415-b29985fcf546", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679873141, "uuid": "600911cb-f88a-4d89-95b9-8517ef69f1f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679873141, "uuid": "26d08205-6736-45d8-adf2-791e07f9a1c0", "value": "e99ed5cc4506d117cd2502f7b56b779b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72e389cd-cc24-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679869243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679869243, "uuid": "5e932f6f-8b83-4f15-b3aa-194c97228fe7", "comment": "Malware payload (RedLineStealer)", "value": "72fa01f1c0c95365bffdbb8e0f62c5e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679869243, "uuid": "af6279f4-5ed5-4124-a13e-67d06e338635", "comment": "Malware payload (RedLineStealer)", "value": "89551bc135efb0262d763796add54f730378324d9acf145ff32ddfe18fac7001", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679869243, "uuid": "a5892107-cbce-4bec-ab66-e36b3e251621", "comment": "Malware payload (RedLineStealer)", "value": "9ac1aaaeee5cb19cb2e0b0ad2b98056c18825590", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679869243, "uuid": "db637e2c-3d1b-4e40-8553-f5a41f994cbc", "comment": "Malware payload (RedLineStealer)", "value": "9ce35d28a9c391687939b1f3acb099d65d5e8ec78d175dd3000f1aef69b878b6547f3385c245e23d8493bbc477b96810", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679869243, "uuid": "82064576-3f85-454e-9dbe-e85fbe7391e4", "value": "T19DE41213A6E81467E4B51B70A8FB07C70F31BDE159B4525937986C9F0CB3988A63237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679869243, "uuid": "785239fb-f18a-4aa3-950c-fc8cbe5e98ee", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679869243, "uuid": "7ef5361a-8d2a-4d66-a399-2b18aa418b6d", "value": "12288:KMrky90l38g5iw7X4F5hnHW2e/vsoNtkgBTRZuxZ2xmVcXqTpTwe2i3:SyW5ir5hnHWvrNtZTRkExmVcXqTpTZ2Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679869243, "uuid": "df53da65-bbef-42bd-ac70-941e386fbb57", "value": 699392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679869243, "uuid": "07901e6a-203c-470f-84e5-8ea0699b7fbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679869243, "uuid": "4d2a1766-7c5c-41ef-b19f-ede3edab95c7", "value": "72fa01f1c0c95365bffdbb8e0f62c5e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2d2d834-cbb4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679821327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821327, "uuid": "643a4d59-d6f9-4393-820a-8fa8e05162da", "comment": "Malware payload (Mirai)", "value": "42945377b6dc56488e141cbd8b49075e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821327, "uuid": "c33bf16d-3266-44a6-b3d5-7948f35060a7", "comment": "Malware payload (Mirai)", "value": "8c19d5b3e323303b1dc703dc7946684db47c48fc699f98d2c5e99fba19b46066", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821327, "uuid": "b86e05f9-b84c-49b6-b362-3ead78cb0d65", "comment": "Malware payload (Mirai)", "value": "58a5a4e038072c344beb1addd2f9e752f1a7a78c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821327, "uuid": "bdddc31c-1bb3-41a3-bff7-2fcddeb21f57", "comment": "Malware payload (Mirai)", "value": "6d3b3dd41ba48c4e02777b1ed1377ecd5b5402ff8e6c9ce45c39c8c52e31dd9285ef86d3fae1769a91f6d7fa408232f5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821327, "uuid": "60f6f8ae-afde-4869-8d9b-b99708c8e9cd", "value": "T17B732855B8818A17C6C152BBFA2E428D373667ECD2DA72139D356F2033C782B0D37A65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821327, "uuid": "b625cc5e-fabd-4efd-8098-9c100bbfbe76", "value": "1536:L/+WYQjS/+VnakfCWZxfWoxeBQA/wvAcZ4yrFhrwJEmNAfZQvVWJ:Vd2/8nLVXWo4BQKwvTRrFhrQEmNAkV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679821327, "uuid": "1341ebca-b54a-4638-af09-ff0cfe55eded", "value": 76932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679821327, "uuid": "b83031a7-d124-459f-9522-badfaee98647", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821327, "uuid": "b1feb787-6e2f-4a0e-abbc-20c0b07eb99a", "value": "42945377b6dc56488e141cbd8b49075e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d26b0ebb-cc02-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679854801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854801, "uuid": "beae8e1d-364c-4a30-bb0c-7c07007361bc", "comment": "Malware payload (SnakeKeylogger)", "value": "f60a805c01faa0d833461a2d3388ab6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854801, "uuid": "6f3e4b4c-f34b-4a82-bcd2-01b5adad249f", "comment": "Malware payload (SnakeKeylogger)", "value": "8c92fe975db6f552f522fbd9a8e542ae2e78cc0c21bb5e316b883b23e0084038", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854801, "uuid": "2e17d2fb-549b-4425-9d18-55f3bf208292", "comment": "Malware payload (SnakeKeylogger)", "value": "729da8943c08531f0861f4f291ef1dd2346d2a94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854801, "uuid": "44f9dce4-9fb3-4454-a1ca-417bebb7dd77", "comment": "Malware payload (SnakeKeylogger)", "value": "bd85da91254c586d804fd048b2fe5fe013109784f05e40c7dc29b6daf1e538a460a1638fdf53e16d6546bced6e949ab7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854801, "uuid": "634d6079-6441-4a60-bd91-3bcdbf9c28fa", "value": "T1A5158B8273B391B2E89F4264153865CD4E39B1473516E12B5F37BBB0A2212BF7E2F146", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854801, "uuid": "28f1813d-f654-489e-9e08-a1484a64cf49", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854801, "uuid": "015cbcc3-da16-494c-93c5-80cadddbbf9c", "value": "12288:NvvaDcBlqYpyOkqDp5y2IEr3YodX/4kZuuGfYzVlYdk:1im4YpyeF5y2Iy3hdv0P+Lsk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679854801, "uuid": "f8ffcad1-86a1-4c71-9272-34e4cb0c262f", "value": 954368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679854801, "uuid": "8471df6c-c9ec-441d-b6b2-5cc37f96e574", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854801, "uuid": "7b60810d-9af1-4b88-9319-99498355b5ef", "value": "f60a805c01faa0d833461a2d3388ab6f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f9c2f55-cc02-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679854501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854501, "uuid": "d3eb7d17-ed7b-4d6a-973c-b6457582a15b", "comment": "Malware payload", "value": "397ac1b63a88e2f79bb0ae8ba84ef990", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854501, "uuid": "f3f55564-4ca9-48fe-ac84-e9b0ddf6451d", "comment": "Malware payload", "value": "8d4e14b6dfd7d84a6dbd5ddbc6ba32208dd74338a44377862d9afa04d46d5015", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854501, "uuid": "f6f1ff25-b79c-473c-b622-a69c0b5db342", "comment": "Malware payload", "value": "34f6871511172a041eb018793896aa63fa0eddf7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854501, "uuid": "853930b9-047b-4361-94c6-58fce2c7357e", "comment": "Malware payload", "value": "28d1d1b069cb5f0eaf86515f4fb09077174b7ac76c0ace511d1dfaba417f39700e5e173efe9e1c3970a039b50e2d1d48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854501, "uuid": "5e76ac76-9929-42e7-8224-47d8c3a8edbf", "value": "T19DE5332B306091F1AC607FA982599C79A784DEDE3549877FF262160872F4E7462FE331", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854501, "uuid": "fd683637-bae0-4228-a8a7-206f1c573525", "value": "49152:6GAS/Yy+/O9ccmVVxcTZ4nynw0z6IdsU81tYA8SeY1vABvylLbWBcCsV+AkJXpHw:lH/Yb2ccmdcTZF5HMN8SOvMLUDAkJ5Hw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679854501, "uuid": "adb67b00-e443-4563-ab1b-cab9d6d35726", "value": 3116691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679854501, "uuid": "046dbe5c-6805-4926-9a16-6bf23e40a57c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854501, "uuid": "5db1d039-f7c1-457c-84df-ee6ae77e3343", "value": "397ac1b63a88e2f79bb0ae8ba84ef990.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c48bba6-cc02-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679854468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854468, "uuid": "d23da8b5-0bf0-4ebd-b8db-06b1cd2b8aff", "comment": "Malware payload", "value": "be5b4337fe94a160d8709199ed21244a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854468, "uuid": "6288eea7-1b29-4951-b6a9-3c62b48b8948", "comment": "Malware payload", "value": "8f276c4e93b1d13cf7aeb507d629ee38839408b40d9c4151df03707956b7fbd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854468, "uuid": "32c7b4d7-ca17-4494-aa9f-ea123e0e73d6", "comment": "Malware payload", "value": "d8dc37a8d7e25f9aa3170c8da983a02dd98ac46b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854468, "uuid": "4c830e67-bbf6-4afc-a982-356dacffa915", "comment": "Malware payload", "value": "97c3cb28744dddad351c9e09477b1da982c2f47a1db2af8c4af4f6fd4a78c8f79e059ef228537db55dbeeaa3a2535973", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854468, "uuid": "88d288b3-68bb-4e5d-9db6-86420726ce49", "value": "T14526335A20726AB1ED697B34C35C98B8BA94BCDD3259CB7FB161024C78F4E3061B9371", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854468, "uuid": "0faf4c13-740d-432c-843c-2107c8f5bba2", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854468, "uuid": "f85d919e-2839-478a-ba85-ab348e387701", "value": "98304:lH/Yb2ccmdcTZF5HMN8SOvMLUDAkJ5HFahXn7979IdLd4ieis:lcbWmck48X7979Id2i3s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679854468, "uuid": "a63f8a67-4fe7-4ee0-a528-1924a971e1cd", "value": 4509696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679854468, "uuid": "76ab7746-8c4c-4d6c-b31b-591fa4ed119b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854468, "uuid": "0c80c825-bc14-458e-a48b-66b7112d7572", "value": "be5b4337fe94a160d8709199ed21244a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "732d5404-cbd8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679836602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679836602, "uuid": "be912f20-d767-42fc-bff0-0de868ab7542", "comment": "Malware payload (Amadey)", "value": "ca95bde685fd084ddf9ae7273ec988a9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679836602, "uuid": "c758d7c7-0431-4071-a265-a767b692207e", "comment": "Malware payload (Amadey)", "value": "902c183c37927ae6dac7d15b01907803ec6e54f7baae6df8041f1ee9e596647c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679836602, "uuid": "e797a387-8a92-46aa-bdcb-0cb581000f15", "comment": "Malware payload (Amadey)", "value": "0c886ec9dd224a5e65820ff563fb9f522fd32473", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679836602, "uuid": "4aca3913-cc50-4417-b55c-e1b6776c0d0d", "comment": "Malware payload (Amadey)", "value": "ad3201570ede984f9d98f20fc90df14659bfc76516f8d5c63e69e2472a35c4e17a373f9efde149bd5ab108fa9645c5bc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679836602, "uuid": "97e97d53-a3ca-405f-bdf5-38ca5258b5b0", "value": "T16D546C3253F06860E553EB328E2FC6FC2A2FB9219E557B7E16495A7F09702A1C172335", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679836602, "uuid": "69a80cdd-7122-48cf-b8ff-1bc6f7a847bb", "value": "c5c75c5b6a7ab4fe20f346e6d5121c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679836602, "uuid": "7b2f25de-d67e-4d7f-8141-a9a1d0d0ef6e", "value": "3072:13TKmCXrb3uLXOIYW0ukEHbZm4kds65Z5xgdDNovqslB2/4/7ANT/5pNN4TJY:KjuXbYWU1d/57xgnoislcW7AN/rNN4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679836602, "uuid": "d3876b81-255f-4826-b075-fe13d9d94602", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679836602, "uuid": "d88e20c8-490f-4939-af28-a306eb51bac2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679836602, "uuid": "c5db32e2-2d0f-4bb4-b46d-2631afc22f26", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4caa0edc-cb72-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679792729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792729, "uuid": "2a28f8a9-d40f-45d7-8a9c-18ca9a597205", "comment": "Malware payload (Smoke Loader)", "value": "3e02d975b396ba9d91921ebda85e12f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792729, "uuid": "73489788-1d92-4136-ab61-7cda94e5b52e", "comment": "Malware payload (Smoke Loader)", "value": "9105377568752a15dc87427d98189a2de7dd57458434240f5807db1f0814274d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792729, "uuid": "fee854ba-53fa-4698-9e51-680a8ab3d5b4", "comment": "Malware payload (Smoke Loader)", "value": "7debc34d7d9fd6830c9e179741fdd5bfd2e6c5cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792729, "uuid": "56a95c21-1c18-4d11-a05d-612e4b8f4561", "comment": "Malware payload (Smoke Loader)", "value": "df4048c9d8759455c0c522e7a11f0853b9671f4ebd11646e22b829928436aa8d196c3c734a7570322d6e3a0e0fdd2f49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792729, "uuid": "56ab0a2e-0dff-4aad-8f1b-758030dba085", "value": "T16C546C0253E26870E76386328E2AC7F42E1EF8615E157BFE12599B3F2971F72C162705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792729, "uuid": "6bb954f8-cc4d-44e7-bf20-19281a06ffad", "value": "9c7e5bcbfd5f0ae72cc015cb41d480cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792729, "uuid": "1d7ed39c-76ef-42fb-869a-f50d695c94d4", "value": "3072:Cb+gfbjbR7iTdA3vaK/Lkq+mAkcVkLt8XzIYaXzKtiRjS4AQCJQN0fm2Rh:Gd7iB4LkqLyjOzCIjSTTfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679792729, "uuid": "c82c4467-51d9-4c7f-89a7-42e2571ac703", "value": 279040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679792729, "uuid": "c5b24b6c-881e-487d-8285-54a21b7fd0bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792729, "uuid": "a1f9d609-935d-424e-b920-d7e533e11c2b", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76561e9b-cc0d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679859371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679859371, "uuid": "7c5429e8-2c12-4fd7-8545-3d32fa73c152", "comment": "Malware payload", "value": "2129219b809daf3bcb1736bcc130dd4b", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679859371, "uuid": "f2c32fae-0bf4-4b60-87e7-f4af8119981d", "comment": "Malware payload", "value": "9256586f657c81070a91f5ccb5a57ce89b188b3209906d592ccbd1b001c20f4c", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679859371, "uuid": "dce351b3-6019-4182-a28e-6f7e9b13e534", "comment": "Malware payload", "value": "fefc3c31de00f8938f21229439db393560227dbc", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679859371, "uuid": "7b27d0a7-5d1f-4544-8449-3f2fddcbcd73", "comment": "Malware payload", "value": "01d1b306efa29d2e86f76219a6432aae2d5e0cfe144728d0765144818dafb7c3afae01da602c442760f3cdcf54ee8b7f", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679859371, "uuid": "00c45fae-2434-4efc-ab7b-1b003a00f473", "value": "T192C63397FB19EE22D1A7C6369736455B692A4C444703E3431B85B63C0EF7BC09B86EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679859371, "uuid": "06e67b2a-468e-4b75-83af-98da4bdc3762", "value": "196608:EpIKZMBbEmPIOEau02cBXXLtryQtr31CgB+GSuE5nvG6+BixbxnpaUTZ5j4X9t:E9mBBPRuYryw5FpSuIIBexnpaEZV+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679859371, "uuid": "6df7d0d0-a666-43dc-a4cf-7444fb59d775", "value": 12480552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679859371, "uuid": "1e929cc5-8e50-40e7-b7d3-2e9637656bff", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679859371, "uuid": "a1b81491-0649-4e53-8657-ffa5012bfd16", "value": "Epos.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db5e289c-cc2c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679872854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679872854, "uuid": "99a2c0a5-629e-4c5b-ab23-d864fb029561", "comment": "Malware payload", "value": "c138038c53066ce2adf8daa46aec0157", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679872854, "uuid": "7cfd0a56-88a2-4f3e-b605-5500eb880868", "comment": "Malware payload", "value": "930ed75ee4c059275fc38a1beb4ed49881942e90017fb842c8214f1db0695219", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679872854, "uuid": "17a38a5a-901e-4c77-84a2-58acd7b19ed8", "comment": "Malware payload", "value": "09889b5af80c49713e578efadd16164aacd477e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679872854, "uuid": "b2993dab-1988-4512-81fb-de43d253a6e3", "comment": "Malware payload", "value": "41708c51320ea8a11456944b1c97ff7015380077d70433733eb2166fee79b96522e8387ec9a2a70f749f78498388397f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679872854, "uuid": "c913a616-b817-4431-bd36-50df5af9a8a0", "value": "T10AD3A50BAB61DEB3D85FDD7705AA860110CD945602A96F6F72BCDA2CE74B94F08E3C50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679872854, "uuid": "acfcc6d1-304f-43f3-a983-d00f442f83b1", "value": "3072:G2a7022NgEMxxek86MV6T/qGDmj4Lq/WoleA:G2922NgXxv86MET/qGDmj4Lq/WoleA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679872854, "uuid": "7658641c-31c8-4536-bbe4-c0bbeb944b05", "value": 131688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679872854, "uuid": "f723908d-8a72-4b61-a9b8-855498e50daa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679872854, "uuid": "83e661fe-5a81-4af8-93bf-b8357cd81493", "value": "c138038c53066ce2adf8daa46aec0157", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbe81c17-cbe2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679841019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679841019, "uuid": "7a0ee804-c90d-4db3-8535-baa777c43a07", "comment": "Malware payload (RedLineStealer)", "value": "6ac746b33d45f3a5389023fa3aa38a40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679841019, "uuid": "6d3c804d-9ebe-4479-8091-54f4fcd55e26", "comment": "Malware payload (RedLineStealer)", "value": "931550f6442765e288034980250788695e5e57bc2ec44b1a09fd6115fb5a1e29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679841019, "uuid": "ec6706ce-77f2-4526-80b1-8c3dbb0c9e1a", "comment": "Malware payload (RedLineStealer)", "value": "ed149f7728ffb1cfaa6b9884522647dad1dd261b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679841019, "uuid": "d80808ce-16ba-41c2-bd5c-7898893364af", "comment": "Malware payload (RedLineStealer)", "value": "7b5281c4287f2b4a645aa66bd0dd884b46982ab7b5088d32e8421946e71b0a46f248ea38a6c1765dabaa386b678159a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679841019, "uuid": "79c50ec4-070f-448f-a929-7bf23c3f0daf", "value": "T1FF84AE3253E06860E563D6338E2FC6FC3A2FB9619E256BBE17549A7F0930261D172335", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679841019, "uuid": "09fdb4d3-9b71-4b1e-a960-f654cfc8f5ba", "value": "c5c75c5b6a7ab4fe20f346e6d5121c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679841019, "uuid": "21cc3f17-6401-49a2-af85-62dc823e635e", "value": "6144:qRnxyU+DIM5nSAy6YbWYYo4zsxDOdu6Q0KgT8S/ANN4T:qRnxt+Ddt49tvOrlT2N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679841019, "uuid": "7444ca39-af61-44fe-a03b-ef0f4a2d2500", "value": 389632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679841019, "uuid": "59c7abd3-086a-49aa-8ab5-0c69445df1f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679841019, "uuid": "81bd7de1-da32-4c88-8ea0-aa89cd34d1d3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "561ae7dd-cb99-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tsunami)", "timestamp": 1679809495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679809495, "uuid": "ae12f078-3209-4fbf-bccb-43b868ba0b7f", "comment": "Malware payload (Tsunami)", "value": "1871abcf887bec851214979aa90fc3ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679809495, "uuid": "6f8621bd-2d21-4c0f-9c79-beb124d4ad6d", "comment": "Malware payload (Tsunami)", "value": "938cd2020a8551d57ed522c81a4fca9df0cb22db221381ea0e19f0149ee8100e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679809495, "uuid": "70da2aa0-a129-4c05-a36d-8c1fd8a4b49a", "comment": "Malware payload (Tsunami)", "value": "d2245ecf8d5388aafbe72e7aec757e050a2d79c8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679809495, "uuid": "4f67539a-9c77-41bb-b3da-cc700d401537", "comment": "Malware payload (Tsunami)", "value": "2218700a0b9cf2e17efb1384aed9d30a7d9e3786d36aa176be4e3fe1e451a92467f9d56c00097dce2d3b0312b79bb619", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679809495, "uuid": "8bed97d7-a7e2-45f6-9f35-9280cdbf91b6", "value": "T127D3946A3E21FBBFE268863007F34FB08795219626A19785F16CEB185F6138D0C5F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679809495, "uuid": "cdd13b31-48c2-415e-83bd-b15f7994dfb6", "value": "1536:S4FwRwb6fntG/azrdgmZ73YfYXZGEazvuKU4cozTz6GidlV0kHL/2WihdwIo7zyb:yY8TnDH/RhhF4emaeGDmj4Lq/WoleA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679809495, "uuid": "37439aa3-8793-4bbc-a42b-68d0f94327ad", "value": 131688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679809495, "uuid": "449970b8-6cde-40fd-8310-23ee898306fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679809495, "uuid": "32652978-4d67-4dc8-8539-40cd8848a9f5", "value": "1871abcf887bec851214979aa90fc3ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a55d540d-cc11-11ed-88f6-42010a9c006e", "comment": "Malware payload (Chaos)", "timestamp": 1679861167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679861167, "uuid": "b035e393-bb77-4640-b78a-991091a6f54d", "comment": "Malware payload (Chaos)", "value": "137cddd1cadfa98cae6479b322c4d130", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679861167, "uuid": "189402ba-7b2c-4c49-87cd-1af8e9701cb2", "comment": "Malware payload (Chaos)", "value": "93bd3d7103aad08472864965ef335acec7173d25282308eebcfe655222cf41f9", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679861167, "uuid": "dfd52623-8d0f-4412-9e3b-fc1461316cfb", "comment": "Malware payload (Chaos)", "value": "13ec5f1201be442b2c2a16e12f5f02f92b93770e", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679861167, "uuid": "766ceb64-d3b0-4dbd-a165-41d47fbf133b", "comment": "Malware payload (Chaos)", "value": "4d1b0f79c8ddd10c40e199f0784fb39d90aec329d82d04045b767cd3a9c9891cdd871eba14ec8c3a72d0b9b6575c27e7", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679861167, "uuid": "0fcb3d3e-5b11-4bee-81c4-2c76126c8a28", "value": "T160D2B35EA3BA4E30F2FF2E79597061517779FE22DD39C66C1888044C082DF5C99A1BE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679861167, "uuid": "c69451e4-e9b1-4ab2-a82a-15c449c40ed2", "value": "768:M+08iri7IW6VujjqiBar9Z1b2fvkpIAtLK:M+5iri0XojjTar9ZUvKIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679861167, "uuid": "8b6f6739-0e91-468f-93f0-572b219b9fdf", "value": 29806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679861167, "uuid": "5436bca2-5d53-4a2e-9021-d4be6fbf0f9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679861167, "uuid": "7f629c2f-5fe5-4e85-b76d-1d99279a719e", "value": "2023-03-24_137cddd1cadfa98cae6479b322c4d130_destroyer_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b93d5714-cbc8-11ed-88f6-42010a9c006e", "comment": "Malware payload (PrivateLoader)", "timestamp": 1679829848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679829848, "uuid": "56ed9270-63c3-4f0b-ab86-d7cbeb81fe31", "comment": "Malware payload (PrivateLoader)", "value": "fee20b7f8b91419f68d100878c5ba5c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679829848, "uuid": "24630318-c919-4fc7-ae88-edeae66c065d", "comment": "Malware payload (PrivateLoader)", "value": "93dd2c7ca6db55e72f58d2895ae5ad42d1ded6fe9de032dcf1584ed4f3a7c6e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679829848, "uuid": "a52da538-087f-49b6-8fe6-4c57f7d40a27", "comment": "Malware payload (PrivateLoader)", "value": "f03663fc7c8f3b7762d9de05c8a5c8105e4458c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679829848, "uuid": "e54575f8-10df-4941-a47f-b0602a7b3c98", "comment": "Malware payload (PrivateLoader)", "value": "6430945ad86a9e1d171b288ff704653ec5472985aaebf4c4e37df06549555cc6ea89bc48e45e4ffd12a15d80f837229c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679829848, "uuid": "4c7042bd-97f6-49a3-85a0-2158e0f1e32d", "value": "T1FA5633022D65146BE8B629718C74E3F395BA85233E7A17E5FD10A3B1CDB8D247E8142F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679829848, "uuid": "522ecd0b-5d76-4cf2-a762-0b319783cb6a", "value": "496fff7f26eb25a135e9d530fa8ef62e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679829848, "uuid": "1e390a5c-3358-4634-8550-8ce5ea84f6ca", "value": "98304:G5+b9ebrL10pgRf0NJQdRUlK5+bI1LoYuFp9kkDqnNzyqu0LbGEFNzuf2rHaxfNf:GApev6pcsoazI1LolFpKlNzyqu0fjzGV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679829848, "uuid": "2551e66f-9cf2-4b97-a1ae-f0437048a31d", "value": 6152496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679829848, "uuid": "657a5232-bfbb-4e53-a710-74010d6c0717", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679829848, "uuid": "c2202faf-028d-4e21-b427-a0e2c28365a6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbfd6d73-cbb4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679821262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821262, "uuid": "b6e51d1c-48a5-411a-91cb-451450598322", "comment": "Malware payload (Mirai)", "value": "8216802d500d04e0a2065060b44d7a07", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821262, "uuid": "3be98ca4-6cf1-4a2b-8794-70cfd8e2eb81", "comment": "Malware payload (Mirai)", "value": "93fe014d807324d4884a84ac31fd1312cd9da563344ce6c7b1ba5be7ab3ea3e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821262, "uuid": "9f23b5a7-769d-4580-b1a3-e5165a8ef5ec", "comment": "Malware payload (Mirai)", "value": "37782e9dfe97299ba3c24bbe49816b982a70ae5d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821262, "uuid": "5d619366-75b1-49ee-a075-d34d786d83c2", "comment": "Malware payload (Mirai)", "value": "2615173ffe5597cecbb817f49160d1b098bc9f164880964f0b70668838e2af2c186f0683d7a21c774a689e8fcb9ae95e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821262, "uuid": "1a880240-26c9-43eb-902e-6e56823a2b23", "value": "T118733A99B4019EBCF99BE9FA41150E09F52163009F430F27B277FEE32DA20A59D47D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821262, "uuid": "da00a6c3-8f19-4be4-9ba9-16514bb7316e", "value": "1536:BCVyHziiC4Mu1K5bXuHNepOR/12WeYB+KtVRxu8PS:liiAEmLuHwpINLlV3q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679821262, "uuid": "bc591d67-29f5-43ad-a6a8-5f8091d23821", "value": 74100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679821262, "uuid": "1d7afef9-757d-49d5-bff3-a8c95944cc8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821262, "uuid": "b7524880-59b6-4513-b234-5e3d20e7e236", "value": "8216802d500d04e0a2065060b44d7a07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f59f2dc9-cbc7-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1679829519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679829519, "uuid": "2ccdd431-458e-4fad-8d2d-33eb0c166ef5", "comment": "Malware payload (GCleaner)", "value": "6b5e9ecbf05e28947c20cf3c025c1e81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679829519, "uuid": "491d1ae6-3c01-4888-8d2c-ccce07efcfbc", "comment": "Malware payload (GCleaner)", "value": "9407e3424fb322d3344b4b8717dae260616f4de1a3ab22eb1e9e674718c993d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679829519, "uuid": "c79b5572-1be1-4f2c-b0f6-a237507d56ff", "comment": "Malware payload (GCleaner)", "value": "7946956191ce8c1f8d0fd5be4b03769a129f9601", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679829519, "uuid": "cc058b49-1336-4dbc-a381-45651aec8a64", "comment": "Malware payload (GCleaner)", "value": "dd0fa4c5436470a2952bb5ece06f85b867dfe41aa9a51148e80656b2fa4be93210656729a9676c37e8cf64c6dc45bad9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679829519, "uuid": "9a925376-3ad0-4020-95d9-847a3634d9f9", "value": "T117A53302A7C090F2F59665B0FD47CB4FAB33F6B22E74A910B05F87CE6B295525811BE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679829519, "uuid": "89920dc8-9ab7-47c4-ad91-c20ace64cba1", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679829519, "uuid": "c716d6c8-466a-4233-918e-a937c931c9cd", "value": "49152:EGlJfs03gynCzX0jmgq+rKk7CujI5CHrWhzLg25dlLYp:5zCYjmgqfk5jI5jXPYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679829519, "uuid": "32f72449-a580-4579-b218-95ea088d861c", "value": 2168974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679829519, "uuid": "df91b7cb-779d-4ea3-b7a3-2d503b49349e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679829519, "uuid": "b87fab49-d793-467a-9e41-b63d5eab343c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "308eba08-cc13-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1679861830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679861830, "uuid": "c2ed076d-3364-462f-9a72-d52eb7017e2e", "comment": "Malware payload (GCleaner)", "value": "38b93a93eb49ea994f8c4a7f02134c6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679861830, "uuid": "a9ab3df9-df26-437a-a24a-7310b8b1b0a5", "comment": "Malware payload (GCleaner)", "value": "95785d5bd7c64e3e8b927d9c7d339608910a81865b97099fa4f15b88bc6de1d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679861830, "uuid": "e5143907-0a6e-4dfc-9975-3d088ff71139", "comment": "Malware payload (GCleaner)", "value": "c09005fce14493aa7add862300de4dec556b7797", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679861830, "uuid": "e224d89a-4257-46c9-abf6-23120c6641d8", "comment": "Malware payload (GCleaner)", "value": "0e376d6b07fc11a6fa3f334a89eaed600ce40ec8cf030219dd8ee640f88892af5bcdcbffbcedfbe111b49010033e8077", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679861830, "uuid": "d0b2b8f1-6451-4013-97db-d57cc5592248", "value": "T1CBA5333AEAE18CB2E4A355311E64867BCE33B9511A78A0B0119D231CAF7B6C2DD17375", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679861830, "uuid": "13c124f1-03e0-41b3-9083-42c09ce0a322", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679861830, "uuid": "d9593e0d-9604-4601-af15-b95588b27bf5", "value": "49152:EGlJfsAwigUZUnu+WQDGLAG+fhPYNgqAnt5v9nKWEc5dlLYp:5nw3UaFGHchQRAnNKWZPYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679861830, "uuid": "5f4b5b05-697c-4e4c-b7cd-40d62109e21a", "value": 2166346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679861830, "uuid": "dc23c1dc-ab7f-48e6-ab1b-e9f5da7a736c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679861830, "uuid": "96cbac53-e3bf-4e2d-a66a-f43285bd0607", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d630b2a1-cbb4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679821306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821306, "uuid": "9c2de357-892c-458e-a38c-0e87c23680f0", "comment": "Malware payload (Mirai)", "value": "99c10e90b6a44959df3bdba73a364760", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821306, "uuid": "11788c57-0c13-4d7d-86b0-9ec51c7d08fc", "comment": "Malware payload (Mirai)", "value": "9582a896fe77d962c1521ec75658ac2319c6a4d4bafb490421ac75d96e63efbf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821306, "uuid": "68d224f5-897c-4bd9-9c12-7def1664ba07", "comment": "Malware payload (Mirai)", "value": "9fa1523b5823309e58839980b6fa74909e94b337", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821306, "uuid": "f3e6219a-758a-41df-8384-7f25b5b67319", "comment": "Malware payload (Mirai)", "value": "e2561902f93348cc6bd62e9a25f789a091714076a202d1efb15048a4bd1c143edd176d48112e5455a34558af5b6e4b62", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821306, "uuid": "3e09e5ff-1ca0-4c3a-8bc4-9ee882eddc13", "value": "T1E4A3820E6E619F7DFFAC823987B75B209208339622F1D585D19CEE025E7034A741FB69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821306, "uuid": "d4630758-61ad-4282-991b-a20c7df21e7e", "value": "1536:FIPW9MIA6KTsn8K30hfOrXI8bhOYzsFMXy8DDoeQoM3WqRj:KO9jA6KhK3eOrY8bhbo2y8DDoeQoM3z5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679821306, "uuid": "97c9d472-f9a7-4e41-acb5-c71b7f8e1045", "value": 100480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679821306, "uuid": "d6c1845f-d8b0-4f65-91f3-6f3e66b16210", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821306, "uuid": "e2237255-c271-44ef-b7f0-fb081b29c4ce", "value": "99c10e90b6a44959df3bdba73a364760", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6db3cf1-cc2c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679872820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679872820, "uuid": "4e709dbb-03d5-46c0-bcc6-0f116c053187", "comment": "Malware payload", "value": "79af7dac366d8b2a33964b2f18ba6aaf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679872820, "uuid": "0f51aea6-5df5-40b3-be3d-57c0c91bc833", "comment": "Malware payload", "value": "9863f63c6344f8ceb8ba3de22d50b64a9cc2cab50dff9239f8385580e1a21fd2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679872820, "uuid": "3765e414-bb28-4497-bb1e-3c6054bbf827", "comment": "Malware payload", "value": "4d11654c5ce2a04f51b65b85dcb5836922b5be8e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679872820, "uuid": "f12887be-c885-4f5f-b6c0-2b75f619fd61", "comment": "Malware payload", "value": "00a29234908e55bf4c1425c68d3785eb3ea17b0c1758e808fc5a08834563ef13ce2018042876e691e3a33f1b1b9ba884", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679872820, "uuid": "b57ea566-911b-4e2f-813e-e4625e016cb1", "value": "T101B3183B77170E73C0E664B212E70331BAB6C6493969438BB9DC2D9C6F16AC435263E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679872820, "uuid": "69fa4bad-d38a-4f54-bf90-2ad6d205240d", "value": "1536:vC49IC7tOQo5Bafft0FhqCf0kHOyAAXQ9JCU43tXc5n4A:f5AQAcfaPqs0fyAAXQ9JCU43Zc5n4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679872820, "uuid": "4852fcb8-4a24-415a-8b3d-32c7068b6f05", "value": 109564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679872820, "uuid": "ba72eeac-9774-4c7b-83fb-828b9c63e11d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679872820, "uuid": "5e2cc100-5984-40f5-a434-50aa2c0fe216", "value": "79af7dac366d8b2a33964b2f18ba6aaf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8340aed6-cb89-11ed-88f6-42010a9c006e", "comment": "Malware payload (BlackMatter)", "timestamp": 1679802699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679802699, "uuid": "156b6ecc-d47a-4595-96d6-f1770e580b2e", "comment": "Malware payload (BlackMatter)", "value": "922dea2c04ec79d24a7ecc3edb6b36c7", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679802699, "uuid": "502f53d2-70cf-4cfb-836e-b735a00eff7c", "comment": "Malware payload (BlackMatter)", "value": "99d3003cc577c3635bcbb883634037469b35c3b1a31109dc145600bb1e683d4b", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679802699, "uuid": "c84b4f53-006f-4b10-99eb-8c8b1cdf6ff8", "comment": "Malware payload (BlackMatter)", "value": "7b829bb5a8f4e4e503c16864330c17cb7996ee2b", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679802699, "uuid": "79387d0d-1e8e-4a22-87a2-39d6afba3908", "comment": "Malware payload (BlackMatter)", "value": "7ba2d62600f1d52c5fb1a95592436cd5e90dc633e94c5e34c24d67a85313169f93071aee963a23b2a1f92f9f4c0e0c06", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679802699, "uuid": "e071284d-8a63-44b9-9ab5-47af89787cb3", "value": "T163E36B21F15ED0B3C87718F12736B17DB3AA4D2C0AA67803EAD90F49ACA59232F4555F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679802699, "uuid": "768e245f-85ac-43f7-90bb-2d0e2b75f027", "value": "914685b69f2ac2ff61b6b0f1883a054d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679802699, "uuid": "129ecd16-85cd-4c2b-aec9-8805b0f57ea2", "value": "1536:HzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDEpOFNPslzvMYFzdT1cg6bjtx0V:4qJogYkcSNm9V7DWOXezUMzdTixD3kT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679802699, "uuid": "f4065a6c-9bef-415d-b6ba-e5953b4d160f", "value": 148992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679802699, "uuid": "806d3c08-8fe2-4a6a-8c8d-2ba5717d1115", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679802699, "uuid": "492dbfc7-00fe-4045-8197-ee4e59809579", "value": "LB3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e713279-cb71-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1679792195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792195, "uuid": "f1a2dca9-41c9-46bf-889d-2b53f5c138f1", "comment": "Malware payload (CoinMiner)", "value": "a8451e3c0020c7fcbedab7c6bf270094", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792195, "uuid": "7593d2cb-6927-4ed7-9021-c41c71350e5e", "comment": "Malware payload (CoinMiner)", "value": "9e3f6bba3a31660f8574d3218999d340b7531d8eed3b0390f52c11d368f24b2f", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792195, "uuid": "353cb318-cb19-47ea-b067-4dbd6679ea00", "comment": "Malware payload (CoinMiner)", "value": "a79f34a5c01636b4f6b60cb711335b3456c864f2", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792195, "uuid": "08dbdc35-e5fc-4f86-8d23-3a1ed636d364", "comment": "Malware payload (CoinMiner)", "value": "51e7b92421a7067314addebaed8a8df8b7f256b3ea4aaff49006ae4f08bcffb68f77128c58f75fead7c77aaa838f0462", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792195, "uuid": "4e11fc1f-27c7-4b71-9f59-00a65e468f08", "value": "T15534BF1334D08932F825D8FA58A6DA75C47EB82027F996C71BCC154E43261F2EB35B6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792195, "uuid": "871336f8-834b-461b-b42d-e9692144a2c9", "value": "1da7baa8e055f9019d8110348ac589b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792195, "uuid": "7652876b-3430-46cf-b5e1-0267dc6d608c", "value": "3072:h2dxRh+vFcQw3yqRSa2zpNfazD7ZaDiDNO9R60u2aDnKsozwsYFIYLSFjtfPbax:h2Tr+v+QokRaZMxooYFrLSFjt3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679792195, "uuid": "cb1b1f5f-8290-4414-a7e4-9de055df2804", "value": 240240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679792195, "uuid": "1b118bbd-0d2a-4d7f-b2ed-00d687a4e581", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792195, "uuid": "540b22f6-f103-467d-9c66-5e9fc9ed2b81", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71efbcfe-cbdb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679837888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679837888, "uuid": "5f1ba7ff-38c4-4eac-b3b9-fe01f98ea023", "comment": "Malware payload (Smoke Loader)", "value": "6908e5f4f40f67ecf2c8f0bb29bae77f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679837888, "uuid": "60b715b6-3334-4f9d-b86d-94eb84421f27", "comment": "Malware payload (Smoke Loader)", "value": "9e50c6be3c3bfba4776826dc13d61f3073cfa18c66f2a37f5decda472a224175", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679837888, "uuid": "28e9c13a-6ecc-494c-b3c0-969d86996e0d", "comment": "Malware payload (Smoke Loader)", "value": "9a971279d9c5f866505a4dcaa53ae4d057514f49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679837888, "uuid": "5e0c9424-7000-4676-95bc-5569d8c79d72", "comment": "Malware payload (Smoke Loader)", "value": "23de9a0340dbadd4c803ede2a7f755f296281a82531d2dff5c3db7829fbb559f1566e40024ed6772462fca71fec869c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679837888, "uuid": "51303c81-ef20-4a7a-a8bc-a3cb4b2d935d", "value": "T129546D3253E07860E563D7338E2FC6FC2A2FB9619E15AB7E12455A7F09702A1C672335", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679837888, "uuid": "04383e31-2da4-4484-8597-c8b511fc831b", "value": "c5c75c5b6a7ab4fe20f346e6d5121c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679837888, "uuid": "48a637f2-0560-4e2d-a6ea-8d8e9decdf3b", "value": "3072:43oXRWdU0zuaKItqHDui72bZsSQR1ohgTTi2GKAoFadoBuT/hdkpNN4TJY:f4rK0qHBSA1PT7vw/hdCNN4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679837888, "uuid": "61790f7c-8cd6-4f7e-a6da-f4084fc0e28f", "value": 281600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679837888, "uuid": "f3c85bd9-264f-405a-bb74-d7441f94bf08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679837888, "uuid": "4bf051ad-30d3-40c5-bc8c-f2acda172572", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9da8689c-cbde-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stealc)", "timestamp": 1679839250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679839250, "uuid": "fc1263ba-c7a6-4e58-a2c3-ec1db4af0b9a", "comment": "Malware payload (Stealc)", "value": "59ab8997244079855e9af6aa577cb8c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679839250, "uuid": "96671225-a59f-434b-9745-805a0389d2b6", "comment": "Malware payload (Stealc)", "value": "9f253f6abcd703cb920e2825df26b468164d15ca2d50f154a5b12fbf84c05ca5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679839250, "uuid": "f82d6417-29a9-4bd5-9be2-a9e90250cc68", "comment": "Malware payload (Stealc)", "value": "0aecd525dddccda85aec5ea07a5648cfa8fad1e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679839250, "uuid": "9e0de26c-26ad-4a92-aec7-cb60dea96d17", "comment": "Malware payload (Stealc)", "value": "6e57de3eba85e6e38b8153042933f4140c9bd69d6abca12b1fc34f2767c058ee17669e66c639a37c75ad644eb0f32db7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679839250, "uuid": "78029e6c-47d2-4450-bb22-36b3ef40b30b", "value": "T16A546B3253F07860E557DA328E2BC6FC2A2FB9319E556B7E13599A7F09702A1C132335", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679839250, "uuid": "d83b1c7d-5f8b-4cbe-92f7-2474d400377d", "value": "c5c75c5b6a7ab4fe20f346e6d5121c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679839250, "uuid": "9d0ca998-277e-43f2-8578-12d6cfa3814e", "value": "3072:j3uRWX6TzugTWRYcSu6u+bZh7YzgNIs8ukBosYg3/rGpNN4TJY:iX1TSYcby38uoL/r8NN4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679839250, "uuid": "6239a846-11ba-46bf-8790-4b31a77fd7f9", "value": 281088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679839250, "uuid": "eacf7595-ecf1-46b2-b882-67123a8be678", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679839250, "uuid": "66782f24-f88a-446e-8cf2-5ee47f91884f", "value": "59ab8997244079855e9af6aa577cb8c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d64a994-cc01-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679854202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854202, "uuid": "248c6170-1d94-4a27-aaa0-524ba3def360", "comment": "Malware payload (AgentTesla)", "value": "76a44f18a5404bc4b1c61fd1d9b7fad5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854202, "uuid": "db6c806e-5dcd-4e4b-852d-a7c07c67eaf1", "comment": "Malware payload (AgentTesla)", "value": "a03d6f7c3db409c3a07cedb14f9fa7e96b4368a39ee4c291c5eee6912e26b9e4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854202, "uuid": "4e1d98aa-6722-40c8-8de7-f41fae126d23", "comment": "Malware payload (AgentTesla)", "value": "61b9d4b92c91512e51fcb737fd450d0083e04de5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854202, "uuid": "9301cc07-35b6-4bfe-a293-19e311bae8ef", "comment": "Malware payload (AgentTesla)", "value": "d3d861590f14529895c77ade56b9454ff83bab7be41791cb644919e49a978d444410a426de35c204d8e32ea44b4232d2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854202, "uuid": "e325dfd1-6ad0-4cd9-a111-9d932c6dd478", "value": "T15E257B8273B391B2E89F4264083955CD5E39B1473416E12B5F37BBB062212BFBE6F146", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854202, "uuid": "315ee40f-fcc3-414e-aefe-cc39ed47549b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854202, "uuid": "7d40cac1-9305-4536-879e-b689be23bd1a", "value": "24576:VGR4ypyeFonQUi2tCVSWDtHq3Bhy+ryz2IZWh:VG68Ow0uHyBc+uaIZ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679854202, "uuid": "d7505330-6b53-4d51-b927-c768238db86a", "value": 995840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679854202, "uuid": "f1631a8f-4f94-40ae-813f-3ec64c9c2ff3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854202, "uuid": "c64b44fb-0d6c-49df-a5f1-5887fe72b070", "value": "76a44f18a5404bc4b1c61fd1d9b7fad5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2697e03-cb72-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679792926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792926, "uuid": "957834bc-c4ec-4f65-b596-a220e1d0f9e0", "comment": "Malware payload (Smoke Loader)", "value": "5d94d7efb94c90808f3d17e4665c7734", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792926, "uuid": "c0c33d5f-5de5-4de7-8ed0-fedb8b81896b", "comment": "Malware payload (Smoke Loader)", "value": "a1409f24e40fb5a5f190d68d237cfa5bb343e3796902dd09a5cce202a681f2c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792926, "uuid": "568d61d4-7b31-4bdb-abf5-8135441c2b30", "comment": "Malware payload (Smoke Loader)", "value": "b33c42a804ed9208ee457ea466119b8fa8b0e24d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792926, "uuid": "2776a6aa-290e-4707-8216-59847c2d273b", "comment": "Malware payload (Smoke Loader)", "value": "a082a93892281a28747c375361fcf1ae3b194111e9b2f4a202e0f313e8088667bed77fc463d39e0157cbcfbe692f8f35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792926, "uuid": "3f9b3e48-da33-41c9-bf6a-35c1cad035bf", "value": "T14B547C0253A26830E72387328E2AC7F42E1EF8615E157BFE16599B3F2971F72D162315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792926, "uuid": "8911b5a9-f611-4aec-83b0-f1609c0ba57a", "value": "4ab2a4d536313c74a2690207bf67c9d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792926, "uuid": "2eaf0ebf-3135-4262-a95b-6d3a168f5851", "value": "3072:Cm8s08r4RtqubALv2po58+SMprhseGzPFQt8zd6U5OrpNCJQN0fm2Rh:SttqKe58+uxQyB6cOuTfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679792926, "uuid": "cb41b850-9555-4e68-a958-ebc6ace98f8b", "value": 280064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679792926, "uuid": "070b6d87-9772-4495-a549-38737a8425fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792926, "uuid": "5a474728-0bb4-4ca6-a7f7-979da73936b6", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95c57eed-cbb9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679823346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679823346, "uuid": "ce38c23e-a6f8-4946-9cb3-6d3e3881ac0a", "comment": "Malware payload", "value": "da08d9df9fbe75d5f086f66d987f9fdb", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679823346, "uuid": "35bf8e37-d981-47de-a85c-71470b7e7d4d", "comment": "Malware payload", "value": "a1497588f4074b0547f0898f1ec86cf60d95febccc10695d1b0cf865a9f4ebdb", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679823346, "uuid": "e7566c8b-9804-49cf-8af6-b42175252ee7", "comment": "Malware payload", "value": "7980d21200dd8b61913aa11170e8d70f415d117e", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679823346, "uuid": "dfb4c76f-5b62-49e7-9d7b-adafdaa1fe91", "comment": "Malware payload", "value": "30c66db6e4fea56714c258d6b337b02bdf30d465b46fc5eceec83a84fe5089cdd3d6faa58255b4117afd9097e051ea9e", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679823346, "uuid": "c9224f59-00d2-4067-a785-e26ca246283a", "value": "T121F195DBCB046DC6352E1B885245227C72EE14E608E46FB08825B34A226DFDB17D8DFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679823346, "uuid": "0d0c3ab7-9938-4e9d-a9b5-d3e29621a291", "value": "96:2JW1wrYksYHZCOhkhLhpafRtbXqaTp0Z83FT4rHsyIUiTX/hE/q/6BlwUBTg44o1:KL4OGpJaNtFTkx2X/hrylwYTg4Nrrrrx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679823346, "uuid": "59628fdd-a221-4bda-a019-87e498304dc3", "value": 7978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679823346, "uuid": "849d24ef-cd40-4f7a-b7ab-0d69c2a97e02", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679823346, "uuid": "36fc504b-3f59-4f30-9e98-d17e912a7967", "value": "CFRUONOPIFLCPIZVJIKZQK.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e17249c-cbb9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679823172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679823172, "uuid": "64c4540a-b954-4f94-aab3-39923f765a6a", "comment": "Malware payload", "value": "1a04d2f969610356e128d86e5b9d18d5", "object_relation": "md5", "Tag": [ { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "xsl", "colour": "#4796EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679823172, "uuid": "1aac3080-b632-42c2-a466-5b16d0c4a6c2", "comment": "Malware payload", "value": "a1bf2b31b5c7cbfe569b29cf42652352de612613ced5a85d9d475f433ecb70c1", "object_relation": "sha256", "Tag": [ { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "xsl", "colour": "#4796EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679823172, "uuid": "9c8a789b-ec96-435b-955a-86b362956c9a", "comment": "Malware payload", "value": "872b165995f13f4f5dc937533b9b0d3cb785c23f", "object_relation": "sha1", "Tag": [ { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "xsl", "colour": "#4796EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679823172, "uuid": "fc16e78b-6e2c-4c99-9c9e-64adcd708c66", "comment": "Malware payload", "value": "e96c79f57fb220a35b13c65f9265c62d9160920a87b3601b910a21335e0d2f0b75dee1fe1835043c77ca581450c45287", "object_relation": "sha3-384", "Tag": [ { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "xsl", "colour": "#4796EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679823172, "uuid": "980d6853-7b91-40dd-93f2-58c36ecfa4e3", "value": "T15F41754C945BD4F2762EE55322F1C26618B49EA939DC719C23D8888253DABC45E983CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679823172, "uuid": "24a17aa3-a8e2-419b-80f3-51ac747df184", "value": "48:qaq7hwS7vDkFNV/dhEwu+/iu9XtRghDcQFht3kmV07:qfhwS7AVE+vtWft1VE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679823172, "uuid": "e14c1d14-d3d0-46d5-abc5-e4d3be90ff19", "value": 1881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679823172, "uuid": "c5869ca2-c758-4b23-be47-9cb8384152c4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679823172, "uuid": "974a787d-4d9c-4b08-ba63-5cf934d50242", "value": "43546567890.XSL", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a605f21f-cc17-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679863746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679863746, "uuid": "12562fb7-64d3-4327-9800-77741a9c3b23", "comment": "Malware payload (RedLineStealer)", "value": "704c2154afe1ea4a2247733a980e1695", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679863746, "uuid": "f5a26275-1360-417b-aea0-8f438e28e38d", "comment": "Malware payload (RedLineStealer)", "value": "a2703a938720483ba3ab69d8c271bb409266e2683fbd0124ac5b22704b49726f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679863746, "uuid": "04a752ab-9d62-4879-a151-2be7bf098eb6", "comment": "Malware payload (RedLineStealer)", "value": "4d31285a7f7a17109a74c6a590cd438e1e5080e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679863746, "uuid": "e91b2e21-797b-415e-8039-39ef83b1d4fa", "comment": "Malware payload (RedLineStealer)", "value": "bca7ca2a71aa15314e35345cff140bd2746ad5366d2503af6e82d7f156ec4a8b0a1a054a67536a9dbd708c9643648dff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679863746, "uuid": "d8a9aaf1-b38e-46ef-b794-3fbed67bf984", "value": "T13084AE2AA3F47820E5334732BE2EC3F42A1FB8615D577B5E2659AA3F0970761DD62304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679863746, "uuid": "41dd8d1c-2cf8-4e70-83b0-e954b1415530", "value": "e995a4cf6af4dc2215ec1060df8374d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679863746, "uuid": "39efbfe9-9eda-4e36-a44f-43c4f860c9fa", "value": "6144:3bvbEgZ5oaZp5BO/jrhrCxq7yz8fQZgIWSsCz7eL:3TblZ59ZzBO/xrCRHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679863746, "uuid": "9d3404c3-238c-49c8-8a6a-71c47448cadc", "value": 384000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679863746, "uuid": "9e6022a4-cea5-4b00-b2f4-c4861db8f0ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679863746, "uuid": "54faf717-dae5-48b3-bf31-8ec704c6041b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc4efc62-cc2c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679872829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679872829, "uuid": "132f003d-eed6-4caa-95df-8604213ad837", "comment": "Malware payload", "value": "cac9fef943e28f9716295b3ea5b346a3", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679872829, "uuid": "ddf285cd-4878-4797-8275-5fe2c2aa0c7e", "comment": "Malware payload", "value": "a2c652f77969aab337c95776c4face7ca59c296fbf58d5b6e338fcf83ba4661a", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679872829, "uuid": "a3791ccf-f7a5-48d7-ba78-aa297ff81608", "comment": "Malware payload", "value": "9a16995e848a26397344a4e98044a131f0cec854", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679872829, "uuid": "19abf107-4293-481e-af81-a5d044e08ef7", "comment": "Malware payload", "value": "ff568780341211c7553a90e4052239785691b1e42d4017b852dd64701121372a8f4edff8c8d01d751ffea6bf78dd5961", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679872829, "uuid": "10b39fb5-082d-4b0a-8931-b843e9712198", "value": "T14DA35B13E553C2BFC4E3A6FA2BDBC5219923F4391B36620933DCBDB56B15AD85E18201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679872829, "uuid": "d2702589-f63a-400b-b9e6-a4ad36dea44e", "value": "3072:GVcEpKom3o4QRUUje4jPwARS9bdp/pakodyk3GmX0VA:bQRrj8ARuRikodyk3GmX0VA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679872829, "uuid": "b6e4fd46-2018-45d1-8ab3-89c3d303f6fc", "value": 101621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679872829, "uuid": "ac2b7237-7287-4436-9dab-b5cc56bf1fcd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679872829, "uuid": "788c4447-258f-4c2c-a3d4-9c2d9b6b68b0", "value": "cac9fef943e28f9716295b3ea5b346a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bb38098-cbd9-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1679836911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679836911, "uuid": "1e97e669-cb43-4db7-a483-4ce55f32a5fe", "comment": "Malware payload (CoinMiner)", "value": "757b7426807eec873b9c41c08f7a2201", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679836911, "uuid": "8195d2ab-6de8-4b8e-bb48-13926a9e43d9", "comment": "Malware payload (CoinMiner)", "value": "a6ed0e2a796da7a17d0a0174c54ef85f21ae62f27a25deeac10bb692687a8acb", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679836911, "uuid": "2a457ba9-52fb-4e2f-bac5-fe02a89b72d6", "comment": "Malware payload (CoinMiner)", "value": "3e385e4db010a5c56ed6fc575cc3222a0ad53da1", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679836911, "uuid": "9167f246-18a7-413b-850c-bd8b2a73db44", "comment": "Malware payload (CoinMiner)", "value": "fe0f9e65caf8884e83bdf1aab9b18c675fd854cdf4e52eeacc8ba7bad87f3d8997dc17710c55354aaa16622511d1b988", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679836911, "uuid": "46246426-3284-4df0-b6b2-f52f678784f4", "value": "T104546B3263F07860E163D7328E2FC6FC2A2FB9619E156B7E12595A7F18702A1C172735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679836911, "uuid": "efaa8206-8d83-48b8-8f87-73f109c29ffd", "value": "c5c75c5b6a7ab4fe20f346e6d5121c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679836911, "uuid": "3d7b90eb-dd63-4636-8f51-4debb265e5f4", "value": "3072:j36sCASW3u9ZNtqHDui77bZoIsd8mNmVl7TACSk2sRydWiv2/ZpNN4TJY:QW8ZPqHUd8mNmVl7kCmO7i+/LNN4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679836911, "uuid": "61d2e461-9b27-410d-9636-eed52c8dbc76", "value": 281088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679836911, "uuid": "d535c37b-fd29-4b9f-aaec-5ded081c8cbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679836911, "uuid": "c0e929c0-4908-4096-b1b6-b082b4fd4587", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "682f03e1-cc01-11ed-88f6-42010a9c006e", "comment": "Malware payload (AZORult)", "timestamp": 1679854193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854193, "uuid": "8e6262c7-ebec-402d-8806-7f7c7ebdbf67", "comment": "Malware payload (AZORult)", "value": "653b919e0bc78bcda063ac6bf3d6bdab", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854193, "uuid": "1fec0ae6-d69d-4fae-855d-5ba0e7d66797", "comment": "Malware payload (AZORult)", "value": "a6f625e40e8b7523312b9a40ce6f3080b3475b9ff349e17785bdf7b6e0cd78c1", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854193, "uuid": "4adc07e2-b392-4e5c-9422-dfa380e404cd", "comment": "Malware payload (AZORult)", "value": "21d921ef9ef1dcc81626133de4ffbfdcc1728274", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854193, "uuid": "1f120ccb-9d63-40ba-aa9e-4e78c533819e", "comment": "Malware payload (AZORult)", "value": "51706d39a7462f2a4b728b400360175e3a194ed29585c5fccbbeb7f584b0c57fc96394411f8e9ec6cb6793cf6ed8cb48", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854193, "uuid": "e2648645-7c39-4b14-9db4-1c3450fb7423", "value": "T1D2158B8673B291B2E89F4254153855CD4E39B54B3416E02F5F37BBB062222FBBE2F146", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854193, "uuid": "f2b6fd71-6530-4d08-95d0-d83a93bc33ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854193, "uuid": "abb22b25-88b0-477c-ad60-4f00db8e1e55", "value": "12288:Avva+1BlqSpyOkqDpg470QilBdpRfhAt6VcSQf9uQ3U2wGS4sm7Ke2rv:ynX4SpyeFg470QOr/CoylTXhS4DKe2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679854193, "uuid": "ea973d2a-d939-4fa4-a8ae-ce2b1930bfb5", "value": 939520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679854193, "uuid": "9b4979c2-2348-4657-8469-d2487182ec56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854193, "uuid": "ecb47529-412c-43ac-ba05-a46977841c4f", "value": "653b919e0bc78bcda063ac6bf3d6bdab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8da6dceb-cbaf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679819037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679819037, "uuid": "2b45e950-252e-4d39-80b7-f56dcec44ad2", "comment": "Malware payload (Mirai)", "value": "7c7be4c13eedd4687790c1ba127a6937", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679819037, "uuid": "1f8c45e5-c713-4c06-adb2-595167183348", "comment": "Malware payload (Mirai)", "value": "a7602ada97d833efbf2584af322ddd416e6dabcb1dbbfa38d86a6c96b6091898", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679819037, "uuid": "677cbc36-1785-4883-bf37-1a387ccb1a90", "comment": "Malware payload (Mirai)", "value": "8d1bed50c0f10f9380e955565e15e0d3cfc04132", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679819037, "uuid": "31468af2-75df-4e58-901f-7b362f8971ab", "comment": "Malware payload (Mirai)", "value": "f4854c2dbff299bb604891c9c53ce0da968a49bdc5154bb6aa1070b07d100c7d1436f06f086c18856ae1923b9d04843a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679819037, "uuid": "226b9c03-f414-4d8b-8588-c8db98034529", "value": "T140435BC4F643D8F4EC970531607BEB375BB6F0F52258D653D3A49A32AC92611E90AE8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679819037, "uuid": "3fa4f685-efca-4b01-825d-c69eec5e2961", "value": "1536:S4Ew3tx+F9inCrb3bPUt0gIPSjKA18dIMGZirAMw:HEw3tx+FMnoLct0guSJmtGZTX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679819037, "uuid": "01edc99a-ece3-4b45-b72b-143d732cfb30", "value": 55760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679819037, "uuid": "f70a0fc0-0fbe-44b4-b31b-8f08b54eacfb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679819037, "uuid": "5eab9678-1830-468d-907f-43600f69c8e0", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99bb8b13-cbb4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679821205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821205, "uuid": "a0555045-bbe9-4309-9dcd-c346852a8288", "comment": "Malware payload (Mirai)", "value": "ef0262f8660fe118dcfbe065d6007f51", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821205, "uuid": "038593f6-6a05-484b-87ac-b7118878a60c", "comment": "Malware payload (Mirai)", "value": "a85b7d6b7ccb6e66e83af237ba1f4d085030e7d37337b2e5a303e053af7c3bc6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821205, "uuid": "93e1e518-917a-41f9-9788-9fd26cf64f93", "comment": "Malware payload (Mirai)", "value": "7096fc77d6914a1375bd9e05944acda36df6b475", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821205, "uuid": "50579cbf-4282-4319-9363-f47b2b89c750", "comment": "Malware payload (Mirai)", "value": "d74dedb3b4de8da532de5a61fd104a5f0eccaa4de466dd8c191281e254133c2928c0a7e61456dac5f441bf7c0572b1cc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821205, "uuid": "2b6c2538-c234-4477-b75e-d9697186dc79", "value": "T1F7735C4AE6C7F9F0DD8505B8106BFB35D936A8322130DFF7EBC8B957AD91202905626C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821205, "uuid": "0e1b627a-8c4c-41f6-a5da-20ce73368631", "value": "1536:uimFftlNJTLADfBB+hMxXcB3ziFk/nnpe6YbXdgY5YoSbKwt2:uiIt947BPcBGJ5Y7b3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679821205, "uuid": "b5488006-f729-43ee-8044-4903583ac682", "value": 78424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679821205, "uuid": "673d836a-36bc-494b-8ea6-51c75491e2e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821205, "uuid": "265a29e2-b474-4ceb-baf1-ad073aace04e", "value": "ef0262f8660fe118dcfbe065d6007f51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19dd71f2-cc07-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679856638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679856638, "uuid": "591f1bd0-b9d9-48cf-aa74-8d55dd92111e", "comment": "Malware payload (Amadey)", "value": "888853269223dfc801a3ad3e3235fbc1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679856638, "uuid": "f3874525-e592-44ef-b4fe-6dddfdf600e1", "comment": "Malware payload (Amadey)", "value": "aa69245f1de4736bb7e95461f9dbc24212790166113bea5a3ae719d5268f3fdb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679856638, "uuid": "36717ecf-5b17-4616-a77f-2ec8a9df727f", "comment": "Malware payload (Amadey)", "value": "aefe02c01dc2503a61bf38c2bf924f3be138053d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679856638, "uuid": "2fb78d6c-f78b-4e58-861c-29412076baae", "comment": "Malware payload (Amadey)", "value": "810a5873044c689f1a2020cb3668a7e410d94df2449f42a9add0237441e62e31734eb39f50bcb6209eda222ffc84a6af", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679856638, "uuid": "be389db3-64aa-476f-93dc-c0b4ba6909c3", "value": "T11C352257A2EC8132D8356B309CFA07D30B317D911C34EBAB5359985F1CB2299A5B337A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679856638, "uuid": "4126ea40-a314-4dc3-9011-4333753157c0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679856638, "uuid": "73cc1c08-ffca-4cbe-9815-57f9999a9dcd", "value": "24576:XyQR5waSbnqA0WXs1eaHZZbJ1GQ4h0TaoI:iQRjSbn/0cs1tX3GJAa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679856638, "uuid": "ab97f723-245c-442f-99ad-4e9054d1defd", "value": 1062400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679856638, "uuid": "633bf619-d14f-448e-b2c5-8327ca822330", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679856638, "uuid": "6c7d7d12-fd44-4c13-a62b-836ecc4d472e", "value": "888853269223dfc801a3ad3e3235fbc1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d24ca994-cbb4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679821300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821300, "uuid": "76e646c1-9f8e-4fff-8f6a-08ed60077148", "comment": "Malware payload (Mirai)", "value": "bd2f89ef4b49f537ce2673e567b98682", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821300, "uuid": "9d7d6e97-6ec2-4f31-a80e-3e4ca93be629", "comment": "Malware payload (Mirai)", "value": "aaaaab7890d9f291361f1a9635d477a35265328398a82943fcb1c741cfa86e9a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821300, "uuid": "120122fa-3e6b-4884-8521-a74bd3fc566c", "comment": "Malware payload (Mirai)", "value": "cba6ecab20c10d46be017673773c3af90c41d811", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821300, "uuid": "3b969283-60b6-4ce8-a2bf-bc319115bca7", "comment": "Malware payload (Mirai)", "value": "b2ee6f0aa052af6ff2198306fe9b195b80a09e4161c14496937ee7a02ce0c68b5c737e2cd072b0b1e783acc9a9c987c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821300, "uuid": "b0fa0a46-a0f2-49db-b908-58041471f283", "value": "T1BD73E785F4CB41F9C407493451ABF33FCF32E97A8070A6ADEF999F22DA37641511225A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821300, "uuid": "beca287b-fb0e-45c1-97b5-46d337916a76", "value": "1536:2NCP5tA9LI+6Loe9dvsZivwJPWopYXcEwDbCOk:2UM9U+6Lf9CZzPjkcVbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679821300, "uuid": "479d7c56-d245-46b8-9b07-388783572c4b", "value": 79632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679821300, "uuid": "5124bff4-1c09-4344-ae09-3d4a621dcf7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821300, "uuid": "8348bff2-1f8e-422e-92cb-588c07c6efee", "value": "bd2f89ef4b49f537ce2673e567b98682", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5423b0d-cc20-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1679867744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679867744, "uuid": "b697fd2b-ea90-4858-b35c-2a993917232f", "comment": "Malware payload (AveMariaRAT)", "value": "9e4b8dd5015ff503c145d5d110c0899c", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679867744, "uuid": "93079972-1d94-4c30-8c5a-d7aa3646d792", "comment": "Malware payload (AveMariaRAT)", "value": "abb0a038d3f1c7c5ea61cdd46e797e1862e5f70d1382d58d59e5404b705bca08", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679867744, "uuid": "5357b2bd-126a-4a23-a368-00318f12ed75", "comment": "Malware payload (AveMariaRAT)", "value": "fc17f01106a589943ea2937de4dbd68f5de50cb1", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679867744, "uuid": "060bc475-5bbc-4a59-9755-fc55e34c9e25", "comment": "Malware payload (AveMariaRAT)", "value": "8b298124e068409c0f9d63d9def5529d09b2f3c46617f983964d1864ee36128730589a379ec3d248e072cc3db504e623", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679867744, "uuid": "e693127a-a0ac-4317-bf56-329147502601", "value": "T162F45B1D7CA899E3C324D677DBD6D235B3639F567723C96635C213220E0E346A8CA11E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679867744, "uuid": "04a5f3c7-ee27-4a31-a689-e8697d489ebd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679867744, "uuid": "8e1c06eb-93a3-4965-8de8-c1e652bb50af", "value": "12288:dIteEGAFDh24NS8Y7GrRybCC4h2M6lavptrnpoZa+fuFtUN4Hhzsc:BIY7GrRy74h8avbrUa+ItPic", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679867744, "uuid": "0d05a63a-0f5d-4b86-905b-0fb363b05772", "value": 734720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679867744, "uuid": "2135a7d5-72e1-4d4d-90fd-74b3ddce21f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679867744, "uuid": "a2526755-bf07-4843-b981-60b87e1dde75", "value": "9e4b8dd5015ff503c145d5d110c0899c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e13e0c76-cb72-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679792978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792978, "uuid": "c65ee28f-a7fd-47f6-a380-42ed5063b1d4", "comment": "Malware payload (Smoke Loader)", "value": "d6988c86fa8065c84afc638de72dec0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792978, "uuid": "c6c7725f-d4d2-4807-b14c-4281486c513d", "comment": "Malware payload (Smoke Loader)", "value": "ac3612b5c39bb69c05b6a9936451f8ff9a0e2e91e25ec78195b5840adab196f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792978, "uuid": "cd7c3c58-0f11-4457-b0ec-a0d6388f23db", "comment": "Malware payload (Smoke Loader)", "value": "6207da321cc8759a31f4b159d808245ef7806f45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792978, "uuid": "c56d0eb2-cdd0-4dd4-9c15-fea821fc7a2b", "comment": "Malware payload (Smoke Loader)", "value": "817cd2f28c732e86537eda81ed36799753f3722f29aafa14957f4a4d547145bc803ab576842eee2c9fed682f711b6b65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792978, "uuid": "c196d0df-186c-450f-ad6d-168d42ade37f", "value": "T124546D1253E26860E72387328E2AC7F46E1EF8615E157BFE13599A3F1971F72C262305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792978, "uuid": "57115d9d-c9e8-4db7-8888-da3741d248e0", "value": "5bf64f0a1a526a4cdb08b53a545d3838", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792978, "uuid": "8a9321a4-e49a-4ff1-8b8b-a4f1eee26433", "value": "3072:ITnfzYu1UUb9RMStD+GOtSOyikfY7+zmcf0crB8OQpzTifIB/BETCJQN0fm2Rh:eT3D7OkOyi4vzRRBTQpzTp/7Tfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679792978, "uuid": "8cdc0b5c-4cfd-400b-9b38-ba0069bf9590", "value": 279552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679792978, "uuid": "3f17f6b6-ab2b-4684-9191-00dc896ee9d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792978, "uuid": "cea11626-91ec-4402-80a8-fb04927e3d2c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b432501-cb70-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679791814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679791814, "uuid": "b529ebc0-a0d7-4c12-ad4d-182975aa99e5", "comment": "Malware payload (Smoke Loader)", "value": "4752e5902c035939a75494b401807e8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679791814, "uuid": "dc08dd6c-c236-4216-a364-62fb54f3bbb6", "comment": "Malware payload (Smoke Loader)", "value": "ad83eacbc1a999ddabf69c0b7b3efa0ce0c842e2d26250d3b488ac27e11ea1a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679791814, "uuid": "cbb5dc06-1547-4674-9792-47972ebcce1c", "comment": "Malware payload (Smoke Loader)", "value": "27ab0f82fe86013724dd59a0526fbc2d1f633a1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679791814, "uuid": "80119d2a-90ed-4826-bac8-6b63899f5145", "comment": "Malware payload (Smoke Loader)", "value": "9882a51756069b47517e6a66b092b11bb764dba26e8f4d6a5546c12ed53f8bed2501d25d1e08fc91bd970b2e0e534463", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679791814, "uuid": "e4c1933a-5230-427a-8e5d-0997aec2b912", "value": "T118546D0252E17860E72387328E2AC7F82E6EF8615E157BFE13549A3F1971FB2D162315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679791814, "uuid": "16c5ae03-7c4d-496c-9cb8-b0297c9942ce", "value": "5bf64f0a1a526a4cdb08b53a545d3838", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679791814, "uuid": "d3afe1d5-3a79-4d23-b74d-708620e2a95b", "value": "3072:VqLMz8LgvBv9OjOYlUGlHFiodRT7fy/sMXiq75N2bxDcJxSHsRwAMkilTJtYCJQO:H0BlJlliodJCN75NQNcSMRwBjTfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679791814, "uuid": "2b6199a3-bc72-419d-8c2d-355d926b8d7c", "value": 279552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679791814, "uuid": "52a844fd-5f6e-419f-bb1f-690c210947d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679791814, "uuid": "3df1f42e-7d65-4146-b735-0f8f449c4503", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ab5239a-cc11-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679861042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679861042, "uuid": "ce38dabc-94a4-44a5-a32a-1b042825901c", "comment": "Malware payload", "value": "f3b4755f457991e56babb9c61677b672", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679861042, "uuid": "8cd203e9-c920-4a59-96b0-4475f29709ef", "comment": "Malware payload", "value": "adbfa5c05c27009744c967a1e3852c2ed130ece8bb8eac821304819c73593468", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679861042, "uuid": "0ee085b2-9040-4e71-9cd1-36f5c209b9fc", "comment": "Malware payload", "value": "6aa2f51dd4302b3910db6cebbee29127b62a9834", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679861042, "uuid": "9cf6e8b1-f061-4c25-b8ba-b283e0f85169", "comment": "Malware payload", "value": "2dcaf3f7809d5c2e8a6a056039e214dcf1251fd731dda631d76307eaf8706562be064b8428cc62b3edc8607832193640", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679861042, "uuid": "9c9683c5-90c5-4d73-8a7c-007a50ce17a3", "value": "T1BBA349556BF50032F5B30A71A97448AADFBEBC226477E46FC7800E5D15B0942CA3DB27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679861042, "uuid": "725e7d0b-9290-4cdc-a9ff-95948dc39ddc", "value": "f5e4c8acb92fb1c8223cff431020dba0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679861042, "uuid": "8db7a772-a905-4630-ac64-52c4a09d888c", "value": "768:g8kr2D6AKlLO+SNhBgCHDck4MV0ggv8KoETBB9D3xvjHhx4eC7Xj8Qc1Mk:T/6A0q5HDR4oWBx3xrBx41z8QcGk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679861042, "uuid": "2762dc84-3623-4278-b345-f387e02ccfb0", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679861042, "uuid": "f737449b-1e1f-4048-a259-811a7a37a394", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679861042, "uuid": "7722c6e1-90a2-448c-92dd-e28b3596feb7", "value": "2023-03-25_f3b4755f457991e56babb9c61677b672_lockbit", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18f019ce-cb92-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679806386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679806386, "uuid": "ffafcafe-4b26-4f0b-b6d3-248e07204c43", "comment": "Malware payload (RedLineStealer)", "value": "0995c7e65e37b776d64b283ca1f21489", "object_relation": "md5", "Tag": [ { "name": "212-113-116-143", "colour": "#077D6B", "exportable": true, "hide_tag": false }, { "name": "cochang", "colour": "#3EAEE3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679806386, "uuid": "482c1b32-9c5e-4e08-a08f-22cec9187b07", "comment": "Malware payload (RedLineStealer)", "value": "adfc6d2b25d8aba59c5b358a1ec69a0d9e79d7636999f6232454397435f035a3", "object_relation": "sha256", "Tag": [ { "name": "212-113-116-143", "colour": "#077D6B", "exportable": true, "hide_tag": false }, { "name": "cochang", "colour": "#3EAEE3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679806386, "uuid": "54b1a1e5-7742-425f-9cb6-38c6c51d9ade", "comment": "Malware payload (RedLineStealer)", "value": "c5f056d287d852a4c88029f3dd863b27e2a7ec77", "object_relation": "sha1", "Tag": [ { "name": "212-113-116-143", "colour": "#077D6B", "exportable": true, "hide_tag": false }, { "name": "cochang", "colour": "#3EAEE3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679806386, "uuid": "99f4c305-372d-4429-9770-2a22c4e07077", "comment": "Malware payload (RedLineStealer)", "value": "74d3be48285f1c3178a9d19f5d8f280f06842ea8dfc7a77affde18e4cbc710a5efe838c88e8ae92ddc15a3f2f245bdef", "object_relation": "sha3-384", "Tag": [ { "name": "212-113-116-143", "colour": "#077D6B", "exportable": true, "hide_tag": false }, { "name": "cochang", "colour": "#3EAEE3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679806386, "uuid": "14557f5b-8de8-42af-9c7c-21c60ed12728", "value": "T19967333025F8D8E1D9663531CD4BBAF062A8EC20D7254DAF7E947E0A76346D0FA3254E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679806386, "uuid": "84e9da17-e007-458c-876f-cdbeccb4dde3", "value": "b5cdc5501116a5933f87b847ea44476c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679806386, "uuid": "c1e5de39-5f04-4b17-aa71-f1ef213bec7f", "value": "786432:SjMR4qHLpizyVp/1q1rINsjsq3gazg7ag:0BqHBV1q1rImjsQxPg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679806386, "uuid": "785bd1c4-86fa-4090-b6fe-d60a336e50e2", "value": 30736032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679806386, "uuid": "a071094c-b37f-4c73-b796-2a737961f1ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679806386, "uuid": "07201d24-27b3-40ae-a8ae-7233c3205cbe", "value": "Analysis of cochang private key leak event on March 21, 2023.pdf.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15b85a2d-cbcd-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679831721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679831721, "uuid": "4307f7ba-83a3-4113-b3f2-85130bc3f13d", "comment": "Malware payload (RedLineStealer)", "value": "9859092d18d6b09a08385b0b2bd40772", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679831721, "uuid": "85c64c28-2191-42b5-a611-acdeca89c039", "comment": "Malware payload (RedLineStealer)", "value": "ae0872edf4c7cebdec2944ffaf112dfde9c7591027e8be49e9823558f8b71895", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679831721, "uuid": "cedb425b-5cd6-447c-9aa6-bbb853ae7f81", "comment": "Malware payload (RedLineStealer)", "value": "f9b19d5becf471d2e7156b96eece128637e50579", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679831721, "uuid": "4f05a64e-54f5-47fb-b829-923f39891a31", "comment": "Malware payload (RedLineStealer)", "value": "80e5a0b294568cde86b5a424bdd7e06f7e3322484fcbccd47f722035bb24e0d729469b696392f9ec4238f8554d3ecddf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679831721, "uuid": "e0e7f9c6-ebd4-4e44-bcb1-056e7ef42f07", "value": "T18784AE3253E06860F162D6328E2FC7FC2A9FB9619E567B7E12859A7F09701B1C172335", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679831721, "uuid": "0b7cba52-86f7-4280-b5c6-c0b51b15531f", "value": "c5c75c5b6a7ab4fe20f346e6d5121c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679831721, "uuid": "475948aa-0a19-43aa-9862-d857634d352e", "value": "6144:TGbB6a36P7pHeDjgurkrwFFXzuviz1b/1NN4T:TGbBf36jp+D0FrwHp3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679831721, "uuid": "285bd194-ea2c-4468-ae91-03e71cf703d2", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679831721, "uuid": "4b1468b6-a5dc-4391-81f1-1763124a551e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679831721, "uuid": "3cd8d71e-fa7f-49b3-aa48-9f480c2630f1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8bd3d17-cbb4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679821284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821284, "uuid": "7629c7fb-80cf-4827-b84b-e1429c03d999", "comment": "Malware payload (Mirai)", "value": "3dda975c0d026c7a26eff8abd61138ba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821284, "uuid": "2a6ad8fc-c629-443b-b0eb-3be0784f0c25", "comment": "Malware payload (Mirai)", "value": "aec7f5e9d6e95e50c700358f536f5770cc6eed3296f8ee1fc82a5fb066e444fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821284, "uuid": "27960a81-c317-415a-a902-a672440503cd", "comment": "Malware payload (Mirai)", "value": "1280e6490ca4ab60cdfe1214b472cf1b5ed96227", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821284, "uuid": "22ed7b0f-c22f-496b-b000-f7642b5a496d", "comment": "Malware payload (Mirai)", "value": "8364618f2c37bf6fc6171cf1a2be6aee7e32a6a6baa7e65b9e7e258e2708a535af6c6b802d0ed67302c633df87d0b78e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821284, "uuid": "7b367b9f-dcda-44ad-aad1-76033d29cb7e", "value": "T1D6438D77E92E5E24C08511B075A88F746F23A5C483471EB719A9C2799483FADF604FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821284, "uuid": "3c802bf3-b20d-47a7-97d4-160ac53bd5b5", "value": "1536:Uao+tU/DQU80T2MpjK0gbMJrFUoC4y3YWo:U8tUrQUN7G0jr2omY9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679821284, "uuid": "d34da473-cb00-48f8-a086-f545e53cf536", "value": 58740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679821284, "uuid": "edd5affe-e681-4966-98af-ea7bc5853d1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821284, "uuid": "91355b33-fc3a-4af0-8d64-e3b000204cc0", "value": "3dda975c0d026c7a26eff8abd61138ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "184c9ae8-cc02-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679854488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854488, "uuid": "8e5426e2-2557-4cc2-a308-8a1ef42c31fa", "comment": "Malware payload", "value": "9ed9a96025e3d8ed71dbfd0e754cd4f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854488, "uuid": "787f89be-f962-4fe5-8158-3e599e29dff0", "comment": "Malware payload", "value": "b1c5d2be7c3bc867b65b68ce2ca36d5c36e87a797283889c99cdf2a63188c77b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854488, "uuid": "875747bd-d62a-4107-b80a-597b0267672f", "comment": "Malware payload", "value": "97ee6113ba55d92f9e9c8264e1f2ba91b8702513", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854488, "uuid": "21b4ce7f-17c3-41f2-abad-3aa1743f2eaf", "comment": "Malware payload", "value": "3550b8e4ce87e2ed2a77b2e85372aef9ac2e35a598af02405b253756c0e0ccd65fb7a17317146d3b6d739c65897e1323", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854488, "uuid": "3662dae5-87c9-4684-bac0-7856d9add312", "value": "T176D31A14AAA98602E56FD7B5A2D7950DC7F1841BE2CFF74D8C81F1F12852396FA024E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854488, "uuid": "ed5a7a73-32e5-498a-aa8c-2810eafe5d57", "value": "3072:gCFQEgHUc9xKB334QfvRrWgJe5TS41i6KVIwUBN8iRmoD+d:gCMHUc9xKBnLRJe1bKVIwsCied", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679854488, "uuid": "ecfec90b-738d-45a6-8a9a-15efbae451cf", "value": 134309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679854488, "uuid": "0692860b-a9c1-4ec2-a8b6-e840fda7f1e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854488, "uuid": "4e36f8e3-f855-4721-8722-3b052a0af27d", "value": "9ed9a96025e3d8ed71dbfd0e754cd4f3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c13c1d9-cbf4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679848455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679848455, "uuid": "f1d24464-4206-407c-b732-8d9ab8d642d4", "comment": "Malware payload (Formbook)", "value": "8ac789f28e38ab2970dcd9ba623d3afe", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679848455, "uuid": "73e7bea9-8cc1-446f-8c00-d02954b80c01", "comment": "Malware payload (Formbook)", "value": "b30d98065cb13fd8b8eb1b0f4b1dac4b8152ab41f80b6d1fd9441eac36c74eaa", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679848455, "uuid": "429b4f71-3184-4e02-8e3d-426e55689387", "comment": "Malware payload (Formbook)", "value": "38f792e7457b9f3222fce4c032aa6fba27ae3262", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679848455, "uuid": "1bb16979-0607-47a2-a393-0eaf744b5cc0", "comment": "Malware payload (Formbook)", "value": "1d55cb4f48b6aebdabe75d5ddf3b058471283c9267ac133fca7d87881f98670e041aa586fdf09cbe59b3ffdfcd2c7be7", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679848455, "uuid": "56a949c3-7997-437c-80f6-626babfa57c8", "value": "T1FB551203D045DD8BD1F943B4BA137AEA490DBC6376E972C73844775B1B32E9B860A26C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679848455, "uuid": "ec689234-4cef-425b-9e51-c7632da4c1e5", "value": "24576:DLKIWQmmav30xSSSMMednEqP6bvdXXXXXXXXXXXXUXXXXXXXXXXXXXXXX//HSSM4:DLKdQmmQ30sMR6k5M1q6XwsurJx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679848455, "uuid": "242af130-0bfd-43d2-a251-ad54dcd16e66", "value": 1337856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679848455, "uuid": "07c169b5-5414-492f-89f0-c4e7a2340916", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679848455, "uuid": "63a1067e-987b-4448-b7e7-536de56ce2a9", "value": "Shipment-Document.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f2f4e8a-cbe8-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1679843440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679843440, "uuid": "17e774da-4d86-4c21-bd96-9e546db44f9a", "comment": "Malware payload (GCleaner)", "value": "a195d840e3ab5380441a4751fe4bca06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679843440, "uuid": "26c32688-0d2e-479c-bac0-52ca5a9c46f8", "comment": "Malware payload (GCleaner)", "value": "b376df63007b8bd39491a8793fa544d42a734db1a332f9eaa0b3e1b81b2cba2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679843440, "uuid": "bfbd7468-eb8f-4416-8e05-5b9671320dbe", "comment": "Malware payload (GCleaner)", "value": "c474f61da91cec2e8482969027f15ac46b1da6c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679843440, "uuid": "4399a774-f5b7-4e49-b19f-afee8dea795d", "comment": "Malware payload (GCleaner)", "value": "dc84366fce1776f356f610fa6e2507f03a1f3bd5beeb6d95731ca34fc5191916c2b1e69285c605dad0f3c9d780ce33ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679843440, "uuid": "5d1035fe-c4d8-49c8-bac8-aaacc899a063", "value": "T1C395332BCAC10BF4D1A1CDF19F47D6C841722E770F2D4CAAA10DA99C9F361E1C698796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679843440, "uuid": "1abfcd15-1b88-4e4a-812e-13956eec5cad", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679843440, "uuid": "bef226ae-081f-460a-a692-822eee2c8f37", "value": "49152:EGlJfsXQN/ybRm3WHMwJIS+6Xf7mCo0B/NL1I5dlLYp:5hN/mRmGzljTXBKPYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679843440, "uuid": "543f8650-4cf5-49c6-b8c6-2199d3fc8184", "value": 1993727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679843440, "uuid": "22d9c945-0070-419f-b964-c278d0e20c50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679843440, "uuid": "a3ee3664-e42c-4441-8520-e372687d890d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbd8bb13-cb6e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679791197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679791197, "uuid": "cd0c2200-2f74-4b70-aa9d-0bf3531f98b7", "comment": "Malware payload (Smoke Loader)", "value": "55ba7699d0cdf95bb05571d736cbcbb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679791197, "uuid": "f83557d9-f89b-4673-bc2d-28335c315bf1", "comment": "Malware payload (Smoke Loader)", "value": "b4cc50dfd7c1734226f0eaee8869d660e7a7bd1c061b4af0ef91a396d76969a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679791197, "uuid": "e9b3fe9f-0835-4ef5-9e09-921d2d7d53f4", "comment": "Malware payload (Smoke Loader)", "value": "c3041d86addb72ab3bd8ecbec81c4635920f82e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679791197, "uuid": "d0d1a29b-3fd7-4dd8-aef7-1a3c4fae034a", "comment": "Malware payload (Smoke Loader)", "value": "af4ca7a8ca236abb5fed0475f9e9d6d44f828c2d23eda277f305f7338e63bb966ec5ed146ef824d7274d8f453bc0b804", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679791197, "uuid": "51ebc727-0523-494a-b0bc-6b9615cb61a4", "value": "T16C546D0293E16820E72787328F2AC7F42E5EF8615E157BFE12589A3F1971FB2D162315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679791197, "uuid": "cacd8313-476e-4c7e-9f6d-6d202dcd85ff", "value": "5bf64f0a1a526a4cdb08b53a545d3838", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679791197, "uuid": "bf4ef964-9411-4579-baff-656ab0117ac0", "value": "3072:9OBTzY0B+6z9b2SlwiGshfqaA5i7/dfi5COaxueMUH8cGql1wzOOgRNCJQN0fm2X:uHJw3sRqaAEfybPUH+wYeOTfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679791197, "uuid": "d7b58e70-45ba-4281-b945-f6c9e8134cba", "value": 280064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679791197, "uuid": "61d4b1b7-6321-4658-9c22-6f17baba5be1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679791197, "uuid": "e8760e7b-4343-4918-b762-68eda999f752", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51aa3fcd-cb73-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679793167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679793167, "uuid": "b40bd394-5085-4daf-a0c7-061ebab2e9e7", "comment": "Malware payload (Smoke Loader)", "value": "ee60b5fa50c9003786e5b9355a577d0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679793167, "uuid": "f99ad989-f42e-4dbb-a2fc-1017dcbd0ae1", "comment": "Malware payload (Smoke Loader)", "value": "b4e09e065b80b8222c4618b631e00bca759b64fc7e499fc14be9af6aa3b26824", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679793167, "uuid": "7ac74191-adbc-4570-a062-97a1d280978c", "comment": "Malware payload (Smoke Loader)", "value": "0a1cbe402f9ccdb7f26d6d64e38c821ea9d62f53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679793167, "uuid": "ed7f40e2-d587-49e0-aea1-097d40c823b8", "comment": "Malware payload (Smoke Loader)", "value": "3f7d87c4db957b929d7b534f36275373de7fde6e7516e5878197c399b1bfb164e69bef568f8138197bd8a0bc62ea79ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679793167, "uuid": "817ec05f-1b55-480e-abac-7d8f206e82cf", "value": "T184447C0252E26420E72386328E2EC7F42E1EF8615E157BFE12599B3F2971FB3D162715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679793167, "uuid": "04adcc2c-321b-4ae3-8248-f70e90932a69", "value": "4ab2a4d536313c74a2690207bf67c9d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679793167, "uuid": "ac8a4103-02c6-4853-9b5e-44ffa5045c50", "value": "3072:CZgSCDERcdyTAnvS9kxkqCVrhEbHBdqWb5TC0e9cDvRDYZm+CJQN0fm2Rh:POcdGWxkqdHBlb5pYoWUJTfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679793167, "uuid": "535004af-e5c2-44de-95a8-49aa21d8d604", "value": 278528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679793167, "uuid": "15f2defb-f802-4d47-af68-d585e5d542ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679793167, "uuid": "0c8065e6-f2bb-40cd-b53d-7d367559cc12", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81830769-cb99-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tsunami)", "timestamp": 1679809568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679809568, "uuid": "6310d2dc-7958-4591-8ae9-22ae54764be9", "comment": "Malware payload (Tsunami)", "value": "22f8f803d752df49ad8d76581ac5d031", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679809568, "uuid": "71602d8f-e680-472a-910c-e392f7111a5f", "comment": "Malware payload (Tsunami)", "value": "b524bc8a3a0b4381fdc99a70114c139b0f62da3e582c7476134448abb124861a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679809568, "uuid": "2c75e8bf-f83d-448c-9043-6b79851d1fd6", "comment": "Malware payload (Tsunami)", "value": "4676698daff72044832b425526969fa9b4b6ab93", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679809568, "uuid": "e54aad35-5466-45f5-bc0a-d01a611d6b67", "comment": "Malware payload (Tsunami)", "value": "6bf1e43fb67cc219b35241b1576bae0d1fef47676726d1c714f6ad0ee74f7b2d5acdf8d4458c3a26f40b6e6e8f4517ec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679809568, "uuid": "82f52d3e-34df-4986-badc-30048f1638d1", "value": "T106A34A43371D0E67C1BB99F51EFB23F087A6F86216626180B51DBE8A0333BB46516F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679809568, "uuid": "dfb52cc1-a5c2-4ad2-9208-31eccf1c6b74", "value": "1536:3/4DdLlRAxCYQ7bK5cyoOQDAL4chV54w/bLNW2/BHgQCU4jto25Z3A:MGlQa3oOQD454ebE2/BHgQCU4j225Z3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679809568, "uuid": "d1c3e52c-59b7-46a3-b904-5d903ed015c2", "value": 102653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679809568, "uuid": "4b42a593-fbea-4eaf-b5ce-98b40ba4d747", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679809568, "uuid": "e7175b74-7899-4c78-b1b0-ac01391ce69c", "value": "22f8f803d752df49ad8d76581ac5d031", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbbee743-cb72-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679793022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679793022, "uuid": "84ec4ece-a83f-4ee8-a2ef-c3391bab220b", "comment": "Malware payload (Smoke Loader)", "value": "421d4437a64a1ae4a146ed708cbd2a3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679793022, "uuid": "8056017f-19d9-430f-8e5a-07a3a7a3b654", "comment": "Malware payload (Smoke Loader)", "value": "b52e42a10c57ce2f2b847624cb50ab94aa628525a39ab4d89a1fe945c4674e94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679793022, "uuid": "b361ea08-a75f-42ff-b3ef-db8629e6c7cb", "comment": "Malware payload (Smoke Loader)", "value": "ddd5e4ae7366bece266f98d0758a7e5409363db1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679793022, "uuid": "eef341e5-273b-4b43-ab23-988ab67bce27", "comment": "Malware payload (Smoke Loader)", "value": "ad4ec79fa4e7371c502efe26ae4301d43c9411963b9d1daa75cab9b28a45e8b37b6c7a0c3ff33fe7c9fcc8784df51138", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679793022, "uuid": "ce3c5c1d-640d-43d0-9adb-9a640b06f6f6", "value": "T193547C1253E16860E76387328E2AC7F42E2EF8619E157BFE16559B3F2931F72C162305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679793022, "uuid": "405ac517-2676-413a-a3fd-1fbbe6b965b6", "value": "4ab2a4d536313c74a2690207bf67c9d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679793022, "uuid": "64b794b7-0586-4f29-964d-f2e03aaca7ab", "value": "3072:CImk3rORYR7bAAvFXRFmFatrhsu4ZfLIi2Wzo4heEVTsuiJ7uCJQN0fm2Rh:e3YRndFmFVxUoNheY675Tfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679793022, "uuid": "8ca04f88-7110-478c-9073-0a7d8494998e", "value": 279552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679793022, "uuid": "bf59ac25-c3d4-4e07-8bd6-5c5efe6fe333", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679793022, "uuid": "e3750b1d-52dc-45d9-b180-16a53e1946bb", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4e5218f-cbf3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679848362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679848362, "uuid": "af8e40c9-c588-4d94-bed1-06bb2afd5623", "comment": "Malware payload", "value": "809fd08e5f79d466a9246b7a793f691d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679848362, "uuid": "91828283-37a9-447f-bb44-ff38cdb67bfd", "comment": "Malware payload", "value": "b532572f5b6417a242309c4a1bf5eef3eac6070626df9dd5b23c89d81592e2d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679848362, "uuid": "41a48862-e643-4db8-994b-cfcf75fe3519", "comment": "Malware payload", "value": "3256eca2d1638d421bc53cbfcca50effc18b5cec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679848362, "uuid": "733b70da-3bc9-4907-bdf6-107e4dcfb9e9", "comment": "Malware payload", "value": "b3c8670f17a314a6c59751e8f516ccefdf2ef1077997666bab98ecd839bca6e509cc335984904d4f7e05bc5c4504df76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679848362, "uuid": "241b75b1-cdc5-48c4-afa2-bcc07ff09812", "value": "T1B4E64B07F89191E5C5BED130C6769262BA303C495F3023E73B21F6B92B72BD46A79394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679848362, "uuid": "418c4737-072d-4991-96e9-7b3fac555a00", "value": "57c9b357ae0cb2f414b0a5873e2f216d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679848362, "uuid": "995e52c5-6247-494d-b4e1-701fb417b06b", "value": "98304:JvmmcknTucGhl/v9bDFVgICy0Ex/4Rm0cZOssY:J5vTpGhJv1FtCEiRm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679848362, "uuid": "d9e397bd-9573-428c-ac29-537c7b4d6a9a", "value": 14548480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679848362, "uuid": "1fa4faad-828f-48c4-83d7-e2e22ff689b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679848362, "uuid": "21337537-afa0-4dd4-8a91-1dc2d4b58986", "value": "809fd08e5f79d466a9246b7a793f691d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acbed19c-cc01-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679854308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854308, "uuid": "7241a5ce-1284-4fe6-9637-92363afe5391", "comment": "Malware payload", "value": "fb75c0a2aad2f8c8203b0e8cd50c5acd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854308, "uuid": "725d3222-40a3-4576-98d7-8f71ec68a85a", "comment": "Malware payload", "value": "b5f7f5e5e5a814d9a871a204ad007108ca892b244427b3d68d3ac2d882f425f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854308, "uuid": "536cf2c5-6533-493f-ab8c-657995108890", "comment": "Malware payload", "value": "93eb0e00a51657b4602b38b3e4257b80f3200d7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854308, "uuid": "207d9198-64e8-4727-9b62-d5ef08c2f234", "comment": "Malware payload", "value": "c7310cd65b41a5b1570b7c11b7efc6b78d907b1c21acf6b1f547fc3aab29d87fe467ac16af2b5fd89b97e78f1d046a57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854308, "uuid": "8a70cf37-b3f5-4c58-9a15-5d24ac5b3672", "value": "T13E75333176C8D477C4BB70BE4465D694A6A6B42008BA454F7BA017BB6FB03C2782E787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854308, "uuid": "ef4bf055-3543-4248-b1b7-f0e92d74198d", "value": "3de943fcc7aac4f92f0aa259611cea93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854308, "uuid": "34dd3fa9-569a-4bfa-9512-838e87c25b87", "value": "49152:FuXEnBSze5817TMBYpenuq5oncZS6K6h8DC8:MEnIwicZS7TC8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679854308, "uuid": "1529ed3c-48a8-4b49-a985-4dfb9064dc29", "value": 1660164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679854308, "uuid": "1cec6f53-9401-4f7e-ac73-bd547a84aba1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854308, "uuid": "48fa0d58-20bc-46f2-9e4d-f1533dfc6671", "value": "fb75c0a2aad2f8c8203b0e8cd50c5acd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c32cda3-cb79-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679795707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679795707, "uuid": "55ee6550-f215-4cd1-8606-850ffcb62210", "comment": "Malware payload (Rhadamanthys)", "value": "cfc3dc40432c7d8d8f838bc20c12bf27", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679795707, "uuid": "dc39ea19-971a-4951-876d-fc030c1020d2", "comment": "Malware payload (Rhadamanthys)", "value": "b6fbf6a0edd6938b1f202feec419341d21d47731ca16fa5b5eabe2672d24a454", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679795707, "uuid": "63fe352c-3199-4411-b28e-3926692abea0", "comment": "Malware payload (Rhadamanthys)", "value": "abbf097429faed4eec090e86d89151a1fcc36ab0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679795707, "uuid": "78f37501-c916-4a0f-8fa3-96749c333869", "comment": "Malware payload (Rhadamanthys)", "value": "ed926207b4d6392df06167901b45f7a447575dff1b1ee78a4c91ba6ed199c0f5d05fd976ddad48c3a65e7c877d828126", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679795707, "uuid": "1c13c853-4dbc-445e-9a65-b495506acd5e", "value": "T16F44DF233F981132C46AC0FC91BDE9DBD77EA8113794C4494A1C322B5A777A29B7922D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679795707, "uuid": "2105f591-2a5b-4616-b8f7-9cd88369d1db", "value": "e8d1c822bb1493104fac7c5466a244d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679795707, "uuid": "bf36904e-5c5f-4778-b774-17bf49082a6e", "value": "6144:IhkI+5/nYc1aWY/yMupzdh62iBIjSp1pbD7:IhkNic1xY/KYJejS7pv7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679795707, "uuid": "c8077fe2-7ee7-4f1e-bd4c-300d3f32bf9c", "value": 268368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679795707, "uuid": "8c0adc41-092d-4a12-b0e4-daba18a2fb4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679795707, "uuid": "8743dcdf-be12-4814-90c7-5d91748a085e", "value": "cfc3dc40432c7d8d8f838bc20c12bf27", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7bd1319-cbbe-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679825657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679825657, "uuid": "4df5436d-deeb-459c-96e6-f64799c6f0ba", "comment": "Malware payload", "value": "79eba0dbf88a4047dd46b835f15b1d05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679825657, "uuid": "3b341784-157e-4ed6-b43f-b1b42df66704", "comment": "Malware payload", "value": "b714e99efdeab444d8f5fe9b8c6711f9bc0cf835e45b8452add1beee29626cb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679825657, "uuid": "635c028a-5ab3-45bd-b0b9-796a6825e8f4", "comment": "Malware payload", "value": "cc95a0ed40a6bab2037f5bcb71b665ad8ab8d7c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679825657, "uuid": "eddb4835-19e0-407c-886e-cb66cb6519bd", "comment": "Malware payload", "value": "d2b49eb5eb3112f75a15a7349046ed8b9fa5cfeb16a274c944633308a8704ac5a4d9fd8ea8dcedd20e4ab03662e08c82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679825657, "uuid": "cd1e7569-755d-4d87-a937-928f963d2e68", "value": "T10306271A39649155C2ABC2BCDF4786C3F67234540B307EF71261821F5F77AF96A3AA20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679825657, "uuid": "73507bc5-4db6-4dfc-9d7a-d491cf66e36d", "value": "645ee38885b0a130fc457aa062e699e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679825657, "uuid": "047979ed-556b-4a6d-a7de-3e4dc5787f40", "value": "49152:sswUxtlJU/AIyOHSbpp1DJlznc//ef+4vYbDi+XitGZSaDV:9nyHm6oY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679825657, "uuid": "b4aab4cc-ea95-4111-bc5d-9ff3849fa6a3", "value": 3915776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679825657, "uuid": "b7acb41d-5b20-4cfc-a0b0-e0b1251362bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679825657, "uuid": "295abd9f-95f8-486d-9e9f-e6e11767348c", "value": "librocksdbjni982936288355848275.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eab4e44-cc1f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679867142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679867142, "uuid": "b72e400b-a73a-4164-a863-483e433009aa", "comment": "Malware payload (RedLineStealer)", "value": "4842aafe330a4066543e094290f55d21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679867142, "uuid": "1e772322-9c82-484c-92b3-5d9066f7c163", "comment": "Malware payload (RedLineStealer)", "value": "b82fcf368bda3ca3dc3909a3962c32c9b778a507b814faa4c9a7e685ab51ca21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679867142, "uuid": "aaec124b-a9cc-4534-bd6a-fd282c9904c3", "comment": "Malware payload (RedLineStealer)", "value": "710fdaa38e74a58a7c73de8fa70bcc0d02b9e82d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679867142, "uuid": "b1dd2c97-e9d8-4230-b7a8-00a5a14815f7", "comment": "Malware payload (RedLineStealer)", "value": "8333e3cca0b49570e26f55b902749e1e93d9408f70d816ca4b63cefe21717daa55003ea0ca77b53f7f3cb5214b8e0f4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679867142, "uuid": "61dbbfb9-c858-450d-b849-01c118b0e387", "value": "T1EBE413137BD84023D8B523B054FA07C31A397CA15D79926E3B86AC9B19B3944BE76337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679867142, "uuid": "1eaac0d1-38c4-433a-9cf6-e4c60c4e7244", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679867142, "uuid": "0753befd-ca98-438e-accd-d6762d7905c9", "value": "12288:JMrmy90JiFq4Cfr2vNVhlpaktBMuhWNhtt24JqKY42mZ:jyF4fcjnpasS/j24JqKYg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679867142, "uuid": "429c7202-5343-46d3-88a3-0535970ac613", "value": 698880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679867142, "uuid": "69f6fb4b-b746-4ebb-904b-7b359d201259", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679867142, "uuid": "6ab1ffcb-0f64-421d-af93-aa230bbfe8f1", "value": "4842aafe330a4066543e094290f55d21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "430d86bc-cbe9-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679843823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679843823, "uuid": "64e36a08-5449-4b65-8714-b4cf23d760c6", "comment": "Malware payload (RedLineStealer)", "value": "eec8e1c12206675666b0d22e61f58b5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679843823, "uuid": "18f72819-1b0e-4c0f-ae9c-c2af1e269dd6", "comment": "Malware payload (RedLineStealer)", "value": "b8b003819518b7d1cf9f8eea0af5b30b2595f61260f8df903f1c37818082ebf1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679843823, "uuid": "76883d95-9db6-413e-bf81-9085af641884", "comment": "Malware payload (RedLineStealer)", "value": "a4cc526b0cb752a840ca4f178a3419270cf70f7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679843823, "uuid": "67b66a9b-8444-42dd-a0dd-002f596c3241", "comment": "Malware payload (RedLineStealer)", "value": "587c323db92faf29616b98100cfbf2d34a5011a59aae0d1179be9aac884714867f8a0f619375a958d6c7cf0bd55e77b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679843823, "uuid": "efc74dbd-0d39-49ae-a766-58c9ffc4d445", "value": "T1F0352351B3D87C72EEF92F7054FF02870B357C908A65869A3751678A0C725E4A9B233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679843823, "uuid": "5e508508-8dcc-4e43-8a46-b42e57521570", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679843823, "uuid": "9e437af5-114d-4aab-bc60-f1ad7bf96064", "value": "24576:+yNrFhRVktaiOepoJ5kMXlJS+hXiv50h0W9f3Em:NNrIrUeMHwvU/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679843823, "uuid": "425e4076-fed0-4056-8d5f-3c7c5c3c02dd", "value": 1059840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679843823, "uuid": "da59f198-d98f-452e-b3c6-3164650df444", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679843823, "uuid": "25f3d2e5-f580-4169-9d38-e2517391ca96", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a94ff1a-cc02-11ed-88f6-42010a9c006e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1679854465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854465, "uuid": "ec91cef9-6e78-422b-a244-0200d8d8fea9", "comment": "Malware payload (QuasarRAT)", "value": "993aa27b0d75949448ff7f6f468dbf67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854465, "uuid": "dea47e94-2102-46cc-a960-c82f5a5e5d5d", "comment": "Malware payload (QuasarRAT)", "value": "b93125a83bfac37816efb75e784188766a2a9d21b108710452810b6a5bd31050", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854465, "uuid": "d4797081-d5f9-4bf7-8109-d1ccad628c83", "comment": "Malware payload (QuasarRAT)", "value": "8229ccd4064a8c55e5e391942aba2aac32b134ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854465, "uuid": "02c70e1c-077f-4aba-af4b-a1f512d05751", "comment": "Malware payload (QuasarRAT)", "value": "aa8cc4b58757ab7ee23ffd5437aaca90b90b752524fb9f24e43a468b6c4b3bf3f6bc7bd180e86e3d21383e4220c029c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854465, "uuid": "f9fc5f2a-6771-469a-b71e-34fbfd3838ab", "value": "T17725E906BEFBC963E29E5737C6E6052447E1E841A232E71F3599239E2843BB78C04757", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854465, "uuid": "60b15b7c-7eb2-4855-bea1-15e5026c665b", "value": "12288:eIlAaF+CQmrom1uS4iorvTSIVFhQfFjK5uxBDSDbFjI816wwhpxpWyhmDgckHMzO:plubLwtFDS7FYNYD7264xnRhc/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679854465, "uuid": "d502bae9-c563-4cda-a82a-02c9c4459a91", "value": 1048392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679854465, "uuid": "53ddcead-db47-4fd1-95f5-ced927f2f4af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854465, "uuid": "dcc0a670-607f-4549-af0e-6b0347f8a176", "value": "993aa27b0d75949448ff7f6f468dbf67.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48c69815-cbc8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679829659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679829659, "uuid": "527387b9-d8ce-4a79-8f85-538ffb3d23f0", "comment": "Malware payload (RedLineStealer)", "value": "fa11bc1145f19ca0fd6520691c661779", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679829659, "uuid": "b36215ad-a30d-4482-8d32-a91d1c9ff090", "comment": "Malware payload (RedLineStealer)", "value": "bb6feb323ee1e8270410c48ef1fd21d61c9bf65d594785d69079954c2b98840a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679829659, "uuid": "b6e97794-559d-49ac-bae3-386612046e41", "comment": "Malware payload (RedLineStealer)", "value": "3e6b09a34240fdc2be6d649cb74c2bed0a668717", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679829659, "uuid": "896ca003-c0f8-4e71-ac29-163d0ea98ed9", "comment": "Malware payload (RedLineStealer)", "value": "5fb054ec7858805dd7f117d08695a9c1890f1d5ca6313e2f606552a291c14053def0e76b7ec0213641eb57ca716ef517", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679829659, "uuid": "d8a625fa-ef4d-4828-8a1f-47e31a39a9c4", "value": "T1F7937C01B5C1C471E57619355C75CBA48E3EFDB04E21AEAF3798026E0FB42C09AB5DBA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679829659, "uuid": "39c58e05-457c-49b8-a173-e56f0b1247e9", "value": "0babd8ca8bd35854363ac1d9f03ed0d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679829659, "uuid": "0577f682-69c0-4447-9760-e2be8305eab6", "value": "1536:UtCq6Kf3Kynwek1M16QlGKRyCpqDQWzNJyI2ChF1jKdvoIWazjGgsW4ucdvJ1g9q:YCk3KGZ4qbRyxNJyI2ChF1bVgjCvJ1gI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679829659, "uuid": "8ddda7c4-b248-484c-aab1-9a18607e3708", "value": 95744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679829659, "uuid": "ae40a6e5-42d4-44e9-9d42-25d853e22f49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679829659, "uuid": "af820f49-0ad2-49ac-a2e1-3e5dccb945e7", "value": "fa11bc1145f19ca0fd6520691c661779.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6342dc6-cbb4-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1679821252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821252, "uuid": "36edf20a-a54c-4a77-b023-1d1f2126cc1a", "comment": "Malware payload (AveMariaRAT)", "value": "45d0badf0d81962d173b3009f3dcb660", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821252, "uuid": "f47b2201-25e6-4cf0-8e52-f6cac5fb8de8", "comment": "Malware payload (AveMariaRAT)", "value": "bba868fe07310c4421085991f00efc87d7874c71780a2e38f17305ed95c73305", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821252, "uuid": "5106bbbc-589e-4e8b-98a5-c0ecd288fb93", "comment": "Malware payload (AveMariaRAT)", "value": "1a930dd4b42133450ec20f4461fe83abfab00981", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821252, "uuid": "116bc115-17a3-44aa-a03a-a00e8df82d79", "comment": "Malware payload (AveMariaRAT)", "value": "bf4293df586f6f1b715a2c7a335985e9702e1a915d2f81fab5b643cf4d949ac5ed2d7b92ab1691e8a8d52cae0b8842b8", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821252, "uuid": "8952340c-7fc8-4e7d-8265-1ab73bad7a4b", "value": "T196E46C7D6DB89D22F435DA758FE2C133A4A0D7D76B218B58079B134C8E0285778DE0AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821252, "uuid": "e8af061e-27a5-412c-b540-0e08fbdd856d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821252, "uuid": "8ec4365e-619d-4aa7-91ce-4d83e7c88965", "value": "12288:aGveLRgNGSD7QK+Vt1FvL/Wl3mcDNT+hU+s2yc1:1edMMXV7FD/uDshUYyc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679821252, "uuid": "c2e7f4d8-58db-42ca-9a75-4e2c7d40b375", "value": 705024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679821252, "uuid": "de054594-a9fb-4f5b-a4bb-c1c0ec37a8ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821252, "uuid": "1728d6b2-cbe8-4d8f-896e-9d6c9aac69d0", "value": "45d0badf0d81962d173b3009f3dcb660.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "056023c8-cc02-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679854457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854457, "uuid": "6b49f051-cbf6-4823-8e13-e7185697b794", "comment": "Malware payload", "value": "df9a51dc5275edb3e268e9af7a565a1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854457, "uuid": "2050d272-0cea-402e-a44f-6a8aa22b90b5", "comment": "Malware payload", "value": "bbe309cba072fffae1e284dd835119a07d716d0ebb097af3e9760e57966ad259", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854457, "uuid": "0210129f-7868-48c3-a727-c8d3fc2877b0", "comment": "Malware payload", "value": "82719402dd2f611ac1a3a6fa4da28575c79cb317", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854457, "uuid": "e38347d5-a28d-4687-9067-08ee23a55839", "comment": "Malware payload", "value": "c341a2d1f925d454a3d381f60a6ed2a4f5294e950ddcaae497578892442444a2b37fb6ad4e38e8fa81583deae886c007", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854457, "uuid": "591e59e5-50af-4575-a343-3b9a7ce8c939", "value": "T15795BF7A83D57995E3BE2E32E4A036554F65E013DFDFD38E7C8008AABC597718E00692", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854457, "uuid": "6f1d61c1-dab7-41cb-9d95-c5cb848bc591", "value": "24576:cY1WguK2pXcwC2BTPDLk4U1sFq1v1ZsCgz/Ktu1Dze6HDpLCbJzl7PELTs5KzC9p:QeQC2BT7UeFqZsCgLTLOXfh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679854457, "uuid": "f1a375f6-1a96-4ffd-bb66-961ee659e983", "value": 2004191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679854457, "uuid": "34dc39c5-86eb-4a5c-ae7e-9399597de274", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854457, "uuid": "bb69f533-017e-4c00-9c83-cdcb03d8ee83", "value": "df9a51dc5275edb3e268e9af7a565a1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dfe7809-cbea-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1679844351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679844351, "uuid": "37c88eae-5db8-4f35-80bc-03e252989e26", "comment": "Malware payload (Vidar)", "value": "f7fd4791be2e2624b7fbb1d91ab2f539", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679844351, "uuid": "b7d623f5-d3a5-45c7-bfea-f4b09223e25b", "comment": "Malware payload (Vidar)", "value": "be82beca4c46e17fb1d4e7f23cf028f61b0d6e64d39146f31f1e7072ecf95fbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679844351, "uuid": "db6dcefa-62e1-467f-bb1f-c18b743fda7d", "comment": "Malware payload (Vidar)", "value": "5e293bd82fc478a0891a092e02a7576d6a9799d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679844351, "uuid": "5a5b04ee-9875-4872-9aa2-4746b41d2fed", "comment": "Malware payload (Vidar)", "value": "742519d6124f7f1fc297a018470e6a643d36a91fbac44cd9dc204be8ce48bfe9a49f0563a5408b3dd341244628f214a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679844351, "uuid": "f409f37a-aeb4-4f32-a0ef-c5fe6bae46cb", "value": "T18B25BE6E1992CBB0C3664976A4794DAC49BD910C33AC2E0674C409CA1FD5ACDB2EFF4D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679844351, "uuid": "2b8640af-085b-42b9-b00d-849564179972", "value": "330deb4fd4ea20960296eba72e2808ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679844351, "uuid": "a46123de-6092-4b6c-a3a6-e8394eb5e99c", "value": "6144:7GZnGSyQWFr8FG6d68UeCVMlVTgjwAaTJVM0ASpk4hHsbPZ0kuydk3CKxh4:aXy7YKxeCVgxJA0ASp2tA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679844351, "uuid": "83a93965-71db-497b-b6ae-df6541b99797", "value": 1048576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679844351, "uuid": "c1377795-b53f-4f2f-8c94-fbcb0c04509c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679844351, "uuid": "a8af5f36-9f8f-44bb-8c17-8c599ee9b811", "value": "Date2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98c7a58c-cb71-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679792427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792427, "uuid": "bdcfded7-8c01-4748-b6e7-a857cca0515b", "comment": "Malware payload (RedLineStealer)", "value": "9eceb17f870d45bfa2f796e3319e84c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792427, "uuid": "91c89914-10d8-4363-ba46-67455187e69c", "comment": "Malware payload (RedLineStealer)", "value": "bf41eff3951f14f8a7c7a904c549feea0742947148feb08c2c893256136143c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792427, "uuid": "74ba2d22-5e1b-4c61-ab94-a723deda1071", "comment": "Malware payload (RedLineStealer)", "value": "0d44c33fc9088a9862f4fff578e5daa1996cd289", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792427, "uuid": "0d3c768a-5c68-4e0f-bbd7-fd28d9dddd5c", "comment": "Malware payload (RedLineStealer)", "value": "3bd3a38d4283404a3c32c7f581861284039a11c232ff024c884472a5152ef5ff16595e5890d26771e535bb3862e3cfda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792427, "uuid": "b73a5bf5-5efa-4788-b7c8-333706e907b0", "value": "T1F084AE0263E27530E3638A328E2AC7F42E5EF8615E156BFE13559A3F2970F72D162315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792427, "uuid": "2354fa59-7a4e-4492-9dfa-43ef1d02b060", "value": "5bf64f0a1a526a4cdb08b53a545d3838", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792427, "uuid": "d3f7a97d-34a1-43a8-a199-903c74779afb", "value": "6144:scAuyZpkSkVAGCOCxIMXZXox3mV0QlaNAvXKp9ZKTfz:scAuqklVGOfMXy3mXlamPKV4z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679792427, "uuid": "ba0c8194-09ea-4c57-8a19-ef1ce9a61435", "value": 388608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679792427, "uuid": "61365b31-759d-4ae2-8648-ba91110168fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792427, "uuid": "ede68f75-20ae-4425-ab7a-22ffe135a027", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e00181d0-cc04-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679855682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679855682, "uuid": "84893b7f-fd0d-4513-a2eb-a14f22607341", "comment": "Malware payload", "value": "b3c8c890a8a14c823da4fcebb050a8d5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679855682, "uuid": "c58e639f-7268-48b8-a80b-50e35372beaa", "comment": "Malware payload", "value": "c03940a1d58fde9e082ee6ef03396eae85f2a34d26c26fe74cf29cad173e1358", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679855682, "uuid": "c7f8abf1-d45e-4d2c-9f43-5bc67499b3bb", "comment": "Malware payload", "value": "c7e32b0d67de42996f77be2569ed8a45f4175411", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679855682, "uuid": "c3b6f71c-2ead-4ca8-9742-cf218674b872", "comment": "Malware payload", "value": "a03e6da5d2ff30f09d27b9414603de99db38f12eac5b4270b71371acf085b31c161f3b4aaf427b8d2d0ff47e24137c20", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679855682, "uuid": "684e9cee-2715-4022-a6e0-34598306a4ee", "value": "T1535623A313941155E0E2CC39C23BBED4B2FB536BCB84E875B8E6B5C139239D4E616907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679855682, "uuid": "f221ad37-f18f-484c-9024-aee3c13f093a", "value": "895e5e6e037e9108574fb94ed614d804", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679855682, "uuid": "52050d9f-3ff5-47a9-a87d-70ab4d0f7095", "value": "196608:s0NZi2IpAkQEyCCv73m/rvgu+weImT5/FD77A:fi2mEym73m/zETb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679855682, "uuid": "040aa60e-c0de-485e-9bfb-5e955cb6bbc7", "value": 6314496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679855682, "uuid": "1bc96f00-c7c7-4266-bfc2-88ee4aeceddc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679855682, "uuid": "68e60b3d-bfc3-4620-8024-18587bb76cce", "value": "b3c8c890a8a14c823da4fcebb050a8d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ccca0a0-cb74-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679793561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679793561, "uuid": "bae8ccc4-3786-472d-8ad4-5fcda58e7ab0", "comment": "Malware payload (Rhadamanthys)", "value": "86846719d9e7aa1ee96820e6b220955a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679793561, "uuid": "d62c6897-6e5d-4a99-89c0-1f08e42e49a6", "comment": "Malware payload (Rhadamanthys)", "value": "c0418fb8f8d9c46f8aa298e996c6a5ff425bfbce32c9f527c6c5e52e64340c79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679793561, "uuid": "7d475e20-fdbf-4af9-a9e2-71b70f6aecc5", "comment": "Malware payload (Rhadamanthys)", "value": "66806bd54bd7bed9e55748ffc382769eeadccb85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679793561, "uuid": "a03c5351-9ee8-4356-8d76-63d6b9b3c1b5", "comment": "Malware payload (Rhadamanthys)", "value": "d8d1ceda0008140337c8d9385969ca4d9d386a9b04280fb76f988fef78f8aa303e17c285d7df516580170d69af6ef6e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679793561, "uuid": "cd325bce-a6f4-4b16-ab39-6d43bfca36c2", "value": "T1DE749E0253E16820E76387328E2AC7F82E6EF8615E557BFE16548B3F1971FB2D162305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679793561, "uuid": "de38519e-d1bb-46de-b513-f559927f49ca", "value": "5bf64f0a1a526a4cdb08b53a545d3838", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679793561, "uuid": "60f34300-0db2-4725-a81a-9f8bd5944e78", "value": "6144:0WUHHdxBProurISplcYpCGki23IQlUfhSBKggPOIUXDB0xGTfz:/UHzRnkL9l4YBKxP+C0z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679793561, "uuid": "0dbfdcd3-84cd-4d41-b5b7-cd26dc3f5c25", "value": 354304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679793561, "uuid": "48b196d0-ec60-4d88-81a7-47ae79564651", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679793561, "uuid": "0b59495c-8440-4f40-90dc-2a74cc31ddad", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48d6ea7b-cbe5-11ed-88f6-42010a9c006e", "comment": "Malware payload (XorDDoS)", "timestamp": 1679842114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679842114, "uuid": "5cda801a-5b45-4972-ac4d-634d8997c342", "comment": "Malware payload (XorDDoS)", "value": "12fecefe30f2ad8f49aae67b92920adc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679842114, "uuid": "74ec343b-9cee-4d3a-9167-8e58c9f55020", "comment": "Malware payload (XorDDoS)", "value": "c0b0225201fd3a4c08245e58bbb4b844e0d3426e89b9ac3fc34db37d994fb182", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679842114, "uuid": "cabe186a-2343-431b-b16f-887292b4ae39", "comment": "Malware payload (XorDDoS)", "value": "1bba1ff3c667a41ae26b12995323f7df7c239173", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679842114, "uuid": "d4b99033-b868-4b12-84fa-13c61892f314", "comment": "Malware payload (XorDDoS)", "value": "9596a5d7fdcdc9493c621c4cbef91a330383783d64955e477f5c387d9599cccebe1b766d1028478318840a31faa18654", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679842114, "uuid": "d1ae265c-a111-4591-8d72-423d52376e77", "value": "T1B7D47D06F243EAF7C4970570124BF7BF4230E6318412DF8AB6889D5AB9379F52A4E356", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679842114, "uuid": "7525821e-9010-43a1-b2b3-c456cac6b8c9", "value": "12288:5BXOvdwV1/n/dQFhWlH/c1dHo4h9L+zNZrrIT6yF8EEP4UlUuTh1Au:5BXmkN/+Fhu/Qo4h9L+zNNIBVEBl/91l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679842114, "uuid": "9ae9b3f4-69ec-470f-bf1b-67da2d69d392", "value": 625889, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679842114, "uuid": "ec3e3bca-dd2c-403c-b39b-ae35dd6be95d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679842114, "uuid": "20af76b2-22a4-4a72-8b89-d04df59d0164", "value": "task2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a0b9f20-cc02-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679854491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854491, "uuid": "aa3fcae5-005d-4204-87ef-4ee61e0cd803", "comment": "Malware payload (Rhadamanthys)", "value": "7cebd523a30d51a0fe602e8abc96a236", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854491, "uuid": "1fa4d353-19a9-4c97-b176-f94dedd6db1d", "comment": "Malware payload (Rhadamanthys)", "value": "c0d18fa6cc6c5c3e3bbc3725718bebe24cd904672b13eb4ec86d26e43e584e4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854491, "uuid": "9baa3f46-b966-4e9f-aa36-b00b472dccf9", "comment": "Malware payload (Rhadamanthys)", "value": "7d4de62d28ac820c0d4c066c340aa168f8162207", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854491, "uuid": "6be1d980-c8fb-4944-8296-18c9499cc722", "comment": "Malware payload (Rhadamanthys)", "value": "f288eccf9352d6e817b3b6a1db006acababc4191174885e921cf7c10f8fb047359bf0020ace5c5114e0ee939dedfa13f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854491, "uuid": "0f571183-8eee-4e9e-8527-d26edfbe3fae", "value": "T182B5085383A23D44EA258B739F1FC6F8B64DF2709E497B6532199E6B14B02B3C263711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854491, "uuid": "dbadc74a-351a-48df-a3d0-074e0fcc7d58", "value": "86f73ba4a5b0bd6d0633bc10b0ac18f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854491, "uuid": "e9f4ffbe-057f-4b58-83d6-c63e4ea551c4", "value": "6144:5WC6Lf8HuLk5z2TPQIonfaFi9G0ei+jvbalhZV9W71:5WC6DiUk5zq4ffaFQG0qjvWPZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679854491, "uuid": "27dc782a-6138-4ef8-a1b9-d41006b818ed", "value": 2383968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679854491, "uuid": "a94c46c3-0b08-41e0-b896-479fe67c322a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854491, "uuid": "f1532706-97c3-4729-8828-0715bc30b211", "value": "7cebd523a30d51a0fe602e8abc96a236.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0d1f79a-cb6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1679790830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679790830, "uuid": "24bcbda5-6458-46d4-8a54-b0b6623e9b07", "comment": "Malware payload (GCleaner)", "value": "e05502a1e3564e1eb7d2825656a37da3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679790830, "uuid": "0504d27f-81c9-4c93-b41e-34f6eb03c666", "comment": "Malware payload (GCleaner)", "value": "c24e160a7ac7effdff8fce20a39fe043de0a57b5d5514ec2ea59fd1809822906", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679790830, "uuid": "1feadb68-4eed-4103-b515-88fb62f7fa88", "comment": "Malware payload (GCleaner)", "value": "3eef8f3fd3186c60c50347c773a501ee0324161a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679790830, "uuid": "9520c379-4a48-40c5-9996-a3b9b1dca501", "comment": "Malware payload (GCleaner)", "value": "db3ff16a41af2d748097dde54b33484e51ad5f1cf993a635f4c5688c51e7b338c65fdfee8315eec7890a555f47e87ca7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679790830, "uuid": "2854d6d2-9386-4134-a8f1-45428a56c895", "value": "T13C953357B3484CF9E11294F10E86DD08F2EB7F650E7CE6B8619C568E8F51681CB4E326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679790830, "uuid": "87e79fbd-21f9-491c-8391-83ecff43b567", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679790830, "uuid": "e180b72e-dbfa-4fc6-8d4a-1d7c2a7799c2", "value": "49152:EGlJfsLiq6c024bnUjrG273Kr2NY5mq5ZpD5dlLYp:5HO0dDHYKq/q5ZpNPYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679790830, "uuid": "b35e2d5a-351a-4bcc-8f4d-3ad477b885bf", "value": 2004110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679790830, "uuid": "d4759339-915a-4aab-8bbb-8fd01ab0a9a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679790830, "uuid": "91fa68b2-a51f-4521-bf11-e8a510f6b293", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8925ae7e-cba0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679812587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679812587, "uuid": "4720de1e-0065-499e-b7ec-d1a108206e8b", "comment": "Malware payload", "value": "27ef5ad3478d99f89928616795667497", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679812587, "uuid": "f9f52350-f626-45e7-8e2e-cafecf74726b", "comment": "Malware payload", "value": "c3cba8fe3b0622f7f5bde6d67dfd02b454055c1e9fd4402197cf70e5002e9fda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679812587, "uuid": "6b6bfc00-2923-4976-9a67-7ae865ff9fce", "comment": "Malware payload", "value": "0024bc5d820ef93ef9b91b6ed5ce93eb55064de7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679812587, "uuid": "ac2249e1-a322-4715-ba1b-c490a261e576", "comment": "Malware payload", "value": "d10edfa5956b6fc78c55bba8aada8e7cf3f4c9d4c5e344722d24955c7a8a84012cd998881e861d7f930ff7a744e82cef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679812587, "uuid": "9632f289-8fea-4189-8e62-63680cc85f87", "value": "T13B458E8993D46556E1FE0F33A4E076AA4B75E412DFDFD38F28D015AABD1AB724C00683", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679812587, "uuid": "96ce507e-d3bc-44ea-b993-8076eee10d29", "value": "24576:cY1WguK2pXcwC2BTPDLk4U1sFq1v1ZsCgz/Ktu1Dze6HDpLCa:QeQC2BT7UeFqZsCgr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679812587, "uuid": "98bddf06-1c07-4bf7-8c4f-a4df03b4c70c", "value": 1278231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679812587, "uuid": "09bc570d-53ef-4a1b-b67b-2b8c48562df3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679812587, "uuid": "a755666a-8604-4c19-86e8-17fee517a27b", "value": "27ef5ad3478d99f89928616795667497.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73f50cf6-cb6f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679791506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679791506, "uuid": "dc804b0e-f89c-468b-934d-fd8500b3acba", "comment": "Malware payload (Amadey)", "value": "0fdc5cf2eb783f818b2629e436b81187", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679791506, "uuid": "40afb5a6-11c7-4509-b905-7109c41be6e1", "comment": "Malware payload (Amadey)", "value": "c3cc924f547ec7e92f00f6a2a5a8e6e55deb0be4906fae0d2a7f9ecc173a3863", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679791506, "uuid": "d7cacfd2-2d67-4249-a7db-6556081682c1", "comment": "Malware payload (Amadey)", "value": "aa78052123be9070744da95c369222b7b26e433c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679791506, "uuid": "fab0849c-a150-48fa-96ac-e483ad98b1f2", "comment": "Malware payload (Amadey)", "value": "ef881dc7109cf90dea0ec946ebd1192fc017b7cd87a986999409d5d175b1766a16711d5200dbae52dc316bb9af4a05dc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679791506, "uuid": "7a7e2652-818f-43a1-8c68-ddcbeaabf012", "value": "T17E3523176BF9907BDCF52B7009FB079B0AB6BDA49830836B1396494D1D736C094327AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679791506, "uuid": "4f3a80b4-ae50-4b7d-a84d-6159387ef773", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679791506, "uuid": "e4bf1a79-06e3-44b4-ad62-f1131eb60ed2", "value": "24576:WyLq8f7z38Qe1AAOaAJ2qWIipBKcYP1rz0s8pcSKtUpVt4tuofMJJOJZQf+R:lLFXex2VipAcQrQPtjKtmJJOJZW+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679791506, "uuid": "19c0fd93-a8f4-4cdc-9def-c0152ed7cff0", "value": 1062400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679791506, "uuid": "5a4b9303-79b1-4860-9074-53ee607acf20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679791506, "uuid": "150e3361-b98e-4e32-a770-82b7aebbe50e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b899f01b-cc11-11ed-88f6-42010a9c006e", "comment": "Malware payload (Chaos)", "timestamp": 1679861200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679861200, "uuid": "ccf776bf-a78b-4fee-b34a-146b8888dc5f", "comment": "Malware payload (Chaos)", "value": "85e62af1d33fe25eeebcca7dd2ebcc8c", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679861200, "uuid": "66f6d314-10ef-4fa1-9130-e41d6444bf44", "comment": "Malware payload (Chaos)", "value": "c44f74ada31e7041ba9a5e2ae61fdfb4933af58a0a1d6eaa85c4d830f0b69189", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679861200, "uuid": "1b1a59c4-0b04-4be0-aeef-c5f345afe3a6", "comment": "Malware payload (Chaos)", "value": "37fa45d703dd9759d79e37b866b96e4bc430a3b3", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679861200, "uuid": "7dc364db-a163-4c0c-8695-a615aabe41a9", "comment": "Malware payload (Chaos)", "value": "a86e0bcae446f96f1066e038a7c9e00420d545c19737bd2e177e3221099b63bb333dc5da72068e76d1f647790d6c0fd7", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679861200, "uuid": "5a309f34-f371-4048-92a7-e9847f33d9c3", "value": "T17613B7283BFB4418F2FBAE395BF07096A62FFB236E1BD46D1444034A0916F44DD9167A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679861200, "uuid": "da8fab1b-6d14-4d64-a03c-3d095270369b", "value": "768:eTo7XXEW98UILhaY4m9lUOmMayPpfHlynRUhMgAA9dEmCLUt:e+UW98U0hxJ9lJPQLVu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679861200, "uuid": "72d1d97e-74d8-48ea-ba89-4cb7af28b9bc", "value": 45051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679861200, "uuid": "390a6139-b5d1-4b0f-88b2-fe6dcdf6da7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679861200, "uuid": "79beee1b-a58e-4edd-9667-478cc861858a", "value": "2023-03-23_85e62af1d33fe25eeebcca7dd2ebcc8c_destroyer_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62a07688-cb99-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tsunami)", "timestamp": 1679809516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679809516, "uuid": "dfd5928b-4063-45fe-ae3f-9bde63f5d979", "comment": "Malware payload (Tsunami)", "value": "26ceb30ae1d3e5a2b129bcd2e52c8c2c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679809516, "uuid": "cbf34092-4865-4498-b84e-eed57de61e0c", "comment": "Malware payload (Tsunami)", "value": "c5128b6c8323eeec7765cf1daf5af92cc680a91676b02c4d6182acbdc18bfb01", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679809516, "uuid": "4a5d2158-25d6-41a5-9cab-08a5121144d6", "comment": "Malware payload (Tsunami)", "value": "f0000c7a98392d5eaee4f8c13b9d9de4b86ed684", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679809516, "uuid": "da93a050-35aa-4ddd-81bb-1d6f07a1aaf5", "comment": "Malware payload (Tsunami)", "value": "fbc51226e1d9125fb950f9faf158ef5539fb92a0e0cfb349581823622c6154233eca4fe434671b149e79b3ac0b8c8473", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679809516, "uuid": "497f5b2d-81c0-40e3-b11e-33e9528ff152", "value": "T1AFA32992B901EEB6F40A963608D34B347370BB954F531626725F396BAF362D43C27B09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679809516, "uuid": "f5994e5f-86f8-48f8-bdc5-7705a4d29c20", "value": "3072:XYWJDWdSYRgTyhVGweIS/nvZCU4jZc5Z7A:BJDWdSnTyhxeIYnvZCU4jZc5Z7A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679809516, "uuid": "4b881c9e-60f3-4493-9f55-e2fa3819c8c4", "value": 107230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679809516, "uuid": "27a40110-ec18-4486-88ca-d0459813db55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679809516, "uuid": "a5a0381e-d5d1-454e-8653-8e072b8dcd91", "value": "26ceb30ae1d3e5a2b129bcd2e52c8c2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e97b4d4-cb71-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679792302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792302, "uuid": "2b29f7ae-08bd-4592-badf-82adeb66e001", "comment": "Malware payload (Smoke Loader)", "value": "3d3d6d7b4eaa0e5cc684e823fd4ac98c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792302, "uuid": "a6cafd30-f775-4abc-b147-dbcf949d6b64", "comment": "Malware payload (Smoke Loader)", "value": "c5c954a2f79469252f3c1018a8d05ede06f58fd066a73a598602022f0f1fe267", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792302, "uuid": "caab1091-f946-4ca7-b062-6f83f3c8a1d8", "comment": "Malware payload (Smoke Loader)", "value": "7363c6fc984ee042a31f00e066a5d758f6c6e5c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792302, "uuid": "064b678d-3dae-46d3-8b62-913c2929216a", "comment": "Malware payload (Smoke Loader)", "value": "47e37c16af87f5677d99d122e76cd112a511ffd00663e6483fbe5a080db8cd14c5a2927ac59bbca12ca010d0fe582cd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792302, "uuid": "6ae41533-7501-4bca-ba5c-a83a4e43090d", "value": "T14D546C1252E26860E72386328E2EC7F82E2EF8615E157BFE17549A3F1971F72D163305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792302, "uuid": "e86fe12f-13b9-475e-84be-7aae132bc986", "value": "5bf64f0a1a526a4cdb08b53a545d3838", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792302, "uuid": "ec3c782f-7227-47f8-8a21-7490a6888f0c", "value": "6144:h0BlJlliodBIioVzglEdjTolN9mI+6Tfz:h0BxlZdBiCwTolLmhIz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679792302, "uuid": "d343ca7e-063f-401d-beb9-143b5e7549a8", "value": 279552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679792302, "uuid": "2d28eed7-62dc-46f4-a1e9-9b312277efc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792302, "uuid": "fffbb82f-fbbd-4a23-9a85-3fa1dfece28c", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e967d119-cbb4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679821338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821338, "uuid": "d0f99054-4a1a-44cf-a989-28a992b09b42", "comment": "Malware payload (Mirai)", "value": "011914f4e6c1246b03cb0798f39e0e07", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821338, "uuid": "0cd10ee8-d5c9-4666-95f6-4ff965793acd", "comment": "Malware payload (Mirai)", "value": "c5edb88626d5a0ba58540b0b5848084e5b243a4d8238d1292deea1e5de4e66fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821338, "uuid": "c94d9604-c512-4d3c-a9e3-09be05ef07ca", "comment": "Malware payload (Mirai)", "value": "070c89cd95014456c86eb995a9a9ff776106a1e7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821338, "uuid": "a32251c4-9914-48d6-af32-056cd3ff04e9", "comment": "Malware payload (Mirai)", "value": "00a9e66492193527dcaefb75cc8951adf1b6cd6033ca7a71bef3f43d3ad63cb120ffceb5d1ec30e4d37950f5a495b7cb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821338, "uuid": "3e725d90-1af1-4fe8-a174-3886aae24c98", "value": "T18EE33C56EA418B13C0D61779B6DF42453333ABA493DB73069928BFB43F8679B0E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821338, "uuid": "eb364fe5-8ee4-4f1e-88cc-84ac0b29af56", "value": "3072:yJTc2PBKpm47Oabvzj4dlRsh8ZQIldUcXkkTM/91Y:yJTc+EOabvzj4dLsh8/UcXkYM/91Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679821338, "uuid": "0f0415de-eea0-4c62-b15b-54322f760467", "value": 150618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679821338, "uuid": "1f3bade9-1f20-4d5d-9e1a-d56363801b82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821338, "uuid": "46a69b56-b735-4f56-83c1-c8bd858479ef", "value": "011914f4e6c1246b03cb0798f39e0e07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "246fd686-cbf4-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1679848496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679848496, "uuid": "c0273a7b-b0d3-4d9b-adca-bebe5fe1d690", "comment": "Malware payload (AsyncRAT)", "value": "70b310b4cce4ff03e0079930ffbeeb80", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679848496, "uuid": "9b8c0119-e531-49db-93dc-74a6662c0f8b", "comment": "Malware payload (AsyncRAT)", "value": "c619a003f3e11399752e0d3d943ce30660b927fd399397657947c555dda24266", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679848496, "uuid": "be1ddf88-90d6-48f8-8258-83007799affd", "comment": "Malware payload (AsyncRAT)", "value": "10f231855f89e57454467692bcab932945139d87", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679848496, "uuid": "da30f048-a9f0-45e3-9cef-0e10a9285605", "comment": "Malware payload (AsyncRAT)", "value": "31a6ec870c4779d47f5bb09993c1ec234ad3ba39f940a575ec3f1d42b12ffcf105dedcedfcc09895d10ec1bb043e6512", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679848496, "uuid": "a9e82aa3-1d69-4e38-a3b6-2fd09731ed3d", "value": "T190232A003BE8812BF2BE5F78ADF26145467AF2633603E5492CC451DB5613FC69A426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679848496, "uuid": "87ed2a25-8b7a-41c4-9d72-0eeb820d957e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679848496, "uuid": "c1039d36-f337-4146-8b72-a72d0a14c3ea", "value": "768:guG7lTHkqamWUAjncmo2qjkz4n9tHw2NLPItzjbngXmiL/wIsJxPbCgQq5tUBDZI:guG7lTH112zz2w2Ct3bgXPLePbCgQq5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679848496, "uuid": "7b7f508e-ac79-4562-a295-59f1458320c1", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679848496, "uuid": "bc97c601-ed83-471a-9ab1-661fcae0271d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679848496, "uuid": "ae8fde74-b3b9-4d84-b3bb-1321aa28c7d8", "value": "70b310b4cce4ff03e0079930ffbeeb80.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b885314f-cbd7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679836289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679836289, "uuid": "8a34f3f5-de0d-4b9d-af53-c4f7428bcb07", "comment": "Malware payload (Amadey)", "value": "27990584efbf5f01e2ee464f5f2381ff", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679836289, "uuid": "8f921408-3c86-40db-b023-4e0512d0c0c0", "comment": "Malware payload (Amadey)", "value": "c666a3cd45bf79f2ff9b56fe136c1625ca140529cb7e4501afc99f58de1bee38", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679836289, "uuid": "c56aa970-07b0-4380-add6-6381ae734b81", "comment": "Malware payload (Amadey)", "value": "4bade16e502a0960f50f27a46c63616e1ea62d7a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679836289, "uuid": "416270f5-1f8b-4c72-a335-7bd9dd82af6a", "comment": "Malware payload (Amadey)", "value": "186135fcdd575d51da02bc8e51deb317305954b7d9bfb8a7ff16aa3cf58ebc65ac91bf9f5c67894d7c37d4e5a80b8aa8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679836289, "uuid": "6fbdb03a-dfca-4345-ace4-3e8948feceb3", "value": "T14E352397BBDD80BAC6B41BB148F603830A32BD90AC78975B26995D5519B33C170B373B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679836289, "uuid": "85d75b93-f1d6-4af8-8054-7af9a48f10e4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679836289, "uuid": "a1c57dcd-8ccc-43c8-98e9-2c5190ec417c", "value": "24576:HyOxLccY40QZdQN0FCdVu6mYQylt1paKP:SOhccY40QZ2NuCdVbmz63pD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679836289, "uuid": "5bf4c621-54e6-448d-81a1-af4cd3a73919", "value": 1060352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679836289, "uuid": "7b798caf-737c-46e2-982c-e9200ce99832", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679836289, "uuid": "d6f82a39-7c3a-4eb4-b1e9-082e45b553ed", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a557f522-cb76-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1679794595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679794595, "uuid": "2d0dbd49-61c0-4757-9db9-353de6a81d4b", "comment": "Malware payload (njrat)", "value": "4b8ac79df242ec6b90201129194de097", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679794595, "uuid": "4b09957a-2f4b-4d7c-b1b5-26d6896704b2", "comment": "Malware payload (njrat)", "value": "c7adfa34cb814bec97bafae65d3d4e3ed49666d869d8e425965cb43e85c46e37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679794595, "uuid": "f000a721-703d-4320-9fc9-d31d70435d6a", "comment": "Malware payload (njrat)", "value": "ceaa748b946d6401e3e3e5f2842d51279e172b04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679794595, "uuid": "36f56d40-52f3-4e28-95f9-aa4022fd911d", "comment": "Malware payload (njrat)", "value": "c1d2b232108204dfc5e242916d45c5519c928c0210dfb57d2cfe82f74f401f36315bfe610e924bd73b11dd6978c9be25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679794595, "uuid": "008fe515-3450-4f21-b777-50b1225d7770", "value": "T177032B4D7FE18168D5FD067B05B2D41207BAE04B6E23D90E8EE564EA37636C18B50EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679794595, "uuid": "026293d7-2c32-457b-8460-5b7d8f1503ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679794595, "uuid": "c932b4fd-c436-4770-b56a-b0505bcf0146", "value": "384:DoTLUiSyL1G5k2gyk/kAPRm/IkBKVyrAF+rMRTyN/0L+EcoinblneHQM3epzXa/Y:UT732bk/kAwgkBKYrM+rMRa8NuYot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679794595, "uuid": "d3f3d69a-9940-4f68-8b7f-6437189be65e", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679794595, "uuid": "cd10575d-c3cb-4358-a8b5-3c465986076b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679794595, "uuid": "226f382c-23ea-4184-86c6-3a2e9191abaf", "value": "Celcrack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5293bd4b-cbdd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679838695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838695, "uuid": "2602be06-4bac-4f58-b303-96d697138183", "comment": "Malware payload (Mirai)", "value": "f9ced54284ea019efa1e2f787587ee49", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838695, "uuid": "78726693-53c9-47f4-b7bf-bccff4924128", "comment": "Malware payload (Mirai)", "value": "c87a078e320eab5fff8fa2d077e9d39dab8c1b51634f76ee7135703a57c8069b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838695, "uuid": "d9f36a75-8b92-415d-8dac-08559f7e7aff", "comment": "Malware payload (Mirai)", "value": "5aa5360fd735571220eaa4f9f43bd69079d3671d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838695, "uuid": "7909420c-093e-4788-8dae-c0eabf7f14a3", "comment": "Malware payload (Mirai)", "value": "d5fd3b92dc59e384aae62913f8c6b34d7333959eb33df39a0fdc0f6887888243f6ca71ef2e93cde5c52b8f70f57c9cee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679838695, "uuid": "bf2467a7-c2b2-4f96-b20c-17505e7accec", "value": "T1CDD3F857F800DEA2F4099A7605D31721B671EFB70E8322A2A64B3D66AE312D53477FC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679838695, "uuid": "883a3be4-524c-4226-abb8-2cee30d6a2fa", "value": "3072:74ZxY/Xse5MhpImTKAuDy72B/GRZgq329Ub7HLcDGmMqKQiVGngBmk:747IMhpImTKry7u/GRZgqfpmMqKQigno", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679838695, "uuid": "cd18aa3e-4473-4725-9184-155b96d4b1c6", "value": 141103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679838695, "uuid": "dfcf5967-a1fe-4efe-b44e-c2917fa3c9bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679838695, "uuid": "9ce77e30-1701-4ca0-9492-a61ba8db7537", "value": "f9ced54284ea019efa1e2f787587ee49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e44aef2-cb76-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1679794369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679794369, "uuid": "a910fa19-40ad-479f-9bf7-eb2ce15090d0", "comment": "Malware payload (RemcosRAT)", "value": "df59dea5d8a77ae66f24cc7d25924cec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679794369, "uuid": "f24b18a2-6e60-4723-b813-6043856a22b9", "comment": "Malware payload (RemcosRAT)", "value": "c9ec59e23695adca831f06aca398c511cac81f2fd65c7353f14b4725791ab80a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679794369, "uuid": "55bf5e36-11cb-4079-9aa1-3825f9035a18", "comment": "Malware payload (RemcosRAT)", "value": "f5a25cdae133bf6851e85c934d90508033d7b579", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679794369, "uuid": "c135d034-d62e-4c9b-afe1-ade8fd373769", "comment": "Malware payload (RemcosRAT)", "value": "54a657f27a986bdd729bba7d45e626a07c583fa375319032b5606758701a968e9870d5b95507b8d459119635e38db0bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679794369, "uuid": "77af9cf0-3467-42c2-8793-0b39446b6bd5", "value": "T1BF45121637998B85C2BC67BD14F2904003BABF3B2352EB4D2EC630DA517BB99CA51753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679794369, "uuid": "a5d79ffe-f5ac-4f4b-8059-a4426942c739", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679794369, "uuid": "8bc0ab41-0259-4d77-add9-007641d6543c", "value": "24576:al06MFYr0PLhaX7nXdrj1IJNf+QQCwQZI5RHsHgZfW4l0:alL8YnzU+QtC5RHsA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679794369, "uuid": "8a62e561-4566-405a-a868-338309115d32", "value": 1249792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679794369, "uuid": "29d40303-c4f1-4f04-8f90-b90c40eaf60f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679794369, "uuid": "50109d8f-4fec-41fb-afc2-aa42386b9a39", "value": "Lecture 10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6504e3a8-cc0d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679859341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679859341, "uuid": "54cf890b-8053-4d6b-b231-1c3419250bed", "comment": "Malware payload (RedLineStealer)", "value": "b1cb7cbd1ce5e480d7d72826fe849297", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679859341, "uuid": "4c3c5fcb-6854-41ae-9c6b-ff2e7c8f2dc9", "comment": "Malware payload (RedLineStealer)", "value": "cb2a011220c6050942b327244c7b3df1b0652c9cf1c18b64f71d2b08b654e6c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679859341, "uuid": "49dd95c9-9c4e-4606-8204-85ddf289c162", "comment": "Malware payload (RedLineStealer)", "value": "d5e7ba459dbe4d664e4afa7c21803514601d914f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679859341, "uuid": "bf021e11-51b6-4465-a312-7f65568bd0c1", "comment": "Malware payload (RedLineStealer)", "value": "12727fdd0f48391b32e8c9f8b1e8705028167739ef1f09d4b6704d0b3266e02fb220a6112c39226641d68da282151118", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679859341, "uuid": "b403d623-1d6f-4c3f-9aa5-3493142f97c5", "value": "T196E41243D7E54822DCF01B748CFA03830B367CA2A97997677B86685E0CB36C4563676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679859341, "uuid": "791755aa-49eb-4b9a-ab7e-190a6f99e1f9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679859341, "uuid": "d8321e47-5da8-43d0-9c4d-101427f96e82", "value": "12288:zMrly90AIqgN2yYHCDcTtkbt3OZHSnDLx8EAMQ5KOe1GovkgBQ8znbj:iyrlWTYUteTpYr1GovQ8Xj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679859341, "uuid": "a987a81e-4c8e-4696-845c-e1adfa1f1812", "value": 702976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679859341, "uuid": "a3ff6b35-241d-4ec9-ba20-6f25e74100d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679859341, "uuid": "d2672c95-a916-4fe6-bb53-61dbf65e39db", "value": "b1cb7cbd1ce5e480d7d72826fe849297.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5563432c-cc11-11ed-88f6-42010a9c006e", "comment": "Malware payload (Chaos)", "timestamp": 1679861033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679861033, "uuid": "7febc45e-0a29-47b7-b9b1-9546c59aa02f", "comment": "Malware payload (Chaos)", "value": "a21169a35d3c7bbe119a26b09a34fb75", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679861033, "uuid": "7570f35e-0a80-4c9b-a416-d5d77708a4f0", "comment": "Malware payload (Chaos)", "value": "cba73eaf27ff3c434da72d63041d457cd3a1712001060e9b078374a91f8ad0b6", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679861033, "uuid": "571615b6-760a-4a8c-ab28-e65e173a3d3f", "comment": "Malware payload (Chaos)", "value": "dcd58c72d6f606c615dd6f3abcb64517b1d4d035", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679861033, "uuid": "3aa4c781-21c8-45f7-8411-1211dd5a4281", "comment": "Malware payload (Chaos)", "value": "2c0952d251581cb394488105bf4bb8bcddf7ab37537949259f9dfbafb974320f4c151582f5a97773d42ac12568d8a3b7", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679861033, "uuid": "604c28d8-f2d3-421b-aff3-62a98abc4be7", "value": "T1E1D2C55EA3BA4E35F2FF2E3D597021517779FE22ED3AC62C1848040D042AF5C99A17E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679861033, "uuid": "193f41c9-0a9f-466a-b07d-b7b5fe0e79a2", "value": "768:M+08iri7IW6VujjqiBar9Z1b2feEEEEwPt:M+5iri0XojjTar9ZUehK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679861033, "uuid": "a30d858a-9ec3-4c8c-b3b2-b53f66509e77", "value": 30817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679861033, "uuid": "e25def3d-a409-473a-8262-b5cad0ae199f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679861033, "uuid": "9edf112b-74bb-46ed-af99-53d5cb1462cf", "value": "2023-03-25_a21169a35d3c7bbe119a26b09a34fb75_destroyer_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebb37a74-cc13-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679862144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679862144, "uuid": "0d4d63e5-1f69-4577-b8cf-4649f46afd1a", "comment": "Malware payload (RedLineStealer)", "value": "d11e4a59082d53abad2766a4c7da2c83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679862144, "uuid": "e9f98184-61e9-417e-b36c-4ba0710af9aa", "comment": "Malware payload (RedLineStealer)", "value": "cd7d654995db0f917d4c7d694c4ec2698eb47ee8702774ed3d9f0603cae3f8e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679862144, "uuid": "fabbcdda-5d5c-4323-977d-d09199875460", "comment": "Malware payload (RedLineStealer)", "value": "e4959411b51690dbda4b9132a41e564521491b76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679862144, "uuid": "2fd40326-d2dd-451d-9ce8-0edb92b34ce9", "comment": "Malware payload (RedLineStealer)", "value": "550d9d11fb3ec7c958f39ab56c16de623f4face32fa6ff25fcf0da1eba0356cf9f1a2088bea1d0aad935a8029440acab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679862144, "uuid": "2604493d-34e2-43cb-840c-af63b928939b", "value": "T1C7952302FAD2C8B2E5321D32562DAB1131BCBD300E34DA27B7A82D7CD939591B725767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679862144, "uuid": "62cf0a58-7483-4908-8ef4-3beff767620f", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679862144, "uuid": "7db1a8aa-925b-456f-891c-88e1c0b38efa", "value": "49152:V5O+qBxAR65Lnt4ZPmN24wBU/VWGOVblDNZhd:V5CBxARCWG0blThd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679862144, "uuid": "37b522c7-e2ce-430c-adb8-fe1ea304dbc2", "value": 1971955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679862144, "uuid": "f036157c-6886-441e-af5c-b829183d8f20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679862144, "uuid": "23895219-1c64-48e0-b679-d15128269c41", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55f7ba0a-cc19-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679864470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679864470, "uuid": "0a727448-8a0c-4c2a-953d-822696d13cdd", "comment": "Malware payload (Amadey)", "value": "5ab493e8263fdc603cd5d6379781370c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679864470, "uuid": "539a2da1-e529-4958-aa52-b28540407ab1", "comment": "Malware payload (Amadey)", "value": "cf031c6da544366c478a769a2a11743e07e6081891344ed83a3e0ab2a96f2343", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679864470, "uuid": "a00bcf81-9b1a-4bf8-9b2d-2f1873a1f187", "comment": "Malware payload (Amadey)", "value": "92e0ff46ecd086e0e030e9ccb0d9b12a5b0716b4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679864470, "uuid": "6918598f-6d6f-4866-b361-15e8c014869e", "comment": "Malware payload (Amadey)", "value": "ac6174637933d257c7a12cbeed8aec189b9131112d9cb813376d92f5e96e94626ea819e5bed299c74e6407315ad2288f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679864470, "uuid": "9acf0821-bc79-4959-92f4-5e3b86dafedd", "value": "T1F925232273D4D873DC901B7158F627C30E357CA14974C33A27A6B19A1EB3794A5363AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679864470, "uuid": "b80cf7b1-6423-4d73-a602-96d8eea8f12f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679864470, "uuid": "818a9d5c-9313-47d5-960b-76735d297719", "value": "12288:/Mrjy90Pqd4U96S5aY50+IprbrXcGhJb3pJmaiqorbP0XHG4ioCk88AVKMCT6C:gybdfDg+INrxhhHmdrbP4mDoJANu3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679864470, "uuid": "552cd06b-737d-40b5-8762-4fd0cd29db5d", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679864470, "uuid": "ad97af7f-e6d7-4501-9c37-fe04f9bbaf06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679864470, "uuid": "27488606-4a60-43a6-ad33-e98bddae2eb9", "value": "5ab493e8263fdc603cd5d6379781370c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d41317e-cc02-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679854523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854523, "uuid": "db021f4f-b137-4aa6-9e84-444c71f6140a", "comment": "Malware payload (AgentTesla)", "value": "0dc62cfaa97d8e6e5b4b31770c78f47f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854523, "uuid": "348f43a7-9d36-473c-8b5b-84456c01e92f", "comment": "Malware payload (AgentTesla)", "value": "cf2168940995549a47e170ff65e038af63a8217526c9dd292eed8f98957750bb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854523, "uuid": "8d901800-1f1a-4e7f-8475-92e7a5007293", "comment": "Malware payload (AgentTesla)", "value": "7bceac1bbb293d269091fb13fe086aa7af5f1966", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854523, "uuid": "071d376b-d2e6-4122-8d74-d9a50bf13773", "comment": "Malware payload (AgentTesla)", "value": "a8d0ba8c71d2473efb8c288443254955f93ecf1b7e259b2bab9baad21257b98795d427d3ecf1edc1a7821399d0a863a7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854523, "uuid": "4f53428d-bb53-4e36-b801-bdf3b1aa3993", "value": "T1C14523542FBC8E51EBAD133911E2D0EED375702ADB48DF2A0D84849CD8C67A86615BF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854523, "uuid": "747d6b22-826d-4902-89aa-a0bf3985af60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854523, "uuid": "6ae0fa7d-2ed8-4d0f-ad64-d956d6b04359", "value": "24576:Q+vs6wgvlq0W188h4b3suhmaYwihwQwmX8zWTHF6VeZbCIXK8P5dEda5JM:Q+ExOzM4b8zwi6Q5fWexCIthdE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679854523, "uuid": "76f6d4cc-a2a7-4df9-8f6e-e7ad1988fcd8", "value": 1231872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679854523, "uuid": "17f5d8e1-ec42-48a1-8a63-af367074b527", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854523, "uuid": "02670833-6efd-46fd-b56e-ec27c66ebef3", "value": "0dc62cfaa97d8e6e5b4b31770c78f47f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc2ce401-cbf3-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1679848348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679848348, "uuid": "98bf83b4-0248-4de4-a1a1-5276c43987e9", "comment": "Malware payload (GCleaner)", "value": "c403333de741e184676165718fcf7111", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679848348, "uuid": "cdcc0f99-9421-46d6-affe-b16e26b408f7", "comment": "Malware payload (GCleaner)", "value": "d05faa3accafd17c997f954412a861208477f3deb4a60e8154b8a75aaac05989", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679848348, "uuid": "71191c80-e8e3-42fc-b2c1-33023ef2d59f", "comment": "Malware payload (GCleaner)", "value": "fe1b3ebe150c6eeba997cb6d00cba91afe50c075", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679848348, "uuid": "617d9e01-755d-4846-b57e-6dda79804f5f", "comment": "Malware payload (GCleaner)", "value": "a70ef2cfe913b4e655bef412cb3ea54a44129cb09d78e2d6125951df95a54dbf3ba38caf605c51ff21670718e3e4aa2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679848348, "uuid": "c57f5f9c-916c-41d2-9283-586dd58f6c65", "value": "T18474AE3252F06820F662EB328E2BC7FC2A6FB9619E157B7E17555A7F09702A1C131335", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679848348, "uuid": "2523ded2-a9b5-49be-9cee-0121e5aef775", "value": "59edcf4038e73a659a2ff6e04ad467ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679848348, "uuid": "646f15af-d2b5-4f21-9de3-10f65bdbe06f", "value": "6144:mk297oIiDDagb4XCpEHMnc6C65z6Gr5W/iNN4T:X297viDGgb4X7HcVX5z6Gr5dN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679848348, "uuid": "38421b90-4548-4445-ab9c-75b74b40d71a", "value": 361984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679848348, "uuid": "f97dcb50-beda-44bc-8377-d4d880ec3d56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679848348, "uuid": "ea03b42e-9b9a-415b-94c4-90c314311f35", "value": "c403333de741e184676165718fcf7111.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04507296-cc31-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679874641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679874641, "uuid": "20bc7d28-4a9a-436e-bbba-d4e48e899224", "comment": "Malware payload (RedLineStealer)", "value": "b9f7bdf334264375c4de1da1918b9f32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679874641, "uuid": "9fd707ae-aa1b-43b9-9f07-7139b05d6010", "comment": "Malware payload (RedLineStealer)", "value": "d0bbc63fb5cbbfe796106e768883253d6839e20106e436368ea36dbd9488fd94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679874641, "uuid": "48c38a04-d328-4d68-bed1-146e1245deb7", "comment": "Malware payload (RedLineStealer)", "value": "9dec62ee014fc6e87bc30ad11904809d1381fbd9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679874641, "uuid": "92f4c0ad-e1e3-4087-ac18-92a698786089", "comment": "Malware payload (RedLineStealer)", "value": "f80896e036d98f460b0ff408591c0d8d7059802a28218d4b9bfb67725b52bc30e70a1c5c2d814dd76e4bce071dd51d0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679874641, "uuid": "7dcf94f4-ed4b-467c-a3e2-8db78c2132e8", "value": "T195F4F12A92F47820F63742327E1AC6F42A5FF8625D177B6E324DAA3F09306B1DD61315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679874641, "uuid": "29ccf8b0-5e43-49b4-8e51-d963a00c9deb", "value": "e995a4cf6af4dc2215ec1060df8374d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679874641, "uuid": "23a9662d-b50b-4ab8-9743-a7b06821b5a9", "value": "12288:M6wPvQ/TucEaw27CDzp9E+QTWQF6Cc7DUpf/rsq+BbY+GEtM:Io/TuZ8C/E+QTWQgh7G+C+GEtM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679874641, "uuid": "5ad7a17a-953c-493a-9a2e-018b78bf681b", "value": 729600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679874641, "uuid": "339e704a-eeac-4f75-8e7f-656e2251eacc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679874641, "uuid": "e2f6c546-7f77-4b09-bba4-6aea1932d17e", "value": "b9f7bdf334264375c4de1da1918b9f32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1c131df-cbf3-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679848276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679848276, "uuid": "ba717e0c-e095-411d-b7db-6b0d1d0cf020", "comment": "Malware payload (SnakeKeylogger)", "value": "039d18e2ebeed71e4de189290ecc6554", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679848276, "uuid": "269a3d9d-fedc-4196-adde-bb2293027501", "comment": "Malware payload (SnakeKeylogger)", "value": "d18c9b56900681c70305abb559a6d1a645b0f3bd0238dc8e83de4a906f6aff0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679848276, "uuid": "eae1491b-11a3-48c9-83ff-f57ef901266a", "comment": "Malware payload (SnakeKeylogger)", "value": "082890e596684e635ea4839c5c1c9333a93ce3b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679848276, "uuid": "cede2810-a9b9-42f3-a8a2-290899c47d21", "comment": "Malware payload (SnakeKeylogger)", "value": "a1451772cc92b9ddc633ba68a91351d1f280eec994a30947e9a2cad4dec7d2bb24444c8950d5ee88c816bc5166b4091a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679848276, "uuid": "c185b3fd-338f-4628-8150-3f2de0652074", "value": "T192E4232AA347C372C539EBFD942B380303B293B9E1D7D6AE4CB028CD97527551F62582", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679848276, "uuid": "b3d6b061-6aea-4e64-ad67-9e399b3d3ce0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679848276, "uuid": "e05f776f-9307-4336-ae5d-c08fdaf47746", "value": "12288:v7qY2zl06/TgTU4beaSHdXMVOUvOFhcp/bHJLJ0Ag/0sB9KAdkYNmwDL70dJ2gD:kl06MF8HdXM3OFhcp/bzng/BnmwAygD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679848276, "uuid": "d1fd9862-3f84-4df9-bdd7-258da1bef247", "value": 691712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679848276, "uuid": "9fe1d2ae-c9e3-4e03-aa3d-ee183f817ed4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679848276, "uuid": "b757d663-0f4a-48a5-869e-e5f882d3cc3a", "value": "039d18e2ebeed71e4de189290ecc6554.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4297d421-cbb6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679821918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821918, "uuid": "58c0908e-daee-41fd-9067-88b9624b4995", "comment": "Malware payload (Mirai)", "value": "77ec84195877a0cafbeefed06f1d836a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821918, "uuid": "acba6c35-70ee-453d-88b1-34cc6710d199", "comment": "Malware payload (Mirai)", "value": "d298e92c9596ba69338186e4eb175027f364656888b040a36257372087a2fb17", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821918, "uuid": "58391c7b-5f81-4777-b1e2-6a11062fb509", "comment": "Malware payload (Mirai)", "value": "6fc6d2b21c0e6a189bd4980dcc183f98fec36abb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821918, "uuid": "13f28209-f0f6-4dc5-bb84-8f88d5d211ae", "comment": "Malware payload (Mirai)", "value": "050ee248693f022a52c75739d86fff75d74fc73eacf01b16e0436dc0040964ddb6a03e80b38b2faa936e36f2b25c3781", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821918, "uuid": "a5ab8480-d841-425a-bd80-89b87ed22d41", "value": "T13EB34B22373A0B23C0E6643940E78737B3F65BC92A64920B7A651EDC7F16AD03553BB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821918, "uuid": "c8f8b802-250e-4a58-8562-83161af37997", "value": "1536:nCsfQeoFCEZWisQMbinlTT8QSznoqEvCT/+lg+csafaKTtl6t5N7W7V/z:n/MbMunRuzno7vhlOyKn6LNC71", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679821918, "uuid": "c2cbf4e3-c322-430c-959b-6b9ca74531a2", "value": 115675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679821918, "uuid": "00e9e8cc-532c-46ca-ac2d-d7757a6a1716", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821918, "uuid": "81bbf570-5c0e-41f4-9ced-4a309f0eba4d", "value": "77ec84195877a0cafbeefed06f1d836a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c720187f-cc14-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1679862513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679862513, "uuid": "08fdae59-2ea3-45c2-a661-781a321029b1", "comment": "Malware payload (RecordBreaker)", "value": "ce0f07a6ff35fdfac88da534d96afbca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679862513, "uuid": "5b36d7f0-06f3-429a-94c4-72ec2b19f372", "comment": "Malware payload (RecordBreaker)", "value": "d5301f0aa2903dc9493efe722fc1b173d52c9cb2c62634966edf00a4201b4c2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679862513, "uuid": "0e9fc8aa-3f79-4143-a5db-15ad453b1c59", "comment": "Malware payload (RecordBreaker)", "value": "0a5528adac0cc834d0da7d8dae8256aa0bff2b71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679862513, "uuid": "26d96f39-340c-47c7-a807-58303032b0e1", "comment": "Malware payload (RecordBreaker)", "value": "21fa32cc246092e8684524ae8360e1a841c752f5c237cd7b60f70bcc95536f843278f59246eecff172e36b4ed1e85513", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679862513, "uuid": "584ad800-14a7-4217-a498-381b1a726e1a", "value": "T1D6548D2AA3F46830E5734732BE2AC7F42A1FB8215D177B5E3659AA3F0970761DD62304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679862513, "uuid": "a60d7db4-efd7-41a4-9061-1e66133e7c0a", "value": "a45b0eab0ff7170ea4d75272be8d3235", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679862513, "uuid": "c3778530-3d30-41e9-85d3-d119cc5b62f0", "value": "3072:htHv+oq+JFrbe7288nmN8NddjFmGzDcn7CIgnnpgWjzmRNeGBcon78B:CoFVbeS883RmGfc+nnpgWj6OGBc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679862513, "uuid": "868c7668-1700-486a-9fa5-6d8161476279", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679862513, "uuid": "80235a42-04db-440b-a3cc-bb8252d063f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679862513, "uuid": "190e2881-4b2a-4460-ab67-bfc1c0f3aee7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e217f80-cbb7-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1679822447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679822447, "uuid": "3d7e8db5-7e96-46fd-b981-dc6806577e82", "comment": "Malware payload (DCRat)", "value": "54c6b64cb242fc9e210578980c59c0ee", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679822447, "uuid": "77a85a1a-772a-4ab9-a4bf-bb23d2c7f191", "comment": "Malware payload (DCRat)", "value": "d56bc8947bd949294eeb0b4191b94beb2553e5972c72587ddd215ebaf899354b", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679822447, "uuid": "f70569bc-0daa-48b6-abdf-819db54fcd6b", "comment": "Malware payload (DCRat)", "value": "1dc98a41b748f67c73fd7be8d702dfc60e7c8305", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679822447, "uuid": "5afb54bc-b0ca-45a5-807f-e4814d5fb527", "comment": "Malware payload (DCRat)", "value": "f3f5164d237fbf64f1e190a5c2fc587adc0e38c28e52aaab50ce15b91784a1689046de3012a681c4606381963149110e", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679822447, "uuid": "be5dc8e4-80eb-4dd9-95fb-9a32ba8d8b23", "value": "T1335529017E448D11E02922B3C2AFC53487B0AC546AA6E71B79F93F6FF5653927D0C9CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679822447, "uuid": "d773025d-deac-47ec-aa9c-840578324181", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679822447, "uuid": "0cf51e1a-3d6b-4c3b-baf4-078b33757c08", "value": "24576:52G/nvxW3W60GnMGAa6h5QcxfImbaPaoVRhL0b7wTy:5bA3+G7AScxfIuaiod6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679822447, "uuid": "7ac195d6-c78e-4490-b04b-a0fdd8727b2f", "value": 1394861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679822447, "uuid": "fb6e9985-6aa1-4fe7-9733-3b7394451e84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679822447, "uuid": "3448ebfa-5ce7-4810-b8f3-26ce68449fa8", "value": "54c6b64cb242fc9e210578980c59c0ee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a17daefe-cc11-11ed-88f6-42010a9c006e", "comment": "Malware payload (Chaos)", "timestamp": 1679861161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679861161, "uuid": "fbb4c2c0-3480-4b30-a08c-acb18590457c", "comment": "Malware payload (Chaos)", "value": "24d7ed696e736edb50e34f24da9cff6b", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679861161, "uuid": "9d724930-c21f-4cd9-8dae-5505b01eb390", "comment": "Malware payload (Chaos)", "value": "d643a6518ad090dea2da2c1485eb091d38eadc2f74b13419709fb3f86ad66fb0", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679861161, "uuid": "20f8a5c1-00f6-4ad8-bb23-1a1ed92ae70e", "comment": "Malware payload (Chaos)", "value": "2fd6e1157e0234c0c1f2f6b5523a50b5cfeab6f9", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679861161, "uuid": "0ee2318b-950c-4491-9743-343cfc129de2", "comment": "Malware payload (Chaos)", "value": "083b091cad76bcbab43af1faf596fe9db2358297f8d0aa93b7e5fb6f265d4641b1d10f68cc41b685d47c346f74097340", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679861161, "uuid": "ad6f8ce3-dc56-4726-a7db-bfd9d67ee7cc", "value": "T1F5B2614EA7FB4D29F5FE2E3C987121107779FE22DC3EC66D19880849086AF4899517F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679861161, "uuid": "7393316f-9b17-4806-9d15-a2bd8f46df38", "value": "384:6DNdVNxNqdh9CVWhxPHugwzdzqGFJVr91C0Qb5vD:6xNShUVWrHugEzjVr9ZQbND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679861161, "uuid": "e19ecc84-dc8e-44b1-93bc-f23aae890894", "value": 23548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679861161, "uuid": "91e4b0e9-7ed4-4b90-9ed2-162e70f17f79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679861161, "uuid": "7c0bb28a-03d3-4e4e-b203-c5b993f2b354", "value": "2023-03-24_24d7ed696e736edb50e34f24da9cff6b_destroyer_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a328005-cba7-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679815488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679815488, "uuid": "f4f528eb-1a96-4bff-ab0b-1ee44604cb4d", "comment": "Malware payload (RedLineStealer)", "value": "7f9cc3889e95b39a93593207cc823dd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679815488, "uuid": "183fe24d-673b-4b34-8353-ad3e9beb8397", "comment": "Malware payload (RedLineStealer)", "value": "d66720ec90fd4c8e65e9a28272ec291db0e7a7ce60426e219ef4623e277313f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679815488, "uuid": "303690d1-04af-4535-8f66-95951550fad7", "comment": "Malware payload (RedLineStealer)", "value": "553b922ae2d755e012792ab495c879f63ab3b923", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679815488, "uuid": "94e90dfe-6abb-4c66-a687-e6dc83a8f62b", "comment": "Malware payload (RedLineStealer)", "value": "6a069a31ceba6179fe18db4433f925a9f53724c982da6bdd359c93a1076cf2fd6f0223fdaa8b685d6e9a1eccaa93913b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679815488, "uuid": "46700be2-8f9a-46bd-bdd9-41898188c610", "value": "T19515F956A6A1FB12E388463AC0D4C83423F59C8477E3F31B66CCAB977413B168F2B655", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679815488, "uuid": "4a3e05ac-9bac-48ab-be33-43cbd77f5c65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679815488, "uuid": "a5ea9e70-0749-4426-8875-7b07e294b076", "value": "12288:/m6ynDHLvz37fjnf1DS03fhK6Uw7W0iRiRtuf+ro3H8o+XAKx+OtOgRv:zmtti3H8oVw+0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679815488, "uuid": "a4a559c5-89c0-4f92-a657-268b38f8cb05", "value": 916480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679815488, "uuid": "c415321f-2486-485a-9521-4cb1980349bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679815488, "uuid": "41c99102-5f35-4d95-ba40-8d79008e2333", "value": "7f9cc3889e95b39a93593207cc823dd2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac70d937-cb73-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679793319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679793319, "uuid": "9842b8e2-1801-4f0f-8537-03a38bec946a", "comment": "Malware payload (RedLineStealer)", "value": "894c0da2e5e34bbfce490003991bce69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679793319, "uuid": "dd03b179-1a5f-4235-a469-00e590884029", "comment": "Malware payload (RedLineStealer)", "value": "d68ba5d832b6dd7257751c3247c32b9f98d7632c1eefa4953eafc6188fb92520", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679793319, "uuid": "224f5c8e-c6be-4235-8cd2-974a3a6d1d79", "comment": "Malware payload (RedLineStealer)", "value": "161a9b075374ddfc942f45d829eb5de46076d8ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679793319, "uuid": "940f7860-4a0d-4e56-a49b-920f7433c77f", "comment": "Malware payload (RedLineStealer)", "value": "2118fdab66050ed26b35b4c08916f1dca2296576ac89b4e10cd5c4c01c3a8942d20af25f321efdd62f8b26b1c26074e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679793319, "uuid": "0134518e-2ecb-4945-ae44-a5aecb3c84ee", "value": "T1AA84AE4253E16461E32786328E2AC7F82E6EF8625E157BFE07548B3F2971F72C162315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679793319, "uuid": "1ee67349-dc25-487d-a52a-c268f77933fc", "value": "5bf64f0a1a526a4cdb08b53a545d3838", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679793319, "uuid": "30c54429-d704-44a6-89a1-402fe97ba5da", "value": "6144:dfaWZ3pSKA6cR/6SkCjEXhJJ4PwGEs+/f3KDZ0JD6GQTfz:dfawpHA6cRCCjEbm7A/fy0JuBz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679793319, "uuid": "934a5693-b318-405e-b306-d5b992fba2a6", "value": 388096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679793319, "uuid": "f28f9038-a30b-4ae2-9319-766f812d360d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679793319, "uuid": "9ec7171a-a198-444d-af77-9f35943a94d8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eff4c3b-cba9-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptBot)", "timestamp": 1679816301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679816301, "uuid": "598bd99d-3f4b-42c0-a785-c1556fd31491", "comment": "Malware payload (CryptBot)", "value": "369f9b8079e4bed5200c40a780a3b2db", "object_relation": "md5", "Tag": [ { "name": "369f9b8079e4bed5200c40a780a3b2db", "colour": "#63519F", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679816301, "uuid": "196d7daa-7b0f-4b9c-bd6b-a2adf86bd647", "comment": "Malware payload (CryptBot)", "value": "d785f92dc896bdd9ebdf3b17cb3de19f732a3eeb040211e38df6ad1854049ca5", "object_relation": "sha256", "Tag": [ { "name": "369f9b8079e4bed5200c40a780a3b2db", "colour": "#63519F", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679816301, "uuid": "aa11b9a4-28cb-4782-afe6-2c5f642fca36", "comment": "Malware payload (CryptBot)", "value": "81f72f547dea34090ae81412afd0f18c9d310c19", "object_relation": "sha1", "Tag": [ { "name": "369f9b8079e4bed5200c40a780a3b2db", "colour": "#63519F", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679816301, "uuid": "51f9d86d-e599-4a7d-8419-09468a1b01d7", "comment": "Malware payload (CryptBot)", "value": "c4870b2764eea327c402cab5b86c56efd9a03aaecce6fe75a6aa4a5798c81937e22e11e13d85672e64f3066c01e6c83a", "object_relation": "sha3-384", "Tag": [ { "name": "369f9b8079e4bed5200c40a780a3b2db", "colour": "#63519F", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679816301, "uuid": "ac298ae0-28a4-4281-bf3f-33102005d425", "value": "T1A37622BA107808CAF7BA9639B710FD5835F821A69547643FB0E95FD02A32740795EF0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679816301, "uuid": "c794d3e1-a824-4638-9bdd-df7fcc997afa", "value": "7d59f1d82b84e111e9b6c1196cc48fca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679816301, "uuid": "b9077fde-85c1-4e56-a76e-d735446b25ee", "value": "196608:LzJ3OmjEn9v0J+Mq6Br++jcf/27E6AeUStw6qadZmy:vJ3OmjE9v0Jhq6ncHQby0qadZmy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679816301, "uuid": "67e30ddd-bf38-422a-8463-1c6981dfd510", "value": 7130904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679816301, "uuid": "d55eef7d-9353-4775-a82a-d7d909461bfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679816301, "uuid": "a7f8fc4a-184d-4a8d-8f26-c870b1d17b0b", "value": "369f9b8079e4bed5200c40a780a3b2db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c937a11-cbe1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679840403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679840403, "uuid": "561c84c5-012a-460f-9c49-8195f3c7e1cc", "comment": "Malware payload (Smoke Loader)", "value": "596d8f644ddca88aa583b978acdd24a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679840403, "uuid": "f1d5fc43-c4bd-4cf3-8102-18c5f6692cbf", "comment": "Malware payload (Smoke Loader)", "value": "d936d6cacf0d0a07083a609ae2475729aa9571bb27f16e89e043cc84f3e08cc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679840403, "uuid": "4a5287f4-07a3-4d43-af9e-c374e69e729d", "comment": "Malware payload (Smoke Loader)", "value": "eee509b98db80540795a130bad1ab9565aa04fc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679840403, "uuid": "16d061cc-223f-46d7-b108-2f635465e791", "comment": "Malware payload (Smoke Loader)", "value": "d8272b27de5e2b6edff3165b3d41fd3258106eab2c2e821c88549b0c4adce647cdc3701eaa9a3c95bf510497cc1a1e7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679840403, "uuid": "901da41c-b3fd-4a36-b864-86c5da2eaf17", "value": "T138547C32A3F47860E562D7328E2BC7FC2A6FB9619E156B7E17545A7F09302A1C172334", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679840403, "uuid": "df1bf65b-f080-4c2a-92ef-f4a2628515c8", "value": "c5c75c5b6a7ab4fe20f346e6d5121c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679840403, "uuid": "3b625f2b-ac9f-4dc1-8d75-b77a2c114df0", "value": "3072:X3Uo6ySkvufjvrHedZuqBSabZs/kItvgNATvVPFPswkhZc8IBjWmE7/LpNN4TJY:IEajvLedQnvgNATjVkDTIBjWf/dNN4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679840403, "uuid": "018058cb-838a-41c3-b2d6-832e8b88cecd", "value": 281600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679840403, "uuid": "afc59347-0e78-4415-abbb-310a12b0ab9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679840403, "uuid": "f916e56a-cc3e-413c-a8a8-af3dcf0cfdd8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3e3abdb-cbb0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679819611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679819611, "uuid": "0b1b118b-b89e-486b-97fc-df84590ef94a", "comment": "Malware payload (Mirai)", "value": "73c1eff4fda39e3d45552b0640190c11", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679819611, "uuid": "7a756583-fc3d-4c6a-a1fe-41edd02dfa65", "comment": "Malware payload (Mirai)", "value": "d9413df16cdd226936419b5ffc0200329ba28a5f6309515c0f9605f2dde1cca8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679819611, "uuid": "bc720ad2-e148-45d0-aae4-e984355069f0", "comment": "Malware payload (Mirai)", "value": "a32598f12028ab2d82c02919a507295575932124", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679819611, "uuid": "6dc88a27-ad65-409d-b13e-fa9ede53850e", "comment": "Malware payload (Mirai)", "value": "b9aaab7a8defb3bf74d317fb6d3ffdce86689f39f58b331ca2b3a15d84806099d43d260f961d9f7b00680c7d1a2a91aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679819611, "uuid": "ff0cac96-c79e-45d9-a574-2c222fbe40fd", "value": "T176436BC4F643D8F5EC8705712077FB379B72E1E922A8D643D3B4DA32AC52651E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679819611, "uuid": "ab6e403d-050e-40a0-85db-95018583217a", "value": "1536:JeESt/basV2rcZhG6ySN7naaRe9xzWOIaEjrqMN:JeESt/basVTgS7naaw9BtXESm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679819611, "uuid": "bfe44f94-7f67-4ce2-ac5f-9b6d2cd61654", "value": 55632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679819611, "uuid": "e8574618-2599-4f79-98f2-af816b1c091a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679819611, "uuid": "bdc17354-5733-4031-9422-c930b039951d", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db541e38-cbdb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679838065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838065, "uuid": "dce76973-cbb1-4fd2-b041-026b99f9f961", "comment": "Malware payload (Mirai)", "value": "75e1f47e5b9f291eb513eb4346aa9551", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838065, "uuid": "d5bbea79-9667-40a8-87c1-ed5ffcc00540", "comment": "Malware payload (Mirai)", "value": "d949824919f7f3519325a46228fa4e4f7a38bd357d526c69f2a2d543ae3cdd61", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838065, "uuid": "963294bc-4815-46e5-bcb0-57b37ab90864", "comment": "Malware payload (Mirai)", "value": "2f89e9d7c83c0cb573c324595c3cc247174eeb0b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838065, "uuid": "94c08c38-4afe-48b7-b3f6-6f8334e7aaf7", "comment": "Malware payload (Mirai)", "value": "35deb7b020d351210bed4f55a6c48273219dde5ade972749d4c848851a7206adc025ab10b5c354752414768508157512", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679838065, "uuid": "c07b5652-c3fb-4920-8ade-020f7b09e26c", "value": "T107D33A1748618E72C0049DB225A722200757BE774E9F26DAE93D79E0977B8CF612EFD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679838065, "uuid": "856c36db-4fab-412c-a75f-48334003d777", "value": "3072:EJ+vpNb1TI/fmetJ8add9Qzhs6e/3TEwwLFyzKQ5CGBgBFU:EJYj2fmetJ8addQZq9uFyzKQ5BBgBFU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679838065, "uuid": "7a02835e-a723-4f96-be62-1b6037052d08", "value": 133894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679838065, "uuid": "8e370a08-7aeb-4a9e-9a32-437736c471bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679838065, "uuid": "9d284a2d-a085-42f3-b16b-a41614018272", "value": "75e1f47e5b9f291eb513eb4346aa9551", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "645a89e2-cba3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679813814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679813814, "uuid": "eeeab689-0efc-4771-8885-755f41a4f2b8", "comment": "Malware payload (RedLineStealer)", "value": "3ad416dd97a724e3cb87eadc1da8570d", "object_relation": "md5", "Tag": [ { "name": "212-113-116-143", "colour": "#077D6B", "exportable": true, "hide_tag": false }, { "name": "cochang", "colour": "#3EAEE3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679813814, "uuid": "5746ecfb-1846-44bc-b2c5-5d58dbf2b357", "comment": "Malware payload (RedLineStealer)", "value": "d9ddd2763fbdf68ffca57d9104c944fc3ed3f158156e95ada29e74b183353e78", "object_relation": "sha256", "Tag": [ { "name": "212-113-116-143", "colour": "#077D6B", "exportable": true, "hide_tag": false }, { "name": "cochang", "colour": "#3EAEE3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679813814, "uuid": "a2df9486-ac57-45c4-b0df-777bb823a14c", "comment": "Malware payload (RedLineStealer)", "value": "dd0fc3995aba90e862c8a11562e1b1d004b4442b", "object_relation": "sha1", "Tag": [ { "name": "212-113-116-143", "colour": "#077D6B", "exportable": true, "hide_tag": false }, { "name": "cochang", "colour": "#3EAEE3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679813814, "uuid": "ab933d6c-943f-474e-a78a-dae0a37b0742", "comment": "Malware payload (RedLineStealer)", "value": "d1564bf1c12ed04de27bd38f04452ca35264bd303450d0030fe377a28cfe4b6993c413a7cc91ac3e656d4e87ab61ed0a", "object_relation": "sha3-384", "Tag": [ { "name": "212-113-116-143", "colour": "#077D6B", "exportable": true, "hide_tag": false }, { "name": "cochang", "colour": "#3EAEE3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679813814, "uuid": "09ca3bd8-76ec-4f91-bd0f-c1b60b15e319", "value": "T19767332039C098B1D9670536CD94BB5076BDFE30177A4EEBAAE4691E67345D02F32E83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679813814, "uuid": "72e7d74a-8843-45c5-841a-d49cc74c19b9", "value": "b5cdc5501116a5933f87b847ea44476c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679813814, "uuid": "ad719af9-097c-4f3d-ab2e-c2aee0e8b908", "value": "786432:znjMR4qHLpizyVp/1q1rINsjsq3gazg7ak:zjBqHBV1q1rImjsQxPk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679813814, "uuid": "d87164ee-7c64-4c34-bfd6-349b44e432ba", "value": 30495752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679813814, "uuid": "74e743ea-8934-4e44-accd-26c7bcf126c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679813814, "uuid": "c8dfc372-4ea9-4ab4-bc4d-46f366b44262", "value": "My video call with celine764 At 3 minutes and 17 seconds showed me that he is indeed FEIYANG.mp3.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f0f505d-cc01-11ed-88f6-42010a9c006e", "comment": "Malware payload (Fabookie)", "timestamp": 1679854178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854178, "uuid": "9d3296d9-e9cc-42fc-8b52-e196e0a0a1e1", "comment": "Malware payload (Fabookie)", "value": "48deca49ac800d1a61531290158e56e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854178, "uuid": "06906511-a479-435d-a5f7-baa534958507", "comment": "Malware payload (Fabookie)", "value": "db7ea1a496e6e1af76d6c63f29ed0472224edbf2b7abb2803d98c0957789bf39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854178, "uuid": "97fe3ed5-f8aa-4b59-b607-0914cb6ba265", "comment": "Malware payload (Fabookie)", "value": "067dde00f6fd844e67d44e8c57f1f89495720ca0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854178, "uuid": "de3d7d61-4931-4117-a8bf-8519d7a0260c", "comment": "Malware payload (Fabookie)", "value": "5985766a4a6d1ae195ed73fcf8805b9729c90b2b3a8bf936fe701728a897a1f5ab1a4d96beff4d0ceea9170ed3eb378b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854178, "uuid": "dec8eaf7-288a-49f7-b694-5f7b2d844fa4", "value": "T19DD4DF81B39095D9C8B88430C693CA71CA317C64DB28569BB7D4BB6F2F32AF16537316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854178, "uuid": "1fe67013-028a-4b6a-b347-8b61eeb638bb", "value": "4673ad56625d375f2efee239af061364", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854178, "uuid": "493b38b6-b48e-415c-93be-bcd1d2c8d206", "value": "12288:G72WP3/jlx8Xr3lRkRc4YFwjsWOfRg6gtPbcTTn7qxerx7:qP3/fWr3/kRc4l6g6gtPbcHn7q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679854178, "uuid": "5a44eb5f-b897-40ce-8701-c709a7a5b074", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679854178, "uuid": "a10c05c9-e992-4bc8-9788-87f5fafa3dcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854178, "uuid": "8db10ea6-8bc9-4ada-93ff-391ee3baabb2", "value": "48deca49ac800d1a61531290158e56e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "568b23ea-cba7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679815509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679815509, "uuid": "b83483fb-7669-46d2-98a8-f75008311028", "comment": "Malware payload", "value": "443785bf8b874e307b89db380dfeb164", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679815509, "uuid": "5e72c592-b7a8-44a9-807d-a13fbe6806fd", "comment": "Malware payload", "value": "dd08c49d2c91b7f446c231a6ede439fdf632d7d2f4dc4ad4ab52276b4aae96a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679815509, "uuid": "742f0815-32ac-4ac8-901a-dfeeee6e5d31", "comment": "Malware payload", "value": "525093ccff5a03c0a5e56e55628071a47d5be33c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679815509, "uuid": "561ccf67-f980-477f-b719-87762be05f5d", "comment": "Malware payload", "value": "6b58f8a8394ba3400a815f93a2347ced440ad748d25be6855cf222f69b11ccc7dd0c9459e740338777ec555f264697ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679815509, "uuid": "318543af-f466-47a7-a6fb-c4d5ac897e69", "value": "T188E64A43F89190E5C5BDD170CA369262BA303C495F3023E73B24F6B92B76BD46A79358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679815509, "uuid": "561001b9-8bf0-44e3-bb3a-9f3355aff41a", "value": "57c9b357ae0cb2f414b0a5873e2f216d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679815509, "uuid": "d3ba5b18-ee52-4c1e-a6e1-d290ddad98c2", "value": "98304:pBg2GX62H0RJH+UpFOmj+0EP/4zng7Y9t:pZL2URJeOjI4zn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679815509, "uuid": "f20e267f-3d86-4f62-8a8d-9194c24d5c19", "value": 14548480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679815509, "uuid": "632f1446-2e76-461c-9a6f-e6c79c42e78e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679815509, "uuid": "bab6eb3a-ca6b-42b7-a931-1f264358e323", "value": "443785bf8b874e307b89db380dfeb164.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c945427-cb99-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tsunami)", "timestamp": 1679809559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679809559, "uuid": "26d14e06-00af-4481-9ce0-82f7a04a7fe1", "comment": "Malware payload (Tsunami)", "value": "8c795fb35ba4111a8d972277045b6ca4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679809559, "uuid": "73a71db2-7d99-40ba-870d-efc49a3fe61a", "comment": "Malware payload (Tsunami)", "value": "e010b606a46f32743cd70ccb96dbf9cd385e41c9296b74d379af5a2c5c009edf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679809559, "uuid": "216555e3-ad52-4cfc-97e0-ef2dd65e0156", "comment": "Malware payload (Tsunami)", "value": "7de25c3ef9a6c1d40b13f82ca146def6a823a241", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679809559, "uuid": "163f6587-3c5a-48e1-a805-55dfef1f63a2", "comment": "Malware payload (Tsunami)", "value": "aa444e16c46ced565f626cd557b26c3c1c473c765799d8a3ebaf7adcf8f79dec9da358aa436ceeeeffe841b15f6183f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679809559, "uuid": "53c31453-3bcd-493e-b3cd-fe231885118f", "value": "T18D835C86EB81DAB3D19319B507AB87200571F8772E2BCF45F35C3CB4AB25688B21576C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679809559, "uuid": "7c8323f0-09b0-4578-8c64-98f89ca4368f", "value": "1536:8RCJyUfAjauswudVchqXV0uHMfuFiwALtkkAQnPwJUkit1O5u1m:8wdsudV4qlbsfwWtkBQn4JUkiXO5u1m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679809559, "uuid": "c2314e5c-118b-4cca-8389-6858304c6bfa", "value": 87750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679809559, "uuid": "f9579436-72d9-4104-a22d-613d6fb23c40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679809559, "uuid": "2cf07094-e054-40ca-9c72-5dc746fae243", "value": "8c795fb35ba4111a8d972277045b6ca4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcb559e6-cb73-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679793453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679793453, "uuid": "a356415b-2b4f-43fd-bd79-95005469fdd4", "comment": "Malware payload (Rhadamanthys)", "value": "44c5171c7eab781f1c3c4441b1673d7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679793453, "uuid": "5da2949d-fe56-43c8-8021-0a2dc8666a7b", "comment": "Malware payload (Rhadamanthys)", "value": "e131641d24a0f1cd82af1a2d7b68bf9f11022fbcd79986f939b083574945003c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679793453, "uuid": "3d74e441-fbec-4e07-b2cc-708eb2218c89", "comment": "Malware payload (Rhadamanthys)", "value": "c8c9fe0aebc6ffb675da0934ede7f140a75feef8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679793453, "uuid": "45f454b0-017a-4088-9f79-becc4bba041f", "comment": "Malware payload (Rhadamanthys)", "value": "f51fd6229af49ee921d9a5e7fecc97fd8937d99d52eb282392b61c939b2fa2fb3ca4bee8a8b9fc7ebc3fc08b780de5d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679793453, "uuid": "e36cda7c-c331-4778-ba9a-76178d9691c1", "value": "T16874AF1252E27820E76386328E2AC7F42E2EF8605E557BFE17589B3F1931F72D162315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679793453, "uuid": "da928590-e3c9-42bf-9380-2416ae2caade", "value": "5bf64f0a1a526a4cdb08b53a545d3838", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679793453, "uuid": "1cb5065b-9a16-4f8d-bdb2-fc6ebbb21b60", "value": "6144:+FpPXW3uYXCLNviT2POrI+oPcdp/9FoRenqTfz:+Fpu3dXCLN6CiRoPcdtKz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679793453, "uuid": "b9020511-27f1-4b8b-b924-db53cb68bdd6", "value": 354304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679793453, "uuid": "36867c4a-b108-4d4e-af28-b6fe48177181", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679793453, "uuid": "de87e37b-11f8-4f8a-b6d0-f695d2fcb24c", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee35856a-cbca-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679830795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679830795, "uuid": "a77ea7c2-c1fc-40de-b2cf-02d3fe6d6128", "comment": "Malware payload (Amadey)", "value": "06ccac3fdb2c7a343e2d0d981c9eb176", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679830795, "uuid": "98d8804b-f453-4eec-8983-ecf936ce95a4", "comment": "Malware payload (Amadey)", "value": "e3143e0b0f1cbcbe34eb260f2e38aae580aefc970d068691ebe069a55ad4b360", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679830795, "uuid": "e5f52403-1d77-49eb-a9d3-b9f7a021a711", "comment": "Malware payload (Amadey)", "value": "5a7cc958c0c7c970c6617a646454c0036e86232e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679830795, "uuid": "48e243a1-a2b4-4659-9fbb-86350c024c70", "comment": "Malware payload (Amadey)", "value": "f2ed6e546826d172ef1c4bbcbfc3a80005b5976df38712f418dc6bc93bc7c78924b94ff20da6c192a39a6dbd35982870", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679830795, "uuid": "11e99ca9-13b3-43d4-a1f9-15ad30508ea2", "value": "T1B6352392A2DC6073D5B90BF19CF707C30A34FCA3913597576248A90A19B3944BAB737B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679830795, "uuid": "886b0f7c-f543-4d5f-b847-842186c2732b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679830795, "uuid": "eafed57a-eca3-4a80-997a-4f2246ac7cc9", "value": "24576:uyvn/78ZYJ01nHb0BkS5fU6TEM/f7s12DLM98nshXi:9QZYJ0x0iwUU37s1uM98s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679830795, "uuid": "c8b1b806-c1af-4616-a447-f18d5c6e2264", "value": 1060352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679830795, "uuid": "a3df249c-552a-4acc-82fb-440e2a70b795", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679830795, "uuid": "e33f60e1-ac35-459b-9072-d7c5968f4584", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b6bab31-cbe9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679843783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679843783, "uuid": "7d129bb5-73a0-48ef-ba3a-375b0da3c0ff", "comment": "Malware payload (Mirai)", "value": "8191b94930120498886dd7caf07d6273", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679843783, "uuid": "65ad684d-0e2c-4d7b-86a6-90776664a43b", "comment": "Malware payload (Mirai)", "value": "e37a4a6b35c31a8c4fa3627df5bc718914954b428840efdd52043be16172c338", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679843783, "uuid": "47d0bdbb-3636-4fb2-a72f-e72c57b1bccd", "comment": "Malware payload (Mirai)", "value": "f393fd974396156c86a612d7caad5a74a9fc6957", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679843783, "uuid": "7c2c6c79-45e4-44a2-8f91-4978cd7b7dcd", "comment": "Malware payload (Mirai)", "value": "131663891884a43c6b67ca5a00ac495d9c76274b4278788630148088de7034df4c3818ad9ae86d42272bac4663f6e4f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679843783, "uuid": "63c80ce7-1e00-4b55-b75c-a32448705e36", "value": "T1E0834ADAF801D97EF84AD7770C530D197631B2E10B930B3663A77AABFD36198241AD81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679843783, "uuid": "47b32195-51c7-43a6-8a8b-bca54f926084", "value": "1536:JtZK9Wui3Ksg27CB8gXqM6hQeuacWjcW0JcWcBVyw/9zouyrCsc3vPoyUYlGuFbp:VqWui6sf6qJhQeuacWjcW0JcWcBYw/9R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679843783, "uuid": "66b369a5-d750-45bc-9540-a652602567d6", "value": 86976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679843783, "uuid": "a8dc2e70-513a-4103-92df-33023f27d97a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679843783, "uuid": "58cf0410-900b-451d-b55a-8c11ae3ab2de", "value": "8191b94930120498886dd7caf07d6273", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c36464fa-cc02-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679854775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854775, "uuid": "90729d92-af91-446c-9cda-b1dd26358ac7", "comment": "Malware payload (AgentTesla)", "value": "ba8fe3fdbbd12dbb483157149456abe8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854775, "uuid": "310380cf-2968-44f1-a5c6-c27282fee13d", "comment": "Malware payload (AgentTesla)", "value": "e3928bbb3f5c9d07d47db48ba6c4325b663894e15019a220bacee24653b4c4f5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854775, "uuid": "f510a48f-25b7-4177-bca9-91e26d0da0a4", "comment": "Malware payload (AgentTesla)", "value": "ded7c22a7cfd7826a8172ae5401576173aba976b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854775, "uuid": "cce61c85-d2a6-42f7-b50f-9c3bb744daaa", "comment": "Malware payload (AgentTesla)", "value": "efc8ff5731f2ce5480b3e08c5283cb71838b46735af4aaeb46582e677a43ec9d0f78deb4327d43186260ce7f4637fdf2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854775, "uuid": "ad45b450-c955-43f8-8df1-8c16a748ee4b", "value": "T14D258CC673B291B2E89F4165153851CD4E39B54B3406E12B5F37BBB0A2212BFBE2F146", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854775, "uuid": "f69ad93c-dcd1-492a-b949-0cb53cb126ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854775, "uuid": "dc7c2980-4a14-4592-8da9-d7ba6754936d", "value": "24576:AL242pyeFMoyiuvLMELLlYF3kuvj+YJmtt6uF:ALlHoyiGLlePvj+Y8tt6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679854775, "uuid": "334dbdd5-aca2-4ba2-89ab-01bca1d96de1", "value": 1000960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679854775, "uuid": "df37db08-29d7-476a-9959-c33c497ff47d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854775, "uuid": "287ff068-9919-47b3-bf82-fba74d463a0c", "value": "ba8fe3fdbbd12dbb483157149456abe8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c71e43d0-cc02-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679854782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854782, "uuid": "5a1a5875-d6f6-4315-b176-6a4d8e9fbf60", "comment": "Malware payload (AgentTesla)", "value": "01b98000b9fd1fd6e87cb3bb1ee89001", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854782, "uuid": "e6c3b6ee-f4b7-41ef-8f8a-f45a366c8875", "comment": "Malware payload (AgentTesla)", "value": "e45adb38f46b6275c9208ffc10f5ad840da121078544fad3555ef8183608dded", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854782, "uuid": "4c62e057-42e5-4ee3-bba4-6eb901ffc700", "comment": "Malware payload (AgentTesla)", "value": "03bde9251748cde15f4dd96698bbe62b661d5da8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854782, "uuid": "055b952a-3f78-466e-aba1-abac562d2310", "comment": "Malware payload (AgentTesla)", "value": "ba0e6706dedaee3ce4d9fdef0effb876c5a19c13b73de5d730c4279ea0b4b1c3850622d80abf11e1d95f706750118c24", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854782, "uuid": "1bb4593a-28bb-460c-8d63-02011de14667", "value": "T1A5258B8273B391B2E89F4264153855CD5E39B5473406E12F5F37BBB0A2212BBBE6F142", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854782, "uuid": "3821aae2-f28e-4fc9-bdb9-8e8283c241a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854782, "uuid": "a620a64e-59b7-46c4-88fc-898929867824", "value": "12288:vvvaMcBlqtpyOkqDpUJ4b1rY7hc3xz1w33S4o5iLUZoUvL5kZppRCajyvweRCsc:P1m4tpyeFQKJahsz6LU5OpRC5oeQl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679854782, "uuid": "74a8a6a8-a761-45ca-9009-c1e38bfd8211", "value": 997376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679854782, "uuid": "520ea26d-54dc-464c-aee3-52db531c1f14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854782, "uuid": "ed1a99a4-d2bc-4744-9c81-c09a4278d199", "value": "01b98000b9fd1fd6e87cb3bb1ee89001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b986cdf1-cb71-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679792482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792482, "uuid": "50703194-950e-49c2-93b9-6403dcc3fa3e", "comment": "Malware payload (Amadey)", "value": "579a7ab114db039dac3ba9faa74670ef", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792482, "uuid": "9f0483a4-fa74-4aad-864d-8fa02e3859eb", "comment": "Malware payload (Amadey)", "value": "e64538b9e6b34f9164d6e8fcbeb3d0996e39f409a1ab0d3add69d336bc9ffb7b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792482, "uuid": "2b181ff7-221d-42be-98f3-54048d367c88", "comment": "Malware payload (Amadey)", "value": "a9d5ff5b5083cd7b42bce7c6e62036d9748cfe99", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792482, "uuid": "9967deeb-ed0e-4789-b323-539e0e87e9be", "comment": "Malware payload (Amadey)", "value": "c77e497f90124836622516b78cd141d374669ad4b998197665089a10e41d0b5660673863c3bc851249a270ff62fd8008", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792482, "uuid": "215c6e75-bdd4-44b5-a1c6-f6508f7e0f94", "value": "T18E546D0252E1A820E72387338E1AC7F42E1EF8615E157BFE16599B3F2971FB2D162315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792482, "uuid": "f30eb8ca-335e-458b-a3fb-3ee9b6e5cddc", "value": "9c7e5bcbfd5f0ae72cc015cb41d480cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792482, "uuid": "be32c4ca-2de0-46c2-a79b-fcc310dfac28", "value": "3072:CL+vju/2RrqnhApvmQ3XswmjAkcVwkW2AsGarfivrdQ3EZZ5b2zBwvjTGCJQN0f1:1FrqhEXswhfKarfi23EbIYBTfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679792482, "uuid": "e6aa7a52-0ba7-480e-8e7f-5b9beb15d9b4", "value": 281088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679792482, "uuid": "45b7bf92-7826-4c1b-8840-467ac7561c69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792482, "uuid": "cc1f16d4-9ea8-428d-9f4d-1937d799930f", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb99ec29-cbe9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679844132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679844132, "uuid": "0a5af36a-f653-4a01-910c-2f697841a65f", "comment": "Malware payload (Amadey)", "value": "4293ec458e657eeb42ca2ec2eb09b76d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679844132, "uuid": "815b2821-8485-4efd-9f0d-bd8daf2dd940", "comment": "Malware payload (Amadey)", "value": "e6cb4fc4fe033760b6276ddea434ed2fde215dac538e357d50c5559ddd30de12", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679844132, "uuid": "a2607700-225f-4fb1-8c2f-1564cca0987e", "comment": "Malware payload (Amadey)", "value": "2589d4a26f3462d7bb19756c291b6ad9235abd21", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679844132, "uuid": "ddff81dc-c7c5-413c-89f2-e190bdd0a072", "comment": "Malware payload (Amadey)", "value": "50fd213a55c94c15f6e072f0030aba093185a3fcd680d5a3780c5b23c17c8ee13ccad75f2d019a38175a2f5ce2840895", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679844132, "uuid": "ba1cd3b0-0494-427b-a9e0-bcb18c929ad8", "value": "T1C7547C3253F06860E122D7338E2BC6FC2A6FB9619E557B7E22455A7F09702A1D272335", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679844132, "uuid": "efb35a9a-2f32-4bf0-8b0d-e1a118cf90ac", "value": "c5c75c5b6a7ab4fe20f346e6d5121c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679844132, "uuid": "6a56ff49-69a4-432f-b79b-f350519a1676", "value": "3072:d36DCiSW3u93DYqHDuQ6qbZYbhnUfvXLvELBPRR9E2DPV/69pNN4TJY:HW838qHWnADmPRjE2DPV/KNN4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679844132, "uuid": "ee64dded-7038-4902-a89b-0444f29fe0ef", "value": 281088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679844132, "uuid": "02eb0e75-441b-4b9a-a66c-0f32e1eb304f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679844132, "uuid": "aea82332-8c96-45a0-a011-66cedc0d62ae", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b17dbf5a-cbb4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679821245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821245, "uuid": "4c22d01e-1083-4521-a238-e8fd71d530eb", "comment": "Malware payload (Mirai)", "value": "408959295f0ffd6948858f5cf1bc0dab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821245, "uuid": "41356c1b-437d-4f3e-9431-d1161b465b06", "comment": "Malware payload (Mirai)", "value": "e6f7efb9a5c1768f5a71a84dfdbf78040328e1afc70bd8e5ae67c2b9af377c90", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821245, "uuid": "d00ce6c0-925f-4a84-95a7-48e6bb299c88", "comment": "Malware payload (Mirai)", "value": "b3a110f64331529dea1fb7e5cd702f8aba520dee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821245, "uuid": "a9fe1df3-cde6-4bd4-842e-9de728cf16d8", "comment": "Malware payload (Mirai)", "value": "a03e3620f579298eda971350b6b9a172b1454d902d81a04e5edff353dc7d243881119f2552387ea2aa0871cac3806aaf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821245, "uuid": "98bf2688-cde5-4884-aaa8-7184b4fb6199", "value": "T1CD832A86BC419A10C6C50777FA2F118D3302679DF2EE7262CD155FA07BCA91F0E2B65A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821245, "uuid": "c000ecae-5b2b-4293-9d12-bb5024ef58d8", "value": "1536:Cyn8X31UxPGUIgJAiuE3WyW7eAqsaDJ70qNdl/T6HWzCIAinMyntmWz:U3g+UIcWE3Wy8S9YqNX/TpbntmW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679821245, "uuid": "e4c299ef-0330-45ae-a274-a3a84b03db7e", "value": 88684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679821245, "uuid": "f89c3fd2-df75-4099-9d23-14982372534d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821245, "uuid": "04fa3981-813d-4660-906c-5900de1d6514", "value": "408959295f0ffd6948858f5cf1bc0dab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f31bfc4-cb72-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679792652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792652, "uuid": "754d3359-9801-4f2d-9737-06d70c02ca06", "comment": "Malware payload (Smoke Loader)", "value": "8397f66491f272191045498d3ce43e18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792652, "uuid": "19ae30ab-a87d-458c-b843-ac5883f7c76f", "comment": "Malware payload (Smoke Loader)", "value": "e7ec1ca258f57005086bfa3746fdd9d513ff01df18e0a30c7239fe39958e416f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792652, "uuid": "acdd634c-8675-46fb-b940-1ac0c3b23f1a", "comment": "Malware payload (Smoke Loader)", "value": "7256c5a902bfe89798d810af06960542d48f240f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792652, "uuid": "aa1cb0d8-0c9d-4934-a550-1a8cd48e8e31", "comment": "Malware payload (Smoke Loader)", "value": "dec33da4c6aea3f5679f8ecb9f1ef7ef2fc61220e71bb733c8b169ea58aa24b522fae063f2f4c1847a5ccc8ee4f34592", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792652, "uuid": "4650a3e8-84d8-495a-86a8-944604f4a5dc", "value": "T111546D0263E26860E35387328E2AC7F42E1EF8615E157BFE16599B3F1971FB2D162305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792652, "uuid": "f34848f4-ec2b-4f59-8644-9971ffba7b53", "value": "9c7e5bcbfd5f0ae72cc015cb41d480cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792652, "uuid": "e5ccadab-a87e-4929-8543-169128ec7256", "value": "3072:Ct+xf7LTRyA5FAZvpCmbk8CVAkcVwxeowdMgsLkUAnytjfNX82avJkCJQN0fm2Rh:1NyArEbk84DpjwUAnytjfLCTfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679792652, "uuid": "2a15c677-0d5b-4df2-ab6e-a8314c9e8ab2", "value": 279552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679792652, "uuid": "14488ef2-ed9f-4643-be80-45621da15001", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792652, "uuid": "80f7e0f3-2551-4d63-a19e-71d0255ebc47", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b04557c-cb87-11ed-88f6-42010a9c006e", "comment": "Malware payload (BlackMatter)", "timestamp": 1679801772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679801772, "uuid": "af7d5251-1d91-4569-8898-7bc180d5e083", "comment": "Malware payload (BlackMatter)", "value": "73564b24197317382ed4b526e341abce", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679801772, "uuid": "1ac6cd2e-189e-4a5b-a9a9-4076c8087c09", "comment": "Malware payload (BlackMatter)", "value": "e80b293b0cecb5265f2a6cc592ee11fea28c3d008fa883781aca1da3f09140b1", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679801772, "uuid": "162d2e4e-aa54-4b7a-9a2f-0ab55d169d2a", "comment": "Malware payload (BlackMatter)", "value": "af028058b793c036191fd6072f194e66bb11c2c9", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679801772, "uuid": "cdfff5a3-2b89-49ce-a469-b91642a68b46", "comment": "Malware payload (BlackMatter)", "value": "f43577e1a328c14aa79d5ac73af69224c8b8d173ac5344a0a2fcbfcca910094d93a5c2443ac3ef43d6d01b5410832577", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679801772, "uuid": "db060e47-c467-4cf4-ad5a-416ee5e582c4", "value": "T1D1F38F21E513D0B3C46768F12B357571B3AF8E2D1AA97413EAD80F54ACA6C23EF18947", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679801772, "uuid": "fbeeb260-1b25-412b-87da-b184838513e6", "value": "89b43582b27abefb2b74684ab12a2f8e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679801772, "uuid": "3f6217f4-1809-4fc8-812c-7b0622616075", "value": "3072:luJ9OlKolUa1U197bzhVsmftsxetGS/To84ri9CEEtmg1yXJ:lufj0zi1dNVsmftk8Gr86pE8k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679801772, "uuid": "e2aa94ae-4d74-43f4-8efd-ccf541d8bb40", "value": 163328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679801772, "uuid": "400a6356-f805-41aa-a911-3c6294917a8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679801772, "uuid": "cba4d8c7-4c33-4d3a-b6d8-51cb3e399013", "value": "LBB.xxxx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0b96ba6-cbf3-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679848275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679848275, "uuid": "d2714b79-2dba-4643-b15b-700ae928217b", "comment": "Malware payload (SnakeKeylogger)", "value": "7b510a26d387227f8558a7b05bdb4795", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679848275, "uuid": "d9dbe0f7-6c30-4480-996b-458bb983ccc0", "comment": "Malware payload (SnakeKeylogger)", "value": "e99086181ac130803fd5f3443f5485ecb3de67acd2f129f888e6ce1b8a2da20a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679848275, "uuid": "8128e43a-cc7d-4c8f-a278-e66bdfa6f436", "comment": "Malware payload (SnakeKeylogger)", "value": "a5604cd78ad136b78d9393a551da861f5f77cd9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679848275, "uuid": "6cce6d3c-48e5-4d1c-b3fe-cc091ede1d89", "comment": "Malware payload (SnakeKeylogger)", "value": "661e8041fd581e846c9797f6f96d8c5620d945dffbc8e1dcd5e80480176be6e8ff8ccde29444246021686c6a07bb59df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679848275, "uuid": "9bb6d601-63ab-4775-9fb1-1bf767d1b2c1", "value": "T136B58C51FCDB24F1EA43553248A762AF2335A9091B319FC7DA447B7EAC736E00E32256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679848275, "uuid": "b09f8082-51ba-4f1c-bffe-742fc030816d", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679848275, "uuid": "b09abb3f-dff8-4fd5-b823-cc6a0aae2c21", "value": "49152:Q59zMNe/Okm8bI3wLYz1tZD1V5NQSrBnbx:+zyaOIbfiZD1V5Nftbx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679848275, "uuid": "da41f9a3-3bf2-45d3-b243-a6cf59fc4f40", "value": 2455040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679848275, "uuid": "ffd45a3d-a59d-4e3c-b1d7-1a97662ee501", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679848275, "uuid": "dd6ce256-809a-40a0-8665-27706196e00a", "value": "7b510a26d387227f8558a7b05bdb4795.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba15ab5a-cc2c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679872799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679872799, "uuid": "6a0b2164-c6e4-492f-b8f6-870c89856447", "comment": "Malware payload", "value": "b9c79552df26110dd0a02f380eb47d5a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679872799, "uuid": "3f30d7b1-9d89-41a7-9dd4-9a95080e58e6", "comment": "Malware payload", "value": "e99e54e0e6321b10c685f5f57bf7240343a72de38a562a3aba1aa0712d707bd9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679872799, "uuid": "680cdae1-30f5-4e99-a3fb-414ce614a7cc", "comment": "Malware payload", "value": "ae5330108dc168b62b403edd1a1e2d1de440d644", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679872799, "uuid": "1282c142-346d-4a78-89fb-b2cf98143229", "comment": "Malware payload", "value": "60d7cd9aeb0a1f390925b129e9dff152544a5316ef4bff166f253301875c4bfe26138079391a7a38da1e527f87c29408", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679872799, "uuid": "1e7cd92b-0b00-46dd-9103-3d71335c4201", "value": "T1A0A32A45F9118727C2D23BF7F75E879D3B355668979733057A2C3EB02B82B892E29210", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679872799, "uuid": "c1dc2091-5cb8-4bd7-8256-e80e09e79895", "value": "3072:FMmTdcFa/+AzGk8Y/r4yK+6L/1RQOn2fxHoA:FMkcFizt8Y/rEL/1RQOn2fxHoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679872799, "uuid": "b549bfdb-1219-4878-b3e9-a9907d9ae65f", "value": 107340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679872799, "uuid": "f75b6d21-2bc2-43f3-bb33-e82f0738526a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679872799, "uuid": "27997f1e-c08b-4e91-953d-fabd5bf18342", "value": "b9c79552df26110dd0a02f380eb47d5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5fa2282-cbb4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679821252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821252, "uuid": "f42c12c0-3ed4-46d2-8a5f-71da382b4ff1", "comment": "Malware payload (Mirai)", "value": "8d434e52b458b701c4d97e7bb21c5ef9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821252, "uuid": "377300d3-e3ff-4a84-9d71-b75c8435aee6", "comment": "Malware payload (Mirai)", "value": "ea123f7a42d257605b49c9182897f0efdaedc63b512fb8de76d3f47a89e4cd56", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821252, "uuid": "f304ba95-57e8-4603-b674-1dbdbaaa0f96", "comment": "Malware payload (Mirai)", "value": "100668dbacba1555245be04dc23feeb4adc51514", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821252, "uuid": "07a0ccc4-7898-42d5-a049-04769eee273d", "comment": "Malware payload (Mirai)", "value": "a2a40657cbe1e2ab43b2d1999cc7f08b948e1aee5f241dfad5de78bb92df67729e70bbfc5e1f0c001381564e16abe2bd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821252, "uuid": "554af20b-fb88-4033-ad60-7e59bb5b7cea", "value": "T192730882BC81EA16C7C01777FE6F108E3315A7D8E1EA32429D155FA07A8AC1F0D6B756", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821252, "uuid": "f60955d5-dde5-4030-8668-7aceeb90590d", "value": "1536:kh/Vjlf08j8jjtc2H9gSbuG8JR1ozB8t46sGYfJcH:2/V5f022dgx4d84DGSJc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679821252, "uuid": "f0b4cc22-2a67-48c6-b6f3-b626e1990007", "value": 78928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679821252, "uuid": "bdd753c0-a0b4-4885-9362-29391f06de90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821252, "uuid": "5419b949-6d2a-46ea-95a8-0f431cd7bff8", "value": "8d434e52b458b701c4d97e7bb21c5ef9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28aff5a0-cbf7-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679849791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679849791, "uuid": "bb2eeddf-36e9-4493-99f5-2a8b85860cb0", "comment": "Malware payload (RedLineStealer)", "value": "0d88bb7e2c87029c60f7dc4ff9c96b9e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679849791, "uuid": "b06b6fd7-e32b-4e68-9c74-6c79a89aaf4d", "comment": "Malware payload (RedLineStealer)", "value": "ea704ebfe9b88d2ea1422f338d33b9c88594fea59a289354dfb04141e173d047", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679849791, "uuid": "1a7859d8-ac66-431e-897b-73a1b1ec1c66", "comment": "Malware payload (RedLineStealer)", "value": "7414b47b0831b73f297e4cf7692f1bb7abf1ebfc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679849791, "uuid": "70ddbd0c-92ff-4dbe-abb0-14c5b096ce1c", "comment": "Malware payload (RedLineStealer)", "value": "05a345b5964edce9812024edeb0ece26b658fd3b01c0fb7fe329e21aff76c867af98142df938a08c4f2b7ef392c7d679", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679849791, "uuid": "9b4e2ac7-5f2d-431b-a2b6-7f359e369a48", "value": "T165E41202FBD89472C8B61B304CF716C71A36FD668A34976B2396595E0C736C0A436B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679849791, "uuid": "05f1960b-ef20-4f13-94cd-3097f3fb65c6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679849791, "uuid": "157eaf76-87e4-42aa-88fa-eaf361b7c45d", "value": "12288:IMrfy90j872tpvCck7igA3bwcEDG6rz4F28PeVB:XyQ88vCcj3eH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679849791, "uuid": "9dc7f56f-0d8c-47b6-9459-3616bd03bc66", "value": 702464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679849791, "uuid": "3e98fc6d-b2e6-4c3f-b64c-b578dc94dcb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679849791, "uuid": "66406de8-6fe3-4237-8b63-020b4bf007cb", "value": "0d88bb7e2c87029c60f7dc4ff9c96b9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaa52137-cb71-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679792564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792564, "uuid": "7f9a0d7d-5327-43bc-b394-e00694272105", "comment": "Malware payload (Smoke Loader)", "value": "b912b5afc83013a53d21d8d3a938f68c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792564, "uuid": "bc9bb416-807b-46e1-a725-3051ce40b8d0", "comment": "Malware payload (Smoke Loader)", "value": "ea8091ca85a22d57b2c9bede23c0b7c66a8c085aacf90e419825df999f02fedd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792564, "uuid": "7e8a66a9-10aa-4c9b-a6fa-2957b14235c6", "comment": "Malware payload (Smoke Loader)", "value": "be3328c2ffc3b706a265c1454f1acf2faf712e82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792564, "uuid": "0fd2de52-5197-48d5-8cdd-fbb5c49d16b7", "comment": "Malware payload (Smoke Loader)", "value": "14e21b737047b6d45f0ec167a60a2a6720c4f462d08653349a89c4d9d9206f514fa2e589e7bf8baa0b4c9cd6f83a1563", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792564, "uuid": "3bbdb9b2-04ea-47f3-aa33-b4efca907977", "value": "T1C6545C0252E16860E76287328E2EC7F42E2EF8619E257FFE12599B3F1971F72D161305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792564, "uuid": "3e54bf00-6dbd-447d-a294-794dcd59a471", "value": "9c7e5bcbfd5f0ae72cc015cb41d480cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792564, "uuid": "3bc346bb-151b-4a13-bae3-6d4a95493598", "value": "3072:CF+Vf7LTRyA5FAZvpCmbk8CeAkcVwjTtmVRn+BX129bxhi3HR/FL4S4CJQN0fm2X:ZNyArEbk8/tCnAX4/KHcuTfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679792564, "uuid": "03bcdef9-e7ce-456e-a9c6-0dd71db53f77", "value": 279552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679792564, "uuid": "0c459ee8-e908-4cb0-a706-c7fdb8c37da1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792564, "uuid": "580a1d7f-1e75-4601-b366-218bd9891062", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ffa8e11-cbcf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stealc)", "timestamp": 1679832651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679832651, "uuid": "b5d06d29-1d7e-474e-8309-9d47d2b1a663", "comment": "Malware payload (Stealc)", "value": "3b1242415b5ca7e9cacddea3b4151dc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679832651, "uuid": "0c6459ab-4d05-4968-8f49-0ad9b0ff4fce", "comment": "Malware payload (Stealc)", "value": "eac0b62e9376be4193ebf3acb465bbc8e766429378e5514ba5d1c32f5ec4dcc1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679832651, "uuid": "6c635b6b-ffc5-4543-8e09-2f88c1a4f9d6", "comment": "Malware payload (Stealc)", "value": "20f5ecfa7bc61916beecfb5970159749ed9e8682", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679832651, "uuid": "0eb7b17d-b044-44e2-83a4-e6fd14b168f1", "comment": "Malware payload (Stealc)", "value": "d7985cde82c8cad2c045ef565cd902a77c8f25b2f9e10367bc624a82543a5eb225b0b30f975b022af7fc1fb15e72cbe2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679832651, "uuid": "600961af-bd9f-4173-8492-fdac8703874a", "value": "T1E675950AF0C0DEB4D3990139338ED97AE159BA342E15E952FBD1A75F4A340EA990F713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679832651, "uuid": "4d36729f-5138-4e27-96e5-546f5921e713", "value": "85907005a666be1e31b171eec03f5b95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679832651, "uuid": "369893fd-5d1c-4c23-94ab-272876ac6e54", "value": "24576:u4qDAzvkzH0mCNmIKQtq8UkmVi5m2WmuysVjDbKPMxA0qWGKMMaaa:uzDl78UrVi0PpbKP70qWX37a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679832651, "uuid": "b46d1ae3-4b73-4dc8-8a6b-8488c314b7a8", "value": 1625024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679832651, "uuid": "143ddcf7-1f0b-4f4a-a3ed-ac573075bb15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679832651, "uuid": "122df471-2c88-4a9b-a5c5-c1705013fc25", "value": "3b1242415b5ca7e9cacddea3b4151dc0.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6149dbac-cbdd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679838719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838719, "uuid": "6ed6a3ba-f2fa-4af5-825c-7f16aef6b9f2", "comment": "Malware payload (Mirai)", "value": "01e201d00574f6b9c651bbb78f65bb92", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838719, "uuid": "17b57438-fd99-4d9e-8226-cb04fbf727b4", "comment": "Malware payload (Mirai)", "value": "eb60136d4d866e5a0c2e24a89ce8cb86e76acaa48cd23a1071af81696dfeda30", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838719, "uuid": "5533cb4b-7d72-4b58-8639-8061a4c31cc6", "comment": "Malware payload (Mirai)", "value": "9423fc3752d5d4f3b51e1609e69c444b6b72fd86", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838719, "uuid": "31fa87a6-c011-4b6f-a5a3-0b248b77ed25", "comment": "Malware payload (Mirai)", "value": "4bd9d8dd420eedbbb23c42b76fcbe077f3b9f8d6b46c7e5a75a8b7b6f27df084626f47f958362d556f1685408328838e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679838719, "uuid": "bb1500d9-e748-4bce-a7f5-9a8c3acf3740", "value": "T1FE04B72E3E11ABBEE164C67107F75B70C3952AE325919382E26CFA185F7028D195FBD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679838719, "uuid": "8c5b5232-0a1c-497b-ac25-1d441b546687", "value": "3072:SfKeED0L+xfZZNcvetJ8add9Qzhs5UxOOPfqnXdfi+KqLwZi+LUk:WKRE0ravetJ8addQoUedfi+KqLwU+LUk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679838719, "uuid": "9a8265a9-acd0-4353-9fe2-1b5c94f2538c", "value": 174955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679838719, "uuid": "2020fd01-6e98-413f-8499-1c0efaa69efc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679838719, "uuid": "a0543081-39e2-40fd-9ca6-2f43688b1fe6", "value": "01e201d00574f6b9c651bbb78f65bb92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "470c3353-cbb6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679821925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821925, "uuid": "40d7f973-baf5-41ee-b8f8-b2bbd05d07b2", "comment": "Malware payload (Mirai)", "value": "c2c96f3cf467887d5779c4d5f93dc0de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821925, "uuid": "84e810a2-f709-42d8-9b34-b9d0da59c30f", "comment": "Malware payload (Mirai)", "value": "eb9eba0c61d653093bce1465f14cde16d3741d85a219de93114d9df85397d53e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821925, "uuid": "c1df8bfd-75ce-4911-b5e4-c1a4c520aa76", "comment": "Malware payload (Mirai)", "value": "ba438644b857dca86995f65f787eb7362ef05757", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821925, "uuid": "911bce56-c9cf-4793-bcf1-ea51e5aa60ad", "comment": "Malware payload (Mirai)", "value": "eb17b6a2f8dc884fa98d86d7474301ef51c82f0da1e47548a3d857396a498825a2517216693db38b0389f9135151b9a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821925, "uuid": "0dd3a3e5-83f0-4b8e-8a62-9323a4cc0c6b", "value": "T17C534A02B21C0E13D0A35AB0253F5BD197BBEAD022F4F684791E9B9996B1E361181FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821925, "uuid": "62da7a4e-62fb-4fe4-95e4-948ded0febb3", "value": "768:JES/qHcb4aRKsR7UOup2aGFaNTkqU1CpEMP2/h9LCc4vaL2NNnZaFV+trAcwWYI5:G6P+OIG9qU1gd6LCzSL2NNZ++5mWY2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679821925, "uuid": "f82c05e0-6760-4033-9157-96c783b0aaf1", "value": 63036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679821925, "uuid": "9a81698b-8ce6-4105-9395-b873a609b3a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821925, "uuid": "310ee416-54de-4942-97b5-86cb13cf7721", "value": "c2c96f3cf467887d5779c4d5f93dc0de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3426fd1e-cb73-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679793117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679793117, "uuid": "1052e006-c28a-4c84-bb25-5611299fcc5a", "comment": "Malware payload (Smoke Loader)", "value": "15247b34ea738f74c3a4e8e23d67a639", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679793117, "uuid": "76a4d0d8-5352-46fb-89c2-2b3a363cdfe8", "comment": "Malware payload (Smoke Loader)", "value": "ecfe9651f2848c5fdebfedc91e998b1cb2c3a546b3f80dd5507b6b00acee1869", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679793117, "uuid": "337b8fec-44ab-4212-821a-78cfc9ecd83c", "comment": "Malware payload (Smoke Loader)", "value": "65b0a8439615fddb1c62166c2a5b3b965f94ea97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679793117, "uuid": "f5581903-8995-4c18-8690-79c422163226", "comment": "Malware payload (Smoke Loader)", "value": "144927bfdf4be34bb2e4715ddb387e07fd9b1205e2e62c6f195c52c2185af80e4099309c776562e9da96c159f9378289", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679793117, "uuid": "b707b880-b731-40ed-87aa-33104e0ea768", "value": "T1A1546D0253E16820E76687328E2AC7F42E5EF8615E157BFE12589B3F2971FB3C162705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679793117, "uuid": "b64edc12-87e8-487c-83d2-38ea200826a8", "value": "4ab2a4d536313c74a2690207bf67c9d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679793117, "uuid": "6f8c4099-075b-4690-a748-fab909669ea0", "value": "3072:C/06DPTRE43XAqvWv89KXWmrhEoPmLfFHk8R5TPotA5iHi9CJQN0fm2Rh:lkE4nh9KXHYfF95cteiCsTfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679793117, "uuid": "85b3804c-4862-40b7-ba57-3dbf01dcdbea", "value": 280064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679793117, "uuid": "b79ca164-2c10-4273-a3d0-b8d9ff05e516", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679793117, "uuid": "53ad9f94-6ffb-4569-b488-6fd383cb3d03", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "396bae84-cbb6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679821902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821902, "uuid": "0552fa56-5858-4ec7-b7e8-93feeb6a3238", "comment": "Malware payload (Mirai)", "value": "40c2e0caaae4d6119eab315940b6b6c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821902, "uuid": "c41611a4-7dc3-4ab3-97af-ceb32803345e", "comment": "Malware payload (Mirai)", "value": "ed2083f82d23b3cf978e497a0d3b9ad9dc504b4ae1e30fad8ac73405e41e9826", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821902, "uuid": "500b081c-c3f3-428a-a013-9ffe76451557", "comment": "Malware payload (Mirai)", "value": "3bf00fd3065ab5d837d2a35bb9bdf642fadecd6f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821902, "uuid": "151ff61e-c6e0-4f3f-90c8-d5e737d3141a", "comment": "Malware payload (Mirai)", "value": "995e3b975a9a6eeac01f36db82d590fc22e65728272c722359a27c0782234488139f469671e37d102f57670f8d782491", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821902, "uuid": "3e6c3625-ab60-47dc-8a5b-775929453103", "value": "T1A8E33B46FA408B13C4D61779B6DF42453323ABA493DB73069928BFF43F8679A4E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821902, "uuid": "df534c8f-3842-4e15-9bd2-263f2e1d8174", "value": "3072:kNT4Y5mOQhcaU0L7RNMrhqswIdSKJ2XfHv3M/9BZnNY:kNT46CcaU0L7RN2hqOJJ2XfP3M/9bNY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679821902, "uuid": "cd83aa7f-4989-4dbe-8a89-a09a0b0bb0d7", "value": 150601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679821902, "uuid": "fd58c4b4-4850-4ba4-a525-69a723e4c3fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821902, "uuid": "dd3d1117-6700-4a22-bc42-6f855fdb05b3", "value": "40c2e0caaae4d6119eab315940b6b6c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "959a983d-cbe0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679840096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679840096, "uuid": "9e2a6478-02cf-4f9a-b17f-728504ca6d74", "comment": "Malware payload (RedLineStealer)", "value": "5e7c5b6487f6d543fcf04767ecb616ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679840096, "uuid": "833ded52-966c-4487-8696-7f474bab99fa", "comment": "Malware payload (RedLineStealer)", "value": "eda79afb5d162cda849d6b683b530aa45158cefb502adc56064993d3110289ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679840096, "uuid": "eb689142-5998-4278-b8d9-25acf2464fe9", "comment": "Malware payload (RedLineStealer)", "value": "88b0c5f020b5b65415ba3029ededfdaef92a6a85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679840096, "uuid": "56c763c1-34b2-4e07-9274-482cebeaef6b", "comment": "Malware payload (RedLineStealer)", "value": "597df3003318db31e3a96ae021925fa348f68ce832d73ef1fc44cffe2e705eccf21abfce940bc9a9e32d3122c1791375", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679840096, "uuid": "ebb61beb-f773-4424-ad77-ed51347c799b", "value": "T18535235363EA84B0DDBD57B044F603C71936F9619E3C8B6B23468C854872A82E1B67B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679840096, "uuid": "83c69c23-60eb-432c-b048-428baf2bbb2b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679840096, "uuid": "c92599d5-acf1-4aed-a091-fe10662b1449", "value": "24576:Wy/dKJDSoz1G4YfR5Hde7gaFRkMW5EqiibubxUpf:l/dKQoz1G4u9ecqkVUs4S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679840096, "uuid": "576c0e36-a7d3-4328-b88f-4b6efdf970eb", "value": 1063424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679840096, "uuid": "fbb7d283-6371-4fc2-b66c-27d213f5b816", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679840096, "uuid": "29ec1c34-127a-407b-8685-84eccecad182", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6c37c99-cc02-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679854808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854808, "uuid": "0736c52c-79aa-4bd1-9903-916e56591e15", "comment": "Malware payload", "value": "f95d11302a83d13259698b84f384fc78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854808, "uuid": "bd0a21be-e959-4b4e-99bb-f84a209d13e8", "comment": "Malware payload", "value": "ee51846bb0172312da1f5dcc204653cb62dff225ee015d8c1cc6776c91e6e424", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854808, "uuid": "21fe635d-2b8a-4986-9f53-4da7c8c14187", "comment": "Malware payload", "value": "2ea4fb8c6f8f3aaeda9b0cc84198bc6b18023597", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679854808, "uuid": "05988053-077c-44c6-a039-3e60c783f99a", "comment": "Malware payload", "value": "212834ce626ee615c695d9777b94a8fd97b16e11926e5817ec0b3cbdb59c75c1e69dc75dffc4442eeefa237f93bbe698", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854808, "uuid": "2d1330db-e0ea-4645-9973-ee6f83348877", "value": "T1BD2633BB128B68D8FD6913B60634CAD7DF944DF2890EF6814E8DC85118ECA4C593EB53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854808, "uuid": "14a4362a-1a15-45c1-a359-3b7db542d049", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854808, "uuid": "7e5d02bd-e8ad-4d6e-ad3c-945b2540fff7", "value": "98304:uidqin+FG82b2mZe1di2CdzGDigSUwR9ab/EZGNpX/e6gkLt+L/NR:5drnOGZb2gdzgTL/uqX/e6JtE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679854808, "uuid": "1d621bcb-d843-4ff7-9967-cf6150c2be53", "value": 4511744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679854808, "uuid": "a6a41f31-b304-4ebc-8a5d-646a8a7115de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679854808, "uuid": "3a20603e-7b01-4912-8cd7-eef1c1e950a3", "value": "f95d11302a83d13259698b84f384fc78.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddf3d78d-cbd0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679833345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679833345, "uuid": "de7bcf9c-ad68-43af-9596-4502ad5c7464", "comment": "Malware payload (Smoke Loader)", "value": "b6de627cd3894a62f1b4c5ac30661952", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679833345, "uuid": "14f00dae-3d8c-4347-8bd5-71ad218a060c", "comment": "Malware payload (Smoke Loader)", "value": "ee6d1485f9ff52ba4fe0ead6a841085b7722626933dae80d5d1d4162680baeee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679833345, "uuid": "23ff42d9-5b9b-4d45-8f99-cd06bfa672d8", "comment": "Malware payload (Smoke Loader)", "value": "5fe78594a6a31d28bdd63da84426c3de6711abd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679833345, "uuid": "5c1c1f79-7ebf-4d6e-ba28-274cd68edd9a", "comment": "Malware payload (Smoke Loader)", "value": "c3803c3add02106483f6c917a5b3d71b73036b12c00d6b4ecad134b82cd26ef2e4ddf53d8ed7ab9b07160c0497ebafc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679833345, "uuid": "2961eace-d3cf-4d00-ac87-33df8e1d99a2", "value": "T18C546C3263F0B860E553DA329E2BC7FC2A5FB9219E157B7E12495A7F09702A1C172335", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679833345, "uuid": "59706baa-3ed2-4942-baa8-b3ac01c01059", "value": "c5c75c5b6a7ab4fe20f346e6d5121c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679833345, "uuid": "8bdbb4bf-5c96-41bb-b555-847a52b26c07", "value": "3072:i3YPCOt43uLvsLuxVu6F0bZiZeIa0hPGEms5owu1WpMsU/jNpNN4TJY:5guv2uxDZemRG/sWwxU/jPNN4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679833345, "uuid": "24c2744c-dbb3-4443-a5a9-88edb9517f59", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679833345, "uuid": "d71cdaa1-2e80-47a3-970b-96e5cb8b60a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679833345, "uuid": "c0c77f45-70bd-42ec-b6f9-5417eee802d7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a762e3e6-cbcb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679831106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679831106, "uuid": "c5a9937c-8fc8-4f13-af00-892ce1457155", "comment": "Malware payload (Amadey)", "value": "47fa206319df2d224ffc4cd1569047ca", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679831106, "uuid": "bd50f715-9c92-4e22-ae6a-210e7f909a65", "comment": "Malware payload (Amadey)", "value": "ee98edec4c14dab2c27ddaec0fe5f0a7472d82b5fa99a8dd127deb5cdfa65328", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679831106, "uuid": "8cffe907-f63b-49b1-b861-a4970ae715c7", "comment": "Malware payload (Amadey)", "value": "d0a51ae101bf26fb4547ece1429f626c18280deb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679831106, "uuid": "4fd48c51-ac36-43e4-9102-3aaecb508530", "comment": "Malware payload (Amadey)", "value": "10f1d95b61e83791caae71ab636be83732b63a2c29f51d7aeefdf5b33cf32840a008aacb665f5eb7818af285ff810780", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679831106, "uuid": "db3d9ed4-06f9-4900-8807-715265711961", "value": "T10C547B3253F06860F562DB328E2BC6FC2A6FB961DE557BBE1285597F08702A1C172335", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679831106, "uuid": "170d7ef0-5a51-4ebb-ac88-849d9eb23189", "value": "c5c75c5b6a7ab4fe20f346e6d5121c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679831106, "uuid": "503ee35f-c870-47ca-861b-c037a2f2b837", "value": "3072:23dEWLjTzubqJ6YcSuQCGbZI15LUhAjPjX3IY26n8eEZJmR/40/8apNN4TJY:4XuqsYcX5LXrjX3IY58bDmd40//NN4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679831106, "uuid": "bb4e736d-d30a-4015-b52d-bc89f0f74e6e", "value": 281088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679831106, "uuid": "a2a5d74a-383c-427b-a8e0-988299f5e97e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679831106, "uuid": "d3f9d96e-03a3-4966-aa53-77b573dcbbc3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cddc9256-cbb4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679821292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821292, "uuid": "121c8f4b-be17-4a79-9e40-9f2fedfd0f8e", "comment": "Malware payload (Mirai)", "value": "d419b6fd6bd3d97c6f698ee457469298", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821292, "uuid": "f70b2935-7d44-4f1e-97f7-e42f96a281a5", "comment": "Malware payload (Mirai)", "value": "f1023212d7714a9fe46728280d5e154747bc57910efae6eed13923cc09cf10c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821292, "uuid": "4d11cad3-3b59-4d47-8d55-f2a054b651c0", "comment": "Malware payload (Mirai)", "value": "ac9e0619d95699613a1c580f3dab9e8cc4759233", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821292, "uuid": "e4ad3a77-04fb-4ab0-9071-792b694e6f9f", "comment": "Malware payload (Mirai)", "value": "3c2b7f83022963ecab02f2f0d56494c23f55b04a20bb037610f942c5eb11853388901d1f86242a027d379cbd73e94784", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821292, "uuid": "270c3242-164c-4a54-bc4c-ac13b8997f83", "value": "T1E3634BDAF801DD7DF80BD77B5453090AB630B3D112831B366397BAA7BC721A91D22E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821292, "uuid": "07c2e5c8-046a-49f4-ac5d-53374ed9852b", "value": "1536:1413L0ULV2+4avXZy8hhSH/1ax9BdzldJT7Q9RW62QqI:14VAC2wXZ+/109bzl/f62PI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679821292, "uuid": "f4e52005-3810-40f0-b362-3fc0e8284121", "value": 69688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679821292, "uuid": "fc84a9ff-fa00-4fba-98f4-b032ac935403", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821292, "uuid": "9915a7b8-292f-4a04-9a78-6266b2c48e1d", "value": "d419b6fd6bd3d97c6f698ee457469298", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2e24e58-cbbb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stealc)", "timestamp": 1679824253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679824253, "uuid": "c68f12be-17e2-4149-959b-eac853a2b4ca", "comment": "Malware payload (Stealc)", "value": "68efe5e0a117357d69115c2823c07c5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679824253, "uuid": "1f14f0b5-85b7-4d9d-a0d0-1529d465c38f", "comment": "Malware payload (Stealc)", "value": "f10f771f0f413e3b37b95590a43dac259259e2edc6d40a6bdf7ac84e2a1fe2c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679824253, "uuid": "ad8e0184-a6fe-4673-8519-18b58d039a68", "comment": "Malware payload (Stealc)", "value": "fe56245970b2d9484e7cc042beabafb690eeacd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679824253, "uuid": "f8b77a04-154c-4aca-8010-098fe29f025e", "comment": "Malware payload (Stealc)", "value": "cae2b069198a15836e9be5cc8051215f5f86c0b7245f2be3efee77dbfd350dd44126c875e58e2ef8da47804612b84316", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679824253, "uuid": "e32196e8-a309-45b1-86d7-f84e3207e0e8", "value": "T1B855122AF641C537C1351A7C8E6AE6D4A66DB7201E2C684FB4E90F4C4F3D5E34A1E1C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679824253, "uuid": "e8e2216d-caa7-46f4-897d-cc21448fe934", "value": "baa5b88b6bb86e914d34b43be035dc81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679824253, "uuid": "eb8233fb-f590-4527-9b6c-850a9b90e339", "value": "24576:3WmAFubS9JJ8pZI5DMpZsYjWePFkTrsRfZBbVHaUjS88hxBgpB3dAutDf:n2FbEZZq+arsRxvHaUjVM4zAgDf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679824253, "uuid": "e3be4cdd-33d9-4c47-b2c8-a4922142f492", "value": 1383090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679824253, "uuid": "f320e2fc-3b2c-4038-b933-6282bebad8b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679824253, "uuid": "b21030a8-023a-4309-8bc0-caf5551272dc", "value": "68efe5e0a117357d69115c2823c07c5e.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1c9f390-cbdb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679838076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838076, "uuid": "1abca7bd-8272-4200-98e1-20b9e709eb9a", "comment": "Malware payload (Mirai)", "value": "0795290ee8634caeab4d8c88de21994f", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838076, "uuid": "c8279019-9956-4bcf-9303-c0e0771103f6", "comment": "Malware payload (Mirai)", "value": "f42df781c510bae352fcd61629f30621eb300f5d495954636ceb2f817b47fdd4", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838076, "uuid": "9cd4682c-9c9d-4385-82c4-24aadbde690a", "comment": "Malware payload (Mirai)", "value": "c0cea0ab841d7178f29aeec95e79e8c6cf0fc0f0", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679838076, "uuid": "c2413e27-a9b9-4414-a304-7a64fed96e19", "comment": "Malware payload (Mirai)", "value": "3a8569a05f9fcb8f5b415a87fb16f613348aa3e44c6043f5bd4d30ac8b14012e8d533e0ea08c24c8f7385592910d3dcf", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679838076, "uuid": "e8c3c215-376b-434f-885e-b19b6e4c8b4a", "value": "T14AE36C2B75C18CF6C00286B126DB63549523FE7F0AB62147B7947DA0BF398C94E69BC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679838076, "uuid": "1763db4c-ca28-4419-b76f-b66d0585d8db", "value": "3072:K1gdBvfRaBNGYAXXpETbZOutJ8adPF4KQTjsV/43giCDebvfcivGmS+Qk:jaLSX5Y4utJ8adPF4fCqCDebvfci+mSy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679838076, "uuid": "d0da59e3-42f4-4575-89b1-7725075c2e52", "value": 143461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679838076, "uuid": "5fe1bea1-c927-4768-b629-1b819dec36bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679838076, "uuid": "b2ba8dd1-9d26-4f74-8248-c01d168d9f37", "value": "0795290ee8634caeab4d8c88de21994f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6309531f-cb74-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679793625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679793625, "uuid": "cb78c0ae-380d-48c7-afe2-86ea228fa75b", "comment": "Malware payload (Rhadamanthys)", "value": "55f44d6adf58c574b55f170d7460426b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679793625, "uuid": "b3017de5-8517-4b50-96ed-f332d6f8feda", "comment": "Malware payload (Rhadamanthys)", "value": "f47bb8a267a7330b93eab3ad2ca75b0e593e19a1cddf9c7553196eda8f1ac062", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679793625, "uuid": "f12151be-3ec0-4109-9771-19e75737ef43", "comment": "Malware payload (Rhadamanthys)", "value": "4abeaa0f7307d3954e664385b5177ba7126f489a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679793625, "uuid": "f9ac90a7-5ba2-43f4-9819-10ddbb8960d7", "comment": "Malware payload (Rhadamanthys)", "value": "e36650027260f86c3c41f6be83e452b4ac66a83d901cd0ca7e982668901ed148245c87c609a9d73ba3820915339822f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679793625, "uuid": "11821057-87af-4b6b-9b46-8be78ba4044f", "value": "T1B4749D0253E17860F75386328E2AC7F82E6EF8615E156BFE16589B3F2971F72C162701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679793625, "uuid": "eb55be9e-dcbd-4d24-9b62-a634de172249", "value": "5bf64f0a1a526a4cdb08b53a545d3838", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679793625, "uuid": "3af7e68b-bd31-4ecb-b780-102121d37f97", "value": "6144:vTZU3k/yQFdhbipNjTn0iSnl8kFHIje9pxSXybTfz:vTZ7/lFdhbipNHzSnvlIj6pqynz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679793625, "uuid": "738368c3-939b-4b76-9c2a-1682f637c99b", "value": 353792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679793625, "uuid": "0477715f-dbb4-445b-8608-4ff0e6d773c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679793625, "uuid": "7bda594b-4ad6-445f-8f90-7a95396e8766", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "962ea99c-cbce-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679832366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679832366, "uuid": "b41f300a-f91e-43c4-97fc-a7ea9ca8d94e", "comment": "Malware payload (RedLineStealer)", "value": "47479afc9b95431d990daf32c06d9978", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679832366, "uuid": "25f81495-d1f8-49ea-a2a8-af7ff71c8f62", "comment": "Malware payload (RedLineStealer)", "value": "f5f27c0a18a95c12982160129e80a41a7b54ba549da80fec732d2f80000fa26d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679832366, "uuid": "8ff2a75a-4ff6-43bb-ba58-2005de09fdbc", "comment": "Malware payload (RedLineStealer)", "value": "683d4522d36f7a9063ace3cec878c06e1611f80a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679832366, "uuid": "bcc90cb9-f641-44c1-afca-74471d5308dd", "comment": "Malware payload (RedLineStealer)", "value": "8fe0d87d6c09a8a130de70c4c062b59ef553962c446a076a0a225c0f772b45c241afb425c068bd46da146597cce4ee91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679832366, "uuid": "4dff8126-244c-4d1f-9ab5-4efa2f482b9c", "value": "T12D454785E480D0B7DD63D93F73EB4EF6252FF8111A63159B724006DACE232F1AAA01D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679832366, "uuid": "93d446e5-e465-495a-9d80-8023011a77e7", "value": "0687d0d0d948483526792bab9d2b83f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679832366, "uuid": "5742e2fe-3a82-422f-999c-dc1547def4fb", "value": "6144:QEmLeVXMFFSWcpODcIwUJku9AOMBAyFhJxpZPR3L:seVXMF4WcO9M/hJxp33L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679832366, "uuid": "6dd8eda4-147b-40c4-aaad-f9099de329e6", "value": 1212320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679832366, "uuid": "9ce649e9-6d35-4463-95dd-72b49adcf0f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679832366, "uuid": "68791a05-c307-43f8-bd23-3ae6c7104103", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fe3c2a9-cbb6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679821940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821940, "uuid": "1c71acbc-625e-4444-b57f-dfc01a24ad67", "comment": "Malware payload (Mirai)", "value": "c36478986f9c875da890f2c077bafd9a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821940, "uuid": "49602d06-e09e-46ce-b22b-6c015532f957", "comment": "Malware payload (Mirai)", "value": "f6f56b9b08046941583dcba468647526d0cf64e35a8f0486a6ea82887ccd87a5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821940, "uuid": "e458fbf6-02ed-4d2d-b39b-d787625e49f5", "comment": "Malware payload (Mirai)", "value": "46c8186ce7cea620ab7bc1f310e6017ed65c3bf3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821940, "uuid": "4a88a40b-ed75-47f5-9c4d-fde62be84048", "comment": "Malware payload (Mirai)", "value": "d3bde00047f47fd26d586e7e949085c75fe683a6731bc10f910c168ca3c971a5acd70dfe20bdc5f5a221f082fee28054", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821940, "uuid": "cd3eaf91-5a82-4fc1-add9-5f352918ea09", "value": "T159632951BC819623C6D112BBFA6E02CD3B2613E8E2DF72079D225F2037C696B0D77A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821940, "uuid": "2dc52fb4-9955-467b-862b-183766eb5738", "value": "1536:YVBO1OEVyiWirxs/l46utIsXGBxajOu2fwL2vnWU:YVOXrPtISGBxaj3MTnJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679821940, "uuid": "dcb68d19-cf82-4821-a7b3-83016bc4e883", "value": 67016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679821940, "uuid": "d14eea55-0a37-48a2-a3b5-a87e0b39ed68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821940, "uuid": "5ab59250-768a-4d2c-9c7c-c81ebed24133", "value": "c36478986f9c875da890f2c077bafd9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda880a3-cbaf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679819225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679819225, "uuid": "abacacd9-8e56-4a6f-80c2-95f456f4f003", "comment": "Malware payload (Mirai)", "value": "26bb652720b1cabd7f2e8fab9c631d53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679819225, "uuid": "90ac13b9-aea7-49bb-8747-1c7fb808e669", "comment": "Malware payload (Mirai)", "value": "f75a90cd472e38dc6922b5f23da7ae886b6e2adc7662eac89a9a742d3fe1380f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679819225, "uuid": "6ad1a3de-cdea-474d-854b-2db144e86a11", "comment": "Malware payload (Mirai)", "value": "eeeb5b8c3277d909686aeda4cdc834cdd05b467c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679819225, "uuid": "cfb3b0d7-29f6-40d2-8e0e-417b4ce84df2", "comment": "Malware payload (Mirai)", "value": "54d8147621ca0c0af8c3a3eff1c891ccee461764bcd36b67e9c21ea2348ca1e05c2c6bb430e96ccd18219b7663f02615", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679819225, "uuid": "44444e2b-0ce1-4142-9285-0af0f1d97026", "value": "T1D9633AC9A5C3F8F5EC040A393077ABB299B7F13B6138EDDFD3982563A941642D1016AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679819225, "uuid": "cf6567bf-3bc7-40fe-8792-8976baf12ee0", "value": "1536:m4/aT1T71yYlupXqMmJmBr4vMFnKi3IFO2418H4QjWZRAttnm759gZb4Rv:b/aJT7MxNpmJm94vMFnKjF/4CH4TRinC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679819225, "uuid": "f7cb958c-e0a7-4428-9325-3e6f31457a93", "value": 70416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679819225, "uuid": "ed9d6a55-5496-4b98-bb52-585007f9a33d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679819225, "uuid": "a9c7ef4c-d3f7-4220-81df-3adde7ccdbe2", "value": "DA.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3744790e-cc16-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679863130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679863130, "uuid": "6538d636-fb3d-4bdb-8a1c-29215b41dae0", "comment": "Malware payload (Amadey)", "value": "98b8bbefb7d83c3ff582b3361090652d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679863130, "uuid": "5de6dfbf-e271-48ee-9d9b-4ad3743bea33", "comment": "Malware payload (Amadey)", "value": "f7f0467dca35ef41db9f63fa93884039a994862e15698207384ab4b35acb7aad", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679863130, "uuid": "fe4e50b9-760a-4289-ad78-7b787e4b5c81", "comment": "Malware payload (Amadey)", "value": "35d103d1f6b4b3f84ee03c0920fbe31d466edc3a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679863130, "uuid": "4dde15fb-d566-4ce1-9ed9-8c8bb080035f", "comment": "Malware payload (Amadey)", "value": "14818d220cd18d8ef7aef469dbed1f86b15f0236e4feb4d06a181dac287d7a1355443cd60a0762b2e6d74a58debefcae", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679863130, "uuid": "70bcc5be-1641-4008-b6c2-7218cb412ead", "value": "T167548D2EA3F56831E1734732BE1EC6F43A1FB8605D177B5E2649AA3F09706A1DD62304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679863130, "uuid": "a81a8569-8dac-4c7f-bed0-32afa74af501", "value": "a45b0eab0ff7170ea4d75272be8d3235", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679863130, "uuid": "2cbec6da-c0f8-48fa-b4f2-3d49d43d41f0", "value": "3072:d49j7Rq+lFlJtbAkyRmRafd3a/VIwdjogMUG2slAlBUeI2eUNUn78B:cRxHJtskye/ZjogMPlCUNU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679863130, "uuid": "46090987-5fbe-47c3-b8cc-56bcb6565d12", "value": 281088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679863130, "uuid": "f06ecd84-8f6b-4146-ab7c-e03885911ad7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679863130, "uuid": "520223f5-19e5-4eef-bd54-1176d380cdc2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2e17cbc-cb70-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1679792122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792122, "uuid": "96fba9f2-3f1c-48a3-83af-f60239582d46", "comment": "Malware payload (CoinMiner)", "value": "7bef643347ce9ff057a54b97fb6dba64", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792122, "uuid": "3d22df5e-e235-4422-ab5f-f5d216e94b2e", "comment": "Malware payload (CoinMiner)", "value": "f9f3059259b32c85bec7b506be27ef074e73d5c34a811c93c451d21ddb1939f3", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792122, "uuid": "811be7a1-5023-4d6c-a3f6-731c5461d566", "comment": "Malware payload (CoinMiner)", "value": "3f0c8a842e4726e5c189c5b0148c7a92ac15cd79", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679792122, "uuid": "e633d307-800f-4ea3-bb67-3d20a058feeb", "comment": "Malware payload (CoinMiner)", "value": "4a0b10d527774f099f1041a3e10c3ac5db27c684829289574578fb460573e75365390f59b6ce231153eac725fe7247d0", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792122, "uuid": "ee01fbbd-4c46-4f0c-a548-de59e9e7a32a", "value": "T18F546C0252E16860E72387329E2AC7F82E2EF8615E157BFE13559E3F1971FB2C162315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792122, "uuid": "c08219cb-7e77-4ff4-8b49-3a71881720a3", "value": "5bf64f0a1a526a4cdb08b53a545d3838", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792122, "uuid": "439e3385-a760-4d98-8d6d-7eaf5a50c8dd", "value": "3072:KLpczY0B4fY9b2SGf5iGshfqaA5P7NmJyyg4bBdRvD1bjRScOCJQN0fm2Rh:xHKf53sRqaArmg4b7RvDpvZTfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679792122, "uuid": "b7a60af2-59ae-4f8a-9ba8-1434eb622e58", "value": 280064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679792122, "uuid": "2bb7e90a-22f8-46b2-8a64-b19930766d04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679792122, "uuid": "104e98cf-c0c0-4e72-bab4-03d4b3ee7d54", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a68e768b-cbb4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679821226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821226, "uuid": "d3b3eb75-136f-4331-a941-070baafa1c21", "comment": "Malware payload (Mirai)", "value": "4696b74df034ff5fc2dce03c32258a74", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821226, "uuid": "d5f0f4ad-52b8-4fd3-9474-9f0769b1f8d3", "comment": "Malware payload (Mirai)", "value": "fa8a6103fd8ba269a4c37531c86df317477773bb001ff4f4ddbea5b347aceadc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821226, "uuid": "2df6a7e7-7951-4587-9f24-93bd97d2ef4f", "comment": "Malware payload (Mirai)", "value": "9589ef10d44692564b9fa0f66543a0beb9f7f478", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679821226, "uuid": "033c5347-449e-4971-96e6-c56aa1ae0a6b", "comment": "Malware payload (Mirai)", "value": "87563df03b95980de6b150d8e0da3a4ec020cf6b3772e34a67edc944a96bdcb7837a1e7370b230a8cf165d90ed0c9e50", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821226, "uuid": "184e78c8-0a5e-4ea5-af76-eeccb20ac081", "value": "T1E4638D76C57859A0D1444970769CCAB44B13B904A2937FF5CBC28F668407AFCF2497FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821226, "uuid": "8a107dd0-7ca7-4098-bef5-38e8ec43ae34", "value": "1536:z/EHByayJpJXvNUN3ESsN82UB3lu8Cza:zcHc7fxS4hE3lu8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679821226, "uuid": "6ece31b5-ba74-4676-aa31-7a44bc031782", "value": 70752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679821226, "uuid": "e4f3cc57-9a08-4d76-a3e5-76143a52fa01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679821226, "uuid": "0ec957b0-673a-4a39-ada1-e7a803fbdcef", "value": "4696b74df034ff5fc2dce03c32258a74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6fa1e9a-cb9a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tsunami)", "timestamp": 1679810141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679810141, "uuid": "1e656374-2793-4156-9e9a-c20046b21855", "comment": "Malware payload (Tsunami)", "value": "5a273ec43ed50b10e01da7531ca925e2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679810141, "uuid": "cac6ca23-2188-4a64-9ec6-2accc5464786", "comment": "Malware payload (Tsunami)", "value": "fac919fc38c456cd30216a6d190fc258049ceb9ede4cefcc60f666d66178f641", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679810141, "uuid": "4995c2fb-2eb4-4759-ab1b-ea8ff3035aeb", "comment": "Malware payload (Tsunami)", "value": "b5f56314840f30fb1dfb573a8865af092b576805", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679810141, "uuid": "98c70fdd-8fee-4e3d-87fa-0c7120642198", "comment": "Malware payload (Tsunami)", "value": "33c5f12d8ed3801b436f89fdaee5be0118a0cec4a9b3cd1ad56d435f2bd981aeb69b9f08618e28db81c1b99767a8527e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679810141, "uuid": "29720111-1f3f-4c4c-82a4-079ae3bb2c87", "value": "T16B931985A743C7F3D4A31ABA02ABD66E0635F8399E259F4CF31D3DB45B139C87216224", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679810141, "uuid": "2c594bad-5f7b-4dc0-b988-b99167504bbc", "value": "1536:r2fgDhEY0B/NNaDfMBbRWALsMR9TgDrTBxLGlwALtAgL/sPwJUkit1O5u1m:r2ff/naD5bMR9TgvTrmwWtAgL/s4JUkr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679810141, "uuid": "e5bdf52a-c690-497c-a401-8122c7936a4a", "value": 89062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679810141, "uuid": "d331d5f5-9e25-40be-a3d1-3b4721bf10bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679810141, "uuid": "b7679fe3-e8d4-4bf4-952b-35a62b2cd12a", "value": "5a273ec43ed50b10e01da7531ca925e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34ed51ef-cbaa-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679816741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679816741, "uuid": "4967bc50-9047-4672-8077-39eb42822b73", "comment": "Malware payload (RedLineStealer)", "value": "4348f3bf99ed0757f66559e7a5ab3607", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679816741, "uuid": "216b5444-0220-401f-b342-75e0a23d31a0", "comment": "Malware payload (RedLineStealer)", "value": "fae6cc338a951d549709a1284f39b11a3a44ceb1a574a8cf3424245404cedf15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679816741, "uuid": "700f2317-6202-4302-bc4e-e3aa215eb320", "comment": "Malware payload (RedLineStealer)", "value": "a46253152ce552888cd8802a24b01d5034a0f43f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679816741, "uuid": "711a9f9c-4a1a-4bae-bc41-dd9d4a3cdb2a", "comment": "Malware payload (RedLineStealer)", "value": "6634798b1193ecf4628c061b504a3fd636cc1220cb4d0f2ceb17ff1356d6e84a0a1d212d66bd7c6485c1dea70392dba4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679816741, "uuid": "3ebda9c6-13ee-4f62-976e-f05cb48d2bc5", "value": "T1A04633E884A15626ECDB60BE00D99EE28D3C7E8CF5DD81D874F197B087573B0A79099C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679816741, "uuid": "a08fdb72-b4ae-4441-ac5b-1d0d956aaaaf", "value": "968fe7eb2710ba43db1e5b6909744004", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679816741, "uuid": "267e3f30-7228-4009-9490-83b9ec4386cd", "value": "98304:glTE5eYkB8p3I3WXUODJ6+oOo7OvqB+9k4eUfXcoZCPGWyzt0dxvtDSOk2:glTE5nF9Xjg+o3OeqfXcvPGFzWdZt+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679816741, "uuid": "07102ea8-25b8-491c-a6c9-c393411df629", "value": 5877104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679816741, "uuid": "ceea2d68-3cbe-4bfc-b300-6939bf662eff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679816741, "uuid": "86daf18f-9806-4283-aad9-5d30802d82bb", "value": "4348f3bf99ed0757f66559e7a5ab3607.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7f34eb5-cba5-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679814786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679814786, "uuid": "25826bed-2465-4673-a563-08024f650b97", "comment": "Malware payload (SnakeKeylogger)", "value": "8facacda293b15419cc2d68049df9641", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679814786, "uuid": "90ef2075-b305-4135-b3bc-cfd7b37df4fb", "comment": "Malware payload (SnakeKeylogger)", "value": "fb11a11453b52eaf817215436583095c45dc67b56290c204cbb44acabd0bb233", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679814786, "uuid": "ce68e4ad-f02f-40ce-9ab0-fdb09c2e6bd9", "comment": "Malware payload (SnakeKeylogger)", "value": "2f0614268f6300105faccc873ad43565b3dec860", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679814786, "uuid": "4e1d6876-c550-48bd-aa33-6dc604b5b2ad", "comment": "Malware payload (SnakeKeylogger)", "value": "2dccc8a70e84eec004fe177adda023ef2f6d611fce074607816fbb1c9547ed42fa4e772537d035168b78a26ac918ef98", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679814786, "uuid": "9eeb000f-c83d-4a32-bc7d-f9e7aed5f5bf", "value": "T1360523C331E294AF6146EDA8B2E39E909F98FB0A0BD019741E5BF71554F3013D625CE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679814786, "uuid": "9a55614b-f3dd-4ec3-aab1-bb3eca9c8ba6", "value": "24576:e5TG8jLsswDPqzgca4yjPIZTGzaREQIDdi4n7yadpwEmk:e5G8jLsseSscNyPMTHRGdi4n7x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679814786, "uuid": "73fe4b42-d906-4c26-8c7c-c4cf38a98c6e", "value": 807480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679814786, "uuid": "dae6cd57-34f7-4c91-a8c7-189c34b9fb0c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679814786, "uuid": "119c54de-4785-4a43-8d87-95456b919c65", "value": "COMPANY CATALOG PROFILE- Qingdao Wisdom International Supply Chain Management Co.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8005435-cbb8-11ed-88f6-42010a9c006e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1679823054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679823054, "uuid": "9bfe567f-557e-4126-850c-4519784d18f6", "comment": "Malware payload (QuasarRAT)", "value": "c82aef2f4af33da65cabc8a1fc314005", "object_relation": "md5", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679823054, "uuid": "780db805-60e7-4919-bd77-729839511638", "comment": "Malware payload (QuasarRAT)", "value": "feccb8e265a44c624eb9786c0d3cadb4f652d44792c4dbb10327508fa58bd149", "object_relation": "sha256", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679823054, "uuid": "fdeba0c2-1f21-4a54-ad7b-bcac7b787b4c", "comment": "Malware payload (QuasarRAT)", "value": "dc18ae23a7cea0ef3f069ea3b1682cf4ad7b7d3f", "object_relation": "sha1", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679823054, "uuid": "e27f0969-4560-4116-b207-783068c66a59", "comment": "Malware payload (QuasarRAT)", "value": "e8d3f7031ab4cc9fd10895a441a12872734d9403acd67b9a3b9e7445e01d05e7b83c2ab76a24c926158858da8d7fbc51", "object_relation": "sha3-384", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679823054, "uuid": "23bec183-21b2-4567-9d81-f8ac0ec0472f", "value": "T1E385DC5A19E67DBCD388427F2601512687EC7D37D48BF0689283E0FB09B3E7669345AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679823054, "uuid": "1a8595f8-3452-4e72-a9fb-00a580383bb5", "value": "12288:j+x48PQ0D1VF5sh0cxA19ocTBTUfUIPHhbd0bDl+ohZPr2yU/+acQ6Iqf5eL7U5T:j848PQ0D1b53cxAS4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679823054, "uuid": "a9a010a5-ece6-450e-9691-2ad4594723b2", "value": 1768687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679823054, "uuid": "27980e50-2c3c-4b2d-a983-a63fedfa5fbf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679823054, "uuid": "339dc115-c29e-4110-8bb8-02fb6a773c0d", "value": "324546756898.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }