{ "Event": { "published": true, "date": "2022-12-25", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-12-25", "timestamp": 1672012981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "21d5cc22-7407-4bc3-aca3-2b6b045b7353", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57704b0f-843d-11ed-9db1-42010a9c0080", "comment": "Malware payload (Quakbot)", "timestamp": 1671963451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671963451, "uuid": "3f73be42-b416-48ac-b0f7-5de2e4f787f0", "comment": "Malware payload (Quakbot)", "value": "b12e01985b5daecc58d7cec5b37462ed", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671963451, "uuid": "0150ac05-b235-4e85-a4f7-e9ad3c2ee73b", "comment": "Malware payload (Quakbot)", "value": "012747575632a83c77d73b90450612446664d78c5a6a1af082c5da1485f6e9e1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671963451, "uuid": "d901a9c7-8c56-4dc0-8cc6-bb18e0a73442", "comment": "Malware payload (Quakbot)", "value": "a8654d9b674a330db1f0c8881d678687ab53a0b7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671963451, "uuid": "dabbb11c-73e9-4cd2-a917-f2e2495601eb", "comment": "Malware payload (Quakbot)", "value": "dd4bf911b72db4d9508f814650ae9642f2e54b50f77d7a4b0081b94857e6fb3a2a217a154049e2c402a098d2a310614b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671963451, "uuid": "20d5d891-5e21-4f0c-af9d-c428dcafe6eb", "value": "T139A53325B8F3D831E53AE8750464F5B11A7EFD306E113D6B2BA84911AE342C2D4869FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671963451, "uuid": "1fe35a2d-27a4-4c96-a6db-d30ac27ef371", "value": "e913028544b09d554e972b73acb72d4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671963451, "uuid": "c4486bbd-cf18-48e3-acc9-2d4f3b13a160", "value": "49152:SWZ5HwJW2sYVMxHqAHIferky/njn/r8CU36+eRNl:SWZ5HwJDdVCQerRjn/rZU3KR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671963451, "uuid": "96829271-80b9-413d-b0e2-ce1b59a35078", "value": 2158592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671963451, "uuid": "45eb3d56-2d74-4e54-8471-31751168ec65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671963451, "uuid": "3f731311-fb9b-486e-ac6b-d512ceffca9b", "value": "nequ_020B0000.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d4e4684-844b-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671969500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671969500, "uuid": "ff66b9cc-94c3-4862-b9f4-4c0ba36dd674", "comment": "Malware payload", "value": "b6672232efa56db9e046ded12df0a939", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671969500, "uuid": "041795e2-2766-4ec3-bc13-f88ca573fe0f", "comment": "Malware payload", "value": "022809a66a0cf46c950c8f312f56c2f357cdbe3bb70e885d7d923c05c426ca2c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671969500, "uuid": "f0fdcef5-5503-4a08-aa1c-3d56dc0a83da", "comment": "Malware payload", "value": "7145d5f4b400cb3ab07c907eaedc9636b53ea207", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671969500, "uuid": "579c3740-9a66-4df4-9f47-3ecf43ba0f73", "comment": "Malware payload", "value": "a9caf4ff5d67f3dc04d990d43cf9e2aec1b0a42fae10a074e388a4d0daa69534c088bdaa66135831917289de060cf46f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671969500, "uuid": "dc9c8443-2a8a-430c-988e-0d427ccff21a", "value": "T1C2A523527BC55572D8622E7418E81B30A439BC100725CADB639C771E9FB41D2EB2EBB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671969500, "uuid": "337d4002-77da-46ab-8dfd-6c4ab32cc87b", "value": "ae9f6a32bb8b03dce37903edbc855ba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671969500, "uuid": "fc4dd852-ab20-46f3-a650-8b049f16ddfb", "value": "49152:pyZdK3+otSXBMVp6Na/ElzKXRsiAWmlE32JPzrM:pyZdzVXOscERkGm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671969500, "uuid": "453e8584-8d05-499c-aa73-3b8e74fef170", "value": 2108547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671969500, "uuid": "12fc84d9-f279-4e3f-8cb5-7b3860fa9e67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671969500, "uuid": "08564c56-1d43-4360-83f3-ec2a8970b253", "value": "b6672232efa56db9e046ded12df0a939", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcedf7da-84a5-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1672008289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1672008289, "uuid": "a5c06122-63cd-4047-9db8-2d900f491377", "comment": "Malware payload", "value": "207b0348214f7bc1c1d520939e4aaa0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1672008289, "uuid": "b23f5887-c55d-417e-b4b8-0104d6659a3f", "comment": "Malware payload", "value": "025118212a92258b65a208a95b342a96e6eb585c582361a64f52d6b3e678f176", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1672008289, "uuid": "47e9c308-e15f-4de8-a204-e6740ce9bb9d", "comment": "Malware payload", "value": "9d6bea1a799c04dfe9196c24ef1017ded46bdc09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1672008289, "uuid": "77ba2723-b979-4bad-9352-7febadb11600", "comment": "Malware payload", "value": "b1fe9b583684db2afd190a4faaf700c0e18e4c1a4a299ee4956c81faa8de1669bbb49471657f3df54a1184cc4346e775", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1672008289, "uuid": "f0eff421-60eb-4cd2-9188-b87bdabb3150", "value": "T19C34CF11B292D8B6D55328314919DBE41B2AFC61BB64CD3BF344BA1F2EF0190A5F6363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1672008289, "uuid": "e34771e2-1ed3-41ec-acaa-04e9e5afcc86", "value": "6a8f260c43148885d76dffe1ee7a8503", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1672008289, "uuid": "0fa7bd10-b72d-49d2-a065-545ce492a581", "value": "3072:JCCKLfg5L5B9guYbVPh8VERW/S/lS1g/tK8PjTsL21LrcSb54VIcVTuh:0LqaFWERW/GtK8PjTsKRbIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1672008289, "uuid": "4562a861-57b5-436e-9b15-6a6c5d3aa7ef", "value": 236032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1672008289, "uuid": "7c1c3104-49d3-4923-9a66-2df52fbf386e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1672008289, "uuid": "36db2149-f95b-42eb-bd1e-160c8ecb9d9f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67eeae45-844b-11ed-9db1-42010a9c0080", "comment": "Malware payload (DanaBot)", "timestamp": 1671969491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671969491, "uuid": "6890a0e4-4334-4db6-ad16-87c86ca29293", "comment": "Malware payload (DanaBot)", "value": "a0f0a5939391e1e6435891fcbd3c1f8f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671969491, "uuid": "b160d9d2-4981-48ce-9806-3c128a20bca5", "comment": "Malware payload (DanaBot)", "value": "025208b3d2dc191ade69d312f02ae794a9a1b03952e959d7031460aa0100d23c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671969491, "uuid": "54e28455-ab57-4784-a0a8-329599bee722", "comment": "Malware payload (DanaBot)", "value": "240a65e3b2fc037e23b631689bdf2b56089b5ff1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671969491, "uuid": "312c33b4-3bbc-4b1b-a252-6b13fa4cdfce", "comment": "Malware payload (DanaBot)", "value": "4097a57ae06692732357d444aa051d9363f81560a22d54bd90689551d375ea272927374e35ce1c79905fb4495633f79e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671969491, "uuid": "31cb312d-1ed7-4beb-adcf-0a5c2d24e0e5", "value": "T14F352201A2919CA6C7C228755C3BD7F8277FBD944E9359F3230A622E3E706B55E02297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671969491, "uuid": "8ce799c7-f113-492e-8858-27c9ba370050", "value": "7b9daca6da068f54ad4e1900288e8efd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671969491, "uuid": "6736af68-1e5e-4343-b1c6-9e6eec48d2f2", "value": "24576:Xo3ciGhHIfz+y/iHemincy/2JIGJZwYKl6cE5CjmXNeEh:XEGZIfzuHeminIN9Q61CjsN9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671969491, "uuid": "28a3185b-9f66-4cc0-bd9d-3d2d1c3bbc72", "value": 1128448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671969491, "uuid": "0d976e73-b66d-42dd-ad5a-20fc02716865", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671969491, "uuid": "d9e5a8a2-d13c-4165-8ff6-c56c377f7ebd", "value": "a0f0a5939391e1e6435891fcbd3c1f8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c7a48ea-848d-11ed-9db1-42010a9c0080", "comment": "Malware payload (LaplasClipper)", "timestamp": 1671997819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671997819, "uuid": "8b445f12-26e7-4595-b57c-44dd6b093bf8", "comment": "Malware payload (LaplasClipper)", "value": "6a7da385f4be35657ce2a93f00f96b0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671997819, "uuid": "2ec72fbd-ce30-4634-a428-8f96563beb91", "comment": "Malware payload (LaplasClipper)", "value": "025bec496d71b1d17d023e04f25a5df0f3538308a5d639007a1e7db41c6d91e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671997819, "uuid": "73bb0a4c-732d-47ac-bcbc-c49053fc4aa6", "comment": "Malware payload (LaplasClipper)", "value": "54fc4aa70e25223642f1da6aa12203bb34820b8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671997819, "uuid": "86da3eb2-c71e-43da-9eca-e2a9cc7ee396", "comment": "Malware payload (LaplasClipper)", "value": "35b07107af8c64db0cc7df1e1dffa8086a78c5292b4c6fc0c8b814b696c917d980af960e8ce7bcf9567b639dadff6d75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671997819, "uuid": "6f734d93-8e89-464c-830f-3fcb882f61de", "value": "T1E0F1E815BBD94119C6AF077C847343014F32BB62A112C62F6CDC926D6D63BCC4A053EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671997819, "uuid": "4768d13b-373c-4dd1-a591-46e119ed8586", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671997819, "uuid": "e4fc633e-b08f-48b5-9825-9e91c3967412", "value": "96:tZNNWTSjhN5XK0N0mo8mez+vsxXaZ4BAdZ+nCgNdZlVhQTsP0M:+Wc0N7bBLC6hOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671997819, "uuid": "12825f7f-f270-485c-a381-d042ca09e9dd", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671997819, "uuid": "b74be5f3-d23e-4fff-97f1-114609a005f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671997819, "uuid": "711fdb7d-4418-4c91-9d30-53d5d186082f", "value": "025BEC496D71B1D17D023E04F25A5DF0F3538308A5D63.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49d13d06-843f-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671964287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671964287, "uuid": "7d7230c2-e767-4605-a66c-9c0e00dc41e1", "comment": "Malware payload", "value": "2b537c9066899e8b1a5fa0354334ea7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671964287, "uuid": "224d6466-0797-46a3-be87-ec1003e510b7", "comment": "Malware payload", "value": "04950b3ce5f06895fd0807e0801731db4fb2f305d99176a57cf3884b7656718d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671964287, "uuid": "732041ef-0298-4973-b5f8-6492595deb15", "comment": "Malware payload", "value": "d213c36ffd0aaaae317e32f15ed7076605d3d71e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671964287, "uuid": "cc9c1fc3-fd87-4142-bd70-2bca08b4fb2b", "comment": "Malware payload", "value": "df704f8be1a0730c2cfc8c17aaf76a75ee770db45a454eb658b6186999dc06cc8d40ca5d6c958769c1bc3757a3c82d5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671964287, "uuid": "d1f7bdf3-83d2-44f4-b1ec-b54fd7cf4a37", "value": "T1A7C1FF015EEB50DAF23707706BE6B3B70666F5B1552E72B870848A995F306C0CC61FB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671964287, "uuid": "b59f5502-6ef9-4328-a79b-231aa7818823", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671964287, "uuid": "42a14022-58f3-468a-973d-f4c41c59f8af", "value": "96:R79o28CFmOwdvtcgrvk+KvAYnsyvk+KIm/wvzd3oj8rl:R9o2nFZwdvZrvkkYPvkEmwzdx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671964287, "uuid": "d17035b6-fb9a-4963-a237-911a9955e151", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671964287, "uuid": "ed67ce8e-fdc2-40e1-b398-a4390e7ce917", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671964287, "uuid": "7998bc22-b1c8-438d-8821-715e23b053dd", "value": "SecuriteInfo.com.Variant.Marsilia.2083.17.3198", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0e76df8-847a-11ed-9db1-42010a9c0080", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1671989827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671989827, "uuid": "7a4e4f51-f47c-4ee7-b5cf-b738c86a22a5", "comment": "Malware payload (RaccoonStealer)", "value": "e8b396d3ecdc2a3d1089936a3fb2a537", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671989827, "uuid": "8bb31549-d4fc-4510-9cdd-a30e98c7d929", "comment": "Malware payload (RaccoonStealer)", "value": "050ac31eccb687f01aa3ee0c16217d6d103b796bb606ddf4e3d0013af689e08c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671989827, "uuid": "df552c0d-c126-486e-8cca-a4d3e8143647", "comment": "Malware payload (RaccoonStealer)", "value": "2082d33ac18070628f045004d293a606abae7b8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671989827, "uuid": "0233b111-fc6a-4974-8204-8451785febb3", "comment": "Malware payload (RaccoonStealer)", "value": "6dd876f1b8583fafadbd06e5d88f02c0617c2967af79bf978b3cd9477b6d8a29b36b30d4d086a610b116261e892baae2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671989827, "uuid": "e80fbb08-5488-4b9f-9503-128886f87cb9", "value": "T1CDB57C88FB667633DA74E7FA887A294A7B38D3A54F8263DB143540F81DE630D5E43904", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671989827, "uuid": "2fcc78eb-1c1c-4112-acbb-a18670bc74ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671989827, "uuid": "d445503f-1156-492a-b54b-94ad54d25eb4", "value": "3072:wLYB8TQ8NVHs/KXQxP/MVBHKN6B6zYk7TGXxAzYIS3XymCMMIFF+OSOO2O2OOHyY:oDTQgVM/KX4Eq5Yk7TGqzYIoXaI7jS+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671989827, "uuid": "38467ba6-6249-4796-ad59-9c598b91a524", "value": 2351104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671989827, "uuid": "fe754d52-b154-4ab7-a041-7bb3f5499290", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671989827, "uuid": "586f4f36-7365-416f-b258-5ed4a26fc52f", "value": "SetupFile.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1681f0b-8479-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671989479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671989479, "uuid": "7eca2862-f5ab-481b-9621-c89a4146b368", "comment": "Malware payload (Smoke Loader)", "value": "999d8ae721958772b0b61d72b3ea20b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671989479, "uuid": "9d4d96d7-c0aa-41ca-961f-1a3df329c58c", "comment": "Malware payload (Smoke Loader)", "value": "07c2bc81dc617a9e547b176e8d074eafeb826659924acf678710f6b70d0366a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671989479, "uuid": "d8ed9338-fbcc-4ec8-96a1-85a00f66caa5", "comment": "Malware payload (Smoke Loader)", "value": "08895b0fb7c3cc93c84a40d7684e85d4c8c9dfbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671989479, "uuid": "c02d5a67-167e-4ab8-98b2-7f8da7aed11b", "comment": "Malware payload (Smoke Loader)", "value": "758d64cfcf22032067c3898942031c582f86b19e728183f5ab9c86c3f00a713993de44c4b9dc84607b43d37e76080c33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671989479, "uuid": "fde0f021-a457-4e19-aae1-88051c39e9f6", "value": "T1EF34AD212691DCB1D7C285314D2BD7E82B3BBC918AA79AF376447B1F3E702B06916347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671989479, "uuid": "6fd6a94a-cbba-4b57-9fe5-40e09941ccad", "value": "8514760d95d5a493235b8748f65885e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671989479, "uuid": "3b8346c7-f9de-411f-822e-7b18cc033369", "value": "3072:MlAaLENJ5/e827SBEF++2Uf10LLgbQWwVnJtJ/Fsxw7RkxmJZs:M/Lq5274RcGLLgcWwJfJ/gGymI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671989479, "uuid": "671929c4-7251-45ba-9e4e-64a158522063", "value": 237568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671989479, "uuid": "cbb67de4-e57a-461b-a61a-9584f7df4e99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671989479, "uuid": "372cbf90-5654-4569-8720-1ffeb81a6464", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8774fe7-8411-11ed-9db1-42010a9c0080", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1671944716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671944716, "uuid": "4162a7a4-e038-437a-ba08-118f862a5e6e", "comment": "Malware payload (Gh0stRAT)", "value": "b3ab97b4bfe8da5ef0d7bfac1b966dd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671944716, "uuid": "e91e0fcb-bfe6-4e14-b095-075be36cd463", "comment": "Malware payload (Gh0stRAT)", "value": "08679ed556cf2ae19c037d2e04ce79038f6c8c2996646e1fc6ff3731d3e00d5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671944716, "uuid": "42295635-d5ef-41fa-be5e-9a8a51bb510b", "comment": "Malware payload (Gh0stRAT)", "value": "d4695c7888b8e5f81198166b7a5cd2a843af8293", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671944716, "uuid": "0e4548a7-1846-47d7-9220-e5a80eeaf999", "comment": "Malware payload (Gh0stRAT)", "value": "40e0bd8d6e58329f98a07e22f70712fb93c4100532f82fb0d9ce101f7fdbe6c8c7dbc94b0f5a13d3ad1efc978bed66ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671944716, "uuid": "90b58cd8-3292-49ee-9427-c40a8c0e6162", "value": "T1DE63023BCDC60B8DDF052C38EE535137171AB083477B191FE406D6A838CB5247A8AE9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671944716, "uuid": "b10e9d33-274f-4dc0-afa9-65c87bd4bcfb", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671944716, "uuid": "6d8fb8d7-06f9-444b-afec-ea52cb9e8e27", "value": "1536:GDLRlC4+q/zSXSeDHogQZOvWlgdYfjnbkI:P4+qLSiYIbOvWKdu7bkI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671944716, "uuid": "566e1fab-d177-42fa-9e2f-669794d1af86", "value": 66936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671944716, "uuid": "06633e43-ee16-41b3-a820-5a0d1e1e5286", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671944716, "uuid": "1881bf8f-79b3-4585-965f-1ebf16758c63", "value": "b3ab97b4bfe8da5ef0d7bfac1b966dd2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a800a4cc-8432-11ed-9db1-42010a9c0080", "comment": "Malware payload (TeamBot)", "timestamp": 1671958862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671958862, "uuid": "8d86bc15-98b8-4543-b9f3-bef08ec852e4", "comment": "Malware payload (TeamBot)", "value": "3313c4807243ab6363f117606b508dc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671958862, "uuid": "d8aff460-1b2c-423a-9ff8-3253758d4f6d", "comment": "Malware payload (TeamBot)", "value": "086fbf26628b6e5c686c0417b0966a793f1719f9cb984ff7770a4eef1b483610", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671958862, "uuid": "22b7d68d-1ff0-44f5-ba34-3a2062ae2470", "comment": "Malware payload (TeamBot)", "value": "d9656c20ef55f12036ccc3524964e89b25d27ac9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671958862, "uuid": "d572e55b-6bd2-4b99-bb4a-d69dcc35b3fc", "comment": "Malware payload (TeamBot)", "value": "a8584b4546a403d074401a83da5ef5dc97ca8458f00f568937c617d777996433dd26b68db19fe87e64aea829de1482bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671958862, "uuid": "a20a3b94-ada4-453a-9ada-be9f69d22c53", "value": "T1B7249D116691DC62C7C24570992BD7E87B3BBCA19A635AF733447A3F3E301B09922357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671958862, "uuid": "4842e052-f7a4-4e98-ae87-9b4c9c30a82e", "value": "78b36debb485b88b8de5929ea52f861d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671958862, "uuid": "f3135626-d073-4957-8d7a-a69cb70b5f49", "value": "6144:YL4nHUXY3hV5Xt6dO2Wz/8d3j1J/NtGGymI:Y8n0MhV5dhM3JVNUm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671958862, "uuid": "4060f78f-544b-4725-8ba7-229f82c85888", "value": 228352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671958862, "uuid": "972377ee-3d01-464a-a524-66c868719986", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671958862, "uuid": "785c367e-a9e1-45b2-ba4a-f738398d23b0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20d06651-84af-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1672012322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1672012322, "uuid": "306fce8f-a807-4932-9fcf-04cbd49a353d", "comment": "Malware payload", "value": "ae135787d453b03736a7c7e01fae9e99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1672012322, "uuid": "818818d4-ea4e-4129-adb2-9ab73299c275", "comment": "Malware payload", "value": "092501f053f81658358e5309e0cf1b69b64a72d97c2875f2e2a824e788db3b88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1672012322, "uuid": "10da83cc-08a0-496e-80a7-3ac2b410aa7e", "comment": "Malware payload", "value": "16270016d069c07d9df3c9659738d1946fe77fce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1672012322, "uuid": "d003cd5a-4f15-45ee-a118-a654215a3e93", "comment": "Malware payload", "value": "d9598a369273af468d13f4c232d2b4b6be4ded402c8ad74143c0cd709bbbcfe5b3b53ce4317b9421c6e28a24b9f3585d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1672012322, "uuid": "3605ef9e-d862-4cb7-b53e-15ba2942eb35", "value": "T11134CF00B392D0B5C4531870192AD7E45B29BC61BAA4EE3BF780BB6F1FF029095E9757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1672012322, "uuid": "ed545ec9-4819-4cbe-99a9-5aaec96cdd22", "value": "6a8f260c43148885d76dffe1ee7a8503", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1672012322, "uuid": "d674893b-153b-4668-9c42-21c78b920c53", "value": "3072:wo0qL4c5ieo8ZTX4KP7l0tZOGq6em4lS1g/tK8czxKt8c2LrcSb54VIcVTuh:bL41eogbPZ8ZOGXe9tK8czxSR4bIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1672012322, "uuid": "5411545b-3971-45f1-b473-56c61f1f8199", "value": 238080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1672012322, "uuid": "db609c1e-2a00-4cfa-b38f-ab7d30553f17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1672012322, "uuid": "92979db2-a76d-419b-baf6-b2763d6bf842", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63a6f039-844b-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671969484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671969484, "uuid": "44f4335c-8549-492b-b1d4-4c0f0312afc3", "comment": "Malware payload (RedLineStealer)", "value": "cffe4935ee388b9c4155ac7f304b1429", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671969484, "uuid": "a7ee08a3-9d5e-4c45-b816-7f8c8062304b", "comment": "Malware payload (RedLineStealer)", "value": "0969698e9298154bd93a23d103a942a2937ed1ad1fef8c1ecc6282a57d3c4711", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671969484, "uuid": "c03fa96e-6be4-4363-b288-cd9dbc35585c", "comment": "Malware payload (RedLineStealer)", "value": "cea43f0386b8fd879700ec5ae4e02d254380096b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671969484, "uuid": "181d6cc5-f22f-49a4-abaf-458cad7b8866", "comment": "Malware payload (RedLineStealer)", "value": "f264c790c0fa3de591cefa4471969d85e352cb760ccbe874e859e56395bfea6f1e8b7348728af4f75dabd8f745c93f94", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671969484, "uuid": "e79f0e6e-ffb7-4514-b468-444a4419f2ec", "value": "T1DD74E0117694DC67D3E245B1882BE3E91B3BBCA54A6769F33B043E1F3E302B05D56286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671969484, "uuid": "17ef1ec1-a5dd-431f-a947-6bfd3141d7c0", "value": "7b9daca6da068f54ad4e1900288e8efd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671969484, "uuid": "83f983bc-0c18-4ffc-b3fd-548bc767316b", "value": "6144:dEL9Rc7DfuLvjt3z1HIrKgsXH0FywhGnaQJ/zvGymI:dE4fmvjt3z1o6XCybaQVJm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671969484, "uuid": "ccbe47cd-b25e-4465-b9ba-803127c602d1", "value": 349696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671969484, "uuid": "935ade1b-f207-4f0f-b2b5-9371c1bf5157", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671969484, "uuid": "e447787c-cb8c-40fa-91b8-ae89708bf123", "value": "cffe4935ee388b9c4155ac7f304b1429", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d58fbb07-83f3-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671931880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671931880, "uuid": "016a488f-4834-4521-9b62-29345ce8f0d7", "comment": "Malware payload (RedLineStealer)", "value": "48c215162090b400bc744151afcf7e5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671931880, "uuid": "7f263c67-42de-4a6c-a166-dd0ded986761", "comment": "Malware payload (RedLineStealer)", "value": "09a0b666c67783938010e0adc3f194067aabfa44aefada1879ae2c94dfc4768c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671931880, "uuid": "8f5c6884-e508-416a-a1a0-2c404bacd57f", "comment": "Malware payload (RedLineStealer)", "value": "50c1d9a6203bdc84b9509d8bce213843bdefcfdf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671931880, "uuid": "8460d630-d475-49b7-afac-ffdc8aef4638", "comment": "Malware payload (RedLineStealer)", "value": "e9365a7f30259209cc998d1f60475f55fed1aa8a653b95d9280bd70385e1b1e902a8b38337d6c8c6ae12ac3e61ded022", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671931880, "uuid": "adc4ce40-fea1-499d-82c4-a79b8f3d6fe9", "value": "T19684F11CBA52C066D8606A34DE65DFE4567EFC704E602A3F3300765F6F70E91866A3B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671931880, "uuid": "ba856f98-ab67-4fdb-be22-07d792ff591b", "value": "1ea9f0326cf512ac0eb7dd4bc1a00a19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671931880, "uuid": "08d931b0-69c8-48d8-ac99-d2437e755281", "value": "6144:GL+DZl15cnytaDVJbWi/SQXyMo9BAjHGKSXDARsy4Tn9daMr:GCDTpaDVJSiR8BAkXDARsy4ZQ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671931880, "uuid": "2f38de67-33bb-4f44-b54a-763b542a5b96", "value": 384000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671931880, "uuid": "7aaeaebc-b0e9-4430-bb9f-effe829db099", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671931880, "uuid": "3f8c9261-6759-4e42-98c6-0d5b66352852", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2f44a61-848e-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671998474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671998474, "uuid": "c54a2853-13ae-4fc3-ae6e-8b2b688db0b4", "comment": "Malware payload (Smoke Loader)", "value": "46fd5c619f96e12ec8b3422e3c60d5f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671998474, "uuid": "a6d5b188-2626-4b93-aa35-f8f523bf0cf2", "comment": "Malware payload (Smoke Loader)", "value": "09be14b4607f12b2d0b3390bc735edad45e39f5f0827a8211f53431765ca353b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671998474, "uuid": "a7b2313d-a734-4dba-910b-08825121291e", "comment": "Malware payload (Smoke Loader)", "value": "973458bd9c8e203794796a13ee81ee0361cbcb01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671998474, "uuid": "db86e6a9-1689-4051-a947-87f8d220b90f", "comment": "Malware payload (Smoke Loader)", "value": "3a9ef4eb2066bf636640080dbb0ac60f5199b2141e6168e26140c565e197a43d75d2e40a0abdc55f03e50aa45fd71bd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671998474, "uuid": "6b1dc9d7-6b17-4100-a41b-2f2c55d21090", "value": "T10834CF00B692D0A5C52319304819DBD4AB69BC61BEA6DE3FF344FB5F2EF0191A8E5353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671998474, "uuid": "6651724c-c230-458a-a446-ac94e80d3b01", "value": "997a79bbc9b29ccf624aa79059ded875", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671998474, "uuid": "e26bc6e8-6c3d-496d-8f61-5fe0653ba597", "value": "3072:uoYFbLPaJ45QcbNxkg8Brog810jHNylS1g/tK8R0wLrcSb54VIcVTuh:ebLPaJ7cQFp810J8tK8RdbIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671998474, "uuid": "66960b54-17c7-4641-8688-d196cd1eea22", "value": 237056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671998474, "uuid": "15d14924-a859-4e29-a823-d875d1a04747", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671998474, "uuid": "148009e8-32f0-4097-9e53-db4b53c6bc74", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6dc08ee-84ac-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1672011285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1672011285, "uuid": "47441e76-7e39-4a69-bbcd-e66c56cd09dd", "comment": "Malware payload", "value": "8ace3c36a179d81502627df95ba23512", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1672011285, "uuid": "af33bf02-9305-48fc-9b30-b10a32142c93", "comment": "Malware payload", "value": "0c12ebab599a88eedd747082188540e59253fbaf6b220876b53139361da4f6d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1672011285, "uuid": "3ecf2609-0a51-40b5-83db-059346639156", "comment": "Malware payload", "value": "c94abe9cd42f9838e2d8aead0b3fa31d8b2122b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1672011285, "uuid": "3adb779e-4d61-461f-8ea7-0a27d57c79fe", "comment": "Malware payload", "value": "8e1c505d62ae2d4ad2004cca81581cae7560aad5c24250b2dfb95354bc5542f846a5b48221a5fe9340784fe6395cf0a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1672011285, "uuid": "c5f20d0d-5b98-4b86-a9e3-aecef85620a5", "value": "T1118523E6F1E8CAB6D05D86B8CE15A166B3357FE21B29450D1DE5CFA7BF2210C831B112", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1672011285, "uuid": "c766e967-a134-451b-a49f-d893f7a5da87", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1672011285, "uuid": "b807d033-724c-4f83-9870-46d64db2c4ef", "value": "24576:BizigJKSkcA8S5E820KUIUlRwl5sgotCbLCxvBIWTwnQXIjI5BE6euJIPyrX:qiC0cAJBJKU2b3CUWUZ1ZaX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1672011285, "uuid": "f12bb682-5796-4622-9676-d5d3b9252c20", "value": 1799881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1672011285, "uuid": "72df7593-eb74-4bf4-bdea-a398b715e947", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1672011285, "uuid": "6c6ee837-59d0-449e-88bb-87aeda1bd54e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e23d52a-8477-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671988346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671988346, "uuid": "c9f862a9-404a-497c-ab7e-4a73e29b392d", "comment": "Malware payload (GCleaner)", "value": "29a54ee91a310b978d6b680c6cc88b2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671988346, "uuid": "1df1ca3d-1e87-4514-b6eb-7a219420eac3", "comment": "Malware payload (GCleaner)", "value": "0d3478443751665c54115a9fa3e44005fe56e2c4a8bf3a27dbb058e112d832e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671988346, "uuid": "8bc5ab39-c742-404a-a822-d059f5512545", "comment": "Malware payload (GCleaner)", "value": "20142c15716e86bf5985f1b6cfaaf0853b4c6480", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671988346, "uuid": "6432d3bd-76a9-48eb-b04e-724438e509dd", "comment": "Malware payload (GCleaner)", "value": "6455a0314669e4ff0be0391380a1147850396296d7c3af518d9828c0ce44351f90bffdb5ae7a927ba117c00acb03ca20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671988346, "uuid": "4d445379-2c04-447f-8db8-35e9c9e69802", "value": "T1AE9533D5F5A5593FE12DCB309D80E46473206B912B2ED91D29ECAACB2F2920C874B771", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671988346, "uuid": "a553cbb8-9f43-4043-907a-38885e36143d", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671988346, "uuid": "5fae17d5-f342-4c37-83f7-79952285a404", "value": "49152:6icMWp56oIGm4+PmHg+cx6HEhk33SoDAdYZaJ:6it056ZIVzDSMMJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671988346, "uuid": "aaaa385e-5bd0-4472-a01c-4bef56885993", "value": 1973755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671988346, "uuid": "fb3fd018-9c67-481f-9cfe-79c664e7d239", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671988346, "uuid": "c8a04194-db97-4065-a491-a64039f3a859", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb9aa32a-8462-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671979537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671979537, "uuid": "34b358a5-8d1c-4a90-a7dd-e82aaf56e0fb", "comment": "Malware payload (GCleaner)", "value": "289cee448b81b29a2da9e0a5f3455513", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671979537, "uuid": "0e32da3a-c46c-4041-b983-1f9a906d7b3d", "comment": "Malware payload (GCleaner)", "value": "0dab2380de738244b1ef4ded68e61ed8ba77aa990de50771926ef58a9463aabb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671979537, "uuid": "24108e44-7ed0-4199-93f4-d4ea9955194e", "comment": "Malware payload (GCleaner)", "value": "575a1d4199c4799ca68f2d441e7e89de1282164d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671979537, "uuid": "3dd044ee-975c-40c5-9037-e37f7b24cc6a", "comment": "Malware payload (GCleaner)", "value": "ef0febe0abb0f2d1f7b890f959bb7874955abb546d204aa3f11c2efc7ba9e40535e9fab27294cd274dba169799945066", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671979537, "uuid": "ce0253da-cb31-4eea-8b03-d6142720924c", "value": "T1E28533C2F6CA9C3EC05D82B4AE90D554B274E7E02F1E961C5AC4DF4BAA7A42CC713791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671979537, "uuid": "2c1390c5-07b5-4f5b-b9c5-790640e0f3d0", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671979537, "uuid": "f2a1a909-1f70-4b4f-848e-1072f649d769", "value": "49152:miXv0uNglIUfs4Y+Maah0A4vpgolyWZaJ:miXv03lhE4TMTh0XnlBMJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671979537, "uuid": "4e925051-ffc7-4dfd-b309-6d7ccfa79685", "value": 1810506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671979537, "uuid": "7b564653-bf3b-4050-a316-3ac86bb0af11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671979537, "uuid": "93d08d82-5e40-4acd-bdd8-0c9b41ab494b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97f94785-8477-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671988470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671988470, "uuid": "f9ed18f3-843b-4c8b-81d5-1569605cab2c", "comment": "Malware payload (Smoke Loader)", "value": "9bed32a9c5bd0988f323bcc1f70edb58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671988470, "uuid": "a9e7fd49-d379-45aa-9c7a-0bfb41a1d679", "comment": "Malware payload (Smoke Loader)", "value": "0e1e7dd63b12a2e0d615f5b0ebac46d887b308059e0a6e1ff182117a063b280c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671988470, "uuid": "3cf0cc8c-72f7-4e5f-be13-2e7f4aba51bb", "comment": "Malware payload (Smoke Loader)", "value": "c5471ad9c54db15adb4a93e7bc251da1dbd5b19b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671988470, "uuid": "c3805621-2d13-4569-b3d7-4054da794ad0", "comment": "Malware payload (Smoke Loader)", "value": "29bac218cf47baa72918f31bb2acc4336af21be756e95941b65bb8767dcd8d126cd55b2714b8e2b13ea9c6e4320bd5de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671988470, "uuid": "c395fd32-8f3c-46ba-9930-a91faa18966b", "value": "T1C534CF117290CCB2C6C28571481BD7E92B3F7CA19A675AFB37487A2F3D305B19926387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671988470, "uuid": "ee164a4c-83b2-490f-b5c4-70be2d7216a6", "value": "8514760d95d5a493235b8748f65885e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671988470, "uuid": "f3b6fa88-c7f0-4493-9b69-c5e66bfcc83e", "value": "3072:0JAppLZTCEq5ijOTMRMLkmslQ1TizFCtJ/qzZw7RkxmJZs:0G7LZTBdjOlIlQliRcJ/aGymI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671988470, "uuid": "e70a2506-c65c-405c-89d1-2b0332ccd8c3", "value": 236544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671988470, "uuid": "4261f73d-7a2f-4d53-81ee-e33f91896737", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671988470, "uuid": "eb5d98d1-52f5-42b5-b43a-d02a4edf1a24", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24a01755-849b-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1672003738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1672003738, "uuid": "77797b23-d78f-448d-a421-1db189c4a019", "comment": "Malware payload", "value": "9f6ae207d5b58dad624dc09b35dabbdf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1672003738, "uuid": "fe55016b-fe76-4f3e-b98e-e9dce64ec49b", "comment": "Malware payload", "value": "0fd900518d49eed06afbe0184770a3feb2ed562a1d1d5bf964ac4d7923b4f886", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1672003738, "uuid": "acb1db60-4c70-4506-9926-283df9213981", "comment": "Malware payload", "value": "f18e764e8413c7c8d43a831f7170f4f5c9bde1b1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1672003738, "uuid": "f847f0d9-361c-4182-8c4a-49e1416209c3", "comment": "Malware payload", "value": "385e74dc1cce488233d53ce5e1d0cf124326befa06c2d6810f3755badadbb3ea08bfee1573adb05feceb636b9e59c98e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1672003738, "uuid": "1f347e56-7e13-4cfb-8765-561a1182e3e5", "value": "T184A309A2F800DFA6F40AEB7604D74B247630FB660F53562673173967AE762D42823F49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1672003738, "uuid": "bfffef68-a59b-4a1b-bbfc-16241d1fb2d6", "value": "3072:NipaIS0Ax3rT0qTRDAFWxy4BOkGDmU9VqFyOfk/X:NVIS1x3rTlTvy45GDmU9VqFyOfk/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1672003738, "uuid": "0c520f15-13e0-40aa-adf4-9cba15f67bc6", "value": 101818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1672003738, "uuid": "b6e84042-7336-4c5c-b581-68ffb4dc9737", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1672003738, "uuid": "9f45090d-8f9b-4608-8dc9-08d9313e1c7b", "value": "9f6ae207d5b58dad624dc09b35dabbdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55311128-8459-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671975473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671975473, "uuid": "93344eb7-4a8d-44f9-abf0-da2f423ca302", "comment": "Malware payload (RedLineStealer)", "value": "4a936db19902fa8c65495b7a4a608f19", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671975473, "uuid": "be50bb2b-71f0-4de7-931d-2e70dc239c5f", "comment": "Malware payload (RedLineStealer)", "value": "114bc4570edf3732d88f11383a7fbe4eb8a92417193f9d098ba095a86b5a60aa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671975473, "uuid": "5cb3ed5f-e697-449d-acbc-8b7fdf6b263c", "comment": "Malware payload (RedLineStealer)", "value": "a097e030457e75bf48458c523c2da5c7c83f1895", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671975473, "uuid": "7e33f6f6-ce70-4f28-b386-e3953f3bf21d", "comment": "Malware payload (RedLineStealer)", "value": "75401f406d5267c14f2ba86f1ddc4a0b70c1776718e4460f8489825addc9718ebbcff3fefb84a4915920eb8c22b47cfd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671975473, "uuid": "89649b05-2b4d-4b33-9936-2558fb77dfaf", "value": "T1B674E0502294DC61C2D259718C2BD7E81B7BACA29A775AF377087B1F3E311B09E26317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671975473, "uuid": "13012a2e-e2aa-45d3-ab25-2dff25513867", "value": "8514760d95d5a493235b8748f65885e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671975473, "uuid": "9ab57921-90e0-4132-9613-17ffefeb8deb", "value": "6144:9EL9B9t2gG4fcHgeEYUJHXEAE0dWxwJ/PQUWGymI:aX9lGKpYUd4FwVOm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671975473, "uuid": "ce04e437-b40f-4819-9a59-dc3dd5b6c9e9", "value": 359424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671975473, "uuid": "6630221d-4f13-44be-8b92-85f2010418dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671975473, "uuid": "a2652d7c-9b23-453d-b8fb-407a709a67ff", "value": "4a936db19902fa8c65495b7a4a608f19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4767670-8436-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671960627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671960627, "uuid": "f7298b60-a178-42da-bc28-40f37527fdf1", "comment": "Malware payload", "value": "31f0b844ee61cd2c8bbea74fc2b09ba6", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671960627, "uuid": "00584c6c-322c-4316-95b6-5d1418a929ed", "comment": "Malware payload", "value": "124745723b74fc19237fb080c475b4dfb39cd722d2fa75da7da0b4f5c8f0e487", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671960627, "uuid": "19e0294a-dc65-4524-9d9e-85f460cdbbb4", "comment": "Malware payload", "value": "c956ea668864997f9aeab19b839ce258a8a07307", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671960627, "uuid": "ac56d454-67ee-4447-926a-d888c63c3f2c", "comment": "Malware payload", "value": "427ef563d24227c0b74b5f86f5a48b97f5a12f4b441c69649110db8e4bce51481cf40d42f9e26e83a1976d83a150849e", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671960627, "uuid": "278fac25-b6e7-4727-93cb-c6707e421618", "value": "T1DE438BC7FB924653D2986C386C37451C47B33E1189AA4BBFD48E7235D9A386C1B227D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671960627, "uuid": "3ec10970-bc05-4ea4-a8dd-2cc084b12786", "value": "768:m8bEH73eGpTJ9Stu47xi41EyN4S6rz0VIZ:AzeAF9S4HP/we", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671960627, "uuid": "19aa5b1b-4377-4d2a-aba8-939aa22fb5bd", "value": 57280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671960627, "uuid": "9ea6d2f1-f5f7-4ec4-abb2-7f8abd69449b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671960627, "uuid": "e2a0374b-fd8a-485e-b06b-73eaeebda66f", "value": "SecuriteInfo.com.Heur.25079.551", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2834b9f-842c-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671956410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671956410, "uuid": "70f33977-35ed-4dd9-99f0-b95e5337a506", "comment": "Malware payload (RedLineStealer)", "value": "798af35d10ee5eeaa15918f085b54807", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671956410, "uuid": "59907b04-eb34-4b14-96c7-271611bf9cdc", "comment": "Malware payload (RedLineStealer)", "value": "13b8a421f7b03dc4ff1ab5a537dc120b89f1c1daacbbb2678ab323a9f5a56c47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671956410, "uuid": "e46bb13f-286a-464a-9975-02a0528b2de8", "comment": "Malware payload (RedLineStealer)", "value": "7717c6bde031fc9d5862639041e5b895fc5b51d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671956410, "uuid": "ef942d32-e4e1-4f65-8b9c-e518798007f5", "comment": "Malware payload (RedLineStealer)", "value": "f1770f71cf7f6967706acd10b43826ccfbf5c28ceb912fcc931c1ae41e78ec0e410439c522bee9ffb3999f2cfb99c217", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671956410, "uuid": "e947186f-03e7-4153-9b96-edbdde8cb626", "value": "T12A94373060B0F0F5D87220F09AA75A64986CE5604F7544EB77940E6A8EE1FF3ABF0765", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671956410, "uuid": "8e914db2-bf4c-42c2-9b2b-47fcfb915040", "value": "7e7c1082b38a4734d89e1f235c71c850", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671956410, "uuid": "a639c99b-0700-48ac-96a1-258f1108c680", "value": "6144:kS4xWrKdFGbK4CRAwTAtBVfjmAONhDi8eDsUkHb/bGPK:kS4xWrKdFGbK4UTnbhD2sULPK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671956410, "uuid": "b6f06e7e-865b-4d93-9d68-7348b8cbd823", "value": 408064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671956410, "uuid": "9e44b83a-8702-472f-84aa-98ac49291412", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671956410, "uuid": "6f44d152-27b2-4183-9e7e-ca3402bc00f8", "value": "798af35d10ee5eeaa15918f085b54807.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f3eb4a1-845b-11ed-9db1-42010a9c0080", "comment": "Malware payload (TitanStealer)", "timestamp": 1671976376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671976376, "uuid": "08018c91-88d9-4b81-b2a5-57f24ed7138a", "comment": "Malware payload (TitanStealer)", "value": "1af2037acbabfe804a522a5c4dd5a4ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TitanStealer", "colour": "#EC6200", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671976376, "uuid": "1044b67b-9c59-4990-9e88-dd15f412bcf9", "comment": "Malware payload (TitanStealer)", "value": "152ef5fcd0278e127c3df415018857f3aed0a748160032356786815ccbe870d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TitanStealer", "colour": "#EC6200", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671976376, "uuid": "d9b02809-d923-495a-a90e-8fa0b02db5bc", "comment": "Malware payload (TitanStealer)", "value": "119f5b7da9e57bad8b618c660d21a91d06d1795c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TitanStealer", "colour": "#EC6200", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671976376, "uuid": "2a893bd4-cec2-40fd-8fae-d1d2d0c6b8a1", "comment": "Malware payload (TitanStealer)", "value": "0281d29ab88732c17d0c0777422f01aefb7022a9a8427e90834d3bc35dc28270b790b5a9a68df8c85a1da91b6123306d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TitanStealer", "colour": "#EC6200", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671976376, "uuid": "a96370ad-c005-4803-9f89-75bec228ed1a", "value": "T122D56D431ADF4E6ADDD17BF871C7231DA774ED30CF6A4B7AA50840364A433D8A91AB42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671976376, "uuid": "e8bbc68b-d92d-47c4-b2c0-37d36bde58a4", "value": "227d8e180539434a4545745b2a33e7ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671976376, "uuid": "405289bc-2ab4-4736-862c-71dfc9610706", "value": "49152:Oh9mgBWyaSu1kD8oMgz1T9CecOU7m6RK3l3h:MWya3LgV9CdOU7Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671976376, "uuid": "e5a5867f-e76f-431b-9dce-8c195cdd688d", "value": 2947359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671976376, "uuid": "5bd400c2-36ad-4e8a-adda-c2d7e243bce3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671976376, "uuid": "1f3ac03e-bb9e-465c-a1ba-2338f4e22377", "value": "1af2037acbabfe804a522a5c4dd5a4ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8a03ffe-841d-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671949843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671949843, "uuid": "8f1a2f91-0a56-45c7-b26c-8b2f3c34b6d6", "comment": "Malware payload (GCleaner)", "value": "f935c28149495ff550327a24a3090ae4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671949843, "uuid": "f3b8dfdb-d90e-4c1d-869b-dbd949c2bd81", "comment": "Malware payload (GCleaner)", "value": "155bd67e830a4eb707797622edd993e1b4b5eb8e5817612ad3a66112555af6f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671949843, "uuid": "66de43d8-0aac-40c5-823c-c70cb0f07d91", "comment": "Malware payload (GCleaner)", "value": "36cd16ff9394c17a780e61e160ba01aef32b7265", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671949843, "uuid": "5c807112-4975-477a-8176-e845931493a6", "comment": "Malware payload (GCleaner)", "value": "3f20a41e6c00c5d27c063f011018e67c4f468bd129a6e5bbb7d12fbc02d1be885e90af74170a9d12e9d3d9163d9e6b2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671949843, "uuid": "87c60ab5-bc73-4d4d-9fce-cef062995816", "value": "T187953341FDA8C637D13CC9B48E61E5413134AF752F39942EA8D9A95B3F78B4EE683201", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671949843, "uuid": "c7fb59e7-0c1a-4cf4-ae8b-0cffcb671d68", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671949843, "uuid": "c4c1ef9e-847b-44db-b902-275d41223d54", "value": "49152:qiMlHvVMFRbs3e8cCnmPi4M4NcZyE3cJVZaJ:qiMl9MF7kRlrWXMJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671949843, "uuid": "a3dfaebb-1b36-4a3c-b538-674e0ee25cc2", "value": 2012866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671949843, "uuid": "03b50ca0-e134-4834-bb2d-76198291ae70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671949843, "uuid": "1ab5d0c6-c1b3-4cee-8f9f-790f72d0712a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20e0df68-83eb-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671928141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671928141, "uuid": "e38b87a9-1015-4512-80e4-b21fb10c63ec", "comment": "Malware payload (Smoke Loader)", "value": "7eccaf0c584f3c32e139d6539ff9c8ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671928141, "uuid": "389b47cc-515d-46f6-ad18-67f81a9ebe2e", "comment": "Malware payload (Smoke Loader)", "value": "17e2cc8dc94606d85df46e3e2daa00fb560466d8512e17627e6a3881ee97f975", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671928141, "uuid": "0de5836d-b8b7-45e3-97e5-4ed627ce6670", "comment": "Malware payload (Smoke Loader)", "value": "743211fe43451bad471d5fa94fa138404a0fbada", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671928141, "uuid": "d6e9868b-14df-43be-a23e-4e14957a7c7f", "comment": "Malware payload (Smoke Loader)", "value": "1e236a2932fcda7ce07dc699812d98d943c99d63215fe344e2aa0a84ffe9ce2789458bc9ef66459b26fb22cfdaf34897", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671928141, "uuid": "32148a18-b201-4e2a-9160-a9f2ac5c8d94", "value": "T14C24CF0DBAD2D832D01519308919DFE0AA7AFC319F619A7F37007B1F6E70E9096367A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671928141, "uuid": "1ea390bd-7c38-45aa-bdce-16ada175b0db", "value": "ff6eadc44bfbddffce47ad40ccb423dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671928141, "uuid": "b672c26e-cba1-41d0-863f-0f0c3ef9eea7", "value": "3072:kbO8Lsurx5ChBwwifrT8GiyBshkbLbLeE5IYGIIhXauDxT1T/ERf/ln:iLsurWLwxf/WyBseb6kIYjIFaMxTBQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671928141, "uuid": "d4888e1f-b953-43e7-9aef-7a7c100f6c3f", "value": 229376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671928141, "uuid": "bb537910-9906-4c9e-908a-1c3be635793a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671928141, "uuid": "d886677b-6c23-43a4-8cea-f24233970b63", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41cefcc8-8456-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671974152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671974152, "uuid": "c13232de-a035-41bd-9155-edf6a7bb9ef0", "comment": "Malware payload (GCleaner)", "value": "f21c7cda3cd59fa949b54bc9e91effb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671974152, "uuid": "93eb1f8c-0496-4804-8478-9d072a81230a", "comment": "Malware payload (GCleaner)", "value": "18dd466b4749faa6302fbf742b09521e5f4109b0ff8054f5c3d7e3817b1f9dce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671974152, "uuid": "634b8f68-f682-4fba-a863-e5e166197e75", "comment": "Malware payload (GCleaner)", "value": "f516f24d07525e03315b15f6a0b3e6dc77d54e50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671974152, "uuid": "d422e8b3-03b5-4bb0-8aa1-c403a3dc8999", "comment": "Malware payload (GCleaner)", "value": "420d9b3f96ab6f32ac581495f63b9bc673803efaed48cce8d8429a6b2b860db752bd760e34b8b603feec7fec0d494a30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671974152, "uuid": "7e73dedc-1f37-47fc-ae61-7b91238de36d", "value": "T17C8523C5FDB84A76D43E4670CAA8944571767FF01BAE80AD6CE8A28F2D3A10DD707325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671974152, "uuid": "f0442b71-6770-48bf-91d5-669c9e3fea77", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671974152, "uuid": "8c47a486-5b97-47d0-891e-d19af13809f3", "value": "49152:qi0prvx9EJATccGVRSlYIlJmeJsxefn3+08O/ZZaD:qi0pdeSyq2If30O/ZMD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671974152, "uuid": "5ee0cd8b-0eea-4cf5-a72c-2f697561239a", "value": 1846583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671974152, "uuid": "af7af9f0-3f60-45d8-8437-2c2c63048d80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671974152, "uuid": "55cb2523-717b-4600-8762-a8d2d818b6a9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccbc7e8d-8400-11ed-9db1-42010a9c0080", "comment": "Malware payload (Gafgyt)", "timestamp": 1671937448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671937448, "uuid": "0c7ce1be-4957-47db-9949-004f933524e2", "comment": "Malware payload (Gafgyt)", "value": "224a80af89f8fd64a173d9d9378c878b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671937448, "uuid": "b53464de-c552-4534-986f-e56f852f70e0", "comment": "Malware payload (Gafgyt)", "value": "1b488b4d47acf22c3c425f202e821b4f2463219a6206ff19b2b0fce9e3430161", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671937448, "uuid": "c6ea90c4-1eb5-406b-8bbc-193e44000c65", "comment": "Malware payload (Gafgyt)", "value": "3d03cbb3492d665ee1d578cd9fe54a14faa14c80", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671937448, "uuid": "3f72ce03-6717-4b2d-9055-40777bcff4d0", "comment": "Malware payload (Gafgyt)", "value": "046e24d8a2dc929739ababf99f281a1ab9f34b1dc2ae1f93c1b6efc77f053b35bdf65c2b84f688a42cbd7721219986d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671937448, "uuid": "0b9c09a6-882e-45e4-aef5-a462666a0310", "value": "T167D3956EFA12EBBEE16C863107F76F70D39531A22AA1D341E16CDA181E7125C2D4F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671937448, "uuid": "007c77fa-c7ab-4b06-af19-e9ae66fbddb5", "value": "3072:jGTyrDxJWwAfr9f3yJddxUEJmTDmjOrWcpu3NJFARtRVJhGvaZqhZYiDhB/ZZ9B8:C+nZSZynJeUmkASFxBKvXZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671937448, "uuid": "20290a77-61ab-4b72-8ba0-a614908513bc", "value": 134222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671937448, "uuid": "2e8d2f12-2dc9-45c4-b6a3-460a25b7e29e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671937448, "uuid": "d2ae2f0d-84ed-4ae9-8293-581017a8985c", "value": "224a80af89f8fd64a173d9d9378c878b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f2a277a-849d-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1672004695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1672004695, "uuid": "cc57abbb-de22-4867-98ef-ea861e7cfda3", "comment": "Malware payload", "value": "baceb9322b1a122dbf13bccaa8ce4b52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1672004695, "uuid": "a31cb208-547c-4532-be48-8c17625b6340", "comment": "Malware payload", "value": "1bca4f4e0de71237ae05548406be170e780de0379cae651bfb81e7b0ead50124", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1672004695, "uuid": "f98a1cc5-2a18-4b8f-9dee-e24f2f2da6c9", "comment": "Malware payload", "value": "1cd3c2c3a40084be5e2bd623383d8e2c855a3a4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1672004695, "uuid": "731d9803-0f90-4808-ad1a-52311601fa9c", "comment": "Malware payload", "value": "322bd95bbd423be82aa1aadd24fd6d57e17ffae939904ced3ce131f7512805dcf598948c2067545129fe9297b4a8a0e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1672004695, "uuid": "4238fa06-2967-4ce1-b30b-b2454e8c4c22", "value": "T1D28533E7B6C84876D40ED4B9CD9688997375ABE02B1BC20E0FDD968F7F3821C9243651", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1672004695, "uuid": "50461053-144b-474d-b55d-07adf2fddee1", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1672004695, "uuid": "98cb4410-1acc-42d5-83cf-ddde97b9fd9a", "value": "49152:Gix8QwQRD3NrWsCniK7//Sb8SfDeFknEZa/:Gix8CxNyJnRjGnfDemEM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1672004695, "uuid": "69467e91-0f24-42f3-8d2b-74249e913697", "value": 1813184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1672004695, "uuid": "03f2d582-9ab6-4686-bb9a-e0d2b385afc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1672004695, "uuid": "dd436df7-4c83-486f-aa7f-ff55f62d49ef", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dc02425-8476-11ed-9db1-42010a9c0080", "comment": "Malware payload (Vjw0rm)", "timestamp": 1671987889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671987889, "uuid": "2cb73b5f-8096-49a8-805c-3f637cab48ac", "comment": "Malware payload (Vjw0rm)", "value": "109a25a65dcb12435377b0f9f4159f4c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671987889, "uuid": "443e0207-8d9a-4b7c-91bb-04a30a63f001", "comment": "Malware payload (Vjw0rm)", "value": "1deb0b650909a1e7895b5b8f315428ac66353161513e5de9261c7477c7bdc386", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671987889, "uuid": "9cf78646-4163-465c-95ca-7fb22c7bdf14", "comment": "Malware payload (Vjw0rm)", "value": "1579ca605a83527a8befe3edeaff3d4feaa293d4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671987889, "uuid": "5fd703f9-8496-4fd0-9d4c-c73449c598be", "comment": "Malware payload (Vjw0rm)", "value": "588b171b93732ad0fb51b7c99b61a4812cd7ef3d8f6d93c309119bdd236e16b1ca28d6e2a1d0cac2aa32f173357ace99", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671987889, "uuid": "2d63284b-856c-44ec-88b9-7a2bb37a5d17", "value": "T1779418A0BB84568DB6980A8BE03D7DAE3BF36B05D5E3B2CC77973547255EE5D2608C00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671987889, "uuid": "1fd3aedf-f0c9-497c-9972-72f89a79377f", "value": "6144:Rcem0BIMD9F+gX64GsJI1s2eVawLGkIHEC6kOnylYYADJKV91XFzza:eeTIiGA6/sG11wLGdbAMV9a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671987889, "uuid": "337a9bb1-1a6c-4209-b546-2c80dbc66871", "value": 413504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671987889, "uuid": "7a4e1759-025e-4347-a944-7a7cc2b4603c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671987889, "uuid": "389dc377-4de7-4beb-9bcd-515902550b4c", "value": "scan_docs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54656cdd-8451-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671972036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671972036, "uuid": "54f26019-25ed-4726-a818-20e95604ea56", "comment": "Malware payload (RedLineStealer)", "value": "b99a892233b109bfd07d34988eb0dd62", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671972036, "uuid": "aa9501ba-5daa-4a06-aee6-fffd6652ba15", "comment": "Malware payload (RedLineStealer)", "value": "1fc1cd4294d1ada2d5b9749125ac1c8fff4fd65d25b59ea9590e9f8545a02f77", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671972036, "uuid": "9f393fc1-b383-451e-85fa-dd43428ca019", "comment": "Malware payload (RedLineStealer)", "value": "79f876e6e54319f531edbe00ed2366a5277e8e60", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671972036, "uuid": "feb1f375-0c39-47f2-a216-244aa806fc36", "comment": "Malware payload (RedLineStealer)", "value": "cb9a4491fbe5203d705f5d224b8121997aa229ca2156c3b0d585152392a3eda524ff15fd2316523d171b6e57925651e3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671972036, "uuid": "57dbd081-3a2e-4a78-9dc6-ce7b0066d717", "value": "T11174E01172A0CC72C6D255314D6BE3FA277BACA559638AF336086E1F3E712B16C22747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671972036, "uuid": "73f437b3-9780-45c0-b796-b6145277f469", "value": "7b9daca6da068f54ad4e1900288e8efd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671972036, "uuid": "3c8f34ee-8b67-4a37-a0ce-180a98adb4d6", "value": "6144:XLgRd+PzuaWkhWe7x2ojELz49eUzxwJ/6yGymI:XQ4zuaWkhWqGz4vxwVVm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671972036, "uuid": "2b4e7678-e7c1-49f0-915d-d7297a973194", "value": 348672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671972036, "uuid": "5271b6b0-6487-49f0-aba7-266372547d1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671972036, "uuid": "16dbd955-e7c1-46c3-bac2-676a23d9793c", "value": "b99a892233b109bfd07d34988eb0dd62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7b21144-8449-11ed-9db1-42010a9c0080", "comment": "Malware payload (EternityStealer)", "timestamp": 1671968793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968793, "uuid": "cc868128-5d40-4e49-a1a2-8e8f7ef4ad7b", "comment": "Malware payload (EternityStealer)", "value": "45e4485a5ca1845bddd704822f5dfabb", "object_relation": "md5", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968793, "uuid": "02a851e1-4473-4d2a-83c1-1fdf36ab4794", "comment": "Malware payload (EternityStealer)", "value": "2041f2918a1e0dc99d4aa35cad36c81f3979435f318b71256394ab38fecb0e0f", "object_relation": "sha256", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968793, "uuid": "111d1cab-218f-4377-9c1a-b9d336456e03", "comment": "Malware payload (EternityStealer)", "value": "6239167355c534a1c86073b738f998d95cb81b42", "object_relation": "sha1", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968793, "uuid": "8a38e252-62fd-41ba-a0ec-a337dc0bdd6b", "comment": "Malware payload (EternityStealer)", "value": "d2d717cf1976c1363060e1d8af3a64731d4a17e4752397865480c46ee3aac638aeccc4872063239d5f79f5e242f9178f", "object_relation": "sha3-384", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968793, "uuid": "39843ed9-33d2-43b8-be2e-752088adaba7", "value": "T1A1C3F81837644A2DC27C21798BF357F08366C3522BB5A64A9F11F08735B12F95E23BAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968793, "uuid": "e35cb335-1fda-41ad-b915-0a54fffa9358", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968793, "uuid": "2f11545d-7725-4ac6-a105-a6717a39417f", "value": "3072:AHZobRK9HQ+aRpZUpXgBEbfEu2Tu25g1uZji:A5ZHQTFCwBEbcPg1uZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671968793, "uuid": "6c94bf19-67e9-4c95-a51f-9c04dfe23967", "value": 119808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671968793, "uuid": "b36cf929-5264-4e3c-a9cc-0b0664c5e406", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968793, "uuid": "9191e27c-a6d4-4d67-a049-b7a4d9066011", "value": "45e4485a5ca1845bddd704822f5dfabb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "076ebdcf-849b-11ed-9db1-42010a9c0080", "comment": "Malware payload (Gafgyt)", "timestamp": 1672003689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1672003689, "uuid": "83ff3ac0-33bd-4815-bf84-08e194f5bac6", "comment": "Malware payload (Gafgyt)", "value": "d5176b9aac0f7f72a91681b34a437e34", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1672003689, "uuid": "9b0ebf2f-23ec-4ff1-9e0f-55e0073cfc2f", "comment": "Malware payload (Gafgyt)", "value": "21441b01cdc9dccb6b3a4f32b83467e0405870ed966b454c8a9276413ec6150a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1672003689, "uuid": "4d7dbad6-e6c4-4a62-a9e8-8c26b97fbe52", "comment": "Malware payload (Gafgyt)", "value": "03423446f49f9dc37346db5f2a77fa289b9e367f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1672003689, "uuid": "e87648cd-1fa0-48bd-9fd6-cc4c45582f1f", "comment": "Malware payload (Gafgyt)", "value": "fa71d8848a966b1b8c2af1877b84af7a69448d9e7a0a936491c60c7d65294eb390e0f552da22110dddd957a9bc44fe18", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1672003689, "uuid": "86de7477-5c5d-47b4-8184-68a7ee3078d8", "value": "T121A31744F8448767C3D327FAE78E439D77351A6457DB33116A39AEB42BC2B982E29130", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1672003689, "uuid": "9de6051b-a57d-4963-ba8b-e11ee146a751", "value": "3072:Plf1jKRi/VYf84YTk7XTRUmpEqQ45vVXY0X:vjdVC7YTk7qmpEqQ45vVXY0X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1672003689, "uuid": "9c7ee1a7-4ac8-4b65-aa87-8cebf96f29d3", "value": 105111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1672003689, "uuid": "b93b5f7d-6a39-4766-9585-823882300247", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1672003689, "uuid": "7ad4d144-f0ce-4280-90df-3ddbb7871f63", "value": "d5176b9aac0f7f72a91681b34a437e34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95fa8d8c-8406-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671939933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671939933, "uuid": "452c33b5-d602-4817-88d6-69ca94912535", "comment": "Malware payload (GCleaner)", "value": "2d5e60feccc00d6d6272b208d4d724d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671939933, "uuid": "90e2b9d4-1ef4-49f4-adfc-edbde4716c3d", "comment": "Malware payload (GCleaner)", "value": "21928115dc41446c60483be7bb9fb08a1e5d9f8899c9b9d7796e71d4d4c27030", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671939933, "uuid": "2eb1b18d-b39b-43b5-9d87-e74fc46842c7", "comment": "Malware payload (GCleaner)", "value": "68289dab662df554e700927373bb37aae7681929", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671939933, "uuid": "7b55c3f9-9c66-43bd-a050-99cc882f65e1", "comment": "Malware payload (GCleaner)", "value": "6e90e87cc859d02708168faec2c3c418f1beaec49c11b49aa3d6b06cb6e47c9109750670559943f77c7646be8c99659f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671939933, "uuid": "82d441db-9dd5-4ccb-908e-fc425b901c77", "value": "T1498533C8B9E54673D9AD90385E21DE443B39F3F01B251A1E78E98ACBFABA10C4717741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671939933, "uuid": "d9ee251d-d2af-4753-8bf2-8fad71079d55", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671939933, "uuid": "85420658-1d2c-48a5-abfd-39fc0efab078", "value": "49152:qiipLn/n6IMGhyGeuGwlnwO1l6q2+PZaw:qiiln/ncgyDuFlwC6q2+PMw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671939933, "uuid": "b568a5fc-2852-4642-9f15-802c7b9fa8c0", "value": 1856459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671939933, "uuid": "c6ebf21c-69be-4749-985c-4e219df2cea0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671939933, "uuid": "cd40c15f-ea1f-4c43-8bb7-de9c457c8dfd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23fc0383-847a-11ed-9db1-42010a9c0080", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1671989564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671989564, "uuid": "7012f2a0-dd8e-4dda-a6a0-7beb6493d007", "comment": "Malware payload (RaccoonStealer)", "value": "8d779a25480853b54185dd850b8a9430", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671989564, "uuid": "e90d3bfe-80a9-49ea-ac72-6da6b2238661", "comment": "Malware payload (RaccoonStealer)", "value": "21ed24d2d6935439ae3e18b6778d8e1c6387cfbc162f0a047f4df9a00d87fbc9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671989564, "uuid": "b656c89c-938b-4a43-824d-4031323d8083", "comment": "Malware payload (RaccoonStealer)", "value": "f41785a3869d23e6b8c0dc51ada2ce656e0b5370", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671989564, "uuid": "738efa6d-2c4b-4e1a-8a24-0788723afe8f", "comment": "Malware payload (RaccoonStealer)", "value": "6c32adffc860b7e5a4abcbbe0d253b087a8ecd8933fed5952544a03172417e3544ac6d337239dc8e361debab7ec97c97", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671989564, "uuid": "bd0b87bd-3610-434a-8e1f-ccc2a13fbb93", "value": "T14934AD113690CC76C3D245315D6BD7A92B3FBC928A6766F332087A5F3E709B0A926347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671989564, "uuid": "fe96f229-ad52-47af-9e3b-dfca2d18b818", "value": "653b90de92b22ec8aa57fc19871541e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671989564, "uuid": "0050eaf3-8c86-4bb1-8cb2-ff8625398d3f", "value": "3072:JL3L6FL5A4MPTrwYQgvq0pNwmYeXAcTtJ/vMm0w7RkxmJZs:9LwW4XgicwmMchJ/vMm0GymI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671989564, "uuid": "1519036f-57ac-4de0-b68e-652db75225cb", "value": 237568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671989564, "uuid": "430d8de0-9d04-4571-bce2-943434f7aa33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671989564, "uuid": "6a8796be-4502-4687-aa18-a18751eee30f", "value": "8d779a25480853b54185dd850b8a9430", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e152c138-846b-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671983439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671983439, "uuid": "f7d98362-c7c5-49fd-a27a-87cbee2a9d48", "comment": "Malware payload (RedLineStealer)", "value": "bb298a0832ed5dd6965d36d9ebe5ec5d", "object_relation": "md5", "Tag": [ { "name": "anydeskh.com", "colour": "#1C3D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671983439, "uuid": "505288e0-1d17-4915-a379-4bb2e7152509", "comment": "Malware payload (RedLineStealer)", "value": "2416eef956b39e6a57f100b4b2d368da0e4d848d90924c2af068845c9c691e86", "object_relation": "sha256", "Tag": [ { "name": "anydeskh.com", "colour": "#1C3D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671983439, "uuid": "23be925e-e8d0-41dc-b770-c34db798d6e2", "comment": "Malware payload (RedLineStealer)", "value": "dd175d7c6581998f71b01c15ed96be1cab74025c", "object_relation": "sha1", "Tag": [ { "name": "anydeskh.com", "colour": "#1C3D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671983439, "uuid": "f50cf16d-c3ed-4d96-a124-2234f509fe4a", "comment": "Malware payload (RedLineStealer)", "value": "6dae345fb87fc87da4c7162cf3124d0398afe945d44737ab4a3d4339de2374cfa4e3daa5898ab5011f6f0028402098ce", "object_relation": "sha3-384", "Tag": [ { "name": "anydeskh.com", "colour": "#1C3D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671983439, "uuid": "8a30dfa0-2a63-460c-8141-7defa57b30fe", "value": "T1BF95E0E6438BC4BDC095D4F8E5C623A5BD320FA4DE6E9CD11FC8ED9F04B8161B829199", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671983439, "uuid": "94c01439-21a9-405c-81ee-38edbd3d6214", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671983439, "uuid": "31d1a0a6-33fe-42f5-8835-c6d307816f7e", "value": "49152:cLM/u06MpzeRsEsPvOamb/rXyPP7RBFM5gJsJECRgH+b:M0ncsEQvtAbeP7ajECRgc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671983439, "uuid": "4ca90797-0847-4604-9fe7-a0b531d1f0ed", "value": 1997313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671983439, "uuid": "62ed8bae-1de2-48ae-82f2-08a79d75d2ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671983439, "uuid": "84190dd5-cbe7-4641-877c-a054407907a6", "value": "decoded-20221225154900.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c90a52c6-8480-11ed-9db1-42010a9c0080", "comment": "Malware payload (RecordBreaker)", "timestamp": 1671992418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671992418, "uuid": "c94a7bda-a408-4a06-86b2-30bbe7d4b561", "comment": "Malware payload (RecordBreaker)", "value": "7db5b8a2ce22a04aede2dc73bb09bd00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671992418, "uuid": "0b01f2ac-f35c-4b22-9d0c-b41363da49c1", "comment": "Malware payload (RecordBreaker)", "value": "25c17fe456e4f3307e03f8fecb0154fcd4d66374922a4d169b30549f80501958", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671992418, "uuid": "2b4eb331-b261-4439-845a-ccd77bfa3b32", "comment": "Malware payload (RecordBreaker)", "value": "bcf7e3e5450763c2b92b33a6e67fbfb5cb4d2317", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671992418, "uuid": "2a0e5042-28cf-4655-b13a-001fadc82876", "comment": "Malware payload (RecordBreaker)", "value": "05c32fcdb499a73fa02b658fb21eaa03198e0cfd5ae3f92482c1eaf36f8d8a7d2328887ba418ea4ff50459a17bd29b64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671992418, "uuid": "9f02ed3e-e2b0-4953-aa78-ca68b46417b9", "value": "T1F934CF01BA62D4B1C45318314C29CBE51B6ABC61BE55DE3BF784BAAF2EF019094E6317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671992418, "uuid": "10fbe226-abaf-4dc9-8533-bcdcd346c6d5", "value": "997a79bbc9b29ccf624aa79059ded875", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671992418, "uuid": "43ef150c-6cf5-478e-a9fe-643ba7a8aadc", "value": "3072:F3tmwbL5Exh53k1y1zuUKyEdFlS1g/tK8JmowiRpLrcSb54VIcVTuh:SiLw7k1yhuUKySLtK88oZ3bIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671992418, "uuid": "109d3424-0597-42a8-b3ae-ceef32d4c60f", "value": 238080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671992418, "uuid": "5ad2a576-d4b7-49a6-88ce-06c68ba1396c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671992418, "uuid": "3e6e2ab9-7a74-4dfd-a305-3d8687bff71e", "value": "7db5b8a2ce22a04aede2dc73bb09bd00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd616758-83f7-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671933611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671933611, "uuid": "13d5b731-bf15-4e57-b199-405299e7a8c3", "comment": "Malware payload (GCleaner)", "value": "ea1e6223f187c4c4ca11696849ffc72d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671933611, "uuid": "06447648-1d91-471f-ac02-29432505b256", "comment": "Malware payload (GCleaner)", "value": "2833c25556deaae74d1165e90c270f233e3dd6bb46f9a3f73231f569ca195e83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671933611, "uuid": "9bc1ca82-8017-4268-971d-3e56e89554e2", "comment": "Malware payload (GCleaner)", "value": "48c65f1a3af252cb85ae39e2d166131a72e2f7de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671933611, "uuid": "71a27aa4-dfd9-4a4d-a77d-f0d6f7a6b441", "comment": "Malware payload (GCleaner)", "value": "b8b241891d9e1273283bda7f128137e58903ed17a615dd0b6fad45e445eef8017374007336b5684d156f895d5058c8d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671933611, "uuid": "e8649343-d86a-4364-80e4-feb398e6e5c9", "value": "T14E8533F5B8C989B2D13E94B44D586A5834F1FF232B29812C34E9AE87DD78C1C87A7711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671933611, "uuid": "68447b03-f978-46e8-be8e-604c614ceefa", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671933611, "uuid": "0d269897-f684-4fe1-aaaf-b85634daaa07", "value": "49152:Kiz/3m5sDnuy/x2otyeqHaGHLF6AmhUYn89FZp8S4R2+/fZaa:Ki725Ynn/gKulHLFBKUYn89FZpr4w+/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671933611, "uuid": "9dbd0a05-7499-4213-bcff-8e5fd493ad64", "value": 1857927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671933611, "uuid": "3945d480-456a-4d35-af3d-e1ba37338c91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671933611, "uuid": "4d5348bb-eace-4192-8c07-254ce66eb172", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b01566d-849b-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1672003749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1672003749, "uuid": "7b6c46c4-4abe-4587-bbbc-6952e3cfebd7", "comment": "Malware payload", "value": "175b1f81e76bda3bf140b469211f8996", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1672003749, "uuid": "c7db456f-9af1-442a-a71f-d5b8e5379764", "comment": "Malware payload", "value": "2871c8c669a964b12288952bc7d7ae9181fdeda6c0e7f81ee7d3fea58e887b04", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1672003749, "uuid": "99c831b6-ae46-456b-8291-6faf14287bdb", "comment": "Malware payload", "value": "55c685d5f1e2e5f5064e5f1bbbb05725c37172da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1672003749, "uuid": "41497a2b-516d-4ce6-85d2-a441c16ab57c", "comment": "Malware payload", "value": "dceee4921fe56d224eb6c6a50a5f975897fc92b644252175187cfa05da271dcb1c79f2eeeb0dcca99ee5baf682ae1e7b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1672003749, "uuid": "9dbc7897-7f61-43d8-b1be-71dd90d88055", "value": "T11BC32905E8918767C2E2177AB79A425D33332B6893CB33255938AFB41BC1B9D1E79131", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1672003749, "uuid": "df61c928-85dc-4084-b488-9789a8c7ee5e", "value": "3072:KdB2qwap6KVXPi4jv8x+RMDkmDhZmTQOIsXAqE:aRwap6Kt6+RMDHZmTQOICAqE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1672003749, "uuid": "67c44744-d222-44ed-9ba2-f9b02334d6d2", "value": 127529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1672003749, "uuid": "eac9d321-b5dd-4ae2-8e63-d876c73f08c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1672003749, "uuid": "0acc65e2-89d5-4769-beb4-a8d4ebcc2632", "value": "175b1f81e76bda3bf140b469211f8996", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98c575f5-8474-11ed-9db1-42010a9c0080", "comment": "Malware payload (AgentTesla)", "timestamp": 1671987183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671987183, "uuid": "c33fe4b7-a6b3-4541-b985-adb6e520eb23", "comment": "Malware payload (AgentTesla)", "value": "fdb328d253f91547bca0378c9ddba5a2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671987183, "uuid": "eeeabd61-9d37-4133-8b10-01a3cdea08c9", "comment": "Malware payload (AgentTesla)", "value": "29303035e598f0f7b42f62a3cf387daab1873c18b0fd850ab8fa470069fba189", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671987183, "uuid": "b9d412db-d6be-4051-bf3c-6bf0fad40da4", "comment": "Malware payload (AgentTesla)", "value": "c2119f54c4dea3613df03bdf058438785ac7f2ad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671987183, "uuid": "6572cbed-bcf7-4acb-9265-dfa1ae8e82bc", "comment": "Malware payload (AgentTesla)", "value": "f31e0c3884b27b907effceb8ae1af08cec95338b4ba8e09511e91e053efcfb0eec5ea16904c807f74a4c7b1da904ef62", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671987183, "uuid": "4d05a727-ba43-427b-b282-73a0edfd680d", "value": "T1DE35AE01B6F284A3F48704764014BACC1E7C6D5AA2D0E66BF6753A88527247BFEFCE51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671987183, "uuid": "97f672e8-237c-434e-87d5-591d53015f39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671987183, "uuid": "00cbe14a-21d4-4c7d-83cf-1060e45ca310", "value": "24576:lB3wtYrJs6oMvWw5pHmJFKUEiTznmblg3R3XR8:lGtQy6ofg8EiTz8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671987183, "uuid": "6d654e41-3ba7-4cc7-ad1c-667cc434f7d1", "value": 1068544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671987183, "uuid": "6af00a59-54d5-4a84-9f4e-004dcb7eb3a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671987183, "uuid": "ee08b3be-6344-465f-bdc9-6add4f3ef2d8", "value": "P.Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccd5bc37-8497-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1672002302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1672002302, "uuid": "26a61f89-209a-40a2-8f03-902cd2a8ca72", "comment": "Malware payload", "value": "2a2b2a85a2137c3ed9ee52b75b5aba92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1672002302, "uuid": "fca717c6-f713-4df8-a686-05a9bbd87709", "comment": "Malware payload", "value": "29b309c21777e0e77b1d6710b18e26197026720bda1aa96c9b8173edd5fdde85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1672002302, "uuid": "a75b96a9-e20c-47da-ae29-622d09702f01", "comment": "Malware payload", "value": "fbecef6c66f4fbf2e6bc5b87467536abbbbb725f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1672002302, "uuid": "5b86aa6f-279a-4811-8803-16647b4969f9", "comment": "Malware payload", "value": "19b876eb9ecb0376ae4e3c7adf1749f27e69806a84a37fdab2d88e5e74e821d0d8dd2bb2d06429791dc794adecfd2618", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1672002302, "uuid": "1d302d78-3a6a-4003-ba0c-99b015ea092d", "value": "T148138D2039808032C553A8744538D2E1BF2E197562FDEC9A5F692A755F327D2B37E38B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1672002302, "uuid": "847f73bc-26d6-4c04-92d4-ed660f8e76b6", "value": "768:a6OM2fa5yVDghl7JIL0pUEnqHO72dDn94GP0Mk:i7fBVOqLoqHVdZ/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1672002302, "uuid": "603ab8b8-0d66-4a18-9156-2cdabf9aa89b", "value": 42829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1672002302, "uuid": "8337a4f5-a8c4-4c1e-ba41-04ed40b186e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1672002302, "uuid": "24b8d0d8-881a-4148-a187-8ddc05ff7dea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84b1c721-8447-11ed-9db1-42010a9c0080", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1671967822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671967822, "uuid": "adfc725f-3d31-4904-8e23-5576e338e9da", "comment": "Malware payload (Gh0stRAT)", "value": "ba5396e15e896c12f5b948b4ab134e44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671967822, "uuid": "f035fbc9-68df-4b22-961e-b7a7491d51d1", "comment": "Malware payload (Gh0stRAT)", "value": "29bdf30d0b641a2fb9abc5dc9b5544e39cb91c9e2deb927b45679010198c765f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671967822, "uuid": "bf890ac1-6541-4494-9f37-e41bfc86ab45", "comment": "Malware payload (Gh0stRAT)", "value": "ad091a08da28014d915f0ba4dee83598d04eddaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671967822, "uuid": "31959130-9aef-4d3d-a37e-f56db712fd28", "comment": "Malware payload (Gh0stRAT)", "value": "d8d5c50983d9a21e0b8d48351c1f16a1225c3588c46e4d0967fbbc908c55e1c8fbc4d7aac0976250267ef7e72bef95b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671967822, "uuid": "d4af6bcc-089b-4b0f-b9e6-52f9afd43893", "value": "T113936C42EE4080FEE965153864EBB736EE36BD9426488F477305ED862C33151B7713AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671967822, "uuid": "016df3d6-30d1-4a52-81d3-48d20e19c7ea", "value": "c21d2bb98ff69599be53eb4b3e87033a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671967822, "uuid": "310feb52-ac55-4034-8686-885264eb8435", "value": "1536:9Jvpm0PGt6rj5w0OqcocxrD5n6eDwDueLic+8ifnIcQ63xF+0j11BrM:XvpmuGt6rj5w0Oqcoc+ekDVLi580nIco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671967822, "uuid": "40b25654-57ce-493b-ae06-089944af82d7", "value": 94032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671967822, "uuid": "d038466f-b083-480b-a933-8132f7be28cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671967822, "uuid": "a04ede01-c58e-474f-9a79-b108d64bfe0c", "value": "ba5396e15e896c12f5b948b4ab134e44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "528f30cc-8459-11ed-9db1-42010a9c0080", "comment": "Malware payload (DanaBot)", "timestamp": 1671975469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671975469, "uuid": "6a88602a-25b7-4372-8e3a-0c88c7149065", "comment": "Malware payload (DanaBot)", "value": "69b7cf3ba1bdfcd55ed4d76b71ea386a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671975469, "uuid": "7156cbad-f41f-48a5-8577-5fb89e6d88b6", "comment": "Malware payload (DanaBot)", "value": "29c8f4e86f33285254e07c7f513c4155a65bfb2c6e308e39b0d90f50fec40797", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671975469, "uuid": "d0e2f6c0-7a71-46b0-8feb-153951332b9d", "comment": "Malware payload (DanaBot)", "value": "e2b5ba9bb45e91124d37238e5fe71c55b43b65e1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671975469, "uuid": "30fcd2e8-e8ec-43a3-bc8c-4c2ca6ea7d77", "comment": "Malware payload (DanaBot)", "value": "c2dd87d681668d22586ce99f6532f0ee1255db280d52d5ea06a27e9283b280bfbc70a452be5e2680c772f8d8f4ecffa6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671975469, "uuid": "9403eb1f-4195-41d4-b992-3d22432ea279", "value": "T1DE35232072A4CEA3C7C28D314A1BD6E96B3BBEA14F1361F356886A4F3D75171AD3114B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671975469, "uuid": "1e24c394-92c3-4a22-a554-edd2cbc34a3e", "value": "8514760d95d5a493235b8748f65885e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671975469, "uuid": "8637cdd3-cd1c-45de-8160-9e47247db0c0", "value": "24576:EU5tlFL01is0xE31iHSUVb1S7N2dDwXoWkSnjGHp:phREL61S7N2/7Sn+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671975469, "uuid": "103e5734-6614-42f4-b2b6-2cdfa4ee0219", "value": 1138688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671975469, "uuid": "91425c2a-c3ef-4dc9-97fe-48747b412542", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671975469, "uuid": "dca2cda0-ac8a-4fe0-9936-a79d0b43e15a", "value": "69b7cf3ba1bdfcd55ed4d76b71ea386a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c556d054-840a-11ed-9db1-42010a9c0080", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1671941731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671941731, "uuid": "1b2d2042-8bb3-47dc-aff1-8304f15e4939", "comment": "Malware payload (ArkeiStealer)", "value": "e16255bffbae9ac0c8bba14c6d291026", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671941731, "uuid": "8713c8e4-eaf5-41dc-829b-b6f9b5d02861", "comment": "Malware payload (ArkeiStealer)", "value": "2a25f5e55bee2b821803628132c0d3aa7b546f695be2de89bb599abec93e4f63", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671941731, "uuid": "345ac019-3a73-4d16-b93b-623f150398e3", "comment": "Malware payload (ArkeiStealer)", "value": "256338a9ac1231443a98eed5f3b884ddc1453830", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671941731, "uuid": "56ab571e-5b06-422c-86e8-e0e710fb216c", "comment": "Malware payload (ArkeiStealer)", "value": "e8a2739e37d7d5fa78b5cdb3e0398d8887f188490caeb04208a483746eef3d645edbf24be6712ad10c77da37cf22f5cd", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671941731, "uuid": "90043313-636f-4303-8b00-a2aa906dd782", "value": "T15874F10CBA93D462C5620A748919CFD4973AFC318B615A2F33507F6F2E70ED1A63A275", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671941731, "uuid": "aca07fb1-13f0-448b-88de-c6066ea61af5", "value": "1ea9f0326cf512ac0eb7dd4bc1a00a19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671941731, "uuid": "28a26c41-b78d-4f5d-a191-bdb7e98dafe8", "value": "6144:lfgLg0J6YnTUSpkD9VMkfAfZMsL/DXDIdMrHtpaMh3F:Rgk0J7ISeD9+9fZpLvhyUF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671941731, "uuid": "8d38b7ec-48d1-4323-881f-481baeca791a", "value": 348160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671941731, "uuid": "59ce4cad-e4b3-44d9-aab7-9b9e382b44de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671941731, "uuid": "4b281d3d-437b-49f4-9753-7ff0273da25d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cecd868b-8428-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671954632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671954632, "uuid": "698792b6-ba03-4966-a9fa-949763afebd2", "comment": "Malware payload (Smoke Loader)", "value": "3821da74120d09a663435e698b4771ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671954632, "uuid": "f9156aaa-a115-4d26-99e2-1b4ce4ec559f", "comment": "Malware payload (Smoke Loader)", "value": "2af033f26c04f2fdbbedbd9016c40356b1924f276c503dad597c32b2bf1136cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671954632, "uuid": "5aa9f19c-9fbe-4e97-8017-a69fc61eca10", "comment": "Malware payload (Smoke Loader)", "value": "c77f0243d5631ea43d79fe73679933f6c22739cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671954632, "uuid": "8eb5911a-bbe2-40a5-bebb-af1fd9fd425b", "comment": "Malware payload (Smoke Loader)", "value": "c0f44a425c6148c4592bfbd87704996281273ed95d8a39128906fa884957d08db592ba3297aa5ef98648e05105ba5e2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671954632, "uuid": "bf30fcab-a021-4e4c-8bcb-576a5d3c34d6", "value": "T1F124BE0DBA63D062D55219308815DFE46F6AFC319F615A3F3350379F2F72EA09A663A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671954632, "uuid": "9152272b-91e4-42a3-a3ea-1d7cb02a414d", "value": "1ea9f0326cf512ac0eb7dd4bc1a00a19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671954632, "uuid": "f8109b09-0354-4740-9863-fc1a648deb3e", "value": "3072:6DVuyLjLD05M/Z48v+3XZexgsJDRGauDnM3f/ln:aLHDra8v+3pSN5saM4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671954632, "uuid": "8eca6418-73f6-4d60-b177-d378ac237c3f", "value": 227840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671954632, "uuid": "879c1133-fd6d-432e-8414-40bfdabfc81f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671954632, "uuid": "f6111b79-aa73-4f85-97ec-323efaf46d9c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf477b3f-840a-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671941748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671941748, "uuid": "dd27b1b5-f118-4e49-87e8-ab768f885260", "comment": "Malware payload (GCleaner)", "value": "877fee9f5c1c0cb74e4a9fc71775ceed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671941748, "uuid": "37e5c571-65bb-42b4-a089-8bc2ea2675f4", "comment": "Malware payload (GCleaner)", "value": "2bd00450772f6dc1200756a7d6a1bfbfaba8ccd6360f35e9c7b80c5fccd6cbde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671941748, "uuid": "f6038029-9d8b-4751-9420-eb355ddcd80d", "comment": "Malware payload (GCleaner)", "value": "39bbdbd166c12abc808c9375033d972a60ed8da0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671941748, "uuid": "9a6d7291-9477-4103-8da4-62ae1f88c12f", "comment": "Malware payload (GCleaner)", "value": "74e52a9dee4826890125d8114e7fbf9c2663b0618edf76a008aa2eb6622e15725e6847661aa146abb9755ed2f417c774", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671941748, "uuid": "22c05313-b7f3-47f2-9c87-3a7a25656ccc", "value": "T10A8523DAF9B5A633D00D8174DD85DA047A3A3B911F0E460E16C89F9BBF3A91C8367361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671941748, "uuid": "d77b0d5c-8c3c-4986-b6cb-fce528af30c4", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671941748, "uuid": "0ffa973d-f3a3-4aa7-b901-904fca3710b8", "value": "49152:miJNmCqXnUOxWIp944Q0kl+44NkzbEZh+Zam:miyBnUEbQ00+441h+Mm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671941748, "uuid": "dcccf6fc-3850-4ae7-9027-664800db0600", "value": 1818849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671941748, "uuid": "57d1cd10-6ad6-4c1c-9bba-9c202ea6b549", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671941748, "uuid": "800262c9-5bb0-4fc8-8c3e-5a11978ec4a3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b4385e1-83e8-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671926923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671926923, "uuid": "b2b0f7dc-3013-43d1-aedf-0876d69c1aac", "comment": "Malware payload (Smoke Loader)", "value": "fcae9d848028659cc29683c18d7d21b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671926923, "uuid": "86295f68-c309-426f-b7c8-1fc45eb6b6b9", "comment": "Malware payload (Smoke Loader)", "value": "2c159e7f51c8aecd6dffe6698c507187f6f13d3321051b601e47d1de8275086f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671926923, "uuid": "2ceb42c0-2917-44ba-aad0-d2bdc579c313", "comment": "Malware payload (Smoke Loader)", "value": "0e90286ab93b8f0d89c5dd91dc04506f5debcd4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671926923, "uuid": "1717de36-e554-44be-a197-d368433abbbd", "comment": "Malware payload (Smoke Loader)", "value": "fe89766ae570dcf962858e9eab55b953e40e6c7ff8e221a28868fee5ca4e5db1b3f8268a3d584fe5af2f42a451a6733f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671926923, "uuid": "ff50dd18-a247-4768-8a44-c1b4d184884a", "value": "T1FB24BF0CBA92D475D55109308D29CFF46A7AFC319F621A3F3B107B5F2E70EA09626365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671926923, "uuid": "20c6413a-7fc4-4511-8e28-6491aacb751b", "value": "1cabdb70cbdd8d3392fe9f92c541a607", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671926923, "uuid": "5b72c3be-ae5f-495f-bcf5-191f54f5d04e", "value": "3072:swG8Lrb3I5th5AmO8KqNnil1u5LFU+1XrhauDC+MbROf/ln:53Lrrg5A38Eu5pU0daMZd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671926923, "uuid": "ad4be2e5-64d5-4595-8fb3-8f1796987e80", "value": 228864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671926923, "uuid": "b37fe143-f874-44af-b4f0-7c89c4baa103", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671926923, "uuid": "a4266683-ef65-4527-bfc2-543859e0f11c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d93bb9a-840d-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671942738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671942738, "uuid": "9641852b-e3c4-41a0-a5bf-961a8d857459", "comment": "Malware payload (RedLineStealer)", "value": "536f9b280e14cadf87599f03e4d7b13a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671942738, "uuid": "ed97d8e6-4a53-4657-9d8a-a7de962ad136", "comment": "Malware payload (RedLineStealer)", "value": "2ce2908d3828dc9656116144af25dd5d7c4fcd85ec398f79d982298600086535", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671942738, "uuid": "0a1a29c3-d1fd-4d80-be13-0b1a69409f74", "comment": "Malware payload (RedLineStealer)", "value": "7d2613d7347af47540263ca8f8b1ed974c2c904f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671942738, "uuid": "2ac749f8-44d2-4f92-80d3-c736e877e0b2", "comment": "Malware payload (RedLineStealer)", "value": "af2f51c7fb95e2a4737da93d401f6722006656c7ddac366266038ae2c36474b9d0d1e94adfbfcc64ca3342147ec97c83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671942738, "uuid": "74224f8b-8d16-4792-bd1e-ae17cf9e8eed", "value": "T16F84F10CFBA2C079C55156349A29DFE16BBAFC714F616A3F33403B4F2E30D9095662A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671942738, "uuid": "1da0ac31-1537-41f1-ad9f-3e726c156960", "value": "1ea9f0326cf512ac0eb7dd4bc1a00a19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671942738, "uuid": "3e54f036-df95-4ae2-9158-730ecd8ce011", "value": "6144:kL+ze5lzL1yfKrRZRKjZ25WJh+xLDZIf3CC+j9raMaYqEIF:kCzmh1DtZRyZ25KcXGyC1nVE6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671942738, "uuid": "1ebb9cf1-3d75-4897-8174-165c6a4ebfc1", "value": 384000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671942738, "uuid": "50eda53a-a464-48d5-905d-859f634382fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671942738, "uuid": "308e4d32-f925-43d4-9851-c28fb935875b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feb32419-849c-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1672004534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1672004534, "uuid": "b2fca046-70f3-4535-abec-05efbd778d43", "comment": "Malware payload", "value": "685a545979ab7f44cb0a144bd753db25", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1672004534, "uuid": "036e5a9d-5cbd-43ac-a37f-75d996657dc9", "comment": "Malware payload", "value": "2cf04cdfc637bd78f14a56338e8fba2178e1daf6aa37f8b03ed9d0441c485afa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1672004534, "uuid": "2fe66337-bce8-4714-9c9b-d84b1e7ba6ab", "comment": "Malware payload", "value": "4310f43080675f471cfc3c0727ad37dde78bf548", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1672004534, "uuid": "fc7f7d72-02a7-411c-9bb7-dbb4bed1ad08", "comment": "Malware payload", "value": "c4b67b67c368a99d393e114d5d7a0314c17edb92f1817daaefdb975ac53cf28dea6c350e6a3c0ef47c8a37a8d19700a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1672004534, "uuid": "d374fa22-fad5-47c5-b47a-ac902440b4d3", "value": "T115D3C65AAB619EBBD81FCE37069A4501248DE64682D93FBFB2B0C51CE74B94F08D3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1672004534, "uuid": "2c24f3ac-4fd7-453e-a1f8-e6dac0425c05", "value": "1536:o2beTpNb9DERkLMurNpZ3efJp68E1wYqNvd00PUmkVmSFxBC7vXZX:o2cNJLlrvJF1SvdlPUmkASFxBKvXZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1672004534, "uuid": "9e20e329-7ca5-4263-a498-6c9bcadba827", "value": 134222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1672004534, "uuid": "583cc21c-a918-406f-96bf-1df25a03dec5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1672004534, "uuid": "84028222-59d8-4557-88b8-93fdee53f041", "value": "685a545979ab7f44cb0a144bd753db25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c530b06c-8449-11ed-9db1-42010a9c0080", "comment": "Malware payload (Formbook)", "timestamp": 1671968789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968789, "uuid": "f7bb8496-7be6-4a6d-814e-34c9dfac2648", "comment": "Malware payload (Formbook)", "value": "63214e85bbba6f06ff5e942adff25980", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968789, "uuid": "90de8f6e-2eb8-4bfd-bb4b-7bdb57ed3f62", "comment": "Malware payload (Formbook)", "value": "2e4678d03a2fd534b0cb7387581a08ff198585090db19781d9dba94a0e7f860d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968789, "uuid": "c41d5035-1854-4e2c-9adf-38c090d4850b", "comment": "Malware payload (Formbook)", "value": "3d5702243cd1b34b9de2facca2054af34deff911", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968789, "uuid": "c7884ecf-a562-4f4f-9db2-a2fdfea418cb", "comment": "Malware payload (Formbook)", "value": "dd73d522dc30d0a1b278775fba0f631a80fb4bc6434116e54253bde7a806fc8ce053947a237a31cf327d9aee2fed6b92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968789, "uuid": "3e1e841c-4c53-4788-8b3b-2d0758b4329c", "value": "T1A3E4BEB7293B02C1CE6A0675C47A1D101D1ED8F90701C6B676D3A2AFD649ACEB9D4CB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968789, "uuid": "93cf5456-9600-4127-abc0-4b4780d180f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968789, "uuid": "66a57644-7fc2-47f9-bc98-193c4d16e08f", "value": "12288:UpvG9X+qjJF0qDIcpo+o9Eu5/2h3Q7DdAeXZHW5eDQFtXpUfE7Fq:UG9uqj3R7xo6uWgFX4eeOfEJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671968789, "uuid": "ef52bcbe-c721-4280-8cca-f85d4b98e415", "value": 701952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671968789, "uuid": "d8516315-a743-461a-bc6f-bc015a10cfcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968789, "uuid": "8fdae2ef-018b-4f13-855e-336b51884a8a", "value": "63214e85bbba6f06ff5e942adff25980.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1e2c74a-8475-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671987681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671987681, "uuid": "ca9e46e6-b723-4d62-9951-8ce0f5d9c61d", "comment": "Malware payload (RedLineStealer)", "value": "210833411dfb3d09154f4e18ae7b61ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671987681, "uuid": "a175704a-296c-436d-b229-e36bfe066916", "comment": "Malware payload (RedLineStealer)", "value": "2faa497e1a7f0851aad38a05a3888070b7cf7000d57e0399b17095539561f3bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671987681, "uuid": "deb65c05-7ac7-4dde-a2bf-922b3699a644", "comment": "Malware payload (RedLineStealer)", "value": "bf6f34517db7a00446b2258b22bf8adf986493a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671987681, "uuid": "874fdcc2-e0e8-40a2-8bf4-93df6c624df9", "comment": "Malware payload (RedLineStealer)", "value": "2b123f4d0b35b197bab32ec7794958212537c6373b304c71272ccd79c02648bd1435e462b126ecd229337863af3a53fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671987681, "uuid": "067301b1-5ce2-4995-a275-aac25dc47c42", "value": "T1DE34AE117695DCB7C2D24970592BC7E83B3BBC918A6356F722087A7F3E702B09926347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671987681, "uuid": "c11f1e23-642f-4bd4-9460-68625fc47051", "value": "8514760d95d5a493235b8748f65885e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671987681, "uuid": "af79e861-39e8-425d-abf2-07fa700f6b73", "value": "3072:Mhb+LdxD4qH5DYmEFXi6Zchg46S32NTe0PtJ/Fw7RkxmJZs:MwL3D4qFYEOcu4Z0lJ/FGymI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671987681, "uuid": "59b7595b-85e8-4705-bc4f-f0c42263461e", "value": 237056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671987681, "uuid": "ea40ca72-51b5-48bc-8ed0-d77bf3807666", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671987681, "uuid": "f26f1304-06e0-49f4-b401-82a26bd4f4fb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27d6d626-8490-11ed-9db1-42010a9c0080", "comment": "Malware payload (DCRat)", "timestamp": 1671999019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671999019, "uuid": "6ee257d5-3829-4e6f-9a11-6e8ae821128c", "comment": "Malware payload (DCRat)", "value": "8645fd54fac7c386197853edb3e2cd8a", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671999019, "uuid": "d5628458-422b-4530-8c0f-a70590a7d838", "comment": "Malware payload (DCRat)", "value": "2ff5f44dd978997ba618bab8bf6ee9900aa005f244db185c98ba5cbecb6866d6", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671999019, "uuid": "e0a42aa4-0d92-4815-9dcc-6718d375ff95", "comment": "Malware payload (DCRat)", "value": "69eba481f214340e8e770e0f9fb4dab65afcd781", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671999019, "uuid": "ecfbe01e-f843-48a2-914c-4f72d08899d7", "comment": "Malware payload (DCRat)", "value": "ea395d478fed7894f31cce94edc8d81a3d0dd3f3465d8b3b12c618ca1805ac1791ae036ae7ed06ce2e9231fe15f91669", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671999019, "uuid": "c06f5f37-b78b-490a-b00e-7c34df5ecba3", "value": "T13E65C6621A4470B2E7EFBE79CCBA0A98A11C71C702F5AF2B9B50E0C56F31644DD8635D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671999019, "uuid": "59d4b1c2-a88f-43c8-9524-d8b1de106051", "value": "0af28484540d5c9f24f0a6a655d76d23", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671999019, "uuid": "75da3b95-3d00-4855-a9d7-7aa5b545e4ad", "value": "24576:8kGAQ2YTEip1A1+dNOL0RCcJNWDKmj8Tc6dhtN3fucovGLPqhmr5ptQBodIF/pGz:8kGAQ61+dkL0y6dhHfucovgPEmr5pGBa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671999019, "uuid": "f933c858-22fb-4e55-a196-65693648451a", "value": 1470464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671999019, "uuid": "bb67d5ef-0503-44c0-82ca-2f0b8c32abb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671999019, "uuid": "a1867b99-2e61-411e-ba5d-94d229053559", "value": "2FF5F44DD978997BA618BAB8BF6EE9900AA005F244DB1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fcb5c8b-842a-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671955304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671955304, "uuid": "1ae97dd8-2081-4bcf-8167-d12f53365111", "comment": "Malware payload (GCleaner)", "value": "c10b774c1d2acc97d358349dad963ebc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671955304, "uuid": "5d91c0bb-f1e5-4f28-92fa-779c75acc90f", "comment": "Malware payload (GCleaner)", "value": "3039b9ce44a50e8d97720b81fd485a30dc8a331a0548021fe347068e0ca95b98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671955304, "uuid": "0c52b2fc-bff9-47c0-bbb1-c1c68aa50639", "comment": "Malware payload (GCleaner)", "value": "7f41493ece5a27341ea36747d245337e98b24b61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671955304, "uuid": "1fb3163e-51b3-4d14-9a4c-959d423a31e0", "comment": "Malware payload (GCleaner)", "value": "a8216286f73bd434e6469f993a88b1d0c70b1e02a1719ca0802cf16e4910addf75681ca83ae9b6d3d7ea72c48ebd80aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671955304, "uuid": "8f428f5f-16b9-40f9-aa9e-5221dd013c11", "value": "T1838533C5BACA5D71D19E82740D24CB1D35316B902739845C2CCAFA83AF7D20D93A779B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671955304, "uuid": "1b908f7e-2b97-47e2-aeeb-06c2061ce068", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671955304, "uuid": "16c497cd-79f5-4793-88df-dee6b8360460", "value": "49152:GixBDDj30NGlhNI26p9HmomLObxcj3snZaD:GixBDDwQlw249HcKisnMD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671955304, "uuid": "e15ec8c0-5a7b-4033-bf8c-02ca222c2ec9", "value": 1798140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671955304, "uuid": "ef332056-c224-4778-8654-20d7152868ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671955304, "uuid": "ca4a5edb-b035-4633-84b4-ddd1bfebd6f5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "136cc388-8425-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671953029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671953029, "uuid": "b17d4773-857a-4cdb-9943-5046eeee88d8", "comment": "Malware payload (Smoke Loader)", "value": "3113ca4fcbaf9c7b6e15ad8599a3c244", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671953029, "uuid": "c0943d46-ccac-43bb-8f29-c4cf16381c9b", "comment": "Malware payload (Smoke Loader)", "value": "30474391ebe041ade2c9b5cea9092f32763c99c714d7a0a25d61ceb0aa616de1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671953029, "uuid": "713ca1b0-00d0-4eb5-a718-57a6dd8f6a8d", "comment": "Malware payload (Smoke Loader)", "value": "7aee0e340e112d919cea18b838cacf0a9150dd72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671953029, "uuid": "0306bc64-211a-4855-9faf-b832c07e2ee0", "comment": "Malware payload (Smoke Loader)", "value": "88385188967b20b5992d9a0c108c4ebf468ddee0082fa5483c9ffcd5da7a24f30ad0a53299409b9a0d10d6f84d21bd25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671953029, "uuid": "08e98373-71bf-412c-bf85-07b34b925540", "value": "T16724BF0CBB93C4BAD55249308929CFE4666AFC719F615A2F3704371F2E70EE1952A3B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671953029, "uuid": "10a22576-cabb-4819-aea0-f92290269343", "value": "1ea9f0326cf512ac0eb7dd4bc1a00a19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671953029, "uuid": "962c0167-d8ef-4ca9-b67f-927eabb5926c", "value": "3072:hD83qLDk5S9N98nu05jBDobVcP2RW8Q0SR6auDz4Uf/ln:yqLD79N98VBsZcgWvEaMzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671953029, "uuid": "391d2328-c748-4a16-8b16-13434e364daa", "value": 228864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671953029, "uuid": "6e860b4c-ae52-426b-9ece-b1cca9cb75f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671953029, "uuid": "42ca9bf1-c494-4897-9adb-d27b5055cc8d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbde6540-842c-11ed-9db1-42010a9c0080", "comment": "Malware payload (AsyncRAT)", "timestamp": 1671956425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671956425, "uuid": "e7ea7ede-9d32-422c-87ab-fdcd27468405", "comment": "Malware payload (AsyncRAT)", "value": "70488131ff53f7f73f351f27f86a10ce", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671956425, "uuid": "75759bc8-9528-47fb-9db9-9b0df16b5810", "comment": "Malware payload (AsyncRAT)", "value": "308f16cf7000655a28f21e6d159ac68740d6c8437b2a83baaa563912a2bf7a19", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671956425, "uuid": "a6297a33-5178-4646-ab47-3e8c94ea8755", "comment": "Malware payload (AsyncRAT)", "value": "fce5bc2ff5d38c068de759868a6ddfb023cb3ca8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671956425, "uuid": "87969c91-26f3-4070-930e-9d35a6f2dbfd", "comment": "Malware payload (AsyncRAT)", "value": "d19526a04868c98f071244143472126c646510b1af50c11d3620ea8c56d81bc90b15412a88c03516af0d5974856950c4", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671956425, "uuid": "3d6762bf-c050-42ee-a71c-ecc7ff9ccbf9", "value": "T14F93060B96987DEEE02B5BB36D5B9E4AE679B9536D0DCB052621074F10620CEF303D93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671956425, "uuid": "53b5e7ce-32e3-4bab-baf1-bf636b7df936", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671956425, "uuid": "41eb5bce-8d9f-4521-bd77-900ab8f6db45", "value": "1536:PgA0iaZaUVQOeyTd9YmTQNcdaqmb+n0+z8bgNcRHKWF2SjP:PgA01ZayLeYAKQNcdad+03bgNcRHKWFl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671956425, "uuid": "d6de2834-a582-4371-ad9b-0c2a6694a547", "value": 89088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671956425, "uuid": "6c6663fe-3f36-4649-b1a5-06ecf6deec75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671956425, "uuid": "a8eb61c8-a190-4b56-8c5d-f9e5ca99ce13", "value": "70488131ff53f7f73f351f27f86a10ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cffc3b6c-8488-11ed-9db1-42010a9c0080", "comment": "Malware payload (Formbook)", "timestamp": 1671995865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671995865, "uuid": "1f22f987-5062-471a-af3d-a7d2748762ae", "comment": "Malware payload (Formbook)", "value": "ec4760bc8a941e07403b446b4fa6c042", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671995865, "uuid": "c7874121-0b20-4551-af93-7da353c0c567", "comment": "Malware payload (Formbook)", "value": "31042c71bb220592ca365e326d6ab5e1ef42d3b71c5d2c8eb24201fa1f83f655", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671995865, "uuid": "50e24223-ed9d-43fd-a973-15e090184928", "comment": "Malware payload (Formbook)", "value": "4de4ef23995f9409f4407bb5b9889ee360c30488", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671995865, "uuid": "b42ba343-ff84-4a67-9921-1e14ac460ae5", "comment": "Malware payload (Formbook)", "value": "c06d7ce31ff5806b533c98b3821008cc9371ac77b6f9d401104ec3a764c7b6d9fbd415b94f0131ee07387ef14c4c9867", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671995865, "uuid": "8de22ce4-a0aa-426f-b962-e092bdfdc1c8", "value": "T127541217A4D189A7EB9F46740667EF7DE77A42880175418F2BAA1FEF1024CC6C3066D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671995865, "uuid": "17a90a04-49b0-4cce-b2a7-08e0f297387e", "value": "97318da386948415d08cef4a9006d669", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671995865, "uuid": "d65b35c1-d13c-42cd-863f-f4346e2660ff", "value": "6144:rkwrGFx8piZU1q1+kPExVkPa+4/jSWo+MGfWDfQeDYjDWq4z:QFWc8W+kMxZ+dX7BofC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671995865, "uuid": "0f8ea93e-dbdc-4562-b24e-282a8445116b", "value": 282087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671995865, "uuid": "b8519d0a-684c-4fd6-94f8-ecd488ac8144", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671995865, "uuid": "25c8f1a1-3f38-496a-9ccb-e070a5218436", "value": "Scanned03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f782b178-83f9-11ed-9db1-42010a9c0080", "comment": "Malware payload (FickerStealer)", "timestamp": 1671934514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671934514, "uuid": "c326973d-2a01-4d7d-80e5-c38570c9120a", "comment": "Malware payload (FickerStealer)", "value": "f6f84e80684195be3d018d72f0c337e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671934514, "uuid": "29758bd0-36c4-409f-ade7-78fae76bec66", "comment": "Malware payload (FickerStealer)", "value": "31d722331a9890b3ac394bf19fa6246397fbf79b37f23bc3fdde850afbc319ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671934514, "uuid": "b748eba4-4518-48e5-9d01-4615f9cf8fc1", "comment": "Malware payload (FickerStealer)", "value": "71edaeb2a19028b2dc74f66b27245ac8ada88117", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671934514, "uuid": "036f193f-97ca-4bbc-8ab6-25eb703ff84b", "comment": "Malware payload (FickerStealer)", "value": "a3c7f604fd3defd3f1a1e7e9ed1e25bc28354ff9534336e88a6fe2a7ef3c622b034f530e25f174898a7c6a3d7404a975", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671934514, "uuid": "354d4115-a043-4991-9191-dd7159113592", "value": "T18884F10CBB92D4A2E45244708926DFE06A7AFC304F55A77E37503B1F2E70FD1A6663A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671934514, "uuid": "168b504a-36cb-4c37-a9be-093df3e50eda", "value": "3ad97f4e43892433cafc01e0293aa96f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671934514, "uuid": "7c4d6040-c4bf-438d-a773-4216ff33aee7", "value": "6144:OwLUCKwEscIr5CAM13HfyTlJRAOvS8YGuz2ewEMXqaMM+k:pgCKwEscIr1Q/utbKmewEMXd5+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671934514, "uuid": "7f9c15de-cdf2-41a0-ae72-83beb9d05387", "value": 405518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671934514, "uuid": "a3645706-38c0-4d01-888d-a501c00ae404", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671934514, "uuid": "ddcb6bd9-4817-4cdf-9b94-c3c81aeacfaf", "value": "31d722331a9890b3ac394bf19fa6246397fbf79b37f23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61f3dd09-83fa-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671934692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671934692, "uuid": "46168676-1d33-4b62-a4d5-536d9bf850e4", "comment": "Malware payload", "value": "64e411fec29f2bdc0e48310552866224", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671934692, "uuid": "e58a3879-e355-4369-b859-6b59001a94d4", "comment": "Malware payload", "value": "31dd12ed866aa187477736bda86ca98f8d0583bcc4b3578aa7daeb883877ad77", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671934692, "uuid": "0ad29b27-2ae5-4174-b209-3634ee143b81", "comment": "Malware payload", "value": "cb78704fa8eae8e22205aa496583440c67f950dc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671934692, "uuid": "df4ac6b1-05a1-4540-bdab-d73deae0b111", "comment": "Malware payload", "value": "b272bf6f0c0d610057290802f41f301891da54968f305bf444d7c202714529668c5168d285a524cbb4044bf0ce27f73a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671934692, "uuid": "e3fdf47f-3bf0-486f-8739-d6f72e6dd343", "value": "T167752312BAD08872E67219391EFAC730793A7C326B758DDBA720571D59345C0DE32B36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671934692, "uuid": "c520d7bf-c905-4868-a463-206fdf92f27d", "value": "ab9ff6e4872ea2766a5f5c6af5649e9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671934692, "uuid": "b7364e58-2010-4fdf-a421-b3b768d21959", "value": "24576:gJr8tE+gHqtF+eGsF6AYALk+vsFJRBLYPbgwI9qKHmkKx3I6XGOGLNalaN:gJ4NtesF8qvWDsDBSdKlI6X7oR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671934692, "uuid": "bb907603-b1d2-4d1f-8a63-6e1cd81e7a78", "value": 1682441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671934692, "uuid": "ebdf2841-b9ec-448a-87ea-602a0342f241", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671934692, "uuid": "a3f867c7-da41-44a5-b09b-1d5628404164", "value": "64e411fec29f2bdc0e48310552866224", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bda14b74-842f-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671957609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671957609, "uuid": "7607ef6a-49ad-4844-b3b5-5c7479f993c8", "comment": "Malware payload (RedLineStealer)", "value": "bb329fed961e356f7103c804a960e7db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671957609, "uuid": "0ce195bd-abb0-472c-8c7b-c9f1258ec1b9", "comment": "Malware payload (RedLineStealer)", "value": "321b7072a0ea33c36933b98b6523eaf4dead69a8e90dc032f8a4b10cfb835b1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671957609, "uuid": "5c6623d8-cd99-4a2f-9d29-d8e9356a72ef", "comment": "Malware payload (RedLineStealer)", "value": "5164fa618d677b5208e81de16ab0613aa3fca5f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671957609, "uuid": "2028572b-380a-4db9-8c67-69c2796746ff", "comment": "Malware payload (RedLineStealer)", "value": "247196d0dfb222c870bb9f048e70123a0eed6f104052c2beb6fa5d8bd1e5c19795a676000322a232b31e103ef6f08b89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671957609, "uuid": "c8314380-e524-4e87-b8a8-89bb6791e351", "value": "T11494F41060CB8D69D362303E41A4417A796C6670C715FEEBAB8F3E6BFA50190F63716E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671957609, "uuid": "a3b1aed4-0c50-4a86-b220-649e8d02d7ff", "value": "7e7c1082b38a4734d89e1f235c71c850", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671957609, "uuid": "e9ba0543-e671-49b9-9219-326f1e4f5466", "value": "12288:Gygxer6dluLigEZoNZaMuWANOYzGmzRP7:AuOdZ6ZBuNOLmzh7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671957609, "uuid": "bd207678-bbdc-49fa-aa70-d9287b54c3e7", "value": 408064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671957609, "uuid": "f200146f-1098-453e-9c35-0eae3a3d34dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671957609, "uuid": "efc08b59-2ba8-4a67-8c2d-62786d08f70b", "value": "bb329fed961e356f7103c804a960e7db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49482491-8444-11ed-9db1-42010a9c0080", "comment": "Malware payload (Hive)", "timestamp": 1671966434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671966434, "uuid": "9ee03246-34d4-47d2-a56c-abe0817689e5", "comment": "Malware payload (Hive)", "value": "047f7f9991565fe1d26c4f9ffbb5c6ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "v6", "colour": "#2AD100", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671966434, "uuid": "353723d6-4a6a-48c8-8274-5772b44e5cf2", "comment": "Malware payload (Hive)", "value": "321d6dd9c7190b344888831600a7a8f2f1aa18710a5bf8bb992f9c90f3f565de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "v6", "colour": "#2AD100", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671966434, "uuid": "18f102c2-60bf-4212-863a-118593fc86d6", "comment": "Malware payload (Hive)", "value": "1ec4db757f1b878121a424912db41ef9082e95b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "v6", "colour": "#2AD100", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671966434, "uuid": "ef510ac8-7461-4ace-91cd-830a37ea2334", "comment": "Malware payload (Hive)", "value": "1ef7ac634d19f3140cfd546425a2d4f0018e6b687ee4b6dfcee5cfd5e275e4e9d87178d5c150a1bb8f99212b05fc9e61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "v6", "colour": "#2AD100", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671966434, "uuid": "6cf9259f-a5e6-43ca-babb-d27a04a30097", "value": "T1BC942C07F9A210ACD9BEC974833E9533FA35788D42126A6777D89A203F19F209F1D751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671966434, "uuid": "04cb1f00-022c-4df1-8e20-b1db74d7cccd", "value": "6144:7w0GxkjKmdy/su0UDna3nxP5QmMHz/ooYJ/Hc/qh3vgLQGUr:7DjKmdyUu/Dna3nR5B0/hYJ/HD1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671966434, "uuid": "5ddd1870-ee4e-49ff-825c-273c4d8bb343", "value": 440624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671966434, "uuid": "8179c422-e86f-43dd-b156-3921173e8d27", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671966434, "uuid": "a3974eff-0051-4af4-8216-f45b63d6f866", "value": "vmware_encrypt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c11f446-846a-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671982759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671982759, "uuid": "b46191b8-19d0-452b-9f3c-52d0d2e29d27", "comment": "Malware payload (Smoke Loader)", "value": "7ec068e171862232e128376642bfb59e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671982759, "uuid": "52654f05-1fd5-4477-bfe2-589f1bc77c45", "comment": "Malware payload (Smoke Loader)", "value": "34270dfeff16ab0ff208875139510b77f8b8c7fd4adf91ac82e2f6091b5f2985", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671982759, "uuid": "f0c63b73-03d6-4201-ab7e-09f4358b4892", "comment": "Malware payload (Smoke Loader)", "value": "a6140ca28a2ed9249dda2badeff37825b8a38c10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671982759, "uuid": "402d3c02-6684-4fc0-9b33-a43a9fd9bd15", "comment": "Malware payload (Smoke Loader)", "value": "95d0b9dd497e25757562ec94baa121deb1f5d5b93fba19fb0aef4b42e385b05ea284346d69300026bb461482aa23e384", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671982759, "uuid": "a9ccd106-d739-49c9-9361-3f9b312cd0df", "value": "T1E434AF506690CC62C7D20572992BDBE82B3FBD918A675AF327047A1F3E711F19D26383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671982759, "uuid": "55941665-865e-4855-b9e1-53ccdd67d7cd", "value": "8514760d95d5a493235b8748f65885e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671982759, "uuid": "fac09fd1-0fb4-494b-8ec3-220bb9e04fad", "value": "3072:F/ESLVVk5qpoHddziPgReoFtJ/4MqrErw7RkxmJZs:FxLnzOggUoDJ/4MqwrGymI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671982759, "uuid": "b866f712-7574-4da3-9472-cd013f679ac3", "value": 237568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671982759, "uuid": "3025c830-9820-469d-9bb2-a0b51628741a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671982759, "uuid": "bc1c7f97-2dcb-402c-b980-b70d028ef8f2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ac77ebe-849d-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1672004742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1672004742, "uuid": "0bf2263e-5281-49c6-8f0a-957e311ce796", "comment": "Malware payload", "value": "b592a4707d49520f208088d8041047fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1672004742, "uuid": "17dc7dfb-c1f9-4259-82f2-a1c347fb986d", "comment": "Malware payload", "value": "35d31939970bcd27e0d99b1d912532393d73b2cdcfdb4d8623e1e7458a6a388c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1672004742, "uuid": "91a8d98a-724c-496f-8354-29bda1febaa4", "comment": "Malware payload", "value": "4fdf742d15229daaffd72bc8e9158f2013200d9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1672004742, "uuid": "a0b3290f-ff5a-4e0c-866a-e4cef0ca9c34", "comment": "Malware payload", "value": "9d37faf07f39b3dc5cd30a65050790249feabe9f3f13e478beb402e317320bd4266ffd926ccb80391fb0d1f6942b839a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1672004742, "uuid": "39eedb7c-298d-48cf-8bd8-9473700ad18e", "value": "T1C2E56A4367EA450CF1B72B79AAB701344B37BE956939C24D019C750E0FF3A4498A6BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1672004742, "uuid": "d6420462-3fd9-48be-9783-dc77e29192cc", "value": "37600575dac88fa721ab93d4dc74087c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1672004742, "uuid": "fbb15d64-3b77-4a15-999d-a6e968517851", "value": "49152:EMJ8xqm3zNKxjipke496PDS6TROZTAC0QdB3WLSgwIaGZJRWrKnnYt:EMGKxjSZ4sUUC1dFroJR0KnnY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1672004742, "uuid": "691d3c07-ba64-4ea8-98dd-236832a1d993", "value": 3237888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1672004742, "uuid": "a8a2172d-87a2-48c2-80a5-090adb4d92d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1672004742, "uuid": "32a00834-9bf4-45b6-8486-838e9fce65b1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa53d2ed-8449-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671968744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968744, "uuid": "c1f7b449-5674-40d7-b5c8-9f0ddbfdd4d8", "comment": "Malware payload", "value": "9a78f8fe8437502f1e6622f1d211dd95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968744, "uuid": "168cab66-c95d-4762-943b-0bfb3c0aa34b", "comment": "Malware payload", "value": "35f33ea8b38520137f28207d7ae108e1df8b0f5909c25e0121ecf2e425e00628", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968744, "uuid": "dfa41af3-bbed-4258-a4a1-d119337fbd83", "comment": "Malware payload", "value": "d0db55b25aefd32ff2ee20e6acebe09a4c982d2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968744, "uuid": "b54baae9-5257-42af-a5ff-d1820dfd01d8", "comment": "Malware payload", "value": "7ee5f41fa080118bda9d14ba3f12fe4d4c3250cf289c0b53e213d1c5d0cb6c144c21acd2ced0b7803af0ad5cd2a149ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968744, "uuid": "492d91c4-0baf-4b0c-88ae-a66ef526aec2", "value": "T1ED7533E164D1E420EC826B7706D4D687DBF4567828DF10CB2F016709F8ABEC1D4AEB69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968744, "uuid": "1ccf1e56-031f-43df-b261-d593fb1904e5", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968744, "uuid": "488e78bf-66d0-4289-be6a-f61bf762f9d2", "value": "49152:tyUwaWMgL+CERc6hwmPPPwf2MD1/Y73hue1MMUVRJg9:tJWt6i6T4fnYzoeilRW9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671968744, "uuid": "cd2f164d-27e6-432d-a592-d1db448b0bdd", "value": 1605632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671968744, "uuid": "3df6814c-5e95-4f53-883c-97461688bf05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968744, "uuid": "5490f2cd-8d86-4dbf-8d59-73bb4ab86cc6", "value": "9a78f8fe8437502f1e6622f1d211dd95.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3f67ace-84a7-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1672009160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1672009160, "uuid": "a96c4a4f-1620-41a1-b098-5683a794daae", "comment": "Malware payload", "value": "886493d8594ae006d9a2c91ab1ca229b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1672009160, "uuid": "66c6c345-66d7-46b8-90e3-2b730eb68724", "comment": "Malware payload", "value": "36ea57c2dcfc146ef63892033df27bdf8c7385f84fd1a2ce7fa589034ab374a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1672009160, "uuid": "4db24410-5e48-4e41-bc33-7493b7227236", "comment": "Malware payload", "value": "0d43fbe420c657ed3773d54f2acedfde81082eae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1672009160, "uuid": "dbcf9228-a876-4c83-8497-e7e1da0c47b3", "comment": "Malware payload", "value": "5f7fb34ffd8e8e81e883d4bf0bd9b34dd863a9ec25a070ae61638ba14654aa50cf97c17b1e313a831bda27f6390453a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1672009160, "uuid": "313105b7-f65f-47a1-8a9f-19155d388be2", "value": "T1EE34C001B392D4B1D41318314859DBE81B69BC62BE61DD3BF794BB5F2EF0291A4E6323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1672009160, "uuid": "23b54a0b-1ea1-4fdd-9fee-f8b0e5eee739", "value": "6a8f260c43148885d76dffe1ee7a8503", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1672009160, "uuid": "1200ed13-a957-4d9a-80fd-88774f655105", "value": "3072:D+lBL0g55A9HtKEt9gTuAWUSlS1g/tK8vSWDYLrcSb54VIcVTuh:CL0ouNKE7gT7ctK8vVDKbIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1672009160, "uuid": "057838ad-a4a5-4b5e-a632-a43dda556330", "value": 237568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1672009160, "uuid": "8817519f-73e4-4bc5-9b72-4e96266f10a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1672009160, "uuid": "2bece66f-a3bc-4fa8-b63a-ff01246e4c88", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a276fcc-8402-11ed-9db1-42010a9c0080", "comment": "Malware payload (Gafgyt)", "timestamp": 1671938008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671938008, "uuid": "1fb3ca2a-156d-4ed6-af00-373a3b857d80", "comment": "Malware payload (Gafgyt)", "value": "ef27acf737fd237bf76eb0e0ebd0742d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671938008, "uuid": "4c231674-7747-42a8-8f1c-05bd841d0ea8", "comment": "Malware payload (Gafgyt)", "value": "37985e594a8c9069a9b2cdb7eb8b15f412db528f103d4edcf94f2c83f2f9f6b5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671938008, "uuid": "47944122-7a88-4686-b9ae-0b63bc5aa8ac", "comment": "Malware payload (Gafgyt)", "value": "b6fb673ff7127c85895da13d7951849547034156", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671938008, "uuid": "f3e0951f-b997-408c-838d-1b55e2bb2106", "comment": "Malware payload (Gafgyt)", "value": "7707160117b82967d9914a590ea974a4ceff6f7d321cdad9ca0beea4227eaa0868c5996b7e76e9eb21d8b6493c0b2050", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671938008, "uuid": "7c553e04-eab4-4687-a637-51e83e4516d9", "value": "T1ADA309A2F800DFA6F40AEB7604D74B247630FB660F53562673173967AE762D42823F49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671938008, "uuid": "60de6fd3-da3b-499d-af3b-562647ebd109", "value": "3072:NipaIS0Ax3rT0qTRDAFWxy4B4kGDmU9VqFyOfk/X:NVIS1x3rTlTvy4rGDmU9VqFyOfk/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671938008, "uuid": "64d8fcf5-695a-46a9-b993-14d69d250407", "value": 101818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671938008, "uuid": "59f34486-a317-41a9-a4d1-61da5672e055", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671938008, "uuid": "ee96d912-7b9d-44ef-b02b-9a6bc8b941dd", "value": "ef27acf737fd237bf76eb0e0ebd0742d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25df591d-8426-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671953489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671953489, "uuid": "0bd3c26d-6017-4d3c-87eb-2879e03e4780", "comment": "Malware payload (RedLineStealer)", "value": "d726dd397c045857c011d8c6ac542765", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671953489, "uuid": "266ea861-7a10-49a1-b757-8dad92c02c78", "comment": "Malware payload (RedLineStealer)", "value": "37cffe9f08f3ba842447d64c141b2d40b1d8039e3963a41472ac6ef7f72496af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671953489, "uuid": "736f5512-d3b5-4bd4-9f76-4cfd76358006", "comment": "Malware payload (RedLineStealer)", "value": "a186d9426088e0d0ad6f70b8dee9bd6d7573815c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671953489, "uuid": "044ec58f-087b-457f-b8ab-be865ff4991f", "comment": "Malware payload (RedLineStealer)", "value": "7a5874acf963f7aadc1d73432026506f508a9cc055e7a877cd43fa819386a8fae50792c6799391ccbf06570c27d4c908", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671953489, "uuid": "3f1d3afa-8fcf-4c82-8102-262d74a47e16", "value": "T19684F10DBA63D066D44115308924CFE42BBAFCB09B26463F335076AF6E70ED19A263F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671953489, "uuid": "5554d391-1f08-4a63-b739-1b870681156f", "value": "1ea9f0326cf512ac0eb7dd4bc1a00a19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671953489, "uuid": "96cefe4f-2541-46b7-be9e-455cf3365fb7", "value": "6144:QLejsfBhL2l4GPp1wN6fOgItXNp/xdFO+IdRVfTaMArMUX:QijQV2LHwWvItL/2d7WRX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671953489, "uuid": "49fe6bea-7a2b-4c09-b255-267999924ada", "value": 384000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671953489, "uuid": "d0193b9f-1abe-42c7-90ff-92852931a47e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671953489, "uuid": "45067fa1-1749-467f-b2ed-58cedd25bc32", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb954158-8421-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671951673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671951673, "uuid": "df30ca04-60b4-4fdd-8ccc-9f940cd2fbf6", "comment": "Malware payload (RedLineStealer)", "value": "e5f69d64f0db37e8a4e543fe612beaad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671951673, "uuid": "552fbf6e-b7ba-4d23-990d-06f816ea2241", "comment": "Malware payload (RedLineStealer)", "value": "38c9de8413068e6ec3113838f823fe9a12d75dfd26257cd84472b155a8451bb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671951673, "uuid": "43de4b16-b6bd-44df-b99a-16fcfe195136", "comment": "Malware payload (RedLineStealer)", "value": "a38a5e20b43ff6276525ac73166f9f6793f83127", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671951673, "uuid": "99a6a56e-285d-4101-8a05-0d78e7563f67", "comment": "Malware payload (RedLineStealer)", "value": "6908b987caa56b735ce312611171494710e966993885f8041c743a5d32df6e65ca63503941ed1b3eada7474d148d7348", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671951673, "uuid": "232daa52-6f22-444d-9eff-ee904497451f", "value": "T17224CF0CBAA2D072D55219708819DFE4AB6EFC305B615A3F3310BB3F2E70E9095663B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671951673, "uuid": "fae3039d-d909-4ffa-b518-d5e0ea40110b", "value": "1ea9f0326cf512ac0eb7dd4bc1a00a19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671951673, "uuid": "aae3ea97-e9dd-4f9a-aa22-9b8bde8734f3", "value": "3072:UDQiULRA5APln7PWWlNhVdtp29xpRauD0oPORf/ln:AULR/PlzWkNhhslaM0jn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671951673, "uuid": "989b2672-ce4d-4c33-9e8d-773da7175229", "value": 228352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671951673, "uuid": "833a1bf2-1062-476a-9928-a2a0187146ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671951673, "uuid": "19a49b50-aaf7-490f-a26f-2731b3a88bbc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0d2d6cf-845d-11ed-9db1-42010a9c0080", "comment": "Malware payload (CoinMiner)", "timestamp": 1671977345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671977345, "uuid": "fae8f1d6-67a0-4aa8-a55f-be5d8ac8738b", "comment": "Malware payload (CoinMiner)", "value": "98841694c7f864f8575774ed60a8303c", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671977345, "uuid": "97f338ac-9f4d-4247-accf-872cf939000b", "comment": "Malware payload (CoinMiner)", "value": "39680d49f6a36bc5de7ab7af70b7754dee95c842911ea35b68ccd0862b9c7992", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671977345, "uuid": "ecc7b6e1-c646-461b-870e-ab07e7335045", "comment": "Malware payload (CoinMiner)", "value": "b04706872aef9350e1eccf2e0b32f466edc5c2ee", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671977345, "uuid": "160cc6c4-24ee-4234-94a6-5e4b6a26c0ae", "comment": "Malware payload (CoinMiner)", "value": "a00737ff5dbd98d70f54804a8aa1261d23e78b1c2183a7285b88b048c8807941e136a023b64ee233de277c960022bf75", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671977345, "uuid": "481b9c72-5006-454f-aed2-dbfdb6bb520a", "value": "T16425F120EA40DC12D29A523EE5625B31A312CC20D612D227B6543FAF7DF35578FF96A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671977345, "uuid": "2d02ebfd-d2d6-4408-b0ba-3849d4634b83", "value": "12e0f2f8d3267504739e45c17e85551a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671977345, "uuid": "6dc18487-23fe-46f0-83e9-84be2c5dd68c", "value": "24576:oi8r/ovrUz3MkUSZ+Arb7NGM2VYwYEOZucL/fbXDxc/Pyr:It7Nf6YdEAuiDDO/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671977345, "uuid": "24256175-4909-450a-860c-4ffe40d9e654", "value": 968704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671977345, "uuid": "a852bfa7-7759-4071-af0c-3eb475c4e577", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671977345, "uuid": "9d1e16f6-7752-4fc2-af30-624d433f87f4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5d51883-8482-11ed-9db1-42010a9c0080", "comment": "Malware payload (DanaBot)", "timestamp": 1671993352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671993352, "uuid": "9be1dcf8-26c9-4ce7-b006-e2802294c16e", "comment": "Malware payload (DanaBot)", "value": "cae6c0990c846da28bcd10ba57b7eccd", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671993352, "uuid": "2392c19c-8014-4178-9919-684b81db208d", "comment": "Malware payload (DanaBot)", "value": "3ba13d7f994198262e3fb7559afeb0f2d836006443188cdba3b6d5db2164cf2b", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671993352, "uuid": "53faf890-3031-4e98-a705-92515fb8b4fd", "comment": "Malware payload (DanaBot)", "value": "d4b5e9927b672e390a8ae6c100e34a044c1b4f0d", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671993352, "uuid": "44a6a565-1004-4c58-8907-b789a024c54e", "comment": "Malware payload (DanaBot)", "value": "fc5709cd2065dbda045a044f7493ee28ec55b043d5e12850c416c0ffa644b6e83fe784d9de81a8c1f28ea90af0e0fe30", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671993352, "uuid": "84226b6e-dada-495b-8e3c-799537306117", "value": "T1C43523125B45CC26C6C20A764C2FC7F56A3B7AE01F6394F376483BAF3D30AA05E25995", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671993352, "uuid": "b3f20ca1-3637-488d-8349-fbb873ac1e3d", "value": "8514760d95d5a493235b8748f65885e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671993352, "uuid": "b4758051-d2ff-4079-b7d2-ae642c0dbe5f", "value": "24576:SjJ/SupPHex17txWwgjjBjztgTUmVFj6/z3q3K0J:u/Supvex9WnjjBjMxFaWF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671993352, "uuid": "b2958b91-0846-4a02-9bf9-e8836b8d26fb", "value": 1138688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671993352, "uuid": "ebbc9ebd-fd04-4fa0-8f40-3eedc6cca83e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671993352, "uuid": "fae6f999-a8e7-4bc2-9b41-95787088c5a1", "value": "SecuriteInfo.com.Win32.PWSX-gen.53.12760", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0ef16db-8476-11ed-9db1-42010a9c0080", "comment": "Malware payload (Socelars)", "timestamp": 1671988136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671988136, "uuid": "cff9c92a-7b80-4603-8a01-67a8bb64698a", "comment": "Malware payload (Socelars)", "value": "9b4d2558b8a5691f9742539136bc143e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671988136, "uuid": "6da45b38-c542-4a52-8909-cec01ecefffc", "comment": "Malware payload (Socelars)", "value": "3bd59ff711c0fb028a6c245c12eaf719176a1c94100d7b2223bb4bbf7a3da8f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671988136, "uuid": "d9b02a2b-1e40-4705-9d91-49750610c4fe", "comment": "Malware payload (Socelars)", "value": "988bb4bb31b35fad52731e08e3b12cf47f4d9194", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671988136, "uuid": "75342dcb-ac29-4c8a-8951-24c59e92d7ec", "comment": "Malware payload (Socelars)", "value": "cae6b371706e833329f0404521ab934ca784d1dd6f6b756a32d9369325c9129d434e6a5f2956e3c68f617c221cf11ee5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671988136, "uuid": "696860e9-4cc2-41d4-ac3c-08345d210fe4", "value": "T16F658F11F6426136ECE3007282FF9AFE8D28AE21031854D7D3C46D6B6E715E27A37667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671988136, "uuid": "35f18a09-f276-4c6e-a088-03f3e54c8925", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671988136, "uuid": "15d3cdc0-d645-4c7c-9fa0-a85cec4306bd", "value": "24576:pJSLpwfVWRh0SGQ48Lm2194mKa4qrNdW9NTPjahuqBYR:pup62ESMTjTPjaIqSR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671988136, "uuid": "fd45a1e7-d3b8-4a4f-b359-42c38a539e18", "value": 1494016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671988136, "uuid": "a984075f-6385-45da-baf1-b1e389bb6c7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671988136, "uuid": "719d983e-56b8-45ea-96cd-1cbfb3cb1bf3", "value": "9b4d2558b8a5691f9742539136bc143e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1a63211-84a5-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1672008297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1672008297, "uuid": "3d3096e7-8545-4200-9334-f0a1bfaf6226", "comment": "Malware payload", "value": "9db66429ea3e88360a3dd5144dea3cf0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1672008297, "uuid": "1a2b58a3-6270-443e-b64a-155df0ea3c0d", "comment": "Malware payload", "value": "3c089ebea6d1e25c6a4086fd8a7df3fa1fedc33e503e6974de021fff2a02cfc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1672008297, "uuid": "ce9cf590-9f8b-453c-b51d-b67910397025", "comment": "Malware payload", "value": "da03d79173e3b682be45b45c471cdb76adf633a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1672008297, "uuid": "cf6c394c-76d0-4780-92ab-8324808cb600", "comment": "Malware payload", "value": "24c6b900051c8ec61332bc8e905fb6f8d66fa23e9387d0d7e1b171d6c27d230605a5104300255db5d5bcfe44749327bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1672008297, "uuid": "6c36f8d1-a452-4960-b793-c432e505df4e", "value": "T1398533F5B2B98E37E01E81B4DF00E855B270BB815B2DDB1C94D8A5CFAE3951A8343791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1672008297, "uuid": "a8d265ae-9921-445e-8a3a-f3c4e6d3facb", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1672008297, "uuid": "2180bb4d-d62a-48c2-b298-d534b05c8c0c", "value": "49152:SiSliDdHHknvkC6bWqe5tvrFdmQffSZa7:SicOnrC6b+XrFd1SM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1672008297, "uuid": "5e0ba576-9d4a-4d01-a089-0c721b3b2acf", "value": 1844933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1672008297, "uuid": "9857f789-7196-4ad3-be21-b712a8f21d97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1672008297, "uuid": "fcd02923-5e4c-4064-89a7-815f33f66350", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aadc20d-842f-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671957309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671957309, "uuid": "42163d4c-65ea-42a1-9ae9-a558ded59ab9", "comment": "Malware payload (RedLineStealer)", "value": "dca51e89de423f30411f9895dce7f1ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671957309, "uuid": "ddf9a2d6-0833-491a-b66c-a4cc625272f2", "comment": "Malware payload (RedLineStealer)", "value": "3ca4879853a8f13a89473cb07e7ae77ab830abbf0ea5e09b3f525c5810b153b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671957309, "uuid": "dd40658a-da3c-4204-ab64-e741b727e902", "comment": "Malware payload (RedLineStealer)", "value": "fb542585959bedf3040c1ecaf59cd5e72eed7346", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671957309, "uuid": "3b31e68e-e476-4be4-900a-dc778fb4c72f", "comment": "Malware payload (RedLineStealer)", "value": "7ceece7238a76071427a5a072f4ac74b8362de21aaa4eceffc34b8245a2ced0df988dd69270b26a804f26b5191703102", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671957309, "uuid": "bf145a0f-b953-49a5-b9b1-7820903b40f7", "value": "T1ED94BF0CE091FC21FFE2D0310BA575648A3BAB501677E6DF56B43BDA4A30A81652376F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671957309, "uuid": "c3194033-f7b5-450b-b7c7-d1638e9b54b3", "value": "7e7c1082b38a4734d89e1f235c71c850", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671957309, "uuid": "543a3ecb-b53e-48cb-8352-d6876e50c9a9", "value": "6144:gygxer6dluLigEBBY2o1FhZRVPjGAOHJaopm1sshCv8DwcM6FoGP7:gygxer6dluLigEZoNZaza2shK8XzP7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671957309, "uuid": "46efc62c-5017-45bf-ad90-71f11f582cd5", "value": 408064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671957309, "uuid": "fc746796-b874-4a55-bd67-831815b4c93b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671957309, "uuid": "efa88f07-f4a3-4173-9c6f-dd0ba6446a7c", "value": "dca51e89de423f30411f9895dce7f1ef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed1f39cf-8441-11ed-9db1-42010a9c0080", "comment": "Malware payload (Pony)", "timestamp": 1671965420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671965420, "uuid": "4b1f3822-9df2-4bcf-9d27-96f4320ef8e0", "comment": "Malware payload (Pony)", "value": "b9892e124eff9da766ab21266c5d6b72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671965420, "uuid": "448b023e-cefa-4156-90d7-9e812a837105", "comment": "Malware payload (Pony)", "value": "3cb0c07ba97461549847dce3b31dba40a7c2336da15a3c3be6c794e78e335d75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671965420, "uuid": "fa9f36c7-5cdf-4c4d-b320-464f511ee54c", "comment": "Malware payload (Pony)", "value": "39b24e2a992803ca134724993639c569e1367d7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671965420, "uuid": "e8fe9714-982e-41a9-ab20-aa444bb5a834", "comment": "Malware payload (Pony)", "value": "21c0326bf7256f5ea66a220dd139c9e130299e963e2d2ed0ad4499a6d3805c6a5ac282c8d055a20d16c9cedea863e13e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671965420, "uuid": "5d8c983f-8afc-459b-98a8-1952918d5f3e", "value": "T186C4AF23F2F05C33D163167C8D5B577DA836BD003928B98A2BF51C4C6F3969139AA297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671965420, "uuid": "9e31a023-f15d-49c2-887f-8921860e9f31", "value": "9ea51ee6af9b33a960c95ee01935c5ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671965420, "uuid": "3511470f-35f8-4361-b34c-cdf342de4116", "value": "12288:JCsdkSYDsmEv9hdQF1ofM1KIxmTfwjlKJ4Ei:ow97mQpKrxhlv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671965420, "uuid": "e31edfac-2bdc-49d9-a2c1-12dced17921b", "value": 591360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671965420, "uuid": "5b8ed030-dcaf-4286-884b-5e7befb80d59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671965420, "uuid": "da84f0c4-f911-4732-8226-85a4ac58f48b", "value": "3CB0C07BA97461549847DCE3B31DBA40A7C2336DA15A3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4da16190-8476-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671987916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671987916, "uuid": "68a04e58-e9be-45cf-bf95-96b4bcbf7a1c", "comment": "Malware payload (RedLineStealer)", "value": "639137eab94bb57bc50083b813a854b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671987916, "uuid": "89a21aef-d65b-48a8-8a99-bff54eb455bf", "comment": "Malware payload (RedLineStealer)", "value": "3dfe0aecf59020bfe0e4d0e14571fb6c586096ce66a5dd9722f699b2858efd6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671987916, "uuid": "324213c2-8834-471a-88ef-7c4837adece3", "comment": "Malware payload (RedLineStealer)", "value": "98e812807bc70cf97e98d3554569a1788f39bd0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671987916, "uuid": "e8d21450-b363-4317-af0b-cb544a4ca791", "comment": "Malware payload (RedLineStealer)", "value": "0b57a5d69f75e539512f2c05f456cca4e60bfff4f44a50532ae092640bee68b7d6ac2be895a4ef5a144a3a01fe45ffd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671987916, "uuid": "8114150e-2099-4bbd-8699-d0a9e7feedf9", "value": "T13DF43DE5E600775E908BB32B950F13F2F0A62FF5EAA46C1D4A151B9490B4D881F376B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671987916, "uuid": "4c600aa5-2de4-428f-954c-8e1b4fd3a224", "value": "25888117fb244bf976329dbc900d2b8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671987916, "uuid": "ae7c9a2a-1935-4197-a74f-34616aaf54bd", "value": "24576:GHT9L3pP7Vz/BXBJhoIo76sg0YWa0O+PubRpTmIYOzsS:GHT9L3pP7Vz/BXBJhoP6sg/0O+eRpTb4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671987916, "uuid": "0da9e536-c5ec-4b27-a2c1-8dd5fead52d4", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671987916, "uuid": "890fdf42-b999-432e-935d-b49c5ae40c56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671987916, "uuid": "63c29ae3-5b3d-40df-9654-0ea45c1eb446", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bca8b64-8475-11ed-9db1-42010a9c0080", "comment": "Malware payload (RecordBreaker)", "timestamp": 1671987617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671987617, "uuid": "5bcbba88-5132-4d33-aff1-5e22e695beb1", "comment": "Malware payload (RecordBreaker)", "value": "09c9e1d234faa47deda6bac7aebce429", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671987617, "uuid": "1b4ed1c6-4bf6-4983-b61a-01b81608bc2c", "comment": "Malware payload (RecordBreaker)", "value": "3e1fbbd273800929e5d4a0d80655a43b262da68eb415141c346b7feb97dc6316", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671987617, "uuid": "3753c83c-0ce1-44ff-a6b1-a48d13428a5d", "comment": "Malware payload (RecordBreaker)", "value": "023729674d6be084944052991e4a6655c8e18976", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671987617, "uuid": "9af9e204-4e36-4e3d-b12b-0c07c2fe5f3f", "comment": "Malware payload (RecordBreaker)", "value": "f96bda1e8147e880f2876a9e67f838189b763b05267e48823f65dd2f27fc8fa1f6cb62bb4617018c819d4ae77ec689fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671987617, "uuid": "e7e2169d-875c-438f-b84e-b25f50e41ecc", "value": "T1AA34BE117690DCA6C7D24971892BD7E82F3BBC915EA74AF336046B1F3D702B09926387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671987617, "uuid": "16b40f9f-3e77-4b81-a9d7-10a3dbaca636", "value": "8514760d95d5a493235b8748f65885e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671987617, "uuid": "f94ab72f-7483-446c-96db-14e303a5d2b3", "value": "3072:mwVyL5LH6V2a5aRX3pKg1k4ad5rGmqtJ/zOjS2FHYTw7RkxmJZs:mBLS2fEgIdmJ/zOpRmGymI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671987617, "uuid": "9cba452f-48dc-470e-ba42-721acef1d019", "value": 237568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671987617, "uuid": "3d556e0b-4d49-49dd-bf44-6f77f3166bf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671987617, "uuid": "1a17f302-a4b8-4c7a-9c06-c317b0687713", "value": "09c9e1d234faa47deda6bac7aebce429.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a94599d-846e-11ed-9db1-42010a9c0080", "comment": "Malware payload (DarkComet)", "timestamp": 1671984609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671984609, "uuid": "5f236f12-a37a-4551-a107-82984d69ca50", "comment": "Malware payload (DarkComet)", "value": "3c41b88825ed5288001a0840f638bb15", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake", "colour": "#36337B", "exportable": true, "hide_tag": false }, { "name": "joke", "colour": "#72FE7A", "exportable": true, "hide_tag": false }, { "name": "prank", "colour": "#F05A87", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "troll", "colour": "#A0E7E0", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671984609, "uuid": "7c68c332-92c8-42d1-a868-2e162baba432", "comment": "Malware payload (DarkComet)", "value": "3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake", "colour": "#36337B", "exportable": true, "hide_tag": false }, { "name": "joke", "colour": "#72FE7A", "exportable": true, "hide_tag": false }, { "name": "prank", "colour": "#F05A87", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "troll", "colour": "#A0E7E0", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671984609, "uuid": "5c506712-128f-4d20-8e32-4591fcb3ba04", "comment": "Malware payload (DarkComet)", "value": "f12e5059fa029c6eea893ab2e6745922d0d89570", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake", "colour": "#36337B", "exportable": true, "hide_tag": false }, { "name": "joke", "colour": "#72FE7A", "exportable": true, "hide_tag": false }, { "name": "prank", "colour": "#F05A87", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "troll", "colour": "#A0E7E0", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671984609, "uuid": "268fa688-6711-47c2-b937-41b3f6bcf9bf", "comment": "Malware payload (DarkComet)", "value": "1c0e0d5e864327e1b37de869c8158590d94a12d5304dc84e87b279c3e198d374ba6b5a6a8fc64ec0e0f58da345e3aec0", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake", "colour": "#36337B", "exportable": true, "hide_tag": false }, { "name": "joke", "colour": "#72FE7A", "exportable": true, "hide_tag": false }, { "name": "prank", "colour": "#F05A87", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "troll", "colour": "#A0E7E0", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671984609, "uuid": "dd7580f7-694c-4288-bd57-40fac82c5ad1", "value": "T107E48E31F1808837D97219789C5F92E6982A7E202E39754B3AE62F4C5F3D6C239193D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671984609, "uuid": "c989a1ad-385e-4d83-a49f-81b38b2d4da6", "value": "e5b4359a3773764a372173074ae9b6bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671984609, "uuid": "7a65109e-7ab3-4704-ac2e-5051a37c18fa", "value": "12288:+9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/h5:KZ1xuVVjfFoynPaVBUR8f+kN10EBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671984609, "uuid": "9d83511d-111c-4b41-8a9e-0f5d205e9056", "value": 674304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671984609, "uuid": "e3307d32-8a9f-4a70-bf99-b45991555d56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671984609, "uuid": "3f052285-e350-4353-beb6-a3225ec56fa7", "value": "Sahte Vir\u00fcs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cf67eb8-8451-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671972023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671972023, "uuid": "9c3d7054-660a-489a-92f5-aec8c57186fb", "comment": "Malware payload", "value": "35d5eea62b91e7c3f180774360ceba8f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671972023, "uuid": "816500b8-0631-4dfd-8dac-970c3e6483aa", "comment": "Malware payload", "value": "3f63a50f468fe3edea949b795d7ab6cd13c2cce8e73998556072fbeb97341bb1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671972023, "uuid": "805433eb-65d2-440c-b07c-be2b5e717776", "comment": "Malware payload", "value": "d7d1d65e563a366b8f6dafb536e79b29a4a42895", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671972023, "uuid": "a62b0577-0389-46fd-8db9-f34ec7ce011f", "comment": "Malware payload", "value": "847bb5e90d0c78aebfc1a7f5c5dae93fc18564751438e1bee93f19028106f263ae79054b7e3963adea1931da20ef0e11", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671972023, "uuid": "d03d762f-f5d6-4393-8498-be43b53ef7c7", "value": "T113A52302B5C68471DB7215382AF3DB709D3C7C319BB689E753982B1D6E301D19B3AB92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671972023, "uuid": "d0fc2bee-6878-4fee-ac2c-8133f413137f", "value": "ab9ff6e4872ea2766a5f5c6af5649e9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671972023, "uuid": "e16fb019-e612-48c7-8c5f-f156ecb5e65c", "value": "49152:VJ4oLRx9L5M+t3paGzqh6FHh6zs16fjw+sTpiWH4JMdXrDIN:VJ4ORxJ5M+R0GzqhqMzssrw+Upj4JMc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671972023, "uuid": "31d52db7-72c8-4461-80cb-53516a191617", "value": 2108209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671972023, "uuid": "047b7202-9278-4481-ab3d-392b8c488076", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671972023, "uuid": "bcf83536-467d-4cb5-882d-b4ebce48fcdd", "value": "35d5eea62b91e7c3f180774360ceba8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d5cb9dd-83fc-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671935490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671935490, "uuid": "fa580979-2f31-4c2f-ab4a-c9b8b90aa0e9", "comment": "Malware payload (RedLineStealer)", "value": "92fc600765f72e118685195da330b14b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671935490, "uuid": "56b9d347-6cf4-4b17-a880-a1e5176d7769", "comment": "Malware payload (RedLineStealer)", "value": "3fc75dc7e4305ec6ee965360363af823cc5545e8bf7afea44d430a5dc70dfc07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671935490, "uuid": "c9f1bec3-ca2c-46b0-ba5f-52e13ce5ec59", "comment": "Malware payload (RedLineStealer)", "value": "80fcb373a9643d43d81e4a20a542cd8f4f318401", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671935490, "uuid": "edf56717-5372-4daa-80b3-8fe013a8c87c", "comment": "Malware payload (RedLineStealer)", "value": "28226a36dc2338b5ed05ad8006efb58d6dbfec138adbfe36b449acb805625829e03a991e11fbfecd1828467afd94b1bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671935490, "uuid": "9a698fc6-6cd4-4ca2-9835-3736f628fc90", "value": "T1CA84F11CFE93D022C44042388D19DFE46A7AFC314B625A6F37547B5F6E74E80963A3A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671935490, "uuid": "b7cc14e6-a462-4c44-a310-8b28faa5c970", "value": "1ea9f0326cf512ac0eb7dd4bc1a00a19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671935490, "uuid": "e4e5c447-59f8-4fda-a267-e4b1c64cf9ca", "value": "6144:XL4NBbIXwSX08u8gijenSPeHuvRaxaj+Xf+xCoXlt2kaQv5aMZkrBJ:XMNmAuN+OYxaj+XfDEzI7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671935490, "uuid": "992cc53e-d0ee-4dab-b89a-67e60188b575", "value": 383488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671935490, "uuid": "851dbbb3-4cff-4d6e-a975-4ed5ff0eb3d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671935490, "uuid": "5d86d304-013e-4653-a73e-95327c076eda", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e60be764-843e-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671964120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671964120, "uuid": "b707ca37-fbd6-40bc-808f-5376741fa1e3", "comment": "Malware payload (Smoke Loader)", "value": "944572972e4e6d3ec4f03e65065e6147", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671964120, "uuid": "8f5d12b0-d11f-4621-b336-1dc9c7b192e2", "comment": "Malware payload (Smoke Loader)", "value": "407d851f019dc788b1b92ddc2e59fa93b068a7c9319dd5ebb7a41a9e0c4d01d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671964120, "uuid": "2ebee759-e21b-4b21-9d9c-93cef188bb7a", "comment": "Malware payload (Smoke Loader)", "value": "ecde243ca5a04b9f712c2bc1c0cf7e1ae4cfdaf0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671964120, "uuid": "1eb7134e-5c7a-4629-aab3-4c57877a2c94", "comment": "Malware payload (Smoke Loader)", "value": "fc62923138977d95782fd58875f40cd24a3b3e3a52e11095d1071bae4ebd7d7ac6d1ef420a54ce5e5d6190cefc89cca6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671964120, "uuid": "3ce4f26f-5718-4a8c-b4e6-3bedb8ea7556", "value": "T1D524BF107A91DC72C7D249705D2BD7E81B3BBCA19A179AF336443A1F3E312B198A6347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671964120, "uuid": "e8da9a3c-9506-4b84-96b0-124e125348f5", "value": "7b9daca6da068f54ad4e1900288e8efd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671964120, "uuid": "d5ebdeb5-74c8-4c53-b1aa-2df5f429f1a2", "value": "3072:/RqLBBhRzc1rV5Tegd+IKbKhzFWScKEYKWWtJ/57pcw7RkxmJZs:4LpRzGrNdpCKzWScKEJJ/JyGymI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671964120, "uuid": "710516c3-b8eb-4152-a405-8f9143a21a52", "value": 227328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671964120, "uuid": "3e61e2d9-0743-469e-8520-f5452f191766", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671964120, "uuid": "b41a0526-7727-4fcd-9e50-89644dbe5f6c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ce60116-83f4-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671932187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671932187, "uuid": "bfe3bced-b1e3-48d4-9c15-70a8ad53f5ba", "comment": "Malware payload (RedLineStealer)", "value": "300bbb0fc654ceee4f3a0af50a51bf39", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671932187, "uuid": "e59d2a4f-cd29-4846-9ef6-d7dd474a4c60", "comment": "Malware payload (RedLineStealer)", "value": "41f7de00c520011be602acf6cee0b2d6342729621336ca9c2f5da205ee3af85c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671932187, "uuid": "62253c17-8a0a-4631-8ede-ccf218b745b2", "comment": "Malware payload (RedLineStealer)", "value": "8bbfb00a35b4ca7a0e85384565cc0022930ddaa4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671932187, "uuid": "00d76bce-e150-4194-b832-7c39841d696b", "comment": "Malware payload (RedLineStealer)", "value": "355607ec7a85d8f0acd9f2f6e960df72ce07950de11dae0f14c18813fccc8ebd964e80e0bc9c8faf9e7b825d265f8057", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671932187, "uuid": "9fa480cb-b9c5-4450-a55b-c70c045e749a", "value": "T15874F10CFAA3C465C5A5BA304915DFE46A6AFC705FA1563F37403F2F2E30ED1952A2A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671932187, "uuid": "0f7ed118-3753-4e68-80a7-e4ea9d8a871c", "value": "1ea9f0326cf512ac0eb7dd4bc1a00a19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671932187, "uuid": "d8b521c7-b97e-4f80-9cb9-96fc7f5124b4", "value": "6144:xLkyxB069LcRolbuuJkGfJKVAvaA2QmaMeO5:xIyxn9Q6u+kOPvb9fO5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671932187, "uuid": "0021c3b5-32e3-471e-aeaf-e9938dc5573e", "value": 350720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671932187, "uuid": "7b083384-d5ba-4371-9d64-1f4b968da5a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671932187, "uuid": "afdb51d0-beaf-4227-a22f-3a128bfd538f", "value": "300bbb0fc654ceee4f3a0af50a51bf39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b897671-844c-11ed-9db1-42010a9c0080", "comment": "Malware payload (TitanStealer)", "timestamp": 1671969793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671969793, "uuid": "1d3bc49a-4ba9-4cae-a27c-2362d2909016", "comment": "Malware payload (TitanStealer)", "value": "7f46e8449ca0e20bfd2b288ee6f4e0d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TitanStealer", "colour": "#EC6200", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671969793, "uuid": "16a86f1d-0726-47c1-ac22-cf1660f8809a", "comment": "Malware payload (TitanStealer)", "value": "421dbec55ce3481c5cecb630b4d216bacd07ce35a912abe57af81a3641414e83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TitanStealer", "colour": "#EC6200", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671969793, "uuid": "d3eedd54-f2fa-4e4d-b995-646fb946f7f0", "comment": "Malware payload (TitanStealer)", "value": "9620f97ab57a8c274f661a70c96f546e6fd30f82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TitanStealer", "colour": "#EC6200", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671969793, "uuid": "6ec69d72-8ac0-477e-9556-6d2be97ba27d", "comment": "Malware payload (TitanStealer)", "value": "557e3eb55e9c2c10de035c77c1c488b39658a2c21493543bab0696e881864dc046e8880d0dcd1e7090e02733f3a6b658", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TitanStealer", "colour": "#EC6200", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671969793, "uuid": "2dabf3bb-849b-4808-8563-0e893045a360", "value": "T1EF951890FDAB14F1E6071531589653AF23302E0A5F3ACACBC6407F69FC77AE60932566", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671969793, "uuid": "7f6846c1-6306-4314-b2eb-b91651a12671", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671969793, "uuid": "f060675a-b79b-4fe0-a8db-dbccfc13d8ca", "value": "24576:sP4QgeJDvLz3ASdxuDHxueKjZiEUi7zDbqaJwZWIJuHTn2nfOKCr3+kpedWcEYqL:reRAMXZzCAIu2dCyddaYq1N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671969793, "uuid": "42080705-02b7-4da5-96d8-2efb3071727c", "value": 1926656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671969793, "uuid": "c1d1e1b9-8230-4bc7-893c-56d5777c5bbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671969793, "uuid": "92c9aa80-0d11-420c-9c52-0f8c109da436", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b321aa9-845b-11ed-9db1-42010a9c0080", "comment": "Malware payload (TitanStealer)", "timestamp": 1671976369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671976369, "uuid": "18f70d45-e9e1-43ce-9a0a-ea14dbdcfc4e", "comment": "Malware payload (TitanStealer)", "value": "a98e68c19c2bafe9e77d1c00f9aa7e2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TitanStealer", "colour": "#EC6200", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671976369, "uuid": "020c2ea0-671d-47eb-8923-e2a123ccc97d", "comment": "Malware payload (TitanStealer)", "value": "4264a0c8d7acc6f10539285aa557a2d9d0298285b0a75a51a283241ccf11c94f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TitanStealer", "colour": "#EC6200", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671976369, "uuid": "3ad22564-70b8-41eb-8dce-64f1a133808e", "comment": "Malware payload (TitanStealer)", "value": "90097f106675b3ee460a9d32f94d15cb6f8daefe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TitanStealer", "colour": "#EC6200", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671976369, "uuid": "5e618957-5a02-4058-90f9-059d4636ef00", "comment": "Malware payload (TitanStealer)", "value": "eab570599062663233a6b17f6598706eceea59abda678c1251bcfa1a19cfb686844f6718899d10c1e2ff3365f61f9c9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TitanStealer", "colour": "#EC6200", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671976369, "uuid": "b1943c9a-7900-41dd-9796-e522b7de0cf3", "value": "T1B3852890F8AB04F1E503553108ABA3BF63345E0A5F36DEC7D9507B69E873EE1093652A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671976369, "uuid": "945d042e-c355-45b2-a52d-c65aa9f912fd", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671976369, "uuid": "8333b015-f670-4c63-81cf-bfd9744d0915", "value": "24576:10En/0+nnwiI4UHCXLHwY4vrK4DrjOvK1MOYhMYzSXPl1oqCrT6CzSOdfj8QYq1z:t/fXjwYLOcwM8F7oqC5SeAQYq18I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671976369, "uuid": "79ab2693-3c75-451c-84df-1914a21fc92f", "value": 1862144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671976369, "uuid": "7b05e4c0-7bdb-4032-b00f-a9938fd40dba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671976369, "uuid": "280a8347-7679-4c6b-9855-b8fc5d3e7139", "value": "a98e68c19c2bafe9e77d1c00f9aa7e2c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a97efb1e-848c-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671997519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671997519, "uuid": "c5672894-0a11-4390-b83a-e7ccc415c1e2", "comment": "Malware payload (RedLineStealer)", "value": "62f903f3feac3032ba38d5239703b22f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671997519, "uuid": "349a3792-f7f6-4d06-a5c9-f32d748cecee", "comment": "Malware payload (RedLineStealer)", "value": "437328bfd95f3c0c26073b271ee1940210ec399cd3add500f7e65a3d64158c58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671997519, "uuid": "ceaf4443-11ae-49d4-a21b-2fd7474da304", "comment": "Malware payload (RedLineStealer)", "value": "0180d5334d4b6fdce351c192035cc1e434c8a9e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671997519, "uuid": "fb0b2897-5f0a-47c8-acbb-362562098664", "comment": "Malware payload (RedLineStealer)", "value": "2cf9796e92a1418f5abb923c19145259c0a1b5bd26ee40f76a11a111f363104aa2a27427f3b5e64269cb3ea922cd23c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671997519, "uuid": "15169415-65bb-4d23-8c3b-ad73766eaca2", "value": "T1FF54D001B7E1A831E0626E305475EBA007FBBC729970C10AE7586B2F2E773D06675797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671997519, "uuid": "60e9c7f6-0701-4d47-aeb6-b4eca1ad6c11", "value": "52f3cbaa89ec222f54fb6ad33fd12ebf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671997519, "uuid": "90f2fee7-07c8-48ec-a77c-8238c7b7e2d5", "value": "6144:ieFFvVEGtxSR3asd8BONy03Jef6PQBligaTwVf:ieFlVEGtxA3P5NyIofxBo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671997519, "uuid": "96e93ced-ddf7-47fc-9349-439d53328506", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671997519, "uuid": "cc732f4d-d7c0-42e0-885e-cc3f873dedbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671997519, "uuid": "31cee968-6629-40d7-b737-9dab13c40d00", "value": "437328BFD95F3C0C26073B271EE1940210EC399CD3ADD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7a67dcf-8449-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671968739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968739, "uuid": "665ed64a-8d78-4903-9c20-bd3bc2ae1cd3", "comment": "Malware payload", "value": "6df39de57e1a6bb0f3b1ca4b62ce7368", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968739, "uuid": "2b930943-1580-4f1f-9a5b-0ea122331e6b", "comment": "Malware payload", "value": "447ecfab4fe85b150463ef96240ae2690eae0534684af88a61b3e9fee459cd9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968739, "uuid": "d69fd9db-619c-4b03-add3-f8dc223dbd7c", "comment": "Malware payload", "value": "045bf7e501ecb9a91a4574911d81621cd9053004", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968739, "uuid": "9c7a6f3f-fb65-4ed6-bf7b-9ce8dd995c1b", "comment": "Malware payload", "value": "b01acaffd2db3e68e2d24d13ef4bc15c612915faf980123732107e5ba5e299aed0d58f60d4331593d8badeec8dc4a5b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968739, "uuid": "d3fe20ef-73ca-437a-8baa-f736c44a2c54", "value": "T1BDC533A25E108ABFC43E13FC4E064E16A345B5829C6297B3C97941BFDB617370EDE4A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968739, "uuid": "446a28be-8613-4b8f-ab05-d8f1f05bff88", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968739, "uuid": "d80d1d2e-0483-4c34-b913-e0ad7e492d53", "value": "49152:wPnkNOQPj5GPWxRPyRUPGplovMKC0oZltx+pytOQ5YUN24YqfDOh0J6FOQv:wPkbPj0P4PLPGpEMKZoXx4aVfCz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671968739, "uuid": "b00f21ca-0b03-4af2-9532-74833a008c27", "value": 2537984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671968739, "uuid": "a12fc954-56e6-4d4d-928c-debb11696d59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968739, "uuid": "933fcba5-2ae4-40d8-9bf2-321a65d5519d", "value": "6df39de57e1a6bb0f3b1ca4b62ce7368.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05667338-843f-11ed-9db1-42010a9c0080", "comment": "Malware payload (CoinMiner)", "timestamp": 1671964172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671964172, "uuid": "a8eeb677-1f71-4020-b0ef-3b488e083c8a", "comment": "Malware payload (CoinMiner)", "value": "9b69d7cee48e241bcb93b01ce600ea8e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671964172, "uuid": "f837dc36-8b7b-4501-b6fe-74d230842e6d", "comment": "Malware payload (CoinMiner)", "value": "4526edce99a91c9414d24578035afe430a94acbbad16ac7f97a4d292dd60bbce", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671964172, "uuid": "a53f7170-2454-4742-9d9b-ff712a584f6e", "comment": "Malware payload (CoinMiner)", "value": "e59cd3cee644283ae7c946159d3dbb68e0e556b3", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671964172, "uuid": "7409c51c-e446-4d00-b216-c406b58c835f", "comment": "Malware payload (CoinMiner)", "value": "c073e10e1ee206bea4dd3498b42648be2ec546c19074c7a636214d9396351a2c35262c12f288de1703eebdd95cfd9d37", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671964172, "uuid": "af80d049-548d-4f25-87d4-513d023bc866", "value": "T11015F120E740CC22D2AA063ED5639731A3278C11E7028227B2557D7F7DB345B9FBA676", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671964172, "uuid": "300a4d86-275a-4514-b4b0-d46f9551350c", "value": "4efd173933be1362505513a69b127894", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671964172, "uuid": "2e3a85da-f0ee-4179-908c-7900ec99161f", "value": "24576:Ji8r/wvrUz3MkUSZ+AbLARF+x8tAIHCzsoWlGHBmjkySJs:x2RgxDzsXqBmjk1K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671964172, "uuid": "1d0abfa2-65a2-49bd-9749-04e0ead5d64e", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671964172, "uuid": "b1a580ce-6bc0-402d-abf1-ae2b5cbafb33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671964172, "uuid": "5b1dd80d-e35b-4704-8bcc-ea00b9bd9e28", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "477e562f-842a-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671955264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671955264, "uuid": "f6b6e26e-8209-4555-9f7d-8ee2bd566107", "comment": "Malware payload (RedLineStealer)", "value": "ddcc2532199b0557523b1ada18e1e930", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671955264, "uuid": "fce3ecac-7edc-47b7-8ae6-e2a20a814d6b", "comment": "Malware payload (RedLineStealer)", "value": "46561b2c5f26c15cf233c48f41686a672634c93e6913c8c4de2666e9f4611c57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671955264, "uuid": "be2b6db2-3a1a-485c-9f6c-30044ea14ce0", "comment": "Malware payload (RedLineStealer)", "value": "34c1772712583a361e0d7763ba779ee59abb7a08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671955264, "uuid": "c23639fc-ddff-4b9a-9c2f-3f08d658a26b", "comment": "Malware payload (RedLineStealer)", "value": "af8ff9c1ce40e6a8a4863c23bbe685e110efa2268b6006524d49f44a3804803171db836942b45467baaa191ae606369a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671955264, "uuid": "4a7bf6da-5ea6-4c2d-9185-f87c4cf9d16e", "value": "T1C684F10CBA53D022C198A530CD25CFE1AB79FC715B25563F37347A6F2E30EA096293A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671955264, "uuid": "d6455a67-615e-4142-aaca-132c8308b3a3", "value": "1ea9f0326cf512ac0eb7dd4bc1a00a19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671955264, "uuid": "25ab390c-218f-481e-b2ba-fe4537f2f96f", "value": "6144:BGLS+6KoH3GiyhAAhArJ9kePGZSaEmCyXkekcXYGaMN+:Y+lWiyhAA6V2ZSan9UXM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671955264, "uuid": "78c6ffcc-54e9-411f-8f0f-9592f3a7416d", "value": 383488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671955264, "uuid": "6cf57549-53de-4e5f-bca9-0dfb673e16fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671955264, "uuid": "7c0bf827-f1ca-4a19-9c3a-8fb8c55f8f8d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ca66c3-847a-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671989761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671989761, "uuid": "6872c0d7-4f4d-4e01-92f2-f43525fc9708", "comment": "Malware payload (RedLineStealer)", "value": "d93ad0af4b5b333a08731db023dbf267", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671989761, "uuid": "0be4661e-ffcc-46fe-a3c5-fb1cf2127eb8", "comment": "Malware payload (RedLineStealer)", "value": "46e8f1e77e132152528af8fea7bc9fe5d08df40b4222d6e91f61cfc0866e73e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671989761, "uuid": "072e5275-0c00-4b3f-946b-6a448b955ba2", "comment": "Malware payload (RedLineStealer)", "value": "14624f9fb6b5c21caea327054c2b7acdd381e93c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671989761, "uuid": "f968c88a-b6cf-4661-9980-f922f2b25b8c", "comment": "Malware payload (RedLineStealer)", "value": "4accb68fd47268323407bdbe2c675496869ede9b21fa7c312074edc7c6cfb32dcc8861ff7e017a0ea19dae9f46abb839", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671989761, "uuid": "ab471312-4486-47d0-a66a-95321171cade", "value": "T17C74F1116790DCA2C2C29971892BEBA96B7FBC514E6756F33304BB5F3D302F0A916253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671989761, "uuid": "fc02a137-2fbb-472d-a37c-5b784c17b5f2", "value": "8514760d95d5a493235b8748f65885e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671989761, "uuid": "c12e14d7-68b7-42db-a0f3-4cd91d25cd21", "value": "6144:zSL6G/b/QnxjZ9YFFjXZvJ6ymprF7r8QWsJ/nwibGymI:2GG/b4nxjZqrjxJRiWsVnF5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671989761, "uuid": "6157ce52-266f-4ea2-a7aa-961f0c0c17f3", "value": 359936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671989761, "uuid": "b8ea1a5a-49a4-4f8e-be31-c144a85987da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671989761, "uuid": "109325c1-6f81-4ecd-a082-affd1f42b5ec", "value": "SecuriteInfo.com.Win32.BotX-gen.22354.5131", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7e68a30-8408-11ed-9db1-42010a9c0080", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1671940957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671940957, "uuid": "17135420-6e1b-4170-bb0c-ace522704877", "comment": "Malware payload (ArkeiStealer)", "value": "6dd6384670baa5423c76f1bbde4235c9", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671940957, "uuid": "c95d3f5d-45ff-4b55-8b41-61feb1b10fe4", "comment": "Malware payload (ArkeiStealer)", "value": "47fa1995f7304b609671b3b49c5bc77255b1218a910be8542f0e397b0a9c2dc0", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671940957, "uuid": "e075bee6-93da-42b6-b305-64a80ab72b47", "comment": "Malware payload (ArkeiStealer)", "value": "3ca565f27bc7a6d87eab5c5e1df038944789401f", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671940957, "uuid": "a6f6db1e-b900-4e3e-9e57-05ff73355be4", "comment": "Malware payload (ArkeiStealer)", "value": "1e806ab5c4388c5ac9c8c49e1ad5c81800e7018d9e5d824b097f2f5b253f87f4a3dc881633a66c56b470fbd1955afba2", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671940957, "uuid": "737a085e-ec21-4282-a4a5-69750f6cbc92", "value": "T1A524BF0CBE92C066D59205349919CFE467EEFC704F615A2F33547B5F2E70ED0862A3A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671940957, "uuid": "9c1bdfbf-a6f1-4497-b5e7-b903d5e14510", "value": "1ea9f0326cf512ac0eb7dd4bc1a00a19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671940957, "uuid": "bc6475e7-046c-4ede-ad28-965efa10014e", "value": "3072:9UDoZu5LD2D5PV7EEjpQJnhuTutFZRtyeauD6Twp/Hf/ln:Ru5LD2vzpQhhPpRlaMH1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671940957, "uuid": "a12d4c6f-fc67-4f59-9d75-4aeab4ca28a8", "value": 229376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671940957, "uuid": "f328134b-f66f-48ac-a502-2234c284c8ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671940957, "uuid": "fb0a54f3-2042-477b-a439-748042b38b29", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea8d9f67-8436-11ed-9db1-42010a9c0080", "comment": "Malware payload (Amadey)", "timestamp": 1671960691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671960691, "uuid": "f5b1c3ae-645e-4efa-942f-db8545022c14", "comment": "Malware payload (Amadey)", "value": "0832c102331af5307c561a5dba7380a5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671960691, "uuid": "b900977a-dfa4-4664-9221-2b022d0bb693", "comment": "Malware payload (Amadey)", "value": "486624a5f6154e96cf6ffdf8e52101e07527bd6488ccbc2f5af860e1d080ce3d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671960691, "uuid": "d46d40b7-e9bc-474f-8af2-bbd6307390ce", "comment": "Malware payload (Amadey)", "value": "e5ad2eecf7dab71f9d55a28e9594d78d10dbfbbf", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671960691, "uuid": "766f2392-7e0e-4b36-979f-6e616f13dad7", "comment": "Malware payload (Amadey)", "value": "e3b4a07f6a70e746a2958683e0364a54fe866d6c0c627c05999959d9232bf4457c4bab2b64ae1aa029cbad33b1dcac6f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671960691, "uuid": "2ac7b75d-db06-42e3-8e6f-131d5112ea41", "value": "T1EF24AE117691CC66D2D24970582BD7E82B3BFCA29A5359F73708BA2F3E301B09D16397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671960691, "uuid": "b076fe22-d8d5-4fdb-9e18-8c71cd6f689e", "value": "7b9daca6da068f54ad4e1900288e8efd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671960691, "uuid": "b95ed2e2-6d3b-477c-9a36-5549ea8e3ebc", "value": "6144:ZCLKRHtwBivIQHzYgtsRvMlGJ/X1hGymI:ZCgt5HjcvM4VXlm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671960691, "uuid": "4fb71399-b949-4be4-9831-5d2af09127f8", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671960691, "uuid": "252e5ebf-a33a-4779-af89-ced93960c39b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671960691, "uuid": "941084e5-e86e-468c-9b00-52fde15c32d9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "229e0dee-8428-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671954343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671954343, "uuid": "62555bfb-940c-4b47-826a-5894538c7f70", "comment": "Malware payload (GCleaner)", "value": "4ca9232db86c2a4367a84de30b1829ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671954343, "uuid": "9899d9f9-89a7-4b2c-9393-154b17c2083c", "comment": "Malware payload (GCleaner)", "value": "4881060ff5691bf48f7375332dff84bc150bda521458e29e4fdb9b998f83c209", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671954343, "uuid": "8026449d-36a9-4832-8667-46e9076c3cfd", "comment": "Malware payload (GCleaner)", "value": "7c9b995c2749c077c1434bd2a6d9d9fc065eb13e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671954343, "uuid": "64de7f7c-ec32-43c3-bb15-3a544153b29f", "comment": "Malware payload (GCleaner)", "value": "4c7bd105691c63d02e2d906eb76935e262164a6cbb1bcb1c831585245d141463696b41337a2c175c1b0a5d875fd4683b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671954343, "uuid": "5992a919-ee9d-4556-9a0b-286b6efb4385", "value": "T1578533E0B6F8CA36D0BEE07C5E91E50571783F601F48964C54E4EE8B6B3994C8F87686", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671954343, "uuid": "8b75b33f-c948-4009-a863-8630835ad6ae", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671954343, "uuid": "6685cb61-ae78-451f-ad57-7816857e2ae9", "value": "49152:GidLyrCVh0TnFR5g/WNaQG3y0pcFAXjqptRkcZat:Gi5yXTr5g/bQG3GSzqbMt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671954343, "uuid": "26d92b73-159f-4437-a434-0f03dde8536f", "value": 1862990, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671954343, "uuid": "22758fd1-e2a6-4c67-b11d-56a4e20385a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671954343, "uuid": "ec804a33-aaab-4710-bc4f-8317529d49a2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99124d51-847a-11ed-9db1-42010a9c0080", "comment": "Malware payload (DanaBot)", "timestamp": 1671989760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671989760, "uuid": "a9bba8fa-0724-4c41-bde0-ad3714ae701e", "comment": "Malware payload (DanaBot)", "value": "c551a87ede300f78a48fadfe6c7b14af", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671989760, "uuid": "276d974b-cec8-4e91-aa8a-71db6c5edd08", "comment": "Malware payload (DanaBot)", "value": "48c4ac00c8bea03f17cea62ec021dcd3ddd50db8bb9c85ee0ffba68b970daf63", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671989760, "uuid": "66baff06-68c0-4e26-bb72-d6a3c4882d08", "comment": "Malware payload (DanaBot)", "value": "4c4c5cd829fe657d640dfd4baf356a45e55e13ee", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671989760, "uuid": "10b3f5fc-f800-4d85-b9f3-37040650557e", "comment": "Malware payload (DanaBot)", "value": "e307f5ba75b76b110a9031fa258f7ed2057f62f7c380261f04f8796ae7d88494fdeb34e82b8fb6b6d896c07db52a5aa7", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671989760, "uuid": "60adbd51-0ee5-467d-b9ee-d3ded8744bf8", "value": "T1E135231062949CA2EBD248714917E3DD563FAC921E4B16F633A47E4F3E701B28D6B34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671989760, "uuid": "67147d4b-9d0f-49a2-b652-54363749acf0", "value": "8514760d95d5a493235b8748f65885e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671989760, "uuid": "a09180e9-28ee-46eb-a513-827ad832b4d8", "value": "24576:MINJmEwrc3nPabM8SA1kHSvNIJdTKlwZ8a8dh4u:MINj0c3PwM8SA1kA7li2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671989760, "uuid": "23c74a99-bd33-40d5-8038-2f87c529e96f", "value": 1138688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671989760, "uuid": "0a1cab24-bcd2-4cd4-9f72-1756995f995e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671989760, "uuid": "599be306-d448-4977-80c5-484f6ca4bf90", "value": "SecuriteInfo.com.Win32.BotX-gen.22816.17101", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f478f4ec-83ed-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671929355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671929355, "uuid": "1f77da0b-d5c0-4ceb-abc8-8c46a442582d", "comment": "Malware payload (RedLineStealer)", "value": "88b8c269645bec66755fa50fb422e081", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671929355, "uuid": "07ee7b04-0c0a-4170-979f-a66771670e49", "comment": "Malware payload (RedLineStealer)", "value": "4959ecdbe225976635a4be74548d955ed181ba257fb7c60bff4161d949eeb226", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671929355, "uuid": "98c02f9d-37d6-4854-826f-325b9e4915a3", "comment": "Malware payload (RedLineStealer)", "value": "a360e15d61f62fcbfddcaff876d3aa8837f8f376", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671929355, "uuid": "0b440640-8190-48a9-8c3e-d55e120c42bb", "comment": "Malware payload (RedLineStealer)", "value": "66e60569b89d0b757a73b0454a1e3af299c817f6e2bb27faa2830bae7b13535896d129a5cb91d8e41a51bde2d52e35ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671929355, "uuid": "86aa07cf-9b06-4f25-bbd1-e9b27abd1885", "value": "T16C04C51437FCCD11E1BA5A3F6961A05147BF9802A842F25B76C367CD1E32B40FA57AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671929355, "uuid": "5acf50e0-59f8-4613-bf6b-6437badeaf32", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671929355, "uuid": "4d7c8997-d445-421b-8a13-13c913bca4d1", "value": "3072:kxqZWVtaKUPLv0Lmm2AXBe4UFhh3bxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jp:6qZbg6MAhh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671929355, "uuid": "1f636269-f5f9-4ba1-9eac-665b886404ad", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671929355, "uuid": "7d6335b2-fbbf-4e63-bab6-eb8490c29f08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671929355, "uuid": "33dd0d72-b098-4848-9a16-97929362d301", "value": "88b8c269645bec66755fa50fb422e081", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae81a7ee-84a3-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1672007406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1672007406, "uuid": "5f199332-c34c-4744-9b0b-b234f3289f86", "comment": "Malware payload", "value": "ae6fa6373d4c7b484b67811f50dff0f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1672007406, "uuid": "b98b9083-cfc8-4cfb-a918-61be5b16ffe6", "comment": "Malware payload", "value": "49855ecab907d44292eff582ff76bd66db563737612a7df84528498e6a0675fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1672007406, "uuid": "a36dcb61-9a74-45c7-b80b-af1989c47481", "comment": "Malware payload", "value": "882bc23172d9b693a9cf3cc3fa4792df747ce125", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1672007406, "uuid": "8480f7d9-f6ac-4231-9dc5-ca49b0d1449d", "comment": "Malware payload", "value": "a179efff371f0c6b00791cece49ad90787d0fcab1dcdbe3864001ff91b8d97bc9d5851fe3610c58add6d33898d604bb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1672007406, "uuid": "cd0fc53f-7b39-46e5-aa77-709062f28a61", "value": "T18B34CE00A792D465C51304315D19CBD42B29BCA2FA65DE3BF354FE5F2EF0290A9EA353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1672007406, "uuid": "e82ba4d7-cb70-41e5-889d-f6115f84a9d5", "value": "6a8f260c43148885d76dffe1ee7a8503", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1672007406, "uuid": "3d9115b2-6818-4464-92e9-48d18a80a456", "value": "3072:Jt3YLKe5YiFlQa0mH79yqIAtL4t/GKXpAbcE1lS1g/tK8m1hKD/LrcSb54VIcVTk:ELK+FlQa0mH7lMXmbcctK8KhKDLbIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1672007406, "uuid": "67427384-8ad5-480e-a603-bc5ea1a841e8", "value": 237056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1672007406, "uuid": "250178d0-6f7e-4a62-acf0-a1fddac7a3ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1672007406, "uuid": "f0459ce1-7cdf-4522-b889-753af9e4a3b4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "810f6c3d-8447-11ed-9db1-42010a9c0080", "comment": "Malware payload (Amadey)", "timestamp": 1671967816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671967816, "uuid": "90f7939e-dbae-475b-a612-02e556e675da", "comment": "Malware payload (Amadey)", "value": "cf2fd271aeaecf04b61219f48d59b774", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671967816, "uuid": "e495c4f3-03f4-4a11-a658-bc7249b69d4e", "comment": "Malware payload (Amadey)", "value": "49f0cfbfd49268a8a7d1435d0fff4b706d9df2dc8c46c7831ec9a6c068c89696", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671967816, "uuid": "1210c330-7d15-4f46-a07d-de85b417e9b1", "comment": "Malware payload (Amadey)", "value": "d7ebfeae7801392c2ca900c0572a675359759067", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671967816, "uuid": "270c20c1-6ae7-4d8a-bdf2-85a631b361c9", "comment": "Malware payload (Amadey)", "value": "0e95b440bc70916b64207da3bfd510d90f352d10e38a75cda3dea3d16a4ef0c066d26537db53ce6f0bfa98906483cb18", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671967816, "uuid": "a46f9ca3-7b3b-41dc-ba68-039ec0a8dfcc", "value": "T1D324AD1176A0CC65C7D20971492BD7E82B7FBCF15A675AF236043B1F3E702B0A926297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671967816, "uuid": "93a5f1e5-0e94-44d2-a18f-562ce894b97d", "value": "7b9daca6da068f54ad4e1900288e8efd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671967816, "uuid": "5c09ab37-598e-4662-babb-ce0197bfe76e", "value": "3072:0xRLjIR7k+A5LG7KF1Ohb8R8TZMPxGttJ/tPrnw7RkxmJZs:uLsR7T2NqB8umPSJ/tPbGymI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671967816, "uuid": "31bd0263-5ec7-4305-8049-f0e3471377ca", "value": 227328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671967816, "uuid": "d29147b9-d846-4791-8388-75bc7759d9d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671967816, "uuid": "135c8a1a-bc5e-4187-8b26-1076f28cffbd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f5a4e0d-842e-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671957048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671957048, "uuid": "08658f7d-42a0-4217-9da7-350a96c964de", "comment": "Malware payload (RedLineStealer)", "value": "bc96776a325f5b76292e79be809f0725", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671957048, "uuid": "3719bc70-863a-4b8b-a260-0c2ce0460d50", "comment": "Malware payload (RedLineStealer)", "value": "4ab13258167f4b6367b397e40405c0fee03cb634b38e6af80d7fc3f60a1e8ada", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671957048, "uuid": "d673a2d8-643a-43d7-9004-003c2955b4bc", "comment": "Malware payload (RedLineStealer)", "value": "d80cc049d2af836ce5f034682df58bec6637688c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671957048, "uuid": "be831da9-3e3b-4f25-8855-17362602b9a8", "comment": "Malware payload (RedLineStealer)", "value": "0cf66a720fc0082d604589d23e1584014868645062d69b254928275cb5424df9411db1e90e5371c2b474c3eba5647228", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671957048, "uuid": "cbe5e1b5-4b78-4cb4-a232-5576b3a4f7ed", "value": "T14084F1113692DC62D3D685305C2BD7E92B3BBCA18A275AF327047A1F7E305A09D27787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671957048, "uuid": "531f5095-e88a-42fb-939d-640103a07f0d", "value": "78b36debb485b88b8de5929ea52f861d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671957048, "uuid": "94781e12-5054-45a2-bf37-35276ba86a6b", "value": "6144:VLlfWUVPqP+7lsonGVBDwiELWjgi6xtVEP0BvMUeJ/ONBGymI:VJf5SolsoGQiELWULjotVUPm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671957048, "uuid": "2d61711d-eb4e-440a-b883-57d023395149", "value": 382976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671957048, "uuid": "f58bf123-50b0-4dd9-bce4-b97d7dc10be6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671957048, "uuid": "8788a164-762b-4bfd-a398-dd9a48a81d48", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "870076b3-841d-11ed-9db1-42010a9c0080", "comment": "Malware payload (RecordBreaker)", "timestamp": 1671949787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671949787, "uuid": "83521ce6-ad06-4316-a041-e4ff665fdcb6", "comment": "Malware payload (RecordBreaker)", "value": "9f09a0b13623cc34413e86e5fc75a5ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671949787, "uuid": "6c9b151c-15bf-4b05-afa0-55f9cac6802c", "comment": "Malware payload (RecordBreaker)", "value": "4c2033d93667869945fd6ddb60fde972a28371c0747d2facf57c53e77196107e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671949787, "uuid": "ea67120f-b734-4705-8624-f407467d70a3", "comment": "Malware payload (RecordBreaker)", "value": "edad25a7142f8e741a801fd0af7551e0d0cdea94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671949787, "uuid": "2c781de3-fc83-4604-9856-4f44ce770f4d", "comment": "Malware payload (RecordBreaker)", "value": "bfcfaf72bfbff664ffda7aa567734abbf11a21b22e2902f3283a62260b89f3de9c3b0cc8dd3d96a9a5640ee6fae71181", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671949787, "uuid": "3ab6dd5d-84cc-446e-92bc-2d9a1f722704", "value": "T1D424CF0DBAA2C076D19155308919CFE46B6EFC318F609A3F37513B5F2E70EA0956A3B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671949787, "uuid": "c5025e0a-4f91-4de2-ac05-b71f6af9a2a3", "value": "1ea9f0326cf512ac0eb7dd4bc1a00a19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671949787, "uuid": "5b628b01-fa15-46d7-bb6b-27807648299a", "value": "3072:HDyPlZL5O568oLnDWnTU+rDbZ+idTK2auD0hwof/ln:O3L5ko+nPttaMcP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671949787, "uuid": "9af021a0-580a-42b8-b308-5b92f8391fae", "value": 228352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671949787, "uuid": "29b0a684-d5e0-4422-be75-209faddfb103", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671949787, "uuid": "4a810148-0458-43af-ae67-2ad82207024b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f7f3a52-849b-11ed-9db1-42010a9c0080", "comment": "Malware payload (Gafgyt)", "timestamp": 1672003730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1672003730, "uuid": "8148f6cb-9ebb-4acc-ac0c-aaa1b8cd0f53", "comment": "Malware payload (Gafgyt)", "value": "1a5d3514a2f60eaa0585a6673e6f4386", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1672003730, "uuid": "649da432-77d2-4db2-aff5-173bef49c5ad", "comment": "Malware payload (Gafgyt)", "value": "4d44cb056b30e992d47486636af914e5c3b6c821611d0720b435c24583019743", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1672003730, "uuid": "13736011-116f-464c-94fb-04c7958c7c27", "comment": "Malware payload (Gafgyt)", "value": "c68d2d656e479df4c4230bcac8598780bc62213a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1672003730, "uuid": "37657962-6a6b-448f-b8a0-e467a8fbe91c", "comment": "Malware payload (Gafgyt)", "value": "076a4f9b2b1d090156ade647292e91b4c635ab4f67e3cd082cf077e6f4deabca4340533cbaa131904f47908892368279", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1672003730, "uuid": "d347cb85-73ec-479e-bed7-1dce17742e45", "value": "T180B30804F8448727C2D327BAF78E439D7735566457DB33116A38BEB82BC6B982E29170", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1672003730, "uuid": "8c45689d-4176-46e0-98bf-3fb8ba394212", "value": "3072:9lX2jKRi0ZDvCTpHv7DSubUmGVrQAXiUXouX:6j6ZUpHv7DImGVrQAXiUXouX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1672003730, "uuid": "14df0ff3-57b4-438c-9630-f18080a238a6", "value": 112657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1672003730, "uuid": "0a968d5d-191e-4ac6-bc10-5bfdd20da33f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1672003730, "uuid": "0fda4e11-edb0-4d69-b5dc-a994b5de56f1", "value": "1a5d3514a2f60eaa0585a6673e6f4386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb7281b5-83ed-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671929366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671929366, "uuid": "0d79a2b6-833e-40a8-a7bd-14583fc3793c", "comment": "Malware payload (RedLineStealer)", "value": "9e1499766df19804efac25eb09ba3f39", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671929366, "uuid": "7b75f8ad-ebbf-408c-8f8b-6fba28925d97", "comment": "Malware payload (RedLineStealer)", "value": "4df9a237fc5204f2c6b7274fd2514bf888d8f7d959f171668354b8d6087d0a90", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671929366, "uuid": "ee36a896-e8de-42c1-87a5-e189b4591b79", "comment": "Malware payload (RedLineStealer)", "value": "8fd8e8696e22954c14415f0debf54fa15746ad77", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671929366, "uuid": "c3214bec-c0c2-47bb-ac89-44a847b9d932", "comment": "Malware payload (RedLineStealer)", "value": "e6548265886f4d0b9515db2d6fd5ab2470c9a97c58dd84e1718b429a069fa95095f6b39c7d9aad0f9b8a9c9e24a292ab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671929366, "uuid": "99100f98-754c-4b82-a2a6-c997beff84a8", "value": "T1F974F00CBEA2D475C6510970CC15CFE866BAFC309FA09A2F37507F1F1E70E91A52A296", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671929366, "uuid": "fec075e9-1380-46e3-aa6a-baa1bb868961", "value": "1cabdb70cbdd8d3392fe9f92c541a607", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671929366, "uuid": "9cce600a-a362-47a0-b4a7-25624c3dc140", "value": "6144:UCxLw8s5mLfryFh4pwJ6hFQGCxhz4LnYB6aMn:Uos8s5ezyvbMhFGzI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671929366, "uuid": "b8d2a5d8-41e0-429a-8196-00164e7ed8d3", "value": 350720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671929366, "uuid": "a85660aa-4f6d-4618-b4fa-5b28983593d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671929366, "uuid": "61659cc5-1178-4422-aae7-21d2577bc48e", "value": "9e1499766df19804efac25eb09ba3f39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dce8f3a-8496-11ed-9db1-42010a9c0080", "comment": "Malware payload (GuLoader)", "timestamp": 1672001579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1672001579, "uuid": "e81b8dc3-fe41-4a55-8a93-5ebbf23ec641", "comment": "Malware payload (GuLoader)", "value": "b5d1d321540f6dc7fbaaed118961fd18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1672001579, "uuid": "f8cccd69-3062-40ef-bc2c-7b21c3d6d55f", "comment": "Malware payload (GuLoader)", "value": "4eea310dcbc75d23880e30080f61492310f5192b484efbacc894286f3907e74d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1672001579, "uuid": "b796cd42-1cff-4ec2-809c-29370dd1b8e2", "comment": "Malware payload (GuLoader)", "value": "2edd3c3591ae8762d83bd182b655b3b650c7ca77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1672001579, "uuid": "d3ee8cef-b1ca-4a4c-be59-9a3e013fc25b", "comment": "Malware payload (GuLoader)", "value": "c10673bedd2207b303d79fe434640b7e807a558d7d13cf0ef85638c5499353ec39f38f2ff0679df862b29cc6a720ca25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1672001579, "uuid": "d63f0615-f70b-401f-ba86-209ac686793b", "value": "T110F3023166F98877F19B42701DE7E7B1F7B6EB050050938BBB705F3AA8741968C0A25E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1672001579, "uuid": "984376f2-b39c-4d10-905b-13160dfac774", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1672001579, "uuid": "b9453f11-1266-4bce-b08a-736769109bc9", "value": "3072:RH/UVfVpLlgMcrNbHgdvll4n1oS0vRYFZ9CxhlKBtD2aE43tLBaSuFyjXfO:RDNAxM1oS86Z9ChlKBZ2aHNBaS5jvO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1672001579, "uuid": "8c566d7f-6e9f-41c3-934f-72643910d8aa", "value": 166857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1672001579, "uuid": "26744b08-126e-488f-95ce-faaf83bf9095", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1672001579, "uuid": "308c4f2e-19a7-4678-9dad-2ccb4107a37d", "value": "PO-TO003256.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84e7b498-83f4-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671932174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671932174, "uuid": "9a8169dc-4588-4bac-998b-c0f1d7c7c4de", "comment": "Malware payload", "value": "06705928f6cd3a29c52aac0c08054bf1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671932174, "uuid": "76e4ecba-3a92-4362-a294-504440448723", "comment": "Malware payload", "value": "5012134deef6465feaafa2f9dbc101ad06413155d07d1e6b814134920fee74b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671932174, "uuid": "f64bd907-c0e5-40b9-ab81-2269c57d59ae", "comment": "Malware payload", "value": "26701d3030baa8b797373b85bebd54995013945b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671932174, "uuid": "bc7f2cf7-717d-4d11-8197-ba0a93af6dcb", "comment": "Malware payload", "value": "08910b8f0f5f55c621a609e87072b23afc207c0512182ee40caaeb00508ec9bbc754828d6437433c2bea5a91b6b29f4d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671932174, "uuid": "4bab7f92-e28a-4f4c-ad95-1d24e9aac499", "value": "T15275231179C18471E572193449E8DB30A43CBD202F3A96EFE3646A2D4E741E6BB36B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671932174, "uuid": "266037c1-4cff-430d-ab98-179c4550585c", "value": "ae9f6a32bb8b03dce37903edbc855ba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671932174, "uuid": "d55372a3-bac1-446e-bdb4-554ed4e82c4a", "value": "49152:A6PaZrovJMd5R2VnR8mZoBcZWmZzCGE4I:faZrovJMd5R8R8oM4zO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671932174, "uuid": "ef7c6e6b-a131-4b38-8a10-262125bbca52", "value": 1689577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671932174, "uuid": "7ad137e6-353a-45f2-b196-5ff14aebca14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671932174, "uuid": "aaf1c24e-f7be-4e2e-b8f8-d65a9b1e4b25", "value": "06705928f6cd3a29c52aac0c08054bf1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48468ecd-844a-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671969009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671969009, "uuid": "0320963c-3bab-4b61-ae82-317f8d50d90a", "comment": "Malware payload (RedLineStealer)", "value": "0ea45bddb097b50c089bea5ae3f5a6fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671969009, "uuid": "fc1ade5f-13dc-4f59-8887-0ffdb20c94c9", "comment": "Malware payload (RedLineStealer)", "value": "505509de0eccbd99559118cc90f42f5618c68827d963394afdef810c7fc3b2f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671969009, "uuid": "ac414f35-7246-402c-b980-7efe90877418", "comment": "Malware payload (RedLineStealer)", "value": "4a9755d1e363803087d8f2c77d2c3cc5804196e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671969009, "uuid": "8e525682-4a6d-46d8-8684-640c83caa90a", "comment": "Malware payload (RedLineStealer)", "value": "f64864cea7ea745b30dfdfc1c98c378ed9b2b9a170d64fd0726ab12a1e796a2af80b435542d09fa05e078d5dabcbed3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671969009, "uuid": "ffc1ff65-74bb-44b0-a721-d848a47efaf7", "value": "T19B9426017CD245F6EC33343DCDA585BA99ACE9104B1249F753A83AA94F221E1F633E5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671969009, "uuid": "3f160018-dbe7-4eee-8d56-3806875b5718", "value": "feb30892e78cb0226d53d5b251c007ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671969009, "uuid": "2bd23eff-aafe-4e81-88bb-3e2ba17dbc06", "value": "6144:p6DCxLT52vMishn5u9OC9ZjYAOkuXFGvNCy7QRO8GjTKXe/kXDN:p6DCxLT52vMiy7yuVfRO/TWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671969009, "uuid": "96b1c8e9-8b42-4343-870f-aa2d2db20a9f", "value": 409088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671969009, "uuid": "040382cc-e544-41a8-9d5b-8dfb27368bf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671969009, "uuid": "7912805e-5aa0-4c4f-a25c-c8a1b3f5436c", "value": "0ea45bddb097b50c089bea5ae3f5a6fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e962e9b-83fc-11ed-9db1-42010a9c0080", "comment": "Malware payload (CoinMiner)", "timestamp": 1671935411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671935411, "uuid": "87b0fa82-71bb-4d2a-b323-0ef638aeb2cd", "comment": "Malware payload (CoinMiner)", "value": "e3dd3606cec2635e2c938d145e2e7fcd", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671935411, "uuid": "4b8c0fb9-6107-427c-a22c-0318b38446ea", "comment": "Malware payload (CoinMiner)", "value": "518261f1fa66ad1a7336a7e499391a02c7239fe665adac002c67d2633e2f8676", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671935411, "uuid": "6dad07cd-b28b-4072-b30d-facc15cb575d", "comment": "Malware payload (CoinMiner)", "value": "1c3d8912a745080c164f24e075e95554d2761e54", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671935411, "uuid": "492fb9aa-b01f-4936-acb9-8e0a53586555", "comment": "Malware payload (CoinMiner)", "value": "659359351da399efeb5063bf74eaeb25e94c345434c6e5c6149bb7501a9c1f6377529f2a8f01b946cc0284c81d2f7bb9", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671935411, "uuid": "698c42db-756b-4864-9ef7-63d90ae8aa87", "value": "T1F715F9F27F815F36CB249676EDB1050D9227C288E11B5F0BB5E264705F8EB282DB6934", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671935411, "uuid": "eb8d467f-812e-404f-96ce-ab010bf77228", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671935411, "uuid": "ceaf56b5-b272-41d0-b3a2-38146d4d760b", "value": "12288:xIGAvAOr18CfCeGDRqn/MzetFCwrT92aSxNhlngQU9LxS2WlpbTvI:2GAIKyCfCFDgn0eFBN2awlgrMplRI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671935411, "uuid": "559e0845-a017-4f86-9de7-9e1af625c069", "value": 945992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671935411, "uuid": "477eedf2-ea7b-451a-9afb-9359d1895ded", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671935411, "uuid": "783aebc9-fde8-467b-b4dc-4f5879b6e573", "value": "SecuriteInfo.com.Variant.Lazy.272297.25749.269", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c63420a-8425-11ed-9db1-42010a9c0080", "comment": "Malware payload (RemcosRAT)", "timestamp": 1671953071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671953071, "uuid": "7d30a38f-24c4-4579-bc4d-fe1cf1c91fbb", "comment": "Malware payload (RemcosRAT)", "value": "2ded7062f4bf5e76c0d62cc805559e44", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671953071, "uuid": "f9e612be-0f6f-4207-9a09-72bdee175753", "comment": "Malware payload (RemcosRAT)", "value": "5251517c9a5cc925e00988f3d9aa30706271cfd0bd6d33d3794e03a92b13b946", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671953071, "uuid": "e1061677-ba4c-4d36-8a5d-6a64766da609", "comment": "Malware payload (RemcosRAT)", "value": "f795e9c5c7f08838535fdfbfd29ac80aeb5e3e28", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671953071, "uuid": "732d0f21-f6e5-42b7-bf45-b9b230ed86d5", "comment": "Malware payload (RemcosRAT)", "value": "8c3144467150704cb9373a43fdab6c9c983f2786e5834034cf97f899d19f51d14ae0fb033f7810df2a4e64a62a82e09b", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671953071, "uuid": "9ce57977-7936-4f86-828c-3cb740f8afc1", "value": "T17B25DFB7187B12D2CE6A0675C47A1D100D1DD8F90702C6B67AE3A2AFC6496CE79D4CB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671953071, "uuid": "f48927d3-19b6-4854-87be-426a2ce5dadc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671953071, "uuid": "64785e40-9ec8-4de9-8ae9-2c148b28ebef", "value": "24576:ALYJrBHX9eXpOhIv1TQJmlYNRI3ks4+FpT4ScHRQuqj3R7:AEJ13wYhkQAaNG0NwpEb1KR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671953071, "uuid": "09866028-6cdb-4781-a4d3-bec0cffd46a0", "value": 987136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671953071, "uuid": "9bf85cf6-5b65-41b9-801c-3e1bdc1e9492", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671953071, "uuid": "fc3b4a7f-d9ac-44b4-b772-de9503a8a66b", "value": "DHL Shipping Invoice PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af24c3ca-845e-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671977771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671977771, "uuid": "80c959be-5611-4334-a290-741b641bf38d", "comment": "Malware payload (GCleaner)", "value": "bf8830852a26569f4a740626ccae465c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671977771, "uuid": "5e0d8ab9-5c60-410e-9b64-806f16210be9", "comment": "Malware payload (GCleaner)", "value": "544a11f45964a5f4e74e7aa45a99674fc1b14bf6f41680e79a754c3b0eaeaf67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671977771, "uuid": "f509012a-161f-479c-bc66-67da83b3c8ba", "comment": "Malware payload (GCleaner)", "value": "5315960141844400e93bba8d987e4e1dcf42cab0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671977771, "uuid": "d48f9884-d253-45ab-a79a-c956fd383285", "comment": "Malware payload (GCleaner)", "value": "18b05388e11cf7b430f035c8555f227a860a4be8179a3072917e9b01db7c2661011f13a82ed8bfea260da107e3e68f3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671977771, "uuid": "2b0c244a-a0fe-4b36-9ed4-be3a2da4948c", "value": "T1189523D6B2C95176E11EC5B8EC90C40676A8AF900B22E30F6DECEA67EE7930D8743554", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671977771, "uuid": "fed7bfa1-c4f3-499c-973f-b3957a5852ec", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671977771, "uuid": "6713cd30-fe88-480c-8514-a0fff818a84a", "value": "24576:Biziuu2TIR1NHhGa19vdjnrkfUjCUhAwmqAfxL4QduoOZsgzhROR/xjXrfE6euJQ:qiraWUaFQfU5hAwmqo/uoSb7E/xX6ZaG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671977771, "uuid": "2c9051c7-280c-4ff9-9c61-3cf9abbf3eab", "value": 1904772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671977771, "uuid": "224ce789-851a-4f89-abd5-9564b6315f58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671977771, "uuid": "2cba88f6-84ef-4861-9307-96125fddbca6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f060939-8481-11ed-9db1-42010a9c0080", "comment": "Malware payload (Amadey)", "timestamp": 1671992535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671992535, "uuid": "ec3a6644-6295-4e3e-a806-e1934bff0818", "comment": "Malware payload (Amadey)", "value": "1d641e8215a82151e8925673bfb171a1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671992535, "uuid": "953708a3-403a-4a20-b1c0-b3bee4273eed", "comment": "Malware payload (Amadey)", "value": "5882c280879e455296e2ff9e0570d6dfe4780cf18e62e7c8ba346a97a719d445", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671992535, "uuid": "31291ef9-3cf7-4e08-a48f-2936ba34ec3d", "comment": "Malware payload (Amadey)", "value": "12885d250304d50920b79a00524250eaac5a7741", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671992535, "uuid": "f426f894-b5e3-403d-84d5-18f36fbd610c", "comment": "Malware payload (Amadey)", "value": "87066c2df14be26c274a9d600d22a2063e0dfa9f433e0bed6bf86eca53dd093455d7228f61ec6100e076ae4f44b2c2f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671992535, "uuid": "d181f72c-7794-4fb0-a22c-27ea38bc83b7", "value": "T1963409217D16C031C56061B729B9BFF2C19DA8259BB049DB7B800F7BDA122E67970E3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671992535, "uuid": "330dc7c6-79dc-4405-b83d-307c0cc68e89", "value": "dd0e4efabc62274a7cfb37b4b7a2951d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671992535, "uuid": "dd624d0b-fb7c-4feb-a7b9-090483c0d8fe", "value": "6144:LkwjBO99g6779r0psUhmiIuVyD2Ng8hJgN:0TrOh2uVyCN3hS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671992535, "uuid": "f4a9154c-5f91-45f6-9971-e5d68fa1d8b8", "value": 240640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671992535, "uuid": "bfeac41f-fa75-426c-b422-ec5e9ad0e5a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671992535, "uuid": "4167fa95-5e5e-4bdf-9a79-45b85e74f8f6", "value": "1d641e8215a82151e8925673bfb171a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42441a34-83e7-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671926479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671926479, "uuid": "50053c0b-f2d5-4290-8a04-dd7008f59408", "comment": "Malware payload (RedLineStealer)", "value": "4da6d2aad164c26e3c0057a4f5b43119", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671926479, "uuid": "74eecd17-57e3-4c1c-8a7b-61aebc452100", "comment": "Malware payload (RedLineStealer)", "value": "58a2d4d04502d30a008185414a5a06cac11727637870e9a4c59771dc3299b252", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671926479, "uuid": "445926db-f918-486e-a0f3-bea26459ec50", "comment": "Malware payload (RedLineStealer)", "value": "477f4eccc68d6a93c6ae5873b0a584b5124833cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671926479, "uuid": "7e637acb-6612-49f1-9203-8da38650d484", "comment": "Malware payload (RedLineStealer)", "value": "869b3881ab8b779a36f870a3de1e704924c3a826f7edb6885552ae5c1e2b4382e25595afb193385594720a3c309e114e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671926479, "uuid": "194dd89b-876e-48c2-b140-14c1c206bff6", "value": "T1F684F10C7F93C436C55149B08866CFE8A62EFC319B35562F3B006B5FAE70E90967A365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671926479, "uuid": "449404cd-a1bc-4e14-90af-39c41fc313ef", "value": "20c459d943d7c19ddc9a1be25fe9460f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671926479, "uuid": "24fd043b-ddac-40fa-9e28-b30d18addd5f", "value": "6144:0LKsFwuI1MMNVrZqPNqrULKp5zG19ZKQMh8kv5e866ZgVEaMNtqDq:0GsSLWMrZq1R7UjhtPgV3stqDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671926479, "uuid": "8f26e269-7158-4fee-b10e-df5c52bb32d3", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671926479, "uuid": "622d32f5-cb57-4f54-ad9e-88334bb79f92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671926479, "uuid": "d5a0db0c-d423-4efd-821d-58a2ea41d774", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "048ab7c6-841e-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671949997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671949997, "uuid": "1367464e-3884-4adf-a9ad-79a09fccce8f", "comment": "Malware payload (RedLineStealer)", "value": "1c93a4aa25c7e8ee408791ef92c8a08b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671949997, "uuid": "ea4e21c5-f75a-48a7-851d-bb99e25b15fc", "comment": "Malware payload (RedLineStealer)", "value": "58b8f339607f6b31ee2c7343964856e61014f9b2fc6cdde5544494e2901ee9f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671949997, "uuid": "afd4b561-5879-4898-9da4-6622821c86a9", "comment": "Malware payload (RedLineStealer)", "value": "29dae1ef070ac5ac035d63203706fc0c4c5586f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671949997, "uuid": "dbc64657-9334-40ac-9921-dd3d9fb72624", "comment": "Malware payload (RedLineStealer)", "value": "9d60c1cde29f63310f76ec1cad15728fcbb496f69d86d99fb5d5240f9c10a2e8fea0f9a3989fb507465a7843a68ecd0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671949997, "uuid": "cfed1636-2616-4347-8e12-e184bc32e23b", "value": "T1EA84010CBA92D021D1520970881AEFE46B3EFD319F62272F7360771F6FB0E9195762A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671949997, "uuid": "7cbf3f91-df8e-47f4-89d1-15017453da94", "value": "1ea9f0326cf512ac0eb7dd4bc1a00a19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671949997, "uuid": "c9a1a57f-f9a2-416c-8c7d-b78647bb319b", "value": "6144:V+L9MBzFqCEjylRvcakRNjZg5YQu/yTWBl99HaMjz+:V+5MBJrcylRvTWEal/f94+z+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671949997, "uuid": "0c97dc78-9430-4921-ae75-545fa611d098", "value": 383488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671949997, "uuid": "71ef34b9-c450-452e-b15f-5f33314377a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671949997, "uuid": "2a42a56b-a709-479e-a4fc-97b22ad10c2b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dd410c5-8485-11ed-9db1-42010a9c0080", "comment": "Malware payload (CoinMiner)", "timestamp": 1671994466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671994466, "uuid": "16577164-910d-4170-9f3f-5f44ff4527ee", "comment": "Malware payload (CoinMiner)", "value": "a949a3fe536e00bd8da93d06877b57f6", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671994466, "uuid": "bdc40935-8562-4f1b-ab47-1b6330548672", "comment": "Malware payload (CoinMiner)", "value": "5a5840972f191e1bb8eaf8fd0ac8141688b192c2304e239ca818d455120d604e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671994466, "uuid": "5f793d00-a2d2-4632-827d-6f6437a32b9e", "comment": "Malware payload (CoinMiner)", "value": "d0bfd598db8b794faa9c173b2b2b27c0573eefd9", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671994466, "uuid": "13b01240-a0e2-4c56-a447-771960ad5745", "comment": "Malware payload (CoinMiner)", "value": "ef307b3fd73d5c2bd8558f30a86b070a99c76e1b589bddc43cfb787ca590038242ff7df36668bf528a49448d4965d214", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671994466, "uuid": "0f29885c-db79-4d70-840f-3b914c762390", "value": "T12534CF10A392C461E55308305859CBD55B2ABC61BF65ED3BF340FB5F2EF0291A8EA367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671994466, "uuid": "a52d6a49-cecb-4a47-96b7-ff3afc16eac7", "value": "997a79bbc9b29ccf624aa79059ded875", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671994466, "uuid": "ba54fdc5-91a5-40f6-b026-07b311339a73", "value": "3072:JaTEYOl7L//RPT5JONL1j72Wrw3qBCXxG6fQAGNwzNlS1g/tK85HdnLrcSb54VIn:R7LXJuLxdE3qwXxqB+tK85HpbIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671994466, "uuid": "c152938e-0d49-4b6f-8051-3da3cc7785ca", "value": 237056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671994466, "uuid": "88d86337-42e7-4771-8700-72107563b9f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671994466, "uuid": "7316d43f-d67d-43e1-a312-4ff6f079e060", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "550ba132-846f-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671984922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671984922, "uuid": "507e4fb3-b77e-4a1f-80a6-233ac72cb476", "comment": "Malware payload (GCleaner)", "value": "367b03838d1d8c8fc9b9dc46500e3771", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671984922, "uuid": "d177151b-4d5f-4cc8-816f-7588656b3917", "comment": "Malware payload (GCleaner)", "value": "5aff7c676fbb4e89658e565b939d014b4c16511ffd0e5c31a40975f1cbacc2b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671984922, "uuid": "8be3bae2-41ce-4948-99c7-7301d62347e3", "comment": "Malware payload (GCleaner)", "value": "7ab5f89ba996ab0a731e45c3287a94ba56acc39c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671984922, "uuid": "ef9cab81-607f-4a2c-a8ea-766f0b19422d", "comment": "Malware payload (GCleaner)", "value": "abb9551a5c0efb66935a5c5f5d1b26d49bc9e11667dc49f50f2e15ca92d0435e305a49f6218942542772806b1fdf8728", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671984922, "uuid": "e45b520e-a6c3-4d55-9093-2582aaf2da5a", "value": "T1FD8533E4F26ADDB1D16D80309E99F564B0B57FF01F99970998D04CAF2F28A0DEB07681", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671984922, "uuid": "743df683-db22-417f-8aef-e314a4f23d7a", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671984922, "uuid": "ec644468-f7a0-4ec9-ba97-d98701d591d8", "value": "49152:GiI2tFKVzAH7dbyacYgCvyiqreNoYN34PgJdEDZaX:GiX5H7RpcYgCxJNhN34WdEDMX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671984922, "uuid": "855ca2a3-c3d1-482e-9abe-7dfe39e944ce", "value": 1825188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671984922, "uuid": "3a894cc0-3d9c-46eb-860e-ea676c22ec09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671984922, "uuid": "de656081-e73f-4af1-aebd-59eada598b74", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79252356-845c-11ed-9db1-42010a9c0080", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1671976822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671976822, "uuid": "a8848a43-2fce-47a0-8146-cbd9d08dba5c", "comment": "Malware payload (ArkeiStealer)", "value": "9e053d7f64032a506a55bc67afbf5556", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671976822, "uuid": "e814f850-88f7-4db2-b844-7b65c161b95f", "comment": "Malware payload (ArkeiStealer)", "value": "5c6da74665a1d13afccd66d58dc20163744abad7cb8d20f06dfce481b6459a9d", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671976822, "uuid": "3ecdbaae-2728-4aa2-9f16-b3b2bfcb4ef0", "comment": "Malware payload (ArkeiStealer)", "value": "4763f3511fb9041aecd7994f285d40074069ee4b", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671976822, "uuid": "7e661ae9-f63a-4bbc-ad86-35908b82e62b", "comment": "Malware payload (ArkeiStealer)", "value": "ade349d32412dbcc6cee8bb43a2eab2aefca8c1550f66f4378a3cace747dbc5fc9cd7dce137bd98f4c63c6490685dbce", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671976822, "uuid": "278558b8-eead-413f-8209-47351dfa45fd", "value": "T13E74E1113691DC72C7D24970582BD7E92B7BF8A15B2746F33608AB2F3E342B09A16357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671976822, "uuid": "836db29c-1c33-41a6-83c9-47995649966a", "value": "8514760d95d5a493235b8748f65885e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671976822, "uuid": "18f827cc-9acd-4790-922a-0bcdf7ff38d7", "value": "6144:OCLZhrrWU1OipsHXHFpYcFqpPHJ/QULWEGymI:DthDpsHXlpYcFgVmgm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671976822, "uuid": "2826bd3c-ba76-4f15-a16f-8758c5ed235e", "value": 356864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671976822, "uuid": "d2684a31-2b69-4b33-932f-922de88340dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671976822, "uuid": "56ca6a89-ba34-451c-b5b7-58f1af35c0ec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e0ea9ad-846b-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671983299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671983299, "uuid": "5ee505d9-b2d5-423e-b732-78f903142083", "comment": "Malware payload", "value": "e79d5e1f9fff4bf994e5538522b24eb4", "object_relation": "md5", "Tag": [ { "name": "anydeskh.com", "colour": "#1C3D73", "exportable": true, "hide_tag": false }, { "name": "base64", "colour": "#4F262E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671983299, "uuid": "710d1e62-21d5-4360-ba81-2d2f864e1dea", "comment": "Malware payload", "value": "5de77f2f3ae3370ff275b412721dba5fb7d1b09ed16a219af4293af34f80d4c9", "object_relation": "sha256", "Tag": [ { "name": "anydeskh.com", "colour": "#1C3D73", "exportable": true, "hide_tag": false }, { "name": "base64", "colour": "#4F262E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671983299, "uuid": "ae34ebc6-b9de-4e4f-b091-a7685e83c9f9", "comment": "Malware payload", "value": "b341ee89c031dd3aeba06c26557fb2a2b0a0b9d5", "object_relation": "sha1", "Tag": [ { "name": "anydeskh.com", "colour": "#1C3D73", "exportable": true, "hide_tag": false }, { "name": "base64", "colour": "#4F262E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671983299, "uuid": "71a9b470-92d0-4507-8917-edf5ea26eb55", "comment": "Malware payload", "value": "e4f8399b7a04deb85a1622515f5dd6fa3b14990ab7ad76e6675356c0c33848315ee63b727e2b37f3fde1042930cfb4f5", "object_relation": "sha3-384", "Tag": [ { "name": "anydeskh.com", "colour": "#1C3D73", "exportable": true, "hide_tag": false }, { "name": "base64", "colour": "#4F262E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671983299, "uuid": "e882d729-ef8d-486d-83dd-33dbc94e9194", "value": "T1B8C5E1F359A09D65AEF80B0CA0AE3E134C5C85CF4CB0B1751B466CF6F6A89D6187D4E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671983299, "uuid": "b0238ace-c800-469f-a25a-f2b0ad0c5212", "value": "49152:ju+35qFXTaUXVhcZTYURtDPczv5uRSq/a:Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671983299, "uuid": "ed4628aa-2383-4d5f-b600-901990d91bbc", "value": 2663128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671983299, "uuid": "6c4e85b3-40f5-48fb-a45a-8c6f4dead4cb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671983299, "uuid": "adc05b4e-a011-4670-8e25-5ed0c0bd5ad0", "value": "qn0og3fyrv3.ids", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cdb93d6-8487-11ed-9db1-42010a9c0080", "comment": "Malware payload (Amadey)", "timestamp": 1671995270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671995270, "uuid": "5acfed88-40a6-43c0-80c4-3dccfa481000", "comment": "Malware payload (Amadey)", "value": "70134bf4d1cd851b382b2930a2e182ea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671995270, "uuid": "e33afb06-c6a5-4141-9f8b-062bf239a0b8", "comment": "Malware payload (Amadey)", "value": "5e4cb0cc51202cef27c4f5da63362ceee8c29a03e61ac19efda3c137b657d9ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671995270, "uuid": "ef0307b2-e4a5-4223-9d14-6bc10eb609bc", "comment": "Malware payload (Amadey)", "value": "8454d476c0d36564792b49be546593af3eab29f4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671995270, "uuid": "5b05f90e-f4b9-4f16-aacc-00817788d828", "comment": "Malware payload (Amadey)", "value": "5e70fa364cce6c3fd8f228cf12bbad185349d330f85de7ffe9676178b4941fdc5b71ea8bbe196554a7f88aed1a0849c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671995270, "uuid": "8975f664-cd56-4fef-9680-bdfd9601b07b", "value": "T1A4C36D73F1D08872D0710F7CAD5AA698663EFE202C351557B6E94E4C6E3B2C2296D2C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671995270, "uuid": "b333c0c4-8b6b-4287-9712-7336bb13145c", "value": "a02ab1a937fc1433a9abad7bc2badee6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671995270, "uuid": "b8e212a9-b4b2-4512-a660-5893569a6595", "value": "3072:Yx7pOYzBekf3tiINwyP7XSSJds3zhrjPcnqULv4q9:Yx7ZNhf3vwyOztPc3L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671995270, "uuid": "4cd3295f-41d1-4784-99d7-0eeccdf2cfdd", "value": 129024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671995270, "uuid": "e056d601-7c96-4752-9411-54e99bdfc2a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671995270, "uuid": "b5de6cbf-3f61-41aa-9085-e57c00e9f92b", "value": "70134bf4d1cd851b382b2930a2e182ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea37390-8454-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671973314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671973314, "uuid": "7dae535b-7e1d-4792-8fae-9db6a1321c14", "comment": "Malware payload (Smoke Loader)", "value": "24170fa94eef3bb1dc9ba5e714543ed5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671973314, "uuid": "ed9642cc-da8c-4cc6-b405-a0ef774ff7ce", "comment": "Malware payload (Smoke Loader)", "value": "5ed47a43b8d0d423215bcba69e73511c1169061748076818d62dab3ea8c3f9e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671973314, "uuid": "c5d93bd0-4978-4f2f-b5b9-02c10a0634e9", "comment": "Malware payload (Smoke Loader)", "value": "de41bbb64f2b0bfcbe474c3e463ff1963d97f42b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671973314, "uuid": "62fdf783-0b7b-4b61-bd95-8342c68dec6b", "comment": "Malware payload (Smoke Loader)", "value": "020b83b0d992af6ce9c2959f1476c10e534580fc6c6614504653184b6b1c1801cf810673d3ee7830940ec59e3bd6ba33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671973314, "uuid": "67e73ef8-6c58-4d99-924b-e2ebe5e2f869", "value": "T16B34BE913691CCA2C7D20971592BD7ED2B3BBCA18E6359F627083B1F3E712719926343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671973314, "uuid": "bb817786-93c9-431a-b960-0b7e7c73a781", "value": "8514760d95d5a493235b8748f65885e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671973314, "uuid": "d33d345a-f099-43a3-bf98-5354a7273b18", "value": "3072:3XJkLtGo5bxEpoNzJzBxUijwFbo7xqdy4tJ/Wsrg4xw7RkxmJZs:36LsqN1zBxUipg46J/WsrjxGymI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671973314, "uuid": "4889dc67-a5f3-43ec-acf7-e467dad776a7", "value": 237056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671973314, "uuid": "7adcafd7-7655-44f0-b3b6-708223fd1068", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671973314, "uuid": "232611ec-9cea-41f1-9aa1-663df10b10af", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "663b11b9-845f-11ed-9db1-42010a9c0080", "comment": "Malware payload (RecordBreaker)", "timestamp": 1671978079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671978079, "uuid": "3b3e6e30-b2cc-400a-baf9-dc2f65d2f3a2", "comment": "Malware payload (RecordBreaker)", "value": "02c7b0f0df871b5e8c5199b83fa14932", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671978079, "uuid": "d336cb0d-99cf-4d31-856c-cbd7c06c6349", "comment": "Malware payload (RecordBreaker)", "value": "5fa1c3ddf64efe1a1c7482987bcd03b32bdbebbb5ca7adeca2f5615d24790811", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671978079, "uuid": "7626540f-8347-438f-a4d6-4cbd7d477a4e", "comment": "Malware payload (RecordBreaker)", "value": "2c3e83f4f1dff9bb87cf23497f77fc022f6ae02f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671978079, "uuid": "1efa8226-4157-410e-a9e0-1b1eeb721a95", "comment": "Malware payload (RecordBreaker)", "value": "1184cc27386327f92ccfec9c0526a2592a175154ed66b95f2408fb3c5ed96150f53719eb7a2a42ff6e8047868a2f87c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671978079, "uuid": "09dbd06b-1221-4a7a-bc36-e14d13c5ce1e", "value": "T13934BE102691CCA2C7D249715C2BD3E82B3BBCB15E6399F772447A1F3E706B1A926347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671978079, "uuid": "3d50dc41-49e3-4ecb-a632-650411d9348f", "value": "8514760d95d5a493235b8748f65885e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671978079, "uuid": "ded9673d-ebda-4179-bfb5-d6c5a181b951", "value": "6144:BlF1q+Lt1Zm00nsuT6FDHWEtuJ/mki6GymI:/Ftvw8u+ZH7uVmkZm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671978079, "uuid": "6c7a6184-e27c-4e65-ab75-d763ad7880ef", "value": 237056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671978079, "uuid": "fb721dce-fb29-4fe2-a4cc-f69e992665cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671978079, "uuid": "63e62c7b-8db0-4291-bfac-30da5c75164b", "value": "filename.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "239c4a00-8486-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671994717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671994717, "uuid": "2c7f530a-2cb9-4af2-8115-f9e78b124d02", "comment": "Malware payload (Smoke Loader)", "value": "3faa63e5d71ea24fdebd8afddef42570", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671994717, "uuid": "b1aa72bc-ad73-402a-9412-171d48161ce5", "comment": "Malware payload (Smoke Loader)", "value": "5fc5aac1072362b9cd6f047bd57854475985a6605ac13ebbeb704ae275de6c37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671994717, "uuid": "86e6f9e7-18e1-4105-bd3f-4f8061aa532b", "comment": "Malware payload (Smoke Loader)", "value": "601af63f1676471f08b739c731671c2a1efe38f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671994717, "uuid": "daaf59fe-5494-40aa-803b-79bc179564d5", "comment": "Malware payload (Smoke Loader)", "value": "5f3146914c7eb670b18f4154b84c10947a4d616f967e9b5d1dd5afa48ed7da62c25f1e40e08718fecc6c30d594732255", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671994717, "uuid": "99e2fb4b-88b2-4130-b44c-4294b206acfd", "value": "T10134BE01B3B2D071D15308704919CBE56B29AC62BE65DE3BF384BB5F1EF05A0A5E6327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671994717, "uuid": "8c130946-654c-4c07-ac7f-f0d87a80a710", "value": "997a79bbc9b29ccf624aa79059ded875", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671994717, "uuid": "c1776d14-d0ce-43c6-ba8d-65374c74736b", "value": "3072:ndn0eLb3E5Vr6l7NQUYVcGiR5CAgZPbPt1V1lS1g/tK8cxTXN8LrcSb54VIcVTuh:OeLbGr6NNQhoCZPbPbltK8FbIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671994717, "uuid": "252e2e55-083a-493f-a338-c6aa03189b84", "value": 236544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671994717, "uuid": "a0c8712e-93cc-4402-acb0-621d731a2ed6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671994717, "uuid": "58d1dac7-72d7-411c-91ba-36b7d7692c50", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ccf0394-8404-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671939059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671939059, "uuid": "e1da36aa-27ed-431e-9ba3-4b32bc9eeda9", "comment": "Malware payload (GCleaner)", "value": "f33d5113c8da65888ec19a56b73e3ebd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671939059, "uuid": "83d2c5fb-e94d-4dff-9750-4dd20522b14f", "comment": "Malware payload (GCleaner)", "value": "5fe42f0673e04cb007c0a0d27f91cde8f27fce6010265af64ad0cc3ec12ac9ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671939059, "uuid": "9ba7b3a1-1a55-4f15-b178-356a41529842", "comment": "Malware payload (GCleaner)", "value": "90ef4d7173178045a259edc5ab18ba3bade06bf4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671939059, "uuid": "1fc4d6ae-2874-4eff-baa6-0533f2ee637f", "comment": "Malware payload (GCleaner)", "value": "ffdabe7dc33a5323cdb0bb8799e6b3c29d24e93a689c25907743044f5ee1e5657ae717f2969a08bf9cee4207cdc2371a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671939059, "uuid": "614a7c54-86b1-455f-8061-f51aa2fda989", "value": "T18D9533C2B5908CB7C1A9C1781DA184157569BBA12F2D930E78D4F64F9F6CB1CEB133A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671939059, "uuid": "8e768615-ad20-453e-a0a3-2d88ee9811de", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671939059, "uuid": "8daa7e6f-e582-47da-87b7-722e29b8513d", "value": "49152:uicyVoG/C5PdxGG45U30eq7W4C41zVLsvAtBhK74xIW8pZa0:uicycJG775y2V8ApBKM0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671939059, "uuid": "9528773d-f7c6-4bfd-aa65-046117e11193", "value": 2010867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671939059, "uuid": "760f4868-02b6-4be9-a065-675d52b70844", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671939059, "uuid": "17370fea-05ea-4d8f-8a66-c3107709726f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4b384ae-8400-11ed-9db1-42010a9c0080", "comment": "Malware payload (Gafgyt)", "timestamp": 1671937489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671937489, "uuid": "0a45e4e9-b9bc-4271-8e29-b05075f4847c", "comment": "Malware payload (Gafgyt)", "value": "0f3e1b1b95692ebc1a0d4aab9cf19b25", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671937489, "uuid": "baee6fa8-fe85-4ec2-ba78-60eaee59abdf", "comment": "Malware payload (Gafgyt)", "value": "5ff16d8fd9d230029e8d4cdeafd8d99b6b5438d59d175a5c0784ec3105f315fa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671937489, "uuid": "7d84d5c3-f96d-4240-916e-ffc00e6e74ec", "comment": "Malware payload (Gafgyt)", "value": "0acf3433a6ba72017a35cfb32a7ac971f6123011", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671937489, "uuid": "402907a7-6f8e-4ec8-8fde-e587ab1a2185", "comment": "Malware payload (Gafgyt)", "value": "e216ac05bb24df04a50d37c39c7f7c85c55fc2a08e12d99b57cbf3ff853791fc71e763b8b0d1dc1e474ee6ad2b7adb3d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671937489, "uuid": "a885aec8-44b3-41c8-8687-3379f75a8dbb", "value": "T12B933A0799A59F77C0C7EAB919EB59300326A9520B2F1F5961386BF4438F9CC740FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671937489, "uuid": "f8435358-8be2-40dc-8252-e5f5eb1c62e5", "value": "1536:fI7+hcIM9naHAAGtKhmA+J/FosGvJtKqCnDQtmW49VquLeefkcX:YNIMZoAAG0hS/FoHKqEYm79VquqefkcX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671937489, "uuid": "e9546304-2897-42e2-8948-42cc370b1b45", "value": 94356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671937489, "uuid": "6ec2c4ea-37e0-4fd7-aca1-d61690651f1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671937489, "uuid": "d47178c1-2a9a-4b1b-9f1a-399d7285ca64", "value": "0f3e1b1b95692ebc1a0d4aab9cf19b25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a053713-847a-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671989574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671989574, "uuid": "79c5cbd3-7933-4165-8d50-054ead5c2c45", "comment": "Malware payload (RedLineStealer)", "value": "033f1c8d781800f686ef0666280c1bae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671989574, "uuid": "dbd00cc8-dcad-42fa-b6ba-c9377ca7c69b", "comment": "Malware payload (RedLineStealer)", "value": "600edd005fda1609e629629fd4cb57d7f18e6cb6b905ff987f3ed7cb94b8e575", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671989574, "uuid": "c29bfac5-a57e-49ce-adb8-3e849690b9ea", "comment": "Malware payload (RedLineStealer)", "value": "fe5495be3a1464eb5cbd78b5193c2a45d49beb28", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671989574, "uuid": "4f0598c4-5b7d-40eb-9b72-6ac56962411d", "comment": "Malware payload (RedLineStealer)", "value": "a97532d4e08d3f822b278aa32536aa9ecf3d6c909cab3e39c938c80c2965dff99de5004b05714a764b65d576d3e7cd7a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671989574, "uuid": "b29fcf57-5936-4b32-af1f-afe11d4b3fbb", "value": "T11654D0112280DC65C7D249718D2BD7E92B3B7C918AA35AF33744BA1F3E742B09D36267", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671989574, "uuid": "f505597d-e041-4b89-a3e7-b73ec2c361f9", "value": "8514760d95d5a493235b8748f65885e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671989574, "uuid": "5ce34760-bad0-4bf6-8685-24575accd70e", "value": "6144:qyLLfyr9yUg6Cs/7ySk+D91sQ9hRJ/cdbGymI:fnfyzgts/7yP+D9SQTRVcd5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671989574, "uuid": "5f46de36-0719-40d3-b50f-d4655516ef15", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671989574, "uuid": "e18a35b3-1fdf-4235-86fc-a403ca09b465", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671989574, "uuid": "bbbde81d-329b-44d8-8999-b6c4d182d362", "value": "033f1c8d781800f686ef0666280c1bae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bea3bec2-8436-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671960617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671960617, "uuid": "8fd13cf4-e397-480b-a982-0403f20ad79e", "comment": "Malware payload", "value": "11df615538dae6876c4ddba16935c65e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671960617, "uuid": "6b6dd22b-75bc-4da8-9677-363d6bc6ff09", "comment": "Malware payload", "value": "6352bb91439dc8ca6dd8863f0010e4637f58b19dc8a3ebad2849eb15fae82a66", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671960617, "uuid": "b942f364-3429-4f19-831f-e99ac0234f0d", "comment": "Malware payload", "value": "1d31fc4341a9139d7596aab3607885889ea5308d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671960617, "uuid": "77a4f8e7-1528-4fef-a5a6-12926e0e0586", "comment": "Malware payload", "value": "a2b77a3e0356cca117d00c91dd351cfe0bb57fa0d5dcb6c2f3d868b3e1bf8838410a5489b59b2c4fa1d2fd3560773852", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671960617, "uuid": "547fc0d0-6a42-4869-8410-a429c975edbd", "value": "T1DF830206BF25DE0ADF100C732AED9F9E8D78BA5F49ABB0B469D1848F27901C97856304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671960617, "uuid": "ac68bfa3-baa1-4d1e-b409-c0498e2c3335", "value": "1536:pxpJNlEYvXndUt/afLuZmVelu9eoCtcCCzNbC4RWC0CQFW3RLlR:phNlHuBafLeBtfCzpta8xlR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671960617, "uuid": "0cab23e4-a859-4324-ab96-5e8cdd0379a9", "value": 84960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671960617, "uuid": "b651fef4-5c91-4083-81f6-1d6f284af4d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671960617, "uuid": "083b757d-a429-4fe8-9de6-679e6358529b", "value": "SecuriteInfo.com.Trojan.Linux.GenericKD.50294160.21911.19878", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d34eea4f-8421-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671951633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671951633, "uuid": "368b457b-b1a3-46c6-b1c8-2081ed47469b", "comment": "Malware payload (GCleaner)", "value": "3e02aeeb5af44dc2483762ef2c4bddfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671951633, "uuid": "492440f2-a3fc-4f36-9a24-3433911e5a8a", "comment": "Malware payload (GCleaner)", "value": "63e5b958d5eab435f0800fa07cea3022caf63334f255bfbf7e2de07236015737", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671951633, "uuid": "3354425a-d7f7-48e1-af71-8a5eea2e9972", "comment": "Malware payload (GCleaner)", "value": "0937ec814893677ac68f7db45b3056dae4060713", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671951633, "uuid": "7e7a0524-e1ca-45eb-b60c-cce17ea7cc4d", "comment": "Malware payload (GCleaner)", "value": "d35505f6c9975221b446cfa02e76bf12012ec8c70d4120ab74cb9be7a3ecb4136456d3ad2e2b34a103538fe8f4f198e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671951633, "uuid": "7f807942-ee78-41ff-8a3f-667e62690666", "value": "T19A953398FAFDB8B0D40DC0F01C94E085B1766FB11B2862289DE5939FB7AA94CD797341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671951633, "uuid": "2aa60b27-c764-4671-b33a-3aafffcfebdc", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671951633, "uuid": "6cc9e469-2c8a-4700-8f14-83be62585827", "value": "49152:Kis/yj9PjY3xb3vf5BJNWvCkhiQ+ykrrcpY7wwlEjJxZaI:Kis/yNsxbHmi1yJpYjlEtxMI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671951633, "uuid": "619d5140-6a6f-4a61-bca9-66021be96fd4", "value": 1991226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671951633, "uuid": "73b0f07a-2b3f-4785-af4b-707c57239fe6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671951633, "uuid": "10e6d4c8-06b3-4995-a2ed-ad15235c1c3b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "163ffd6d-840f-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671943585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671943585, "uuid": "e0dc27b4-5781-461a-ac5e-5e6f0153d7e8", "comment": "Malware payload (GCleaner)", "value": "43d5cdd9d280da31eaa75b0fdd9c41b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671943585, "uuid": "9bc22300-6888-4559-bb7b-393b7960c0d7", "comment": "Malware payload (GCleaner)", "value": "642526506bbddc486ae30a8c0b285bce7bda2b08ec90cedea172d1e2f70c1317", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671943585, "uuid": "c07be339-4014-4701-bc02-e15a4948bbfc", "comment": "Malware payload (GCleaner)", "value": "61f3a20ba60a709e4735d0355dd7de2e0e4713bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671943585, "uuid": "2949d025-2354-4732-bc7b-a1e3b3d69fb9", "comment": "Malware payload (GCleaner)", "value": "b0603a3360daed548b50fe65c5a7ebba315e50118738eacf189cedaad0b046685d7d6193f826d4965b93f0954bd7d1e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671943585, "uuid": "10c38bac-ac0c-48b6-9360-36500b06beb9", "value": "T18C85339AB840D876D05D83B066B8C96CF5BDFFD20B2A880E58E4CED777A950CC393651", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671943585, "uuid": "168e9e46-d06a-4324-82a2-174763b18a94", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671943585, "uuid": "2b991a7f-1ea3-4079-91ae-7ab131ad2a48", "value": "49152:eiIcjwR7feeQwpHDSyq2GD5spOBTkwf/c3JPCycYZal:ei7klfbJhq265sYB7/c3JatYMl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671943585, "uuid": "e806c985-04b9-4f79-9554-2a6c09c91cf8", "value": 1837660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671943585, "uuid": "3c40aee7-c571-48ae-a29f-45065aedcb31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671943585, "uuid": "1abfb8e5-ccb6-445e-8d9d-519a787f1366", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3d4c984-8400-11ed-9db1-42010a9c0080", "comment": "Malware payload (Gafgyt)", "timestamp": 1671937460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671937460, "uuid": "cb12951d-89a5-4a42-9105-bfe9a81e2f1b", "comment": "Malware payload (Gafgyt)", "value": "6bb697f18105e895efdb4a04f01c855f", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671937460, "uuid": "4b9c50b0-d004-4d1e-983d-b22f5375c359", "comment": "Malware payload (Gafgyt)", "value": "64abe219672698df7b54ea4b149b1e18170f29b90cbd6183c3de6670d4ef9fca", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671937460, "uuid": "9da8fe87-8ab3-4b83-9f17-af331d9368eb", "comment": "Malware payload (Gafgyt)", "value": "1f233fa2b791ed66f5c673a7f14a5bb3dc135346", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671937460, "uuid": "c281f619-9147-4f6d-926a-6fe8b1e60d02", "comment": "Malware payload (Gafgyt)", "value": "9b1aa6d7f217e26ad052a80999bf38531d11db3ee2b773c102b5452ebdfa370de952567743fcd681372b459bd6cbb370", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671937460, "uuid": "93126cea-d714-4c4d-9277-574fd98fe3b4", "value": "T108A33A33A753D6BAC09322F417DB9675A823B47C0B32322B33D86DE56B05DE91E5A701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671937460, "uuid": "3de643d7-5a95-4a6e-8d64-4ee30ad1dcae", "value": "3072:2K5ejA4jB4h89HOPQzM9FqVyb9W9vmrYuOHy+ZNzX:sHjBzuPQQtk9vmrYuOHy+ZNzX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671937460, "uuid": "622cc013-7537-460f-8d41-2b7db0ee20d8", "value": 99332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671937460, "uuid": "07d51d0a-26b7-4fbf-9d41-d17ef2885d92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671937460, "uuid": "52010cdd-bc93-4715-8123-332c36bf2e03", "value": "6bb697f18105e895efdb4a04f01c855f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "744cf17d-8404-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671939018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671939018, "uuid": "4b812f5c-c9bd-44ba-bb10-280ba4d0b51c", "comment": "Malware payload (RedLineStealer)", "value": "d96fdb706bbce57e4f4ea9b402a7ffc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671939018, "uuid": "d06b0d50-818f-4fb9-be37-b451d45df8b3", "comment": "Malware payload (RedLineStealer)", "value": "64c8261a424f0faaf10920c1f9b5b875e907f77f5198a55e21cffd3b074d4c9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671939018, "uuid": "6a4bd23e-dfe0-4ee9-a2f6-389f2c8e5a2a", "comment": "Malware payload (RedLineStealer)", "value": "596169d20887eb615eae569650d1007638c2643f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671939018, "uuid": "bf6d8ecd-27f1-4abb-a7c2-cbcee8e368d5", "comment": "Malware payload (RedLineStealer)", "value": "f0483568aa2a3f697f831821f99e9a5f71cbeeb22bd90739f5db002d308fd28f71c2d4b2f57e2e6bec1049873e885c3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671939018, "uuid": "7ae6f664-a781-428c-8307-6c185af11a82", "value": "T1E684F19C7FA3E062D55109744915DFE08B79FC719B62263F3314770F2E71EA09A2A2A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671939018, "uuid": "00f2617e-866c-48b6-b1d7-6f9b4b065be1", "value": "1ea9f0326cf512ac0eb7dd4bc1a00a19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671939018, "uuid": "6e39a8ec-c97a-44c7-90ed-0290bd02b2fc", "value": "6144:UL2keMOEq0RMyIJ3Zo1vledhHQBG6tUTpEMaM9np:UykeMK0CVJ30wfwB7tUTOPGp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671939018, "uuid": "14099d5e-3e78-4d57-887f-b9dfb8c7145e", "value": 384000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671939018, "uuid": "000d6dd2-d510-41ac-aa3c-2e17e320fc3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671939018, "uuid": "1b8ac686-dfb3-4647-b1b0-7b499176668f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cdd0418-83eb-11ed-9db1-42010a9c0080", "comment": "Malware payload (Amadey)", "timestamp": 1671928214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671928214, "uuid": "eb843079-64c7-4fe6-a818-7cd83b2400dd", "comment": "Malware payload (Amadey)", "value": "8ee025b90e5e0882eed99de5ac4bb58f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671928214, "uuid": "29a0d7ac-1d84-454b-af67-6b1851bc44e4", "comment": "Malware payload (Amadey)", "value": "662fa69addaba2dada857a86111b8dcbfaf186121e68b0d93ab20fced493eec6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671928214, "uuid": "943f1621-bb26-4b52-b7a7-27924c0798f8", "comment": "Malware payload (Amadey)", "value": "1a60abf8362d09e8c604667f7f382906c52e1d6d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671928214, "uuid": "3eb0f19a-e5b6-4152-bb7c-23e8413f1810", "comment": "Malware payload (Amadey)", "value": "b7744ce38e440babfb09ed07b4da5359aa96a736a11dff063b145eb83d8fb0c51b74ab38a90dccb4e9c926bbcfa03b5c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671928214, "uuid": "a10df680-3708-43bc-9cfb-f70c4a1356af", "value": "T15034CF0CBAB2C476C64119308519DFE4AA6AFC704B615A7F37513B1F2E70F909A3A3B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671928214, "uuid": "22808f0b-00bb-443e-953d-23b1297cf6c5", "value": "562782785f867427ce8d2b46c0257fd6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671928214, "uuid": "c2c9587a-d7dc-4e0c-9e56-a3893a0511c4", "value": "3072:5Sp5gNYLY7pv51byp18mui1O7CEVt+Y024+4iYP2MmLyqauDuA3f/ln:UxLY7pCpuji1O7VVt+Y4+kP2SqaMug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671928214, "uuid": "e3c3a301-a014-4313-990a-9415af3bd63e", "value": 230400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671928214, "uuid": "adfc74b0-1bd0-4c31-a6a8-d5495e362098", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671928214, "uuid": "cd8ca5a6-bee2-4985-adb6-727319a9e5c7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e79522e-849b-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1672003701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1672003701, "uuid": "baff3398-e1c8-4d4d-9d4f-d720ced0df44", "comment": "Malware payload", "value": "46fa63e9bf46f0aa511c946e43a394c8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1672003701, "uuid": "66e9a4b8-a8ad-48ba-ba7a-40d333c92fb6", "comment": "Malware payload", "value": "6701772ae20790f908b4bcd7de33df2c17dd356191ca99183b180483d664a654", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1672003701, "uuid": "66dad247-1d9d-42c2-8ab7-7c7ffd0f5db1", "comment": "Malware payload", "value": "1e7fe0eabf017eaa5fd413382f31d1e60abdf33d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1672003701, "uuid": "6b520aa6-e3c1-432e-92a0-0929a90359f4", "comment": "Malware payload", "value": "3f9eac63ff1b0da6fb86c9b7c91b4b0c7747cbf7a05195145d9e94085fda375d45eb93730de146e752f10cd893df6264", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1672003701, "uuid": "35cb919f-b424-43f9-af9c-e71e9b751d40", "value": "T1FA933A0799A59F77C0C7EAB919EB59300326A9520B2F1F5961386BF4438F9CC740FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1672003701, "uuid": "8d3cfdd1-bd3d-44f5-a15e-b0605353d180", "value": "1536:fI7+hcIM9naHAAGtKhmA+J/FosGvJtKqCdDQtmW49VquLeefkcX:YNIMZoAAG0hS/FoHKqSYm79VquqefkcX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1672003701, "uuid": "8f60da71-8897-419f-9046-e85f5de150a7", "value": 94356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1672003701, "uuid": "845e8fc5-88e3-423a-aa0f-f284ff2bef0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1672003701, "uuid": "d2369248-57d1-4244-ab2f-b4f00f29b7da", "value": "46fa63e9bf46f0aa511c946e43a394c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90835207-83ef-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671930046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671930046, "uuid": "c22d64a3-63a6-4fa3-a688-710a0dcbc2a4", "comment": "Malware payload (RedLineStealer)", "value": "b31e09e5972628629c70920a72c538ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671930046, "uuid": "728db705-fc3b-4de0-b033-01e73aa4b0de", "comment": "Malware payload (RedLineStealer)", "value": "671a2aef426199523c5c10862b2b9a4368d476ec6306fd7a33a5ff3e51254d8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671930046, "uuid": "d3c2c6b3-4768-46f0-90aa-b6edd0a4f802", "comment": "Malware payload (RedLineStealer)", "value": "f98438ac9a66ac1adf6970b449bba7501d59dae6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671930046, "uuid": "459385e2-48b7-46f3-9804-d36efe49f0f0", "comment": "Malware payload (RedLineStealer)", "value": "4030e2bc5bf14fbf5f130994ed8685eff1b04ba8e35ce70b78abe1247e7a23b4a2681a4347c4fd49cead277743620275", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671930046, "uuid": "a6771f63-2802-47da-84c8-c56b43f900b2", "value": "T18484F10DBB93D066D38194758915DFE46B3AFC309B61063F3360AB1F2E34AD1952A3B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671930046, "uuid": "ddb44c13-04f9-49c3-a0c9-10fd8fe28970", "value": "1ea9f0326cf512ac0eb7dd4bc1a00a19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671930046, "uuid": "89059a6b-38b7-4524-8a4a-36d8c416a2b6", "value": "6144:3R1LvsOclKiuWXBJWWQU/ggWN3z4nmhyFziTWETJraMC36X:3R17sVKiuWiWQ9hQm4EK9Z36X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671930046, "uuid": "9dc34f25-36ed-40cd-8c8d-dff240219ec2", "value": 384000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671930046, "uuid": "f5cba2ff-3824-4df4-8648-45f4b3623c7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671930046, "uuid": "56bfcb9d-49b2-4268-a707-f2d255fe7126", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6646fd59-83fe-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671936417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671936417, "uuid": "bb5483b5-c026-46c0-baab-a251a20291e8", "comment": "Malware payload (GCleaner)", "value": "c3acd07e41cb276ae8e7042290906b11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671936417, "uuid": "0a2bf2ce-5769-4c76-b5de-c07db84da398", "comment": "Malware payload (GCleaner)", "value": "67481e581203fe69b456cb18eb07afceff9623e24bf87d320833501a261170eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671936417, "uuid": "1345ec4b-0cd5-469b-905d-7cb6a2ff3437", "comment": "Malware payload (GCleaner)", "value": "d47db06091f9cbde0597ea0db386788d907304e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671936417, "uuid": "91af28c9-b822-49d0-afa4-0beb3a734fc0", "comment": "Malware payload (GCleaner)", "value": "ee8980291f93e31beef39fa5d49fc3c8aa213c222adeed282eb81e740907ab27f7e890009b52689a8d8734a3dcc02482", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671936417, "uuid": "1441e37b-9ea8-40fd-8d8f-31a7671b6417", "value": "T1068533C0B4D61632C02D54788D64E94DF174BF90BF69940C68EC89ABBFB86AC875335B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671936417, "uuid": "66e2cb63-33bd-4370-be39-29a03f46731f", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671936417, "uuid": "13971a84-dcc4-4106-a92a-39d3c6c47908", "value": "49152:Wiy/eAqZh2dwAEdjmnjtwLZv/gUI0HjRaZas:WiE/qZh2mWjudXFDRaMs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671936417, "uuid": "b8c00b43-08d8-400f-982a-3704c963cdc4", "value": 1826164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671936417, "uuid": "66ed9cbd-d384-4750-b8da-82a52f60147c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671936417, "uuid": "15e4dc48-4be5-4445-95a7-b8eb22702441", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31fd9582-849b-11ed-9db1-42010a9c0080", "comment": "Malware payload (Gafgyt)", "timestamp": 1672003761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1672003761, "uuid": "97e31f8c-ecb4-4552-8352-dea67290e00e", "comment": "Malware payload (Gafgyt)", "value": "f665001bee683e6e64c3235139ff7dd3", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1672003761, "uuid": "92c6386b-55f8-41b3-ad52-7608a60cf518", "comment": "Malware payload (Gafgyt)", "value": "67562e8c48a344ee4ed90457de4e394a966f84bfce60ea7b4ddb385aaf42f790", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1672003761, "uuid": "16466f37-0cfb-4d94-80b7-c16799cce662", "comment": "Malware payload (Gafgyt)", "value": "757eae59996a3bc3250cbbaf8541d3225c3d2d49", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1672003761, "uuid": "592466e9-64e6-4c6f-8456-3492648faed4", "comment": "Malware payload (Gafgyt)", "value": "9fa354b31b1dbe319ac2b69470900e6cf7e21d07a356f21fda898fa7d6112ca6eb66ad5c381d65842ecf2a63f7be6d0a", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1672003761, "uuid": "e690fd62-30f3-4b97-bc09-ea48971fbc1c", "value": "T1F3A33A33A753D6BAC09322F417DB9675A823B47C0B32312B33D86DE56B06DE91E5A701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1672003761, "uuid": "54d63d14-23f8-4c72-a1a9-e5d9639d5a64", "value": "3072:2K5ejA4jB4h89HOPQzM9FqVyx9W9vmrYuOHy+ZNzX:sHjBzuPQQ/k9vmrYuOHy+ZNzX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1672003761, "uuid": "8c04caf8-90d4-416d-901e-e6a2298ff084", "value": 99332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1672003761, "uuid": "921a41d3-08ef-4c99-879e-b774d4888bd1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1672003761, "uuid": "ea238489-c56e-480d-a0f0-0ef93ddc81a3", "value": "f665001bee683e6e64c3235139ff7dd3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a35438ed-8449-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671968732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968732, "uuid": "6b89cbb0-5a3b-4547-9b3e-dc54663a7315", "comment": "Malware payload (Smoke Loader)", "value": "194e137a38b079bd5bf9845211300441", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968732, "uuid": "83faf0d7-4e8f-4927-ba74-6345c8436c29", "comment": "Malware payload (Smoke Loader)", "value": "6777fb49f3b7b0683745801508d19f792715107d8bbb6e2c9b77e3b6dd90cdad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968732, "uuid": "c6fa5ff2-4fe8-45b6-84a1-71f7eab557e0", "comment": "Malware payload (Smoke Loader)", "value": "f94e1df069a95002b4435aa11af8159252a305b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968732, "uuid": "45c3b05b-6634-4853-b4b3-3a8e2190614f", "comment": "Malware payload (Smoke Loader)", "value": "a0b170593d02dea27f4d0e5a758f85d0b97926caa41f2e3d53a2a07ca0974d2d74374bc24110bd1e198135a8e5384e50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968732, "uuid": "17110333-0797-4995-92f2-afff64d94220", "value": "T1BB24CF0CBB92E066C54109708955DFE4A67AFC319F219A6F37507B0F2E70F90966A3A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968732, "uuid": "7c79cb4e-67d0-41d1-a137-cbd6c28c6426", "value": "20c459d943d7c19ddc9a1be25fe9460f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968732, "uuid": "85196f63-7729-4691-aae3-d963957d7214", "value": "3072:uYwOLz7ih5R+IayoBCAFx7ujspcauDx8Rf/ln:zLzWQIayoc4fpcaMx8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671968732, "uuid": "b9895e8a-6597-4999-bb3d-1609b5b7f2df", "value": 228352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671968732, "uuid": "89021686-d8a8-4c25-b5b3-c8703890994f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968732, "uuid": "6c9594b2-cdaa-4077-9a32-196a282fc37a", "value": "194e137a38b079bd5bf9845211300441.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31a1ba43-843f-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671964246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671964246, "uuid": "387d3505-8b4f-4863-b0be-0519e544e1ef", "comment": "Malware payload (GCleaner)", "value": "4825e7a63db70430d68abfaf5cfd3bf9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671964246, "uuid": "2534fa06-9734-414f-be7b-9ae808392f60", "comment": "Malware payload (GCleaner)", "value": "68529454081bd8e2bfe17046ccc33d629fa581e03a566703a0ffdbfe8d86819a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671964246, "uuid": "1eade985-b540-435a-8642-7db0c9ff893a", "comment": "Malware payload (GCleaner)", "value": "a9dc86a186ce0eedca9c10933cc4c5233bc2a21d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671964246, "uuid": "dbf06cef-6e56-485e-af31-87860229b24c", "comment": "Malware payload (GCleaner)", "value": "409e6c4027298b0e4fe20424e17f9d5e40c4493d329cfef2774f10e4dc55df881ff61c625dcf007402e6275d576792f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671964246, "uuid": "66d4d601-6b30-4c27-9bfc-1e6cdab3bfdd", "value": "T1698533E6FA985A35C05FC2348E9CC8127371B7B03B1AD31D25D89A9FE650D2C6783B61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671964246, "uuid": "1e22c471-c4ba-4757-84c1-bd2c7e892388", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671964246, "uuid": "8b78ea83-cd0c-498b-bf0f-50b523d292a0", "value": "49152:2iOLVmzTJjtdp7Ef4VZHq88FYAKZqbRMZaG:2ikmTJRdp79H0hKZqGMG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671964246, "uuid": "7b48cc1e-26e1-4979-8a68-615f77ce5593", "value": 1834776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671964246, "uuid": "cbb89cee-3317-4c09-b1c3-ab64f3e9ea1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671964246, "uuid": "843498d3-f0e0-4e66-ba31-e1a1a5b46f0c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d4f8ff9-844b-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671969474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671969474, "uuid": "47a04c02-1e1e-471b-a1c5-49fc4de45f36", "comment": "Malware payload (RedLineStealer)", "value": "d644e121e4e3e53a46f2ddd843048c2d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671969474, "uuid": "0f60935d-066a-4f1e-ac88-ad5145d78825", "comment": "Malware payload (RedLineStealer)", "value": "6986b19f5c698ed5b8ff620d17a4abe7c498a89b56425162d652d9beac305dd1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671969474, "uuid": "822bb40d-2c6b-4006-92a1-69319331af33", "comment": "Malware payload (RedLineStealer)", "value": "61f72a7d170f5a8f6ff1681b5a73b7819adc7c77", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671969474, "uuid": "2d44bb34-9181-4634-8f5c-f9f5e272c313", "comment": "Malware payload (RedLineStealer)", "value": "b82911c93d06d90e54e1e2324b24b9746cee4b722aad236565c16eb76277ab4e80656c126f5b6ab42897853a031403bb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671969474, "uuid": "76470a06-594d-4514-9f49-d7f54120d22e", "value": "T13C04C61437BCDD11E1BA1A3F6921A05186BF98026852F75B77C367CE0E32B40F957AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671969474, "uuid": "eb89d2f7-e424-475e-895e-0921fe918f74", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671969474, "uuid": "1c641d16-2d8b-43a2-8019-ac1458cebdb7", "value": "3072:FxqZWR5a+ki/nfVblG3HGieLvFchL3xNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0F:PqZifVblAm3ch", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671969474, "uuid": "b4fee170-c7f7-452e-b676-8433e320e659", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671969474, "uuid": "782120c4-d987-4e64-bba6-8a3c55579fa4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671969474, "uuid": "d668b027-3d8e-4ec0-b982-010b573a7858", "value": "d644e121e4e3e53a46f2ddd843048c2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3995e056-840f-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671943644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671943644, "uuid": "0cb718eb-10ab-4eb7-a309-fd32023a0814", "comment": "Malware payload (Smoke Loader)", "value": "2ddea33e6c12ac98cbddd32b3625eeca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671943644, "uuid": "2a02703e-a810-47b3-9a48-85efa9b269d6", "comment": "Malware payload (Smoke Loader)", "value": "69f5c8c4aa06f434fdc5ff048ef30a2ceb5a3838bae87a9b88d91f2e77968450", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671943644, "uuid": "b8e7bc5c-fa70-4201-8063-5b9b310dead7", "comment": "Malware payload (Smoke Loader)", "value": "55ea65feee1331b6c22d72d56bfe2d1d9f22a5e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671943644, "uuid": "f98e6874-ae90-4d54-a47d-576dbf10d882", "comment": "Malware payload (Smoke Loader)", "value": "9135000786e5f0cf7e51cf18546b137e3bcdf911dae9e832b9c86a0fccc9922554d30b500257e4ada845e089747263a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671943644, "uuid": "82d6974b-3331-4e17-82f7-a0e98db32b34", "value": "T15724C00CBA53E476D1520E3088189FE4A669FC709F215A2F375C3B2F2E78E9156793B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671943644, "uuid": "6d3c0f65-d265-4a29-9ff8-1efd89c65e80", "value": "1ea9f0326cf512ac0eb7dd4bc1a00a19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671943644, "uuid": "1c5cf449-8f5f-4550-8b0e-47666a34ff1f", "value": "3072:3DmO/gLJ25MPibBXiGbAlaUN/3+yjJA0cauDeH4V2GARf/ln:RYLJpPitSGEDuyjm0caMebRn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671943644, "uuid": "08e5b5a5-c527-46c7-bbc5-05a05d2d7585", "value": 228864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671943644, "uuid": "d73e6f5a-c139-499b-a8e3-55dd1031f069", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671943644, "uuid": "6a8a6d73-1a1c-4a64-86d5-d85055e97100", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2766c42e-8486-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671994723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671994723, "uuid": "51ff2b4f-8227-45a2-bd9b-72d289864341", "comment": "Malware payload (GCleaner)", "value": "c262b0c27718b2c29707acb77f3a4a8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671994723, "uuid": "02f9d322-683a-4606-a026-c7f0262ec081", "comment": "Malware payload (GCleaner)", "value": "6b0a6164e0793169ccbdc65ca6b3f4572cd1616127488d702950b53fc1776bf2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671994723, "uuid": "1319779c-61d0-4a99-821d-019ccf3412fe", "comment": "Malware payload (GCleaner)", "value": "c8fded6a75838303ea4c7d9e2df1fe82ee57fa61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671994723, "uuid": "1ab1e0ad-0f42-4b65-aaa4-4a1edfa8937d", "comment": "Malware payload (GCleaner)", "value": "a682e779bb84652838fa8b1c51ddef736931f88b9279596a99369b7ae8f945038ce98f1d7dcf252249192f18788cbb3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671994723, "uuid": "b8dcba35-e257-422e-8c2c-ace42e35ac2f", "value": "T17C8523D1F9E4EE79D02EC2389E18D449B9B57FB0271D832C49DCA697AF6445C8E43306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671994723, "uuid": "ce4d3770-09d5-4cf7-b6cb-bad86d2d6e2e", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671994723, "uuid": "9f063de0-564f-4e72-aaff-3aa236682ca3", "value": "49152:aikohxDRkudOW07CmDJUEN99LV8q+OHW5blGZNxZaL:aibRkudOWJmVPfNa0WhlGZTML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671994723, "uuid": "11539a94-e884-4cf1-9c2b-193da81c33b0", "value": 1828643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671994723, "uuid": "d3013f63-1724-49a0-89a9-78014fb56214", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671994723, "uuid": "fa4c3d95-3d17-4585-8296-fef3a2fae75d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16855ad0-849b-11ed-9db1-42010a9c0080", "comment": "Malware payload (Gafgyt)", "timestamp": 1672003715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1672003715, "uuid": "aa881e10-8bb9-4f3d-8865-415957520b06", "comment": "Malware payload (Gafgyt)", "value": "f17b35e43d803767021a3bd6ae6ad3bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1672003715, "uuid": "99401d36-d027-4681-9953-faacad6df847", "comment": "Malware payload (Gafgyt)", "value": "6b79492d9b6cb6c7a31cc4af69b85ce1652baa4e5ca72dd18334f88455f6b328", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1672003715, "uuid": "92554716-481f-4481-96d1-952e34f6159f", "comment": "Malware payload (Gafgyt)", "value": "5920debd64abdfb63ad4ab957896e576055f8264", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1672003715, "uuid": "70a461e4-0615-4faa-9923-bc0b3cb1cec3", "comment": "Malware payload (Gafgyt)", "value": "8d6224a65b8774e929eafb34bfe4c59d9e385f109d5c57e51a8b096b4b0e2205cf58a8281fe3bf296aed10d7216052e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1672003715, "uuid": "4f31c6bd-58ae-4348-a695-605c881f7065", "value": "T1CA835C49D747CAB3C88307B2029BBA764532F93B5E2E9E45F70D7CB49B124D87226712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1672003715, "uuid": "b2b20494-ec04-4f04-aa0b-d2c70755b5a3", "value": "1536:sQmab6bXPm8VjWWHT0im5t3ItTShKW6GLdUF5MI5AtpgwMUOGHfV+mLI2VOYjXUd:Oab6bXPm8VjWWHT0B5t4tcnBUF5MI5dZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1672003715, "uuid": "2fcdb78b-20da-43b6-b43a-dd2b81c00ed8", "value": 86409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1672003715, "uuid": "452a9391-3efa-4e58-8951-70b4778b44db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1672003715, "uuid": "01a2578c-6687-4a26-b602-7baaa7d1b1ce", "value": "f17b35e43d803767021a3bd6ae6ad3bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3da8f1df-83fe-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671936349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671936349, "uuid": "4f244a89-9d37-4681-a9de-78966c0e91bb", "comment": "Malware payload (Smoke Loader)", "value": "a422e189c00eaacd56610aa52d763226", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671936349, "uuid": "cf60ad59-fd2b-4e7f-90d9-416987819a5a", "comment": "Malware payload (Smoke Loader)", "value": "6c1811f33aab9dd047d432452a790529f0fc289219aaa06b1e458ff7927dd0de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671936349, "uuid": "1ceba6af-1cca-4955-b069-49edaa8c6a20", "comment": "Malware payload (Smoke Loader)", "value": "da2f452bcdfa0629ff1cd938bee4dae4be309f78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671936349, "uuid": "a897334b-d6b0-469c-a253-01499f2e9cbd", "comment": "Malware payload (Smoke Loader)", "value": "cad02e7e67d9a8ab67322f4150fa3e84235128ebaaa14f080330db94b10b608f07df60a1b5c6b4b60808564b30a0329e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671936349, "uuid": "34c7bd9a-ad75-4951-973a-c5b6fd98fb5e", "value": "T12624CF4CBA52C067C6514A308929CFF0677EFC329B615A2F3350375F2E70E91966A3A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671936349, "uuid": "255f29d0-c899-40d9-ac73-89d7a50502fe", "value": "1ea9f0326cf512ac0eb7dd4bc1a00a19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671936349, "uuid": "7bfec3a6-c4d6-4e0b-a1d8-d0b2eca20105", "value": "3072:aDnCgRLmt55kcmBhZel4EeOh8xXlqWNa5oPwA9auDmg8ff/ln:5gRLmZbmBhZNE8XLo5kwA9aMmgi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671936349, "uuid": "92195ec8-9188-4c27-a832-c3e230a2fe75", "value": 228864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671936349, "uuid": "0ce8479e-754f-4e1b-9a4a-8697cb370627", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671936349, "uuid": "269d6fe4-faf3-4a01-985a-e97d48d68b99", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe99d9e3-8471-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671986065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671986065, "uuid": "dc1c9ecd-b684-4ddf-8459-5f4ca392affb", "comment": "Malware payload (GCleaner)", "value": "c46a0005957730087f6d1223f19e0e21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671986065, "uuid": "034ab650-e242-4c2a-9807-0a00f9cdd617", "comment": "Malware payload (GCleaner)", "value": "6db5715d724af143edbcf325e255f800379718a38d9fbfd57ca2785a4e92500d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671986065, "uuid": "bf09d6b1-5500-4cde-87b8-c82280b42de7", "comment": "Malware payload (GCleaner)", "value": "383d95309a953d3b62f3249b24eae817d78b6746", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671986065, "uuid": "bd402da5-ca59-47c6-89e9-9be7f1a27ec9", "comment": "Malware payload (GCleaner)", "value": "303dd73b420dd9f15ad424214567fb0c7afc25623cc761c7babf81caa9da01e8e69c65d56150a009cc6c5e6ecf457233", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671986065, "uuid": "ba04b8d3-8c18-43a9-b464-d522edacd007", "value": "T1369533D1F9805E36E07A42B43E90E1197274FB301F2AB21D20D9F39FAE7560CA75764A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671986065, "uuid": "4dfca764-8140-415b-b3c3-2cde566f1516", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671986065, "uuid": "bdc0ec10-c737-4545-91fa-58f2e079e04d", "value": "49152:+ie11Ik4YzO3Zv+YMy/+zx3VtwyLwsikZ/ZaA:+ie1CwO5ug+zxHwyLKYMA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671986065, "uuid": "1b5b1f4d-7802-4029-ae41-4dc5645f7667", "value": 2017400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671986065, "uuid": "f06ea1aa-d36a-497a-a2e2-213612682b9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671986065, "uuid": "c393315d-6519-4e18-bf5a-895a22f5b48e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "350a34d4-8471-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671985727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671985727, "uuid": "90017f47-5b16-430f-bfe5-46cff5dd1a46", "comment": "Malware payload (RedLineStealer)", "value": "8818e76ba3855fa06f3799108aba60ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671985727, "uuid": "362beaeb-5ca2-42cf-8e72-285b0de73247", "comment": "Malware payload (RedLineStealer)", "value": "6efb2e32950265ab4042fc55e79f9791940bd1e228ab626193a6aef2f8ac937d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671985727, "uuid": "16a0514d-617b-4d6c-82bf-4a3fa497d8b5", "comment": "Malware payload (RedLineStealer)", "value": "40744d61951dc1091393ab3ff84f13266fa52491", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671985727, "uuid": "f1eb7df4-06c9-4baa-a6e1-cc31c5c3a7f8", "comment": "Malware payload (RedLineStealer)", "value": "6c22c32cc913aa063aec4ff251460731ba4778c942d2f95c89bc00d631c99f4a1a0d939275c0dcf570ca80272537f36c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671985727, "uuid": "a8561797-1ad4-4f00-8960-01402d17cd71", "value": "T13474E01066A1DCB2C7D284304D2BEBD8673FA8A19E6356F32719AB1F3D306F09916357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671985727, "uuid": "170cb8ad-8d66-4808-92bd-de274de2cc78", "value": "8514760d95d5a493235b8748f65885e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671985727, "uuid": "4ac087c5-3603-464a-adc9-cd07d81aa529", "value": "6144:79LtYsU5+5hoZ0PVFZXzczNVKzt4CJy73wTeeuuJ/ApGymI:hhYs8+5M0NFZDi0t4CJyDM2uVAnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671985727, "uuid": "50d0e464-4250-4b4a-b0f5-7f2758d30a58", "value": 359936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671985727, "uuid": "bb3042c9-1115-4017-b33e-c27a8815ff5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671985727, "uuid": "92bd3eeb-4443-4a7a-9d75-0592be23e131", "value": "SecuriteInfo.com.Win32.PWSX-gen.14820.24591", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b08caed-8452-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671972396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671972396, "uuid": "cd3cb2d1-18e6-40ac-a583-9ddbd97b58a5", "comment": "Malware payload (GCleaner)", "value": "176c1e92d3dbf79f610f4dcaf2695dbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671972396, "uuid": "e3cd787b-e12e-4800-8713-d1ac7c4fab7a", "comment": "Malware payload (GCleaner)", "value": "705d83e372743d8f68605eaf36ebce057e5e8e663b3ef8660f261d0040b5d7a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671972396, "uuid": "1f8459a2-332d-462f-a520-1b250ed50125", "comment": "Malware payload (GCleaner)", "value": "fffaa918a3512ed84cd5e2d59ebec41f7ade7227", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671972396, "uuid": "f8aa5ac9-65f2-4620-8d5c-cae8c8bc4135", "comment": "Malware payload (GCleaner)", "value": "04d7732293e3fd44144c3dc15d4008ec5c4e093392545702beb1d204fbbb9c2972a92bb95965aab17316a61d9078a03a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671972396, "uuid": "70c9c9ff-947b-418d-89c1-8da5c7485f88", "value": "T1AF8523D2B5B41CBAE09CC2B18EE5A92CF225FF60272AE70C25E499C77F6840C5347795", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671972396, "uuid": "e8cf67f1-86ce-48c8-8242-01287f2b8757", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671972396, "uuid": "d07c93cd-bfc8-4f6a-b5ac-dc27b3a627c3", "value": "49152:GijXlgD/qlLovKoygiGir03RLJP9CBDpZaX:GizlgDMnofjJlCB1MX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671972396, "uuid": "ad59e139-07f0-4455-b6bf-ce7c1f7ce969", "value": 1807828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671972396, "uuid": "2357b1e6-8f21-4ac5-bb25-1f5d2b071019", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671972396, "uuid": "78d99143-0c34-4a0e-b199-e46945005f9d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd4074a3-8400-11ed-9db1-42010a9c0080", "comment": "Malware payload (Gafgyt)", "timestamp": 1671937476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671937476, "uuid": "1f05693e-70d8-4538-951a-530588f2bf48", "comment": "Malware payload (Gafgyt)", "value": "e5954ec0f8dee38efcb9afc2263b27e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671937476, "uuid": "84af131b-c307-43ff-940f-baaebf9abba7", "comment": "Malware payload (Gafgyt)", "value": "70b2c834850fa4d569ea7ec3a6cb1f7a5e5c1b957710b28d4f9bfb3ac19cafd0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671937476, "uuid": "251c9f2b-af43-47b1-a0d6-97f0b23b9154", "comment": "Malware payload (Gafgyt)", "value": "0424609eabd8a4779ff95be4a5f84123799099e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671937476, "uuid": "cbdfe951-b91b-4e1b-8203-77252c958164", "comment": "Malware payload (Gafgyt)", "value": "c88c28d7760544e92415b314b599cece0c4b3ddd62365bd857eaf726fbef258778201b5a8cd7b38603157c83cef3f890", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671937476, "uuid": "788d63d5-8488-4f75-8690-fad9f37bd4a7", "value": "T173D3C65AAB619EBBD81FCE37069A4501248DE64682D93FBFB2B0C51CE74B94F08D3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671937476, "uuid": "71c53f0b-0eef-49ed-9459-e7268dd51b1e", "value": "1536:o2beTpNb9DERkLMurNpZ3efJp68E1wYqHvd00PUmkVmSFxBC7vXZX:o2cNJLlrvJF1MvdlPUmkASFxBKvXZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671937476, "uuid": "03b797f9-72a4-443b-a9bd-114190385486", "value": 134222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671937476, "uuid": "2218cacb-962f-41c8-bcf6-6e8765309626", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671937476, "uuid": "10a2a205-3c59-416e-884b-af111f509782", "value": "e5954ec0f8dee38efcb9afc2263b27e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dd3a7b3-845f-11ed-9db1-42010a9c0080", "comment": "Malware payload (RecordBreaker)", "timestamp": 1671978064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671978064, "uuid": "b093e9ec-92b0-4d73-af60-da9b502ff50f", "comment": "Malware payload (RecordBreaker)", "value": "cf13478b9e1c5488b4e30d318123ad81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671978064, "uuid": "58118271-a2e7-44d6-bde9-d1cf07d26ec6", "comment": "Malware payload (RecordBreaker)", "value": "712a5c955bd61408454fdb715f46dbd0edceb328e61ad1feb84939b6c69fb65c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671978064, "uuid": "be252402-f608-4fb7-bc2c-a2578be5cb4f", "comment": "Malware payload (RecordBreaker)", "value": "cd28ca5d6b2a83f2220197144d9de6a89ac215b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671978064, "uuid": "9223c8a1-506a-4385-9a3f-59ecdaf2b495", "comment": "Malware payload (RecordBreaker)", "value": "26d657ab10abd6a02a49ef52bfe0fa37e4a7d2154f126adaef27b5d62a304f7ada2191c2630cbd0a03ed6b864e3d2232", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671978064, "uuid": "d2414cf6-8586-44a2-b788-287a697658a7", "value": "T1EC34BF107691DC71C2D259709C2BD3F92B3BBCA15A634AF23608BA5F3E705B1AD26347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671978064, "uuid": "a1eeffe9-3073-4eb9-ae67-46b90f90cba5", "value": "8514760d95d5a493235b8748f65885e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671978064, "uuid": "fe5f7d49-5536-4c98-a7c5-c40e6e94dd35", "value": "3072:gs5WiL/Pe5wQEvTMRn/NHKe5kqUr2F/x2T7MD1tJ/Ma1XG5w7RkxmJZs:gmL3RpGwemq/p2ITJ/Mj5GymI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671978064, "uuid": "b1d78725-9514-4c2b-86fe-b6a1c438c102", "value": 237056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671978064, "uuid": "5ea26bc9-88b2-48e4-972f-d48a08ad7574", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671978064, "uuid": "050ed159-f1ee-4653-b4a4-9be8ddbead7a", "value": "s.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a838989a-8467-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671981625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671981625, "uuid": "cdfa5461-10c0-4518-bc42-d75665fcca89", "comment": "Malware payload (RedLineStealer)", "value": "36c6073ad0eb9666bf2e711be1ceb852", "object_relation": "md5", "Tag": [ { "name": "anydeskh.com", "colour": "#1C3D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671981625, "uuid": "a7b579f2-3909-429b-8c48-4c2c2fb75563", "comment": "Malware payload (RedLineStealer)", "value": "715ae96609191cd05dfeeddbe578125963495ec9e95b1668e277ac3becc14aa2", "object_relation": "sha256", "Tag": [ { "name": "anydeskh.com", "colour": "#1C3D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671981625, "uuid": "bfa7aa98-f667-421a-a39c-bfdd21a2615d", "comment": "Malware payload (RedLineStealer)", "value": "e6e938ff704aaf9cf9d69b86511611718fe5091c", "object_relation": "sha1", "Tag": [ { "name": "anydeskh.com", "colour": "#1C3D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671981625, "uuid": "3fed3565-15ef-4c01-bfaa-3777f9e56a6f", "comment": "Malware payload (RedLineStealer)", "value": "122fbcba5be1798fef12ef811947a3b097f90c4dd343e8ed402b972611afdddb81ba464c5fe23f5ee811cac6675a7771", "object_relation": "sha3-384", "Tag": [ { "name": "anydeskh.com", "colour": "#1C3D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671981625, "uuid": "b9a98cea-e69d-449e-8995-1e7025b97327", "value": "T11BC4290A307DA2B7F117CAB93857957A036D2CDA4280D639FBAEF6A90772F00051B757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671981625, "uuid": "e4d84485-bd74-411e-9c78-a1f274209926", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671981625, "uuid": "ad3ae27c-e571-42ea-b8fa-7a9412ad285b", "value": "6144:xQRe0d6m+FJGpXgIiyEIx36bm+m9bHMGsgL7G/+:SRe0CJCFEId6o/nG2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671981625, "uuid": "e1bc9d4c-4e97-46ff-beb6-7793c36d28fa", "value": 543232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671981625, "uuid": "b6510eeb-9127-4486-a6b0-bdbedbd4fc5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671981625, "uuid": "be346ef0-699d-4a89-b62b-f5e4da8c0634", "value": "setup-win64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cbd0708-8428-11ed-9db1-42010a9c0080", "comment": "Malware payload (SystemBC)", "timestamp": 1671954521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671954521, "uuid": "7c52ebe2-19c0-45b5-83ad-1ee42e3a8037", "comment": "Malware payload (SystemBC)", "value": "a0be0fc03b5e4097a0a60f89afd3ea9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671954521, "uuid": "d414f26a-d95e-46bd-a70d-d3ff1762de0c", "comment": "Malware payload (SystemBC)", "value": "71c37b1d53f487f7b8c025ab8b3aca6635e3d1555b5961a5c9b56bbbeca9888f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671954521, "uuid": "c8b941d2-0ddf-4ecc-b946-7114d0aa19dd", "comment": "Malware payload (SystemBC)", "value": "dae6c080f184ffe61e62931084cef68a5e45dbb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671954521, "uuid": "276ec0fd-7493-4eec-b49f-f17cb92bcaf0", "comment": "Malware payload (SystemBC)", "value": "786c78a6638b25ac8d70972a49976d243ff9e7228b83e6f1d3be5f438f52bda3f3b08bd61da8ba6498e0bcf1a47e5c9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671954521, "uuid": "4b06e24a-6b0f-48bb-8c9a-eecb5744e2d2", "value": "T149849D2672E18232D2F316721A35C7E55B3BF876253585CE2AD8063E1F21B90C7B635B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671954521, "uuid": "0672e600-a89b-4025-af29-4ae3638fcead", "value": "d943b9e62d78306a5b1f5a80e23ce7c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671954521, "uuid": "a11d5d8a-358e-44c0-ae44-fbe5475d65c4", "value": "6144:0bKbnMYcwtusRIUA3ku18D5kebj/juUe4WV5s+gVRfvV3PxD:0bgnFcoRIUMku18D9jrpzWV5JOfvhPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671954521, "uuid": "1171b02c-29ca-4690-b3d9-0a8be3afe435", "value": 384499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671954521, "uuid": "68199ea8-5aad-4414-a6a3-a687e1643ca4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671954521, "uuid": "c0c9dc69-fab1-4e41-9456-9ca2c79f9ede", "value": "a0be0fc03b5e4097a0a60f89afd3ea9c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4895843-842c-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671956413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671956413, "uuid": "5c09714f-9644-479c-b5d0-0c1c07164a0b", "comment": "Malware payload (RedLineStealer)", "value": "06954f9d525615085402fa958b5b2a15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671956413, "uuid": "466eb06b-564a-48eb-b225-d404ce1a4497", "comment": "Malware payload (RedLineStealer)", "value": "728d0c12a4883b351dab40bfa2881a0dc967f9ff598384050da6c43d0d9bb476", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671956413, "uuid": "1951d9f6-7e56-4839-a837-826d8ddf7142", "comment": "Malware payload (RedLineStealer)", "value": "13ab62d6412659cef215a5577c804b3efffd738c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671956413, "uuid": "fd6a5c91-382e-4035-a4a0-bf43218c6eba", "comment": "Malware payload (RedLineStealer)", "value": "69a201cd9daa7a4f71a667c2e519ced5a5e2d1924f4086c495be1c7d92891856a48a8bc56629b49027903c5299ced290", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671956413, "uuid": "c8227cc4-0a89-44e0-b6bc-294a7dc9a010", "value": "T19294490CA4C15031D96238314AE7A97C993F7633179667EFEF883A5D4A20AF1DB37162", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671956413, "uuid": "e68d76fd-4bc1-45c0-b75e-6d1ea2145b35", "value": "7e7c1082b38a4734d89e1f235c71c850", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671956413, "uuid": "3151a13a-4220-4a97-82df-0e30652ffacc", "value": "6144:sPIxOrHmF27am0pv+09bVzjeAOMJJG4RHa8rFnbVerEAHKbcxNGPl:sPIxOrHmF27amp90JG4R7RcrzUPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671956413, "uuid": "ece33e1e-4a6d-4111-9fec-50415ec4604e", "value": 408064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671956413, "uuid": "de3e6aa6-e677-471b-b1d4-e997abea6bdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671956413, "uuid": "faa7aa0b-c320-485b-bcd1-0d2e97e5b8c3", "value": "06954f9d525615085402fa958b5b2a15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b412e715-8447-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671967901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671967901, "uuid": "7914b3af-f311-4bac-824e-2059bc1b35df", "comment": "Malware payload (GCleaner)", "value": "23196f3b4cc186ae63d1316e38b5a1f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671967901, "uuid": "00a9d3d5-7a4b-4864-a277-88d5e8260609", "comment": "Malware payload (GCleaner)", "value": "730bbaa3aa859a124fdf5da2035cd29d91afc7319cf3098ce86d236629668d01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671967901, "uuid": "8fe1cc57-344d-459b-9f3a-ce3c2ab8eb7b", "comment": "Malware payload (GCleaner)", "value": "829e818a0bfe5aaaa4445dbdf9348e7440e5c400", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671967901, "uuid": "73a4ae1b-9b81-45cf-a82e-e0d64b7215c0", "comment": "Malware payload (GCleaner)", "value": "e925a638ed3eeed6d9f72756ee7a12b4ecf29ff3e31d2bd06d470838e74b4cb3b785d3f3ab8af7e452af759599f1b2a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671967901, "uuid": "323b9b7a-02ef-4d4e-af61-bc1bb87d0bf9", "value": "T13B8533C2F9A78979C16FD0346E94F35432A1A7902320C53E58ECCEAF7D3950C976B5A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671967901, "uuid": "587c340e-04fd-4d2b-89ca-c0e2ddecf382", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671967901, "uuid": "5e8007ca-22e7-4e64-89dd-78fb7d7542ef", "value": "24576:BiziU5FrHglMGdOkaE96DROI+Nj3NfYxRTzLxgz62c2CAcX8akHo6G9XfY7wz56c:qi2PGdOhBidfw9zLx72c2CqaD7imRZai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671967901, "uuid": "a86012c8-a2bc-4f50-9284-9553706dbdca", "value": 1835238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671967901, "uuid": "bd5208e9-fdfe-4773-96a1-12ff31cca70a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671967901, "uuid": "d8028154-6fce-4957-ba85-354ca476322e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19c7a58f-8448-11ed-9db1-42010a9c0080", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1671968072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968072, "uuid": "151843a7-16d2-4e88-ba57-c6073aeff5d0", "comment": "Malware payload (SnakeKeylogger)", "value": "a2b7cc4c3cf2da68e49a1da149fc6269", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968072, "uuid": "6207a044-1aab-44e6-ab2c-c1bdfcf5d703", "comment": "Malware payload (SnakeKeylogger)", "value": "7392a24e4f77bfce3476c9368eab06e15a317f8475f1d2adc2f8db74ab8f9f72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968072, "uuid": "acfcfcc8-3415-4ced-b38d-552715d2b8c2", "comment": "Malware payload (SnakeKeylogger)", "value": "693d1ebdba3959c3456b327024ec2a1bd27adb96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968072, "uuid": "f465de93-4ed7-4688-a698-426558507e95", "comment": "Malware payload (SnakeKeylogger)", "value": "afb1578122e156e880a8e9e0c8522728d0eef010dd2e574d7b6f624379443030cc82a9219eb32b58f91c7616454885d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968072, "uuid": "5c2dc5ad-0919-497e-b130-4a0b16c9dbe7", "value": "T19DC3071D3BFC8804E6FF8A7315B14211CBB5F952191ACD1D1AC1F4592ABDA809E1BFA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968072, "uuid": "41290f51-2e53-4a19-ab7c-b88d9eb515da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968072, "uuid": "ea912cad-241d-4399-9a73-5e751e5ef4cc", "value": "3072:ipMrsxsGgc8HPis3Hz385Xpqb8MwBqJFbY:WfgqwQGbz3b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671968072, "uuid": "bc8004d5-5644-4694-a34d-d9c38056041c", "value": 129024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671968072, "uuid": "55428c31-35cc-4d77-8d57-c1ed703ff102", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968072, "uuid": "c2dbff97-641a-4300-aee3-b530b624c59d", "value": "a2b7cc4c3cf2da68e49a1da149fc6269.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8b036ac-8464-11ed-9db1-42010a9c0080", "comment": "Malware payload (njrat)", "timestamp": 1671980418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671980418, "uuid": "a0c41fc8-1904-42b4-8d82-045d9c839b44", "comment": "Malware payload (njrat)", "value": "bddb4d3fb8dc47b7e9b62dbe27f1ca99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671980418, "uuid": "90c4cba9-a0ca-4fe2-a386-f2ca35db9644", "comment": "Malware payload (njrat)", "value": "73c80bf251add3ea65b0172936e65e384dd3e7f00f0fd30efd502559b6d6c96a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671980418, "uuid": "c56f3807-eb95-4440-a953-56a6d3489cbb", "comment": "Malware payload (njrat)", "value": "e089e3a9c3f6fe9453f0254654b0113568d2035b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671980418, "uuid": "425cd127-0b90-48f6-8641-d7c96cdecedf", "comment": "Malware payload (njrat)", "value": "593e4fb37f925e7e4016f16f68fb2a44f02d926d8b017a7c876371b011d73c40260f79e44a9daf2e47981888138cd1c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671980418, "uuid": "2e47a42a-f274-458e-a6df-c95cd517fea5", "value": "T1FB25DD52972F851699ED1871DC1466C2CACC4F3F2E027EB256408E6CADB26A7F65CF30", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671980418, "uuid": "74c977d0-8202-40cb-9081-27c00e7946ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671980418, "uuid": "b6e8e0d9-087d-4770-b933-13d35acee03b", "value": "6144:APSPFgkYwTKDe+VdaIHaJ3pqSG8a7Cbu0U/eozRZHdYem6Ekg7oSmXy87V04c4p9:4O6NZ00JvaHi5DYCxxOO1obFb3cW9p7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671980418, "uuid": "eace9b0f-efc7-460c-891d-aa1c3a968c1d", "value": 1047040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671980418, "uuid": "096c39c2-77c0-4a3f-a0f8-6b98a2432050", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671980418, "uuid": "9ff3e611-ef0c-42c9-9126-8307fab6d551", "value": "bddb4d3fb8dc47b7e9b62dbe27f1ca99.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39c63d3a-846f-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671984876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671984876, "uuid": "dc9b2812-6427-4922-b2c0-3212c294fa0e", "comment": "Malware payload (RedLineStealer)", "value": "6313c7b9bac61b7eeec4e806149ca312", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671984876, "uuid": "b49f735e-9fa5-45f0-983a-9c90425973f7", "comment": "Malware payload (RedLineStealer)", "value": "73d2a3e816c731410ee8b4b6cb0fd06bfd8dd8463caa9924f717da8bac0d34f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671984876, "uuid": "3fe03c03-10cd-42e7-a647-80e5bdb8ef0b", "comment": "Malware payload (RedLineStealer)", "value": "bcfc4753b098d0f10f7707318633d037c01fc25e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671984876, "uuid": "0e0f311d-1f8b-4643-84a3-d7ac2fb1f9ae", "comment": "Malware payload (RedLineStealer)", "value": "dcdf9d70cb60b705a04b55eacd6f14ea1ff720796739af0b974f2d5c5dfe71d1ec9dd1eae2eacd1f8e652e4155e04b3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671984876, "uuid": "fbf14c74-1a56-4152-b5aa-a458d6d0973a", "value": "T14B04E11A7385D762E55DC679C4B291A70372F0369A6BD3037ECC4A762E233C09523BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671984876, "uuid": "bdf21d91-fb89-4cc7-b8b2-8a538bfdf82a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671984876, "uuid": "17a917b7-3416-494d-b673-c80cdb3d9b5b", "value": "3072:987RMgur6zzHvc5Hp/habaoJney83uvzl189wds5IxpePt9nyb:q7RTuGzMHpsaoJnN324XA9nyb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671984876, "uuid": "aa5444da-ee43-4f82-96e6-de32c65f6892", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671984876, "uuid": "60a67ab5-b579-44fc-8c4e-9d68f267e9a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671984876, "uuid": "a7025a84-c355-4214-8f29-8689d96c50a4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e5f7df5-8493-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1672000372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1672000372, "uuid": "4c81a389-6e97-4a6d-9336-01d8c7716c94", "comment": "Malware payload", "value": "00789b45f6e3f15ba245d7139564ab2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1672000372, "uuid": "6ce5ccde-4a22-40ff-95e1-67abb3edf0ba", "comment": "Malware payload", "value": "74ac5b3d68f28ceec79d3367a4d1cc308f12f3250e49c4d6f38d461f9becb413", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1672000372, "uuid": "92deb45c-1f47-43f7-a0b9-3af786584632", "comment": "Malware payload", "value": "fbf57577cbfb4432df2c79b13ba1d351d2db5c06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1672000372, "uuid": "0ca8526a-c12f-4531-be07-df31c7350108", "comment": "Malware payload", "value": "78d9b58c58d8e49054c4f35c4b1bb52236afc6274a97b8c547f372498cddc249e627631a7891ec2dc528547aa41d5e91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1672000372, "uuid": "e39c89fc-74e7-4e8e-aa3e-842517e03435", "value": "T17E34BF00A6A2C475C1532831482BCBEC5B1ABC61EA55DD3BF744BA6F2EF0290A5F6357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1672000372, "uuid": "be4e3a84-1d7d-4b22-9166-d52541434bf3", "value": "997a79bbc9b29ccf624aa79059ded875", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1672000372, "uuid": "550dc087-a01f-418a-a73a-94046f062888", "value": "3072:Jqpo6Lzde5JatCpL2m5zerbxA1e4lS1g/tK8h7HwPewJNLrcSb54VIcVTuh:x6Lz9CsENJtK8hMPewJpbIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1672000372, "uuid": "9ece9916-5caa-460d-8968-e113214b5202", "value": 237056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1672000372, "uuid": "8f610560-05ae-4b38-bb27-1d03b483f747", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1672000372, "uuid": "e2cb1862-9e99-4152-b34c-ee9c91c3b16d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc05b057-8431-11ed-9db1-42010a9c0080", "comment": "Malware payload (DCRat)", "timestamp": 1671958519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671958519, "uuid": "b0a1abca-9fb8-41d5-a49f-40375366c1d7", "comment": "Malware payload (DCRat)", "value": "b78b9ccd1b9383db112f9eba5397db4e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671958519, "uuid": "2271b701-e791-4703-8a3b-fad02f701c2d", "comment": "Malware payload (DCRat)", "value": "7680386e46daa89aa2d9a17884926570eec569517e90cd424f1f1c232c5d33ee", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671958519, "uuid": "1f6e7bc7-e51e-40a7-9855-75aeab386b41", "comment": "Malware payload (DCRat)", "value": "9625d5eb132f6d9aac24c3c220143f53a5104086", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671958519, "uuid": "590151a1-b706-4e3b-8062-ca5e8e27f396", "comment": "Malware payload (DCRat)", "value": "02c1c041f3ed31b41ca2f9ff85167eda700f3e0839e6e0ba30d9704d4fb32f531e25d05337ad93af8157577716637e5c", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671958519, "uuid": "368bd292-84f4-42fe-9479-6cc3250dc96d", "value": "T1B7D5E0017E45CA11F4495633C2EF855887B199416AE6F32B7DBE336D96223A33C0E9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671958519, "uuid": "93de2c3d-85b2-48a7-823f-8cacfe282016", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671958519, "uuid": "2b703f3f-1cc8-4db0-9b8d-329a1453a99e", "value": "49152:+GqQ0q3hONi2GOHyzYrvr8Ei89Dmlw09A280wNKdb0m9ZOK2uGKd:pqPVGAyol9DmxbVh04Zn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671958519, "uuid": "c4a50792-355c-456d-a8b4-94791d2b21f0", "value": 2926592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671958519, "uuid": "7288d84e-cd9c-47fa-b36f-043563358a02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671958519, "uuid": "a8eca957-a468-4aae-beea-6472cbdcfc30", "value": "7680386E46DAA89AA2D9A17884926570EEC569517E90C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cda630b5-844d-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671970521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671970521, "uuid": "5bcd3561-fee0-4c5b-aa49-e4b600b72958", "comment": "Malware payload (Smoke Loader)", "value": "5a06da61eff912c02f6da2fa705f67ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671970521, "uuid": "7cc4dc07-d0cb-47fd-ace1-dd5ae7803e90", "comment": "Malware payload (Smoke Loader)", "value": "769947de5e605e31a42f125687ff8e1e73e78ff82541533e1e8de21e5da393b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671970521, "uuid": "f286d674-283d-44fb-b623-69d717fcee77", "comment": "Malware payload (Smoke Loader)", "value": "d3600409822f38c0da4395921e40925f702a1c14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671970521, "uuid": "fb607548-f470-466d-8f78-95de9817a9a0", "comment": "Malware payload (Smoke Loader)", "value": "a6754b319aec7e22b7cf2f9e6425e17bd4145a820e3e068ef37f694dde5351a194d043afb1085160ec8853f3d93cb646", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671970521, "uuid": "5b739cde-27fc-4990-b718-1a205f5dc731", "value": "T1BE24AD106660CC62C7D249314C2BD7E82B3BBCA05B675AF737046B5F3E716B19A26393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671970521, "uuid": "1465e905-0b2e-4e25-a628-7d2150dfb707", "value": "7b9daca6da068f54ad4e1900288e8efd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671970521, "uuid": "53326ab2-fd0d-4b68-b0eb-84668a72eb33", "value": "3072:yZfyLafR9PgT5gNlb/pvu/Lb0USlWr+IWnYtJ/5ChDtdw7RkxmJZs:iyLKR9oIlb/p2TmlWiIWaJ/cNTGymI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671970521, "uuid": "99c41120-d93e-417d-a286-078edc34325d", "value": 226304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671970521, "uuid": "fbade06f-2df9-4198-8237-63cadf2a57a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671970521, "uuid": "d6f2caf9-3621-4bb8-818f-7c0143dd3a2f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9822c9ba-847a-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671989759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671989759, "uuid": "c73d53c2-0640-4e8c-bbc7-43e1644b720f", "comment": "Malware payload (RedLineStealer)", "value": "ed5220b44205fab74d4aa1dfb1052b41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671989759, "uuid": "88f9b123-1a5c-4bdc-8c96-1c42666e7f0e", "comment": "Malware payload (RedLineStealer)", "value": "777e65e00628ae01a5be7027d471bae921525620493656033d2823eb9c275ff5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671989759, "uuid": "4cb6b918-f42a-4bb2-adc0-b0df6a7f387f", "comment": "Malware payload (RedLineStealer)", "value": "79b2f3a2fa77424dfc9687296b1d63da29c24efb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671989759, "uuid": "56e79b09-ce91-42a8-a131-4bff769f3a9c", "comment": "Malware payload (RedLineStealer)", "value": "bf758bd1cdc45fca96942831451168abfc6593ea2aedfa12d90661917db569fe05f16db11aa3a96ed3fa300898961c26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671989759, "uuid": "f73d51f1-dfb8-48f4-a6d4-14f43a360503", "value": "T1A874E0112691CCE2E7D24470492BD7E95B3FB8605A6756F737097A2F3E302F0A966383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671989759, "uuid": "08e1ce03-0560-4bff-aac6-0372e80d09c5", "value": "8514760d95d5a493235b8748f65885e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671989759, "uuid": "79590b1b-9ec9-4988-b6bd-1cdfddc6c96c", "value": "6144:6OLhS7UGHuTWA1eQbSvQA+kceApT+pyKRTWt6gFZWhmJ/FrzkGymI:7dSXHufIQ2vMx6yKo4gFZW0VtUm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671989759, "uuid": "1b7dd00f-71cc-4fe7-9c15-189e94ab904c", "value": 358912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671989759, "uuid": "aa24c923-07e7-4139-b607-1e78fbd7dfde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671989759, "uuid": "792f05cf-60a9-4032-8c41-8855cf79d4a2", "value": "SecuriteInfo.com.Win32.PWSX-gen.31104.2078", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "498f1569-8477-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671988338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671988338, "uuid": "7749283d-3c06-41e3-b078-a3dd1580f2d4", "comment": "Malware payload (Smoke Loader)", "value": "19eb7da6bc579b3fd111ddd581ae7126", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671988338, "uuid": "84e40998-6dce-4c9c-b498-b072ded177f6", "comment": "Malware payload (Smoke Loader)", "value": "77dde39fe33ab9374817f6ad807f4f018ca36aa93162477234d0505d0ea4490f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671988338, "uuid": "cfffd818-8a7b-4831-995f-187fa161369f", "comment": "Malware payload (Smoke Loader)", "value": "5e277b1d1639dd920eb2cdc033812296f8a3d99c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671988338, "uuid": "86068ac3-5e4b-42c2-b104-9b1f04baa268", "comment": "Malware payload (Smoke Loader)", "value": "142dd638841ed7bbf22dd766cf20759f20b85487b5d30221c000080db03e26edfcd04ed33c03b44e58cebc80bede37f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671988338, "uuid": "45d04101-971a-4e78-a56e-c2d1977bb991", "value": "T14934AE107691CCB2D7D20971592BD7E82B3FBCA14A6355F22628BA5F3E702F09D16387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671988338, "uuid": "c9b093b6-d10f-41e3-a75e-3ea1f75caa69", "value": "8514760d95d5a493235b8748f65885e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671988338, "uuid": "7ae43ad8-b0a1-4236-b452-c8003300196a", "value": "6144:uHLyxZU81/t3Sbv9/MgPD0TtJ/xA4GymI:yexZx1s9My0TtVeMm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671988338, "uuid": "aafed41c-147a-48c0-a1b5-d25000af2d95", "value": 237056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671988338, "uuid": "659d8d21-7d59-409b-823d-be25a0a2cedc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671988338, "uuid": "b94b3b71-b728-44fe-b797-cf9086ea289d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c317ed8e-8449-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671968785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968785, "uuid": "f643f548-99ae-4490-8d50-8b6b5aa056d3", "comment": "Malware payload", "value": "eb110ff7e407c3df05c6ceb1b064de29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968785, "uuid": "3f91ce28-bda4-4f7d-9974-8c30e9a876ec", "comment": "Malware payload", "value": "782005bb624045fb335318cd6f32c075ec74e887ddb4487357423000bbc53c7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968785, "uuid": "f2bed52b-18d6-423c-bcf6-d642c95ebcab", "comment": "Malware payload", "value": "cf60ba0c4161cfc91de254db0cad30ac9af4a08c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968785, "uuid": "db518673-3fd1-45e6-9f9b-696e6f763d90", "comment": "Malware payload", "value": "d9681d0169bd4130076264afea6bb6c53ac1ad6fe0500878bf74db7d87fcd09203d2747802aa89f6065895936094fa50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968785, "uuid": "c27f5c14-d288-4529-96ea-fb930281b6f4", "value": "T18735231CFF51EAB5C05104328869CBE056E9FC322FA19ABD36486F0F6B74F80E957961", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968785, "uuid": "3d580019-4d47-404d-9ad5-54e3c52c2385", "value": "3ad97f4e43892433cafc01e0293aa96f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968785, "uuid": "7cbd2034-916a-4d1d-901a-759c054a81cd", "value": "24576:0UltAGrRDqInX1/nO8mDkLwOkoN1DFrt4M2dN:0UkGEw1Z1LmozD92/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671968785, "uuid": "f18a52a3-9716-4d63-b213-39b5bbb5e41c", "value": 1070592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671968785, "uuid": "420a9d7c-b5d9-4220-839d-5269d08c1dc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968785, "uuid": "48a518f9-ce72-4ee0-ab7d-8a573abeaa34", "value": "eb110ff7e407c3df05c6ceb1b064de29.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "108a960a-83fc-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671935415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671935415, "uuid": "e1490808-1abb-4f81-9a15-8d911725a0ff", "comment": "Malware payload (GCleaner)", "value": "c60d1f79141d80d9a450f8a5a0af00a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671935415, "uuid": "f1af9368-0b68-47b1-a053-661ee9558a34", "comment": "Malware payload (GCleaner)", "value": "785f60993b631c7cf4ec289b055d5342d5997ff73d292c5e452dc44640ba3505", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671935415, "uuid": "d44e3207-5f69-408d-9af5-0093ce538017", "comment": "Malware payload (GCleaner)", "value": "73456488d68c37fdfb47cabb9f824157ad4be30b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671935415, "uuid": "f1bdf289-a459-4ce5-9c80-4811b6a6a5ad", "comment": "Malware payload (GCleaner)", "value": "917d4ad1f1f116449ece0e80ead88ad61a7edd93985e97506991d7e8f9e5d9c8fe02ff4d4056249b86c72dce03ed8890", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671935415, "uuid": "fd4df019-4fc9-4d16-beb9-c5763ebb8d26", "value": "T1138533D7F8754C3BE02E80786DA49468B1B61F90571CC25E26D9CFCFAE6E61C9783206", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671935415, "uuid": "30add04a-a284-415f-8ee1-766c4b526dd0", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671935415, "uuid": "3cad8a0a-a012-4fd8-9f64-e0123f01a2e1", "value": "24576:RiziipOFnA0Mw6sjIxoyxyLFXPNCUeFqB2uLBDtcdToMhZC+2MDuKptmar6euJIV:6iipEnA0MFmIxMLHiuLBRc1CKDfdZa2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671935415, "uuid": "aabadce8-07be-40a6-b500-b2904f8da4a7", "value": 1815153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671935415, "uuid": "749177c6-9e80-4db7-bb8c-0fb33537cfe2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671935415, "uuid": "29b345fc-e1a8-4729-a7e5-8b2f4cde837d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3ba7c8d-8449-11ed-9db1-42010a9c0080", "comment": "Malware payload (LaplasClipper)", "timestamp": 1671968840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968840, "uuid": "fe56d40e-4332-4d7c-b78e-70d235696e70", "comment": "Malware payload (LaplasClipper)", "value": "549b94fa1bc4c8b2e5b892e598d7fcc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968840, "uuid": "e3b538a1-aebf-4ff2-9e0f-ae05a1cfc884", "comment": "Malware payload (LaplasClipper)", "value": "786edc69484ca285ca9f79e53c48102eed69a45424573071ae7a2fb38ef261d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968840, "uuid": "c44e5fec-b643-4703-a51d-7de09e69d08e", "comment": "Malware payload (LaplasClipper)", "value": "4af9194baeea1e3f9b97cf3444e9ec331721b1a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968840, "uuid": "e21725c6-418f-4306-aaa9-2e397d4a1be6", "comment": "Malware payload (LaplasClipper)", "value": "0be5273c2efe604be704516b7629169ac4c164c8d85687122e91af17323e4f612d9b11f40b4bc552ba0c6498a4436e84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968840, "uuid": "541b553f-bc16-4fb9-93c0-1be8ff276f16", "value": "T1B076337353714045E6C2CD368E2BBEE8B1F71F6AAB00FCBD259739CA2536450E612993", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968840, "uuid": "a7e54da9-4899-4bda-a44b-b120eebb5b5f", "value": "ce26abf4781cac630107d46b9c76d477", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968840, "uuid": "5c2e25cf-726f-4f83-b529-cd31cdf5c119", "value": "196608:K+yerBFuWi6qUTGTcMLSgxpNnkarS5jy:FyeNI96yTcMOgxpdbrS52", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671968840, "uuid": "f33667c7-fb21-4fff-852c-c74962d36890", "value": 7456768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671968840, "uuid": "ca9e011a-ea30-453f-aeb3-23769a356cbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968840, "uuid": "b4d28250-5653-487e-86cb-688377cdcca2", "value": "549b94fa1bc4c8b2e5b892e598d7fcc5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31014437-845c-11ed-9db1-42010a9c0080", "comment": "Malware payload (TitanStealer)", "timestamp": 1671976701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671976701, "uuid": "17928b09-06b1-4618-94a3-f0f5c6498e34", "comment": "Malware payload (TitanStealer)", "value": "f89d22841ec8a8350035913165885ca1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TitanStealer", "colour": "#EC6200", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671976701, "uuid": "2ae8f2ff-f7c1-45c3-956f-661e33cb4fce", "comment": "Malware payload (TitanStealer)", "value": "78e27b98a7490de940c39948497894aba3d1408dd3ca2bbaa26430032b0a0bd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TitanStealer", "colour": "#EC6200", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671976701, "uuid": "c0082b66-3f53-4970-a8a8-af423a29749e", "comment": "Malware payload (TitanStealer)", "value": "a1e79d95872ff57bd2e61a5476ecd00004084a9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TitanStealer", "colour": "#EC6200", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671976701, "uuid": "c708d09d-29ed-43d4-83df-bba755908719", "comment": "Malware payload (TitanStealer)", "value": "415523a02ab42e87504d28df1299b90f299c3aab4443cf4271f2807d0570d910679505de30426fbed3f76aca0882c561", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TitanStealer", "colour": "#EC6200", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671976701, "uuid": "214f7245-46ff-44aa-9cf1-dc855aee2540", "value": "T1B99533D4BDCFFFCDD8C8F4B16C69C85AC7202D2BB4E88A4BF90752164425948EF96294", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671976701, "uuid": "3e014d0c-b86c-406a-8ebb-6b5baabae001", "value": "227d8e180539434a4545745b2a33e7ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671976701, "uuid": "c1cbf547-004e-4b87-83db-9b03d7ebb25c", "value": "49152:kPjnikLby8chr4lCkmKGgGPtBZYAcZLcOU7m6PcyARY:kLnfL7chrGCkmKG1YAJOU7EycY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671976701, "uuid": "e75c02aa-06d2-4daf-9b6a-22b0ffc87bcb", "value": 1929728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671976701, "uuid": "cc774e0a-da39-443b-b7ee-2b221d76fe16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671976701, "uuid": "67f4948f-75a9-4ba3-951f-da341dc7cc60", "value": "f89d22841ec8a8350035913165885ca1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6cdea1f-8475-11ed-9db1-42010a9c0080", "comment": "Malware payload (Matiex)", "timestamp": 1671987743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671987743, "uuid": "f605fcdb-7a52-4d6f-a4f4-c553257b247f", "comment": "Malware payload (Matiex)", "value": "bd05a2e89d0fa8fc885335bb28abf82f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671987743, "uuid": "3d2bd57f-69bb-406a-998c-69307a05cfa0", "comment": "Malware payload (Matiex)", "value": "7908e0fbec2d187dbc950958fe7de240a20f19af75b2a5e3c864d316465e26f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671987743, "uuid": "d6bf868f-660d-4ca9-b9cb-b890b9e597dd", "comment": "Malware payload (Matiex)", "value": "9d3825d8fca4c181c243aa17c5a1949faafab19d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671987743, "uuid": "1ddfa9dd-605f-49f3-bffc-5306abf8a575", "comment": "Malware payload (Matiex)", "value": "7869b50ed13db766703c58a0247443532b4095ed1a246ade7dec8677034b8f9686a00db426fd4472b57c1bac47c6cf8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671987743, "uuid": "10f78716-1c3c-4f02-ac2c-ee71acc12eaf", "value": "T117F4F192B3A840C8C06BD674CD605627EA72B8A457346AEF5760CE790F33BC5F839716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671987743, "uuid": "e0544610-c277-4ea3-a1fa-c38dbaf02383", "value": "755b26ee88bff31382938e00e4a0bfa6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671987743, "uuid": "c792c635-9f17-4040-a252-12eb4745ff73", "value": "12288:aCe8LxGQ7MRSRAsDYeQBWlWc4b70eU06zTwjZ++R5Mi6/ZVgCp0TLAXZoCzZWpfb:aN88Q7aQjDYLWlhW7JUyZ++R5PyZ5pcN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671987743, "uuid": "8295d45c-72e0-4d23-83b3-cd89eb5fe5bd", "value": 727008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671987743, "uuid": "4cd894a0-ee87-4781-830b-d44b6fa3fded", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671987743, "uuid": "13e90346-d0a7-4a8d-bf2a-6f6fcec6bcd6", "value": "bd05a2e89d0fa8fc885335bb28abf82f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7621ae3b-8461-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671978964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671978964, "uuid": "42d20e68-6baa-46c6-a719-a6ad34e1bd1b", "comment": "Malware payload", "value": "1a77644635a5be939a4d3255d7196d96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671978964, "uuid": "7656d5ba-c196-4745-9dc6-95c75d6d4a42", "comment": "Malware payload", "value": "79a588cb43914797a9d5ab67a4b7d092e51744e1158de43b5ebfa01910fa741c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671978964, "uuid": "4541749f-ced9-4f5f-9a6f-eb912509a442", "comment": "Malware payload", "value": "d58c39c4e0c03c52f94e78b0bb6135211803696e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671978964, "uuid": "cf3813c1-6696-49f8-a004-68a582b51574", "comment": "Malware payload", "value": "fbfdf401a1b78d50568dd4f7d5ed25a4f2f4d173f9685d20c99c4de810a63fb48344dbf883dc9cbe2933e99bd8d468cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671978964, "uuid": "8b072b08-dd07-460d-a404-30013d7a0d2f", "value": "T123137D207980C072C493A874547892E2BF2E592222FA9C879F191A755F727D2B37F35F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671978964, "uuid": "10587500-7135-495e-bcaa-1904f5f83d56", "value": "768:T86Q/Ca5NEdt8R3GFYI9LI40UjSBpz0F9DL5QPE:T+/CLt8w3Ld0UjDPGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671978964, "uuid": "45b0dd9c-75d6-465c-adf0-2d1e54b1b87b", "value": 42352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671978964, "uuid": "eaf53c0d-3fc8-48d2-970d-6c5345dae48c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671978964, "uuid": "c7d98193-ca28-4788-a2f8-210caa172790", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33fdbcaf-83ec-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671928602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671928602, "uuid": "077e03fb-fbb0-4994-a59b-f4f28260c179", "comment": "Malware payload (Smoke Loader)", "value": "ab6e3eb5715e3ec71089585a1c1d97be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671928602, "uuid": "6439d919-404e-42e5-b79b-46ce34425d36", "comment": "Malware payload (Smoke Loader)", "value": "7aa3a3f6134a7dabf61cf2a6b35e5905668df803eb8c4aef742727a5095030f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671928602, "uuid": "0c66d83f-3547-448e-ad28-990be2dfbd45", "comment": "Malware payload (Smoke Loader)", "value": "743ed1a3c33f4a9e708b8b8703f3f964ed8ad7a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671928602, "uuid": "30aeedd9-cbe3-448d-94ab-e9bf3c3b6caa", "comment": "Malware payload (Smoke Loader)", "value": "c4f5512f3b8c9a3b172584c960894717da16f1febfb29b5a509ae5bddbeea0de96f1becb9ad5dd1a268586118616e16f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671928602, "uuid": "f06f4830-4627-4ca6-bf3a-5442587d4590", "value": "T10724CF0CBA92D472D55205308929DFF4673AFC319F609A6F3710BF2F6EB0E909526366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671928602, "uuid": "664a8fc8-56da-4ce5-974d-b15ccaf14286", "value": "919fbdc4b5aeef59e4e8a300d491562a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671928602, "uuid": "b866ba34-fa95-4495-a3af-724b8830da1b", "value": "3072:tvBrLU3To5s/w3gSUdn26kh1yDjW9/6UzXauD4nTgTNf/ln:PLkY3o526gaUDaM4n8Tr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671928602, "uuid": "9463fad3-eb25-42aa-8b77-a22fc201210a", "value": 229888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671928602, "uuid": "907688b4-3f6e-474f-b2bb-136d2d7b9ba2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671928602, "uuid": "1c1fd964-5be5-4ff7-8c9a-1dc8e848493a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "168912d0-8448-11ed-9db1-42010a9c0080", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1671968066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968066, "uuid": "f478e989-967e-455c-b7b0-4b483e1cc18d", "comment": "Malware payload (SnakeKeylogger)", "value": "748d2f91ee0d537d46727874ff50c671", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968066, "uuid": "659f9052-5e27-4cb2-8c55-98d915004704", "comment": "Malware payload (SnakeKeylogger)", "value": "7da5ff274247f3936df6b9d2225cc15e8990a4efec62f4f82147071fcab72898", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968066, "uuid": "63c82a23-4827-4a6e-9c4e-62565eb337e8", "comment": "Malware payload (SnakeKeylogger)", "value": "dd892f73eaa7c2b0f3c86525be7ef2a7e52745b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968066, "uuid": "4cf9ab79-2e6f-488e-ab26-4aea612a3fac", "comment": "Malware payload (SnakeKeylogger)", "value": "b3315dc4369ce2f8f8bd66ffc96d466ae74112cc78ada6f6be0f30247253a8d34d80378738acd99a5c5a4ad375979362", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968066, "uuid": "692304f8-9a29-4a46-8c96-e518f821c731", "value": "T116A402997898C89FC4991BB08D96FB695230BCB11C989C873D6A3F2D75B1381202D7FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968066, "uuid": "c403e009-9185-4d40-a44d-286f7e04913c", "value": "97318da386948415d08cef4a9006d669", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968066, "uuid": "0cd0b57f-681b-4201-a0bb-e32b71167d00", "value": "6144:qkw08k8hN3UhCj6c9FUF/mjcUxB7DyOmU9eTuwCbk3AOtx+c4rXzyutF604eQT4U:xPAy/BU/fyO7F4Q4kD+urQTpG5g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671968066, "uuid": "f3d49fd6-bf48-49f5-b8d3-989042fbe5e7", "value": 492112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671968066, "uuid": "f8dc982f-ed37-4dc3-b4a5-2dcd3e251b51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968066, "uuid": "beb16dba-0fa4-4024-9d51-5e1f6f97a92c", "value": "SC-20221225.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae9ebacd-83ef-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671930096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671930096, "uuid": "6b1380af-62f1-45a0-a9a8-0136acd5fe42", "comment": "Malware payload (GCleaner)", "value": "6297671af99c001aa761ecdb4e44dc6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671930096, "uuid": "5ce83e4c-9449-4200-9d05-f5e123a5b528", "comment": "Malware payload (GCleaner)", "value": "7dccb66fbb8f7004b0175a19be321002e91d2d8cd781ff0370e8fd61d4ab49d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671930096, "uuid": "9803e204-3169-4907-8afb-8e79d022ac4b", "comment": "Malware payload (GCleaner)", "value": "ffff34a1957578b52ca38922bdd1fdd156846e4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671930096, "uuid": "530d2af3-991a-4dff-ab98-0e40de57286e", "comment": "Malware payload (GCleaner)", "value": "e9cf22d65302b58132609cd5ac485509c2ff8caab9dc560e5c3df05f0e947a6f2e7c74125b7b0210a85d73c3cca8678c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671930096, "uuid": "e673af1f-5e23-4e8b-a173-14bc22801436", "value": "T1AE8523C1FAF00937E26D80749E84DD54B3B2BBE02716560A1CD5FE8FAA7581C9B97603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671930096, "uuid": "485758ff-397c-4bc7-acdf-a03308ece864", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671930096, "uuid": "6dcd2d52-0de3-4d41-add6-71506da222ef", "value": "49152:ii1tOwKVwyTfX838bnH2CJ/Dt8GFdXDh3Za7:ii1tOwPToH24582dXDxM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671930096, "uuid": "89669367-ab05-454b-bb56-62bb8cbb9272", "value": 1807374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671930096, "uuid": "0b9254f0-678a-4a8a-8eaf-8433cc78ce80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671930096, "uuid": "f8766b2b-af8e-4c41-bacc-4b8d5d9828b5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f384da48-842c-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671956411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671956411, "uuid": "426f9073-d2e4-4c56-a61d-ab8be3a40cef", "comment": "Malware payload (RedLineStealer)", "value": "7c79767f070899d102d6f20dd4aab76f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671956411, "uuid": "6b410957-308a-49cb-9481-227645364a23", "comment": "Malware payload (RedLineStealer)", "value": "7f11a927ac9742f5b53973e5a198044f52c11af540c028ba81bf1b93ecdff4f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671956411, "uuid": "1da60f8a-a876-422e-81ba-e1f191ae336a", "comment": "Malware payload (RedLineStealer)", "value": "2d520306e1edcd13b37e12eceedf261f5c15abcd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671956411, "uuid": "6ba60a88-2e77-41e3-ac5a-71e6b4764213", "comment": "Malware payload (RedLineStealer)", "value": "b3c72e8d1b0c07984bb626d7b324e803d167a4ef89006c8eed5ad792eca636aea63e9864720f1ad4e90428b0d3ce2a37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671956411, "uuid": "4c0f7ee5-4c10-4a9d-a63d-58e5089e36f1", "value": "T1B1940506E0CDACE1E7BA833147B4D965B529A42A031514EF5FB7B61ACAE01C33F3D259", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671956411, "uuid": "71331ae2-d99a-408c-8a7f-d5cbcde5cdf1", "value": "7e7c1082b38a4734d89e1f235c71c850", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671956411, "uuid": "35cf77b8-5323-491c-a553-ca37bdc57c84", "value": "12288:2ygxer6dluLigEZoNZaZDhm8aAxHsyKP7:QuOdZ6ZyA8aAxHsp7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671956411, "uuid": "f713b1bd-1426-4caf-ba10-a65a9f228af4", "value": 408064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671956411, "uuid": "5eec39fe-9c31-4018-9160-96554c3b29c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671956411, "uuid": "11b52f4f-9381-4b58-b86c-0f6e29380d1c", "value": "7c79767f070899d102d6f20dd4aab76f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c428ad08-8400-11ed-9db1-42010a9c0080", "comment": "Malware payload (Gafgyt)", "timestamp": 1671937434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671937434, "uuid": "414506e0-3962-4fd9-aac4-ff76e23b3839", "comment": "Malware payload (Gafgyt)", "value": "d72a6633ba3803c7fb1ce95ddfa741aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671937434, "uuid": "ccf9c783-9512-46e5-9e2f-fee1765b4f35", "comment": "Malware payload (Gafgyt)", "value": "7f4eed6748000ea70f209754c5f1ba2585ff87f60799c5edb52e8f7221669f86", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671937434, "uuid": "3644379d-43d5-4a0b-9997-7c4bec1e9216", "comment": "Malware payload (Gafgyt)", "value": "d57ee33eb6809509af50da4511a7796937d85311", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671937434, "uuid": "7769df75-d641-4d50-a656-c7bd667ce0f3", "comment": "Malware payload (Gafgyt)", "value": "825f8be6273609ebca41cc8e6b2bc38b21bc84bb6ff2a5e6b77fd01b16e72f76b310bedb53a64fe2cd8a9843e0a1d3f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671937434, "uuid": "443cf1b1-d3c0-4b3c-8510-1b65c3b6218c", "value": "T108B30804F8448727C2D327BAF78E439D7735566457DB33116A38BEB82BC6B982E29170", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671937434, "uuid": "5544f762-d1ae-416b-bd5e-35acddf0984d", "value": "3072:9lX2jKRi0ZDvCTppv7DSubUmGVrQAXiUXouX:6j6ZUppv7DImGVrQAXiUXouX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671937434, "uuid": "32c3cd58-b4d1-4dc0-85bd-c400f4e9e285", "value": 112657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671937434, "uuid": "e622d84f-421b-48d0-a155-e136d0206771", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671937434, "uuid": "bf1a08a0-93d7-484b-a800-8ba46dc60149", "value": "d72a6633ba3803c7fb1ce95ddfa741aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abf37036-8445-11ed-9db1-42010a9c0080", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1671967029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671967029, "uuid": "6bbfad3a-2760-409a-bfb1-575af3273826", "comment": "Malware payload (ArkeiStealer)", "value": "c657dda51197887c07acb2c0020741d6", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671967029, "uuid": "48dab689-8234-4928-8d62-2d359c9cd025", "comment": "Malware payload (ArkeiStealer)", "value": "7fb81b96e4df407058f5c9b96096f409c2783db604d67f31dcb4d2d8b38e917f", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671967029, "uuid": "b6ea8d5c-212b-411c-8337-4176bd14de1c", "comment": "Malware payload (ArkeiStealer)", "value": "b7ad6e0288310078e3dcac605b0a93213f352282", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671967029, "uuid": "62737e7b-b23c-43dc-af97-e6adc9c2aa27", "comment": "Malware payload (ArkeiStealer)", "value": "68d5615ebf65352e61429d7c0b5b56c7e94f85c3f13327c11a27ec2acc51510d403a1c58f734628d0a5551afcdabed2e", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671967029, "uuid": "bdd33e22-8043-4a38-b955-42250dd615bc", "value": "T12874E01036A1CC75C3D24572492BD2E82B7F7CA28A6346F33748BB5F3D711B1AA16287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671967029, "uuid": "8ebeb9b9-8db4-4ee7-84f0-0e33c5e71c67", "value": "7b9daca6da068f54ad4e1900288e8efd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671967029, "uuid": "31f90ad6-60ce-4eeb-bcba-d9164da1fe9f", "value": "6144:cLSRLYTCFKu2N4vyFtE7DiheOvE2ZHrNcEpDsUCe/hTx3PJ/NhnGymI:c4ngu2N47OvEyHrnNx/VNh9m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671967029, "uuid": "04f7b2a8-3741-4c4d-bd61-6162d5672381", "value": 346112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671967029, "uuid": "5676290a-ad81-4b95-8214-8953f781e504", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671967029, "uuid": "a21f457d-bef7-435f-a3a6-b22d31edbf23", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6308a56-847a-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671989809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671989809, "uuid": "836b810a-ff1c-4719-889f-78a6cb5a502a", "comment": "Malware payload (Smoke Loader)", "value": "ee559517ecfac2cb41531aa773b8d560", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671989809, "uuid": "4cbd738e-8cfa-478e-8d46-cec3b0cbb278", "comment": "Malware payload (Smoke Loader)", "value": "806cd1c3e78a0e879b42327cf5663dd949ee36e428dbb660ebf51bf84e37567d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671989809, "uuid": "5349db7c-de59-4022-8d1a-70b0f1121c13", "comment": "Malware payload (Smoke Loader)", "value": "6dea2f1e1adc5c676e734be42a8ab2af97cde994", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671989809, "uuid": "1819b197-4821-4e4f-8f78-b14f1cb288cb", "comment": "Malware payload (Smoke Loader)", "value": "174cde4e0aa539fbcc9b36308d259d2b600875b1f20ebfde192b914336cdd6acdeb6ca47463a1b13fa5a0a98a89f782a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671989809, "uuid": "b0753640-3745-4fbe-9376-81adf23a9bc1", "value": "T14934CF00A272D065C45309305929CBE45B5EBC61BEA5DE7BF380BB5F1EF0A90A5F6363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671989809, "uuid": "9a0bbd40-aac2-4f81-a552-326823ae7a2a", "value": "997a79bbc9b29ccf624aa79059ded875", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671989809, "uuid": "ffc8fb3a-f6d5-4c38-9cde-e56d79cdfa28", "value": "3072:e92VXLABva5RalByTdBTEwiDFwr6wUL/K/Po1lS1g/tK8Akg/vLrcSb54VIcVTuh:hXLaksBGdywiDFVwULK/P6tK8MbbIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671989809, "uuid": "4158e537-4b24-48f0-b1ab-9c06ba38f4aa", "value": 236544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671989809, "uuid": "74d15384-5078-45b9-8435-2ae56eb24e55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671989809, "uuid": "436f3062-3980-4787-a233-64fd3071f1ee", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c05e4b4-8489-11ed-9db1-42010a9c0080", "comment": "Malware payload (IceXLoader)", "timestamp": 1671996020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671996020, "uuid": "97030ab0-c119-4a1a-a705-be8948e5d355", "comment": "Malware payload (IceXLoader)", "value": "075dcbfddffe7f8045b7d27aff6cf546", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IceXLoader", "colour": "#91F647", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671996020, "uuid": "37ce665a-58a3-4647-aa14-fc8bc399ee9c", "comment": "Malware payload (IceXLoader)", "value": "80adefed93903b47b8cedfb308e6b45efd086aed736ec6548318400db5c2c30c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IceXLoader", "colour": "#91F647", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671996020, "uuid": "3d5fb1d3-e137-49d8-ab48-a9aaee5ec589", "comment": "Malware payload (IceXLoader)", "value": "0d7eca98aa866b37d4dc416e3153de62631fd063", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IceXLoader", "colour": "#91F647", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671996020, "uuid": "441b3b6c-f4f3-40c3-a0cb-185110f6850a", "comment": "Malware payload (IceXLoader)", "value": "df74c4fbe8a6600e23fc2349b236bacbbccaf2143928dd69f54fc74550b087fda4e0c81aa705a09328453284415579d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IceXLoader", "colour": "#91F647", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671996020, "uuid": "bcfdb7b6-34cf-4dfb-b128-6051fc482138", "value": "T170A4126241A1C8B6C48D63B5C0769E9888251835DF923B1897A8E53FFC763C3E607E1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671996020, "uuid": "2b73fc7d-b839-4bee-a602-b47b85d35c08", "value": "712f4a29c405ecb576101d367b2180fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671996020, "uuid": "e83b6148-4a0b-430f-854d-b0ef57c2883c", "value": "12288:5u/osQMgL96w0SVvV6fcaubLH31O2lxvdJGtKcV47bYbuGh9krTR:5ur9gkEPGcHHX1OSr/cV4/auGho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671996020, "uuid": "f9cc2b71-36f0-419a-9006-bf1374ad0fea", "value": 472576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671996020, "uuid": "026afbb5-7d01-431d-95ea-f01e116f077e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671996020, "uuid": "1283f42e-73b9-4858-ab05-a3d9d5abc3a8", "value": "80ADEFED93903B47B8CEDFB308E6B45EFD086AED736EC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5163dc85-8451-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671972031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671972031, "uuid": "0f98c15e-8405-4609-b4f5-1ad646af9f2f", "comment": "Malware payload (RedLineStealer)", "value": "6ecb32fe0a776fe3b4db33e7afb17b1c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671972031, "uuid": "9e559e1e-f4c7-4450-b434-ee188d5ef1fc", "comment": "Malware payload (RedLineStealer)", "value": "80e78163acd3b14cc83ce01c8a9203236cfde0dedbc98259ff9e88b230982b32", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671972031, "uuid": "8a835a7f-e38a-4940-ac52-5b4620dfc4be", "comment": "Malware payload (RedLineStealer)", "value": "acc545bf4929aeb6a3ea4bb7efc679dea4400059", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671972031, "uuid": "fbe5ca4c-f5fd-4ef7-abd1-a6de530a848f", "comment": "Malware payload (RedLineStealer)", "value": "9f959f92c99ffb833b474cf6dfd6068415bdf22fcd8dfcb9fbfa1d4e76974dc87349508d7f13db922f83a0aee8263058", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671972031, "uuid": "a8e05716-b5bb-461c-a022-6a27ca855aff", "value": "T19A74E0207690CC22CAD249755D2BDBA82F3B7C618B6359F726086E5F7E302B17967307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671972031, "uuid": "8cbd6524-0da3-408b-9aba-c2f7646ff6c7", "value": "7b9daca6da068f54ad4e1900288e8efd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671972031, "uuid": "8c07eb94-0c30-44ee-bd27-7772b68f769c", "value": "6144:oLARTwjw4+lFhtqnXBykiHHimXp3WCLaratkJRXX4KDJ/plyGymI:oOYWkiHH93vJtkJ57DVpYm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671972031, "uuid": "2b803ef0-7a25-49ad-a752-7a503c59b1e7", "value": 349696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671972031, "uuid": "969e6d6a-1bad-468c-a3ad-716a9f213738", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671972031, "uuid": "335be112-d360-4e62-a320-deb7b0affe3b", "value": "6ecb32fe0a776fe3b4db33e7afb17b1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee0bcec1-8400-11ed-9db1-42010a9c0080", "comment": "Malware payload (Gafgyt)", "timestamp": 1671937504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671937504, "uuid": "e7d1be2d-542d-4ed5-9370-1f5f726e88b7", "comment": "Malware payload (Gafgyt)", "value": "04cf54eff2ba1a690efe7054ccfec954", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671937504, "uuid": "5760f17e-352b-4335-a281-90a17294f5a6", "comment": "Malware payload (Gafgyt)", "value": "82aed30e28dbc90103143a53e8415212eb0ff3155dc921dbae814bc9cd4d648e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671937504, "uuid": "bc61ead3-59e3-4f63-8fc4-516fb1753e54", "comment": "Malware payload (Gafgyt)", "value": "145ff7954b7de1c5478bedc0b92e9c979977255c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671937504, "uuid": "9a971bfa-7bad-4943-9fef-5d61c306868c", "comment": "Malware payload (Gafgyt)", "value": "fe21a2421cd43e967d10fe570582cc91e8ff0d2ebfa6f98bf7ee78545c8abfea9deb09f2032d8cc3911a100980b2a39f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671937504, "uuid": "dae4e24e-c6c1-4c3a-9f69-cadb7ea63034", "value": "T1EE835C49D747CAB3C88307B2029BBA764532F93B5E2E9E45F70D7CB49B124D87226712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671937504, "uuid": "bda9d80e-35fe-46fb-b190-a1d93147857b", "value": "1536:sQmab6bXPm8VjWWHT0im5t3ItTShKW6GLdUF5MI5AtpgwyUOGHfV+mLI2VOYjXUd:Oab6bXPm8VjWWHT0B5t4tcnBUF5MI5dL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671937504, "uuid": "65da482e-9516-4483-a463-599a12b7138d", "value": 86409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671937504, "uuid": "960633ce-de11-481d-9599-8ea2fdc6139a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671937504, "uuid": "19301c77-27a6-4572-979a-156fb79c9453", "value": "04cf54eff2ba1a690efe7054ccfec954", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b6ed323-83ef-11ed-9db1-42010a9c0080", "comment": "Malware payload (TeamBot)", "timestamp": 1671930010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671930010, "uuid": "ed5a2b98-826d-4d07-9373-fda014cea4dc", "comment": "Malware payload (TeamBot)", "value": "543caa0ce162a5de72edd147e7fa53b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671930010, "uuid": "1e4b8f5d-cf25-4a72-9e86-06759e1c4085", "comment": "Malware payload (TeamBot)", "value": "83c367edf37749ea7b2bc4c870cbbdb684ab265ad1209e071292a226584fe819", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671930010, "uuid": "f002496e-b576-4eaf-8f6d-90a695e7c52f", "comment": "Malware payload (TeamBot)", "value": "59989ba435c79aa98b2313e836455bb488ec5990", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671930010, "uuid": "d1d42c45-c9d2-44ec-a88c-2f52f9c57148", "comment": "Malware payload (TeamBot)", "value": "8566e499451e72cf72298dbc835c99ce390655952c44b2073b67d83f32a7592c62ae0ba628b86f2ff2b32dfd6f03090f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671930010, "uuid": "8e01bddb-72a7-409a-a90c-9ca137572bb4", "value": "T17D24BF0CBE92C47AC5524D7089159FE4A76BFD318B225A7F7340375F2E70E90A52A3B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671930010, "uuid": "a4f49bc8-89ce-4c5e-b10e-ffafd3e24fd2", "value": "1ea9f0326cf512ac0eb7dd4bc1a00a19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671930010, "uuid": "9211f749-aa86-45cc-8f7e-46fff69c0d85", "value": "3072:KDIMS2LDm5qbFpV3SHuBE28laCauDx22WbSpj4f/ln:cJLDRHVSyL0aCaMM2WbSpG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671930010, "uuid": "3205fdc4-5b0c-4601-b00f-65ff78da57e5", "value": 228352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671930010, "uuid": "caf749c7-794f-4b5b-abdc-ef4924e7cb46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671930010, "uuid": "e70504e1-739d-4ed2-89a8-4fb17351cd7c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18f1c238-8448-11ed-9db1-42010a9c0080", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1671968070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968070, "uuid": "449fa33a-0161-4861-8c30-5d0414d10457", "comment": "Malware payload (SnakeKeylogger)", "value": "f44ff429a8dd61f89cfc57be609c955c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968070, "uuid": "d3d84db2-0533-47af-86da-57cc5da9b5bb", "comment": "Malware payload (SnakeKeylogger)", "value": "85d070dae9aa47a620653a7eb47bf2b92b105a486650dc0549830d425fb4c85e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968070, "uuid": "e76de068-b674-4a72-b5b1-058d47a5fbb5", "comment": "Malware payload (SnakeKeylogger)", "value": "c54fa338c0f92fb8a3e689707e7f7535d16bad12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968070, "uuid": "db5c38a6-082a-4bc4-86ce-548360a1be4e", "comment": "Malware payload (SnakeKeylogger)", "value": "049b66c564c42d8ee2e8a33d1cf6f392e75caf811616a05b1568f56eea17040f1da007bed597ba447007afaaec34e498", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968070, "uuid": "3972e7c8-b1f8-4700-aa89-4bddfd92045d", "value": "T16BD49DB7157B02C1CE6A0679D57A1D100D1DD8F80702C6B6B6E3A2AFD6496CEB5C4CB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968070, "uuid": "b3283fe9-31d2-4090-8cdf-18ba918ce7c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968070, "uuid": "dc759874-7d67-4c53-8d61-f897fc6af4f3", "value": "12288:1pvdyX+qjJF0qDIcpoF0JnSgW2rqY7XBLHdvVr1:Ddyuqj3R7+0J6IzvNr1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671968070, "uuid": "197688cb-3f78-4b20-bdc1-e8e59ec50022", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671968070, "uuid": "e741ec94-0410-4ce4-88f7-abb0971b4ea8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968070, "uuid": "aa20e99f-a1d1-40fd-82c1-912c7bd4dcb7", "value": "Revised PO_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "547acdf1-83e7-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671926509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671926509, "uuid": "62ba1f41-419d-456c-8041-506959d780de", "comment": "Malware payload (GCleaner)", "value": "af82a59b286e8cc19c5fcd1a57006f07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671926509, "uuid": "8377a3a1-5462-44af-93f2-b38e9c325d2f", "comment": "Malware payload (GCleaner)", "value": "85dd0bdc44705034be84a41d4c56207547325a657dd0ece7bee6e1ea06652849", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671926509, "uuid": "7fb36086-d9ed-4f55-bef9-a6220700aeeb", "comment": "Malware payload (GCleaner)", "value": "f64dcf729ad0ca7036cf8aa6ae5ee815fadd36e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671926509, "uuid": "9cf27d82-69ee-4a04-9f6e-16c746c63072", "comment": "Malware payload (GCleaner)", "value": "ae73b08c323a2f92f45d6a3a8e8ca858ede51c0a3871ad9eb5522b0d50c14782f470add7a9e1689b732cbc5d2516ac1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671926509, "uuid": "d9f2eb91-2cab-4794-b706-ae69a40a036c", "value": "T1228533D5F5E08E79C25DC2B49E90D18BBA31AFE02728450D6AE0EA9F3D3344E9B47117", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671926509, "uuid": "50a8b3c4-9648-4da8-884a-990fc342f691", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671926509, "uuid": "4a9a6c07-a52f-4e69-bbe3-a7139651f286", "value": "49152:6i5PamXcljjbZ0jHvwODJ6flvEEAY5Zap:6i5P7cRbZaw8EvEEAGMp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671926509, "uuid": "9cfa6a8b-b7c4-46fa-bcf7-6d8f6bfbfe99", "value": 1820321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671926509, "uuid": "1722d21d-b5f7-4fee-878f-2e85edb7c427", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671926509, "uuid": "fc74f412-8d91-4924-8e1d-6c7900e1a512", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88135b85-83f3-11ed-9db1-42010a9c0080", "comment": "Malware payload (WannaCry)", "timestamp": 1671931750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671931750, "uuid": "9a5139dd-5ed4-44f9-9203-afed5b40adf5", "comment": "Malware payload (WannaCry)", "value": "017f63d0be693e53bc5b8edd426cfbd1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671931750, "uuid": "366ded42-4e3d-4b30-bae1-055f17b97756", "comment": "Malware payload (WannaCry)", "value": "86963c4751030168f7ebba58a99cf567ab7dd56ec4ff22ba785101aea45cd97e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671931750, "uuid": "91d910e4-d1f6-4527-acc3-ae2a7bb1fa2c", "comment": "Malware payload (WannaCry)", "value": "1d02de42b8278a5865ba9d8f8c0ce5d9212d5236", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671931750, "uuid": "181a22c3-b6c4-43c3-aef0-1fe36763e6fb", "comment": "Malware payload (WannaCry)", "value": "5b35d295e4a06c5ac5c1c58b1bc9712c72d244460514b645c61fe49fc5ce74b8c4f897c29ed473876bffa4d41a83e9b6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671931750, "uuid": "8a4ac83d-4634-46c3-8131-b362c60baa30", "value": "T18636F1037285C066D0181A394C67DAECA5E3FDD5FE2DD00B7ED2734F2976A86EA41B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671931750, "uuid": "db56d844-165a-4079-8921-7f7c342df7a5", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671931750, "uuid": "893c2a35-fbf9-44e4-ba04-7f406bfb63ef", "value": "98304:+DqPoBhz1aRxcSUDk36SAEdhvxWa9P5UBSa:+DqPe1Cxcxk3ZAEUaduBSa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671931750, "uuid": "fd178984-c8e9-4194-bb3c-0e640e16e8c5", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671931750, "uuid": "21c55b98-73c0-4ef7-aaf0-66b19b265d7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671931750, "uuid": "329d3050-2bc1-4d1e-ad0b-56e86c007826", "value": "017f63d0be693e53bc5b8edd426cfbd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b30a6d7-83fa-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671934708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671934708, "uuid": "4157e27e-1cf8-4628-b815-49006feec415", "comment": "Malware payload (RedLineStealer)", "value": "257b5ccc7a209304eedaba20117425d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671934708, "uuid": "88461f52-e987-48aa-9bef-63fdcf5fad39", "comment": "Malware payload (RedLineStealer)", "value": "86fe0a5aae7bcf333119902b9e2bbc5464fb0a89391b5534898f45680fcae9e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671934708, "uuid": "d900628a-a855-4e78-918e-09c3bc11cd26", "comment": "Malware payload (RedLineStealer)", "value": "4dea1dca0cc7488fc5cfb4e9a3c267011df930ed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671934708, "uuid": "052a8055-2170-4569-9ca3-ce4b6df951f6", "comment": "Malware payload (RedLineStealer)", "value": "cf7ba58f78a419f0deb0cc51372cd69f34992b3f8ba5b578b09bf136f7f556f3a85804fce7e61b5e207be9fa8a58e994", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671934708, "uuid": "7112b5b9-ab0d-47f4-bf1d-1263ff939879", "value": "T1A674F10CFA62E062D51104349919EFE56A6AFC704B60CA7F37443B5F2E70E91AF36366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671934708, "uuid": "0f8411a8-539c-45c4-8049-347dae7990e8", "value": "1ea9f0326cf512ac0eb7dd4bc1a00a19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671934708, "uuid": "b5d3066c-11bc-4e80-a481-7cd934fa0371", "value": "6144:WLkkQ62RyLM/ejCekW2BUSn8huGADpZ9hPsaMmKm:WIBRyoW7q8cGA1/h3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671934708, "uuid": "142aef6d-80b7-466e-b0fc-2ff85d80887b", "value": 350720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671934708, "uuid": "bfab9e76-9d17-41cb-8b9f-af6ec86d788f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671934708, "uuid": "87d7a8a5-24c4-4d48-ae74-0c0ca796aa61", "value": "257b5ccc7a209304eedaba20117425d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19a4f609-83fb-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671935000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671935000, "uuid": "a52a8f54-b414-4508-81e9-41fc4539296b", "comment": "Malware payload", "value": "228194ec93d0130e26bb18d34dadfd46", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671935000, "uuid": "6d0a4527-cbb2-4721-ad67-8282eb900388", "comment": "Malware payload", "value": "872d6f98c87cc9f9c7a447db24828ea9e00fc67d9eaa60cac45695f575c0e734", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671935000, "uuid": "6c0e70f8-cc34-485c-8b94-d59af70b7c57", "comment": "Malware payload", "value": "9b14f15412fdc3a7b370d07fdbb0ddb132cab4ba", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671935000, "uuid": "342e133d-dc3e-4cce-9c5c-05e907b42a5d", "comment": "Malware payload", "value": "61f9dd5e6a69896dc12c573d8682b367766a1bc567714523974b55476ec25b5b49f71663faaaf6675687a4acaf3a35d3", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671935000, "uuid": "207cd5df-2c7f-423b-bb87-9b251cf95106", "value": "T1712733631C0AE9DEC132A439467E2389A8358A1E3DE267222494DB77C5F3565CDCDFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671935000, "uuid": "0974b79c-6159-428f-b7f1-d387574c539d", "value": "393216:FmLO2sJA35z7A79L++0r1mbgafiubcLZXbfT9i/zVN2I+TXq1kKpPbNiRSKcsjJ4:owJA35z7c58BmbBffcVX9i/zVN2IkaOk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671935000, "uuid": "a9ced016-cf1f-46f7-9278-29a195953974", "value": 21469716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671935000, "uuid": "de8ee809-4371-463e-8726-8fe92c6556ed", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671935000, "uuid": "0854e8f7-2f04-4256-bcca-dc13ce7ac091", "value": "prog.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f972a592-8448-11ed-9db1-42010a9c0080", "comment": "Malware payload (RemcosRAT)", "timestamp": 1671968447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968447, "uuid": "f267aa07-6ec2-47f4-b33f-c9ce24025cea", "comment": "Malware payload (RemcosRAT)", "value": "53a43340c5a64d9bccc94a245759ea0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968447, "uuid": "89343318-ef86-4853-8212-8c77a7723c72", "comment": "Malware payload (RemcosRAT)", "value": "8758be9f226102217b3f28ffc1d6093dac1c9d5e8b3de32d85d150204169c10d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968447, "uuid": "92a608e8-97a2-4fc0-a8d1-90ac75374f7f", "comment": "Malware payload (RemcosRAT)", "value": "24a5ba1d86e871c72dcf1eb56770c410d6efb4b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968447, "uuid": "4e221591-2e7c-4fb0-8558-8402d2db2655", "comment": "Malware payload (RemcosRAT)", "value": "c40e827a5f01735fb14a20c263bdfb147c7915ddd54959c58c939021182646ced8ccc6540f48fb791e6b6248dc579bae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968447, "uuid": "822c2fa7-35d5-4ee0-949c-09fcfb16b32d", "value": "T12B35D17715F61290DEB60134D1391C140E3FAAE94622D2797AD372AFCA18BCD7D90AB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968447, "uuid": "bd8a6bba-6204-4ad7-9cfd-b25fbe194475", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968447, "uuid": "57825301-9384-43f0-acde-fcee348c37f3", "value": "24576:S9AQYzR1V/qrdx+a1FaHX6Rqg6uT3dR76lvqXpauqj3R7:S9AQYzRPkPFPRt6U3u6JKR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671968447, "uuid": "25e409b6-e4e2-40c0-81ef-df7fc950909b", "value": 1149440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671968447, "uuid": "f486c76a-cb4b-4b2d-9197-029b09736680", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968447, "uuid": "63d72890-61b4-414e-8fe5-f240527fe7ba", "value": "TNT Original Documents PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67741c01-84a0-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1672005998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1672005998, "uuid": "3734a414-0cb4-4ab5-a63f-da8c1991fcc1", "comment": "Malware payload", "value": "3eaec07698bd9747f91d905b6bf78f21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1672005998, "uuid": "91463b57-c288-4b89-beef-7011e3ac0cdd", "comment": "Malware payload", "value": "88948b276a9732fe05e0ea8b8a0d2a33d0d9083d1b7e3f09b4d28b6b192deae1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1672005998, "uuid": "aa484e97-c9ea-44d9-bc9f-936e4715ec71", "comment": "Malware payload", "value": "b596b905890c03ed7c89df0ffa254be5b42b9fe7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1672005998, "uuid": "8005a6d7-ca48-4807-bc06-e5755ada0252", "comment": "Malware payload", "value": "608bef064db1f7db1545bfb08441bc751ea960ec45cc3292207a0d8e14919fef3a717a7fa3e29b2a3010dedd40ed539c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1672005998, "uuid": "86f13620-628f-4b19-a2a1-4074c3ad640d", "value": "T17334CF21A392C0B2C15398705D19DBE55B19BC62BE60DD3BF780BA5F2EF01A095F6327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1672005998, "uuid": "56926df3-0135-4a52-a519-8119f7b08983", "value": "6a8f260c43148885d76dffe1ee7a8503", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1672005998, "uuid": "bd62a7f9-5f0b-44bc-b3b1-fdbb694b45e5", "value": "3072:ClmwLUF54sRzNxLR0kXR5Ch//Kc6+gaklS1g/tK8YDwKCLrcSb54VIcVTuh:sLUAs1zLR0kh5Xn4qtK8vbIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1672005998, "uuid": "bc36fe28-32c4-4271-9d17-ee87452a4d04", "value": 237056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1672005998, "uuid": "58de3378-dd6e-4d93-91a3-df57f926d87a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1672005998, "uuid": "534b9883-070c-4efb-a5c9-01c93adb34ce", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e863b139-8414-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671946085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671946085, "uuid": "62435997-cee5-42de-a031-c95dceb22184", "comment": "Malware payload (Smoke Loader)", "value": "710b4f4bf93baee1ab63f61e7e51d757", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671946085, "uuid": "55cc7229-b36e-4c37-bde4-d1acdbc5ea06", "comment": "Malware payload (Smoke Loader)", "value": "8896f2d4a2943a6f6e0daab390fd39af334182080a31b1f98aa228c6cdc48b8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671946085, "uuid": "ca647bf6-c579-4018-b060-4a99ae8a0b32", "comment": "Malware payload (Smoke Loader)", "value": "6c8b8d93f9ecde1e08faab396f8d4846eb136ee7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671946085, "uuid": "0d6e1b32-b4e6-4762-b4a4-a20fe1ef6476", "comment": "Malware payload (Smoke Loader)", "value": "8163a4d98454fbed2609bb29ce662e67e0da554ed3178057c5c46684cdbd217cc55f619739b2ed512aa4d9ff3bc10dcf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671946085, "uuid": "3dd3fda0-fe32-4d8e-b660-7c4364ccb03c", "value": "T12424C00CFAA2C076D55219308929DFE4AB2AFC715F605A2F3350371F2E70F90966A3B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671946085, "uuid": "2ca1383a-84c0-4316-b090-29ada41f0159", "value": "1ea9f0326cf512ac0eb7dd4bc1a00a19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671946085, "uuid": "d61a3b07-e7c0-4d8b-a5c4-4e9d51c82df7", "value": "3072:8DN1J/L8Q15XGlNcEZ5T3aqKk+auDNBzVGf/ln:KJ/L8QulnD2qKHaMz2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671946085, "uuid": "7090c253-2366-4aca-a5a3-69e34a795479", "value": 227840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671946085, "uuid": "5974c786-c195-4905-901f-8a2d9beb6dc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671946085, "uuid": "56d39226-69bd-4512-96da-2784a56fe85b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "952b8b02-8447-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671967849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671967849, "uuid": "daa74539-67fa-4f26-a9d8-b1099635b44d", "comment": "Malware payload (Smoke Loader)", "value": "efb127eb904fcedcc2edec12bf4ac809", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671967849, "uuid": "f9cebfde-da3c-48d4-be76-345656561bd2", "comment": "Malware payload (Smoke Loader)", "value": "88a869de110f57937f7245d5d98fc433b2a82066e4e16ac3688fe7fa16e16492", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671967849, "uuid": "5d1b9f8c-df56-4727-b093-2a37af97f6fb", "comment": "Malware payload (Smoke Loader)", "value": "0f77c08e6f30cc8624ddbaefd7a48011b2b61727", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671967849, "uuid": "9f90063a-41bd-4727-864a-93dbbfd79f8c", "comment": "Malware payload (Smoke Loader)", "value": "fd513c8a1eef402db16294a5b503b451fd4cbdcc36b5cd41cc1fbc3a9700c5862b78cd7b95899451154500cbda7f4101", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671967849, "uuid": "63a32f63-5693-4191-99c9-b85de0e5b79a", "value": "T1E124BF107690DC62C3D24935596BD7E82B3BBCA2DA2396F736043A1F3E711B1AD26343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671967849, "uuid": "7d1e4fad-e050-43a9-9a5c-0b824550a532", "value": "7b9daca6da068f54ad4e1900288e8efd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671967849, "uuid": "1788633d-0f20-40b3-b17d-ab4098eaa176", "value": "3072:rbOL1YRt5f953qVkovxVP6wCjFS8tJ/eY+Eqw7RkxmJZs:OL6RtpHiVvzP6wCjFSmJ/9qGymI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671967849, "uuid": "e625c243-fc12-4df8-8116-fdea74b0da3f", "value": 227328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671967849, "uuid": "a174c47d-a689-4c7a-947b-4e508c209e73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671967849, "uuid": "f1b9413f-4af2-41f2-b1bc-e7fe30fe7c2e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11b17a24-8402-11ed-9db1-42010a9c0080", "comment": "Malware payload (Gafgyt)", "timestamp": 1671937993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671937993, "uuid": "aeb6e765-9d02-434c-a5c6-062079479376", "comment": "Malware payload (Gafgyt)", "value": "ca16f71e80a218276c458beb5d22daec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671937993, "uuid": "4d7bf342-39c8-4c16-8f31-57527589c647", "comment": "Malware payload (Gafgyt)", "value": "8aa7c8a2ad686b4814e5f82ba47cf10d4561e0a475f7e2d2f3a2869758a121fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671937993, "uuid": "564ad06b-9d7a-437e-a18f-a07abddc9a7c", "comment": "Malware payload (Gafgyt)", "value": "d93025770f490552d57fa55de96c06cf1529c694", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671937993, "uuid": "5e1e5cc5-bceb-4623-8c1e-556fd61f4bde", "comment": "Malware payload (Gafgyt)", "value": "fe34eb529ddef37e07e6cddd4c6cde38f18cc65bc407e53c8a8c29b0c9e71819852e4974c71328c2ef84f6c616f814c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671937993, "uuid": "d9180518-d16c-4021-990e-69ba0b0d3cad", "value": "T116A31744F8448767C3D327FAE78E439D77351A6457DB33116A39AEB42BC2B982E29130", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671937993, "uuid": "3df7af65-4668-450c-ae27-4cfec2de89f7", "value": "3072:Plf1jKRi/VYf84YNk7XTRUmpEqQ45vVXY0X:vjdVC7YNk7qmpEqQ45vVXY0X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671937993, "uuid": "846d585f-2e5d-4028-860c-653cf6440f37", "value": 105111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671937993, "uuid": "0d41ba17-8582-4d0e-9a1f-cb1f81526e5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671937993, "uuid": "55759779-2270-49fb-b962-e7404bd746e6", "value": "ca16f71e80a218276c458beb5d22daec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "542b44e2-844b-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671969458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671969458, "uuid": "5ff166da-0aa8-4f08-80c9-445f89627663", "comment": "Malware payload (RedLineStealer)", "value": "c7bc4743b5597e444490e45da5b42b1e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671969458, "uuid": "1da79fc3-fe10-41d5-bf6d-36f305450650", "comment": "Malware payload (RedLineStealer)", "value": "8b0ac449b6ad803b6141bf9807c0178b22e83e48028a5a64dff6c5c5be3a8ff9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671969458, "uuid": "3ccb7f64-7e1f-4a6f-9f39-af4174b3324a", "comment": "Malware payload (RedLineStealer)", "value": "b6d9da6e74b98b601db062a602c76411d25fc965", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671969458, "uuid": "54a05067-2b02-43fb-8604-e674262b10e1", "comment": "Malware payload (RedLineStealer)", "value": "fc9a04389c7d4ee5f4eb6309bf1dee3cd6b5d574497590ac8d206f67417d73ad9b1d571ceb1253c992a4459d409d1b13", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671969458, "uuid": "800175a1-5648-4652-a968-6cac1199965d", "value": "T13974E0126695DC25D3D24579586BD3EC273FBCA1CA2396F337042A2F3E312A09E26357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671969458, "uuid": "29e1c4be-5e68-4f75-bfee-32d79fb03ce8", "value": "7b9daca6da068f54ad4e1900288e8efd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671969458, "uuid": "8f32fb90-bd24-454f-b6d9-2e5cc7e99089", "value": "6144:zLylRKpVcFfn7Sl2U6gilXFo8KUHbUoC3zMJ/BGymI:zOiTcLJD4oC3zMVPm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671969458, "uuid": "acfcb8b6-a25f-49b3-9ed3-f8cf9ac9f8ec", "value": 350208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671969458, "uuid": "949bcf93-7e97-41a4-87b0-f4c170c37eff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671969458, "uuid": "5c5c36d4-37b4-473f-8b7b-da3bf8c87451", "value": "c7bc4743b5597e444490e45da5b42b1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba7aba08-8400-11ed-9db1-42010a9c0080", "comment": "Malware payload (Gafgyt)", "timestamp": 1671937418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671937418, "uuid": "f02dc06c-4036-49da-b8b1-eb3fd895ee1f", "comment": "Malware payload (Gafgyt)", "value": "a828d2f563bd7f5040e7f25416338f4f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671937418, "uuid": "fb9a55df-4b79-4f6e-96cf-3c8ff041d279", "comment": "Malware payload (Gafgyt)", "value": "8bae81117cc19a76d3f7fbdb601566648deaf450383ba74561eb67faf3e04a84", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671937418, "uuid": "d2e9ca75-4919-42cc-bf7c-a84cf708e500", "comment": "Malware payload (Gafgyt)", "value": "ff5e38edf115603226418bf9cf480b6a596da3c4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671937418, "uuid": "6ce35fe7-9dfb-4eca-8f8b-6987d8dd7711", "comment": "Malware payload (Gafgyt)", "value": "26c0509b0ebd380a1e3bab53c6fd1e0080558a8db30eacc5886be9d13f8a20e6c571002ac667389342097ee888be97a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671937418, "uuid": "e2de4233-9963-4fb3-8ab1-abd00555439c", "value": "T1F2A33943A72D0F83C4DB99B12DB72BF1876DB97112A361C1690BEE9003739B81517FA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671937418, "uuid": "ca8d7dd8-021a-4ff8-afc2-05e45e2c700b", "value": "1536:7QQfckMzQzgv9OtAC0QptczD3z+FavgjTXvEmL49VqFjtUfkjX:7xH/JFDtczD3mB7vEmU9VqFBUfkjX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671937418, "uuid": "b152dbd8-d5b1-4c87-9243-9576d98b7ab7", "value": 99023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671937418, "uuid": "e1a08ca3-935c-47c4-b466-53e4bcf7379a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671937418, "uuid": "32f6965c-0b95-493d-b186-0d63b86191d2", "value": "a828d2f563bd7f5040e7f25416338f4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa9c6e2d-8475-11ed-9db1-42010a9c0080", "comment": "Malware payload (Amadey)", "timestamp": 1671987776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671987776, "uuid": "6172c8b1-9545-4565-a696-689a2a71c9c2", "comment": "Malware payload (Amadey)", "value": "ec6c80c5368cd7730f5b5fea30e7c99a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671987776, "uuid": "5bd56e9f-3f38-4a2b-aab6-b9cbd29dca87", "comment": "Malware payload (Amadey)", "value": "8d32e430ecb3f4a0f1d830110ac279241c2691e514adf0986288f00b32b57d2e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671987776, "uuid": "7aa01ea0-c905-4ed3-ad2d-ed80a45de28c", "comment": "Malware payload (Amadey)", "value": "41e9fb66c28f965cf5afd2e56602f155d973a83d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671987776, "uuid": "7a072c10-38b2-4178-8b61-1fd4a7280531", "comment": "Malware payload (Amadey)", "value": "603aa9d19add3528a4ba80345583376f7e09429c6b762d45a1b219c1484819e5dfe2f3f36184008c77db8be324de8cda", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671987776, "uuid": "f4fed7a0-b7bb-46d8-a7de-50b53d779689", "value": "T16954DF1126A1CC76C2D24475486BD7E82B3BBC914E634AF362587F1F7E701B1AD26387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671987776, "uuid": "e06d7d0b-c154-4bea-af86-0c5339c22037", "value": "8514760d95d5a493235b8748f65885e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671987776, "uuid": "93d9b286-b4d9-4e05-97fb-1d53e8997ef7", "value": "6144:ujL67avoujZou3NnQs5rUX9NyqJ/oGymI:e27avZ9dQ4lqV8m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671987776, "uuid": "cdd65f52-5630-4609-9987-3d93aa603dee", "value": 292352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671987776, "uuid": "d456f0bc-290e-46fc-b52b-c54fa9035e90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671987776, "uuid": "503c371a-67fc-41e8-a5e3-286ddafec7d0", "value": "ec6c80c5368cd7730f5b5fea30e7c99a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4c82c46-842d-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671956709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671956709, "uuid": "e77cf552-0bd7-4556-8ab8-4ea11da50e1b", "comment": "Malware payload (RedLineStealer)", "value": "8bcc8f91eac6071e201893b8e24ba3e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671956709, "uuid": "5fa3c9d2-36f2-4714-9982-289b233c7a7e", "comment": "Malware payload (RedLineStealer)", "value": "8e2e0590b0418adf88d487f37a49107538e7e2d243f165845852c3f7ece6a337", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671956709, "uuid": "96be1e73-ccf3-436b-ac6c-455d4bec5772", "comment": "Malware payload (RedLineStealer)", "value": "9c5fae6c14e3bf42db272ec2847b338eb7b91dfc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671956709, "uuid": "2907f076-8206-4495-9574-9de93abe9f07", "comment": "Malware payload (RedLineStealer)", "value": "e4033319caf32390c8d452a3892ea5ab5221d734be49eeb4d310f0f36d6fbc0684635ba751fffaf5b39c55a35394786a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671956709, "uuid": "5364e7be-90a1-4e2b-bf99-fbfdcb42dbc7", "value": "T1FD943831E4808432E863163305B4B969D928ED33DF1564EF639C762A5A339F36E31DE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671956709, "uuid": "3aec7e59-91e5-4a03-9f84-5b9f7fcab01c", "value": "7e7c1082b38a4734d89e1f235c71c850", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671956709, "uuid": "2624334f-5d2b-4aa4-9851-187078f849e1", "value": "12288:Mygxer6dluLigEZoNZ6RF2Rybootouo7CypP7:GuOdZ6ZyF2Ybootouo7VZ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671956709, "uuid": "0edfe6e7-4ac9-4461-844e-52632432e887", "value": 408064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671956709, "uuid": "ad4cdbb4-3efb-4f92-bd7f-2c36b14c5db3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671956709, "uuid": "d491f494-09c9-44e4-8632-0e64efe714d5", "value": "8bcc8f91eac6071e201893b8e24ba3e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b54cfaf-8491-11ed-9db1-42010a9c0080", "comment": "Malware payload (RecordBreaker)", "timestamp": 1671999616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671999616, "uuid": "1dcece74-3f64-4515-8e9f-650534244a58", "comment": "Malware payload (RecordBreaker)", "value": "b121f35760e09d89efeea494ce89479e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671999616, "uuid": "8e692417-84ef-4cba-968e-d728da632f04", "comment": "Malware payload (RecordBreaker)", "value": "90abcdb47675972e3ff218c51ea3aacb97b6ca105aed5e1a880704b92177144a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671999616, "uuid": "97950444-8d4d-45e8-9463-8bab82870cfa", "comment": "Malware payload (RecordBreaker)", "value": "0cf4ac054779df2dafaa9723c4de9f7e741ecdea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671999616, "uuid": "5cb215f2-a455-49bd-ae6b-1884f6ee3a93", "comment": "Malware payload (RecordBreaker)", "value": "e8351a837a901aa2b53953786e1db77648e001bac3f4f73ebc8695795f19ea7f980042488fce0eabd4fb4ff6976fd62e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671999616, "uuid": "d54db70f-2f4b-441d-a83d-f298f7ebf9b9", "value": "T1E334CF00B793C0A6C45389300959CBF45B29BC61AE65DD3BF784BB6F2EF019294E5367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671999616, "uuid": "e6f481fd-3c4a-4de8-98a3-fa10e98060bc", "value": "997a79bbc9b29ccf624aa79059ded875", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671999616, "uuid": "a48d246e-6f54-4653-8be6-7cdc328b5377", "value": "3072:vpjMu7LA1h5I8ZSZ6UQOZW+gQgMFFblS1g/tK8RE9MLrcSb54VIcVTuh:b7L088cZdQOY+dZtK8RtbIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671999616, "uuid": "19162243-c3fa-4c71-b36c-d17e7fed6811", "value": 238080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671999616, "uuid": "c7648513-8a3c-49ab-a870-bf929bd3d3ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671999616, "uuid": "347a3173-d27f-4c6c-bacf-9a0fece9712e", "value": "b121f35760e09d89efeea494ce89479e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e227004-8477-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671988453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671988453, "uuid": "3f0c66c0-4d46-4b90-bcf5-385a8c1a1254", "comment": "Malware payload (RedLineStealer)", "value": "d511992136c2cda00b468ce9e30b0cf5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671988453, "uuid": "96a24298-77a3-47f3-a416-dd7b55c31f02", "comment": "Malware payload (RedLineStealer)", "value": "90d635817607ef7037d5f3c3d516cbce989155590946c088cabb9f80bf7fbfeb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671988453, "uuid": "d975d1a4-b366-406a-ac0d-8da00f26bc36", "comment": "Malware payload (RedLineStealer)", "value": "e947bcc2b9e603392841fafe4fcf4c2e23fa42da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671988453, "uuid": "00e62230-9d0d-4608-8e6f-6730dd904b0d", "comment": "Malware payload (RedLineStealer)", "value": "e465fe823dcbf78ff30dd4960a940a450de5ebdd4fb2270f80f07c613611cb62e038009b5ea62530009a8a0027e0a421", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671988453, "uuid": "8e61b902-d23a-4a18-bbc3-6c9ffb402a9e", "value": "T19F952302BFD294B2D5151C365619E790603CBA702F20C6AFA3DC6E5DE9B12D06325FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671988453, "uuid": "92bd4ef9-2fb0-4215-aab3-fd5deffeaf56", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671988453, "uuid": "105cfec4-0341-43b9-9e30-81a429e9669d", "value": "49152:V5OzHCcQhi/kByJ4g3AVm5c3+12bk7vRDB3VwMylYZRL:V5ph3W4wAycuQbk1FFwvYf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671988453, "uuid": "42d8c40b-1385-40f8-96a0-ba3b2c065b1c", "value": 1899960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671988453, "uuid": "599342b4-6154-4576-9a66-e02b8d31ea02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671988453, "uuid": "72d0f7d0-f23c-49a4-b689-79c406122742", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2a39f99-845e-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671977804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671977804, "uuid": "f3510c52-85d4-4e46-aa98-10a973281b71", "comment": "Malware payload", "value": "a5889d022b6719928d911c4d95586fa5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671977804, "uuid": "b77254f7-83b6-47f8-8234-24935d7a2ff1", "comment": "Malware payload", "value": "91b63191b54828c4d3f881bfd47d63644d55a9d9f28365ca54d1c20de3a52ed9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671977804, "uuid": "db2a784f-e003-42f8-8fa4-aedd25fce827", "comment": "Malware payload", "value": "14cb734dfa63261e2323316e3ab3e17ecacb9808", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671977804, "uuid": "08a2c7ce-eb48-4cd1-8d49-addd2cedbafe", "comment": "Malware payload", "value": "2f73edbe2d9bd89fd5b21a93d7fb8bf967ac9c47f77a696b9722a896d43cfdc5182d4c540c0576869c6958c77c94793c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671977804, "uuid": "cfdb72e7-cb1c-4d90-bd70-8084ec835e66", "value": "T1F7952A91FBE0CE22C4CF1772A6A20B045778DC85B741E7AB5998B1B42CF330A2D5965F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671977804, "uuid": "c88c171e-f8cd-4aef-8e79-65b9b2673e25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671977804, "uuid": "afc088e6-1e01-493c-92fd-2bc87dc9864f", "value": "12288:gpRhyQwI+mkC3K5QW93TjIo7ts9DhGvd4e1MxdYy7OaADQBTjsrGzgRLYlWPEKmC:S9k15Qijoh5xdbkrjmKeHWl5D3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671977804, "uuid": "eb68270c-ec5f-414d-ae63-314ca637bdd9", "value": 2052096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671977804, "uuid": "552c1aaf-74a0-45e9-a001-fff8ee0b7e67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671977804, "uuid": "776e1969-6f9e-461b-86f2-b649b0fe65b7", "value": "a5889d022b6719928d911c4d95586fa5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b76d7b92-8449-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671968766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968766, "uuid": "33100cb1-7d8d-4d03-9919-5ff85fd3c715", "comment": "Malware payload (Smoke Loader)", "value": "a005a1892f2d4990e32e42438776bcde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968766, "uuid": "4ab57cb0-6b5b-4fa0-b60d-867d721fbb67", "comment": "Malware payload (Smoke Loader)", "value": "92f7063fc037fc2b18f0c78afd4463734ebf43dd2936b2b4398cab47da7ab1e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968766, "uuid": "2c84a5ca-5280-416e-8678-5c74bbb24134", "comment": "Malware payload (Smoke Loader)", "value": "991902c67214308745523842659cfa0ff202b9d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968766, "uuid": "b9e1de8b-351f-4324-afee-e124fbc6ddea", "comment": "Malware payload (Smoke Loader)", "value": "fe79f29ba334ecab6e5fe0f1f4416e066a888fb24ae9da9c0b0885f673ff3286e9d70637b693a123da622767cc4e5d35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968766, "uuid": "e87e20f8-5a2b-46e3-8688-b27be81695b5", "value": "T1C424CF0CBAA2C066D12505308D19DFE4A77AFC304B215A7F37547B7F2E70E91966A3B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968766, "uuid": "3d0e943d-03c9-4ff7-be17-b926b95c7049", "value": "1ea9f0326cf512ac0eb7dd4bc1a00a19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968766, "uuid": "2d32a38f-3923-4a13-ba4e-98cf0328a405", "value": "3072:LDprrLXA50b9blHx18Qhtz/UHwxN3auDGDTKff/ln:BLXPtlHNL3aMqTM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671968766, "uuid": "a6e7e190-26dc-46b4-898a-c93fe92c1c49", "value": 227328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671968766, "uuid": "f5b25d6c-a25f-4534-b187-6593665237e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968766, "uuid": "726827b7-86e0-44d5-b75f-4685f7250890", "value": "a005a1892f2d4990e32e42438776bcde.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9de4aad6-8411-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671944671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671944671, "uuid": "648fbc42-565d-4e3c-94cf-f7f38b1f2660", "comment": "Malware payload (Smoke Loader)", "value": "48c2031b82e27f60b5c07b84ab3ccfe5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671944671, "uuid": "d1234702-e649-4535-b2e9-909d2e10ebdc", "comment": "Malware payload (Smoke Loader)", "value": "932ba1468220264f7f2991e8ca915a6ba3c2bc9a37b747a16c50d983fe89c5d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671944671, "uuid": "b50bec39-0b13-427a-9fe3-3922a187923d", "comment": "Malware payload (Smoke Loader)", "value": "d7ac785078d95d63b221e508bdc22e41dfb709cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671944671, "uuid": "6273a828-7d89-45f7-95fa-7261b4bdd594", "comment": "Malware payload (Smoke Loader)", "value": "cdeb53cef6fd1b758b1c00ea024abd8da6236396913ab30b6b5fd500cda3e652aae5d2fc98c61e0ca6497061d01e119b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671944671, "uuid": "03ac4514-f862-4206-89ef-bf715ee2dab6", "value": "T18D24BE0CBAA2D436D55109708919CFE46B7DFC718F216A2F37507B5F2E70E90962A3B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671944671, "uuid": "664e0f7c-ccdb-422e-85ff-f87ddd97c6cd", "value": "1ea9f0326cf512ac0eb7dd4bc1a00a19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671944671, "uuid": "89215013-b40f-4653-bba4-b5a0c9670e86", "value": "3072:ZDn7pjqKLTU5sSc3/pHfO3fdomGiHs02GauDrkf/ln:LjqKLTtScPp/YfdomGzGaMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671944671, "uuid": "5a9c7eaa-f0f0-40ef-99e8-eb2ad8554de9", "value": 228352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671944671, "uuid": "5bc50cdf-6aa9-4e89-a68d-2acb5659a567", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671944671, "uuid": "e36545e7-6553-4091-9d8d-a8bc9a574104", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99d1b133-8419-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671948100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671948100, "uuid": "be190223-ac1b-43dc-908f-cebc94f33a2e", "comment": "Malware payload (GCleaner)", "value": "e7acc888eca7975dcfa92ca51a34ba94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671948100, "uuid": "ddcbeed9-38d9-4d27-87a3-f88acbff5721", "comment": "Malware payload (GCleaner)", "value": "9363c0cdbc30a611cf08654187dc0e45fc63346539f4f0b818179d2df0e5c5d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671948100, "uuid": "9dc3d7fc-4bfa-45db-8d3a-71d951372aa2", "comment": "Malware payload (GCleaner)", "value": "a865ce582f29be8716f94f3d9561bdbe2770092c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671948100, "uuid": "82d754df-0711-4163-ad0e-a2e7dde7fdf9", "comment": "Malware payload (GCleaner)", "value": "8ec7c0f83ed9d8aa5b61731f1c7e6c061c421d7a6a1c4cb63f108a11cd235010f82e3948c0a94be31d2a9581627b5819", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671948100, "uuid": "a8927e1f-6a0d-4038-803d-5cfda2900b7f", "value": "T1DB8533C2B8649975E09E51B94EA5C009F33BAB402B2CD22D69EDDA47B73C60CDB43717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671948100, "uuid": "0ce460f7-9c89-4167-9e85-f33829d6bb6a", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671948100, "uuid": "845fa249-ab9b-47ac-91f5-4001b86b5f8c", "value": "24576:Bizi7bgkQsN5v06Epu+93JtSlqCqJnodWftWfUWoYur1P9i4Tzi4qEbPu6Cx6eum:qiFfv06EYK5YACqJno0Dr1P9ic66cZaq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671948100, "uuid": "76683f85-474d-43e5-b7a4-4aed3b992ec9", "value": 1859691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671948100, "uuid": "ca8e2306-7d05-41d1-9bec-fe85744c70b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671948100, "uuid": "81876d88-4e99-4c57-9d9d-ba83d688b7c3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "732fb1eb-8450-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671971658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671971658, "uuid": "9846d120-7240-4765-9503-e012a5ed0664", "comment": "Malware payload (Smoke Loader)", "value": "abf989f11c01c5dbeeb5e35f314befba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671971658, "uuid": "70771899-fa0c-4d45-a00f-84f3abc698c4", "comment": "Malware payload (Smoke Loader)", "value": "93da96dacab627d1062a3ab7f6530e4f2228e2317a035224e2885390c63659b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671971658, "uuid": "1612831d-893a-466a-aee9-8ea5dce892c3", "comment": "Malware payload (Smoke Loader)", "value": "ee505b610a1e5398596bc306490068bbc02414f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671971658, "uuid": "6d13d3a2-618f-4a71-b1e0-325873ae72a7", "comment": "Malware payload (Smoke Loader)", "value": "2b61c661311831a557e2ff8d21467e451d4a28ece8a6ca887a81dc45b16d66e6135e790795daec55f904f4b292354026", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671971658, "uuid": "443d11d3-3cf8-40f7-aee9-2cda2dfaea36", "value": "T15C34AE103670CCB2C3D24971582BD7E82B7BAC916A6745F33A187B5F3D70AB0A966347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671971658, "uuid": "84f0623f-fdc3-402c-81bc-00d381cde06c", "value": "8514760d95d5a493235b8748f65885e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671971658, "uuid": "b42daea3-80cf-4c90-ba75-100d699883d7", "value": "3072:T+/U3LuM25tIpUHVPa/Sxoc83RBWD0ZfEi6lotJ/x2w7RkxmJZs:TrLxUIpG0SaRBPaiqKJ/oGymI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671971658, "uuid": "fe78e058-0a6a-4059-9082-cd489d46d99a", "value": 235520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671971658, "uuid": "34d42545-d944-4726-b9d3-c999185a863e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671971658, "uuid": "504268aa-13a9-4f98-8073-99052247793d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "316d597e-8482-11ed-9db1-42010a9c0080", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1671993022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671993022, "uuid": "72c24304-89a9-442e-8e7c-30dde717d589", "comment": "Malware payload (AveMariaRAT)", "value": "34cc724acfb241fecd4228402562bd3d", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671993022, "uuid": "c1f719c8-3753-4947-9ca0-4aebc50b0538", "comment": "Malware payload (AveMariaRAT)", "value": "949b1eb63ef7e52cc6aa5b6983bdf20148ef8223398694010bb8d2ebd2040333", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671993022, "uuid": "84860e8e-cfb5-4c0a-8443-40d9a1fdb867", "comment": "Malware payload (AveMariaRAT)", "value": "1aaf5756917a775961e959f0944f258147071d0f", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671993022, "uuid": "02d1a558-ca02-486d-8f65-90a4bebf67d6", "comment": "Malware payload (AveMariaRAT)", "value": "cd14f41559d49dd55f5457dd9695dc33bc35b1e6457fd971a42176db1b1db3f90f1b7c46c99cdcb87c67933115dd984c", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671993022, "uuid": "b6677dd7-b9a3-4ea7-88f7-97ca2614b3bb", "value": "T1C374CF1DABC68FA3D75E4BB5C47350146238C4A644CBD33F494D08E698A13EB76872EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671993022, "uuid": "a65e8973-ead9-46f1-8de4-ba1ea339409f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671993022, "uuid": "2a513627-06ea-49dd-989e-dc9496786398", "value": "6144:lvhDTPDckxZODSEotvGJmub1uxA7So7UvlyadarqYHx+u1fl2VtAx:lZDDDcfoUh11Oo7UD8FHQullMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671993022, "uuid": "d74e6359-641b-4402-9a5a-a3773461f225", "value": 354816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671993022, "uuid": "5d7bc4f0-8e6a-4f2d-bc5a-17638332d59d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671993022, "uuid": "ce314518-0f90-4557-8e34-52cf1142d202", "value": "34cc724acfb241fecd4228402562bd3d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48835b82-8442-11ed-9db1-42010a9c0080", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1671965573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671965573, "uuid": "4d46820b-2e30-4d6c-b5eb-ca3828493ae3", "comment": "Malware payload (SnakeKeylogger)", "value": "a9ebca8e8a45313485d7b43b07e8b253", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671965573, "uuid": "51d1ed1f-26b3-4a85-a8c6-55ad041964d9", "comment": "Malware payload (SnakeKeylogger)", "value": "95ed52837008a838dfe100d211d1a1747e709101d40455bc64d4b7f55bb442cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671965573, "uuid": "00418d28-882c-42c3-bc0e-a687802baf37", "comment": "Malware payload (SnakeKeylogger)", "value": "8b1be89c590936e3c70097099c27c67ea064b178", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671965573, "uuid": "30525cfa-81df-45cb-91df-63a87bd8d658", "comment": "Malware payload (SnakeKeylogger)", "value": "cfc99db714e0b059017ba00ef6c0efa46f59748f9488a1f49ce7e2bdc8f1547b3084d5572df5b95c1e0f4030532cc9d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671965573, "uuid": "7b4a503c-a8e8-4ffc-8ca5-a3e17f2e02fc", "value": "T1A9341205B0C484B7FD890AF2EAA3D3722AF52E90595425C377D0AF6EB41A0D7ED193A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671965573, "uuid": "56df2d26-d688-44e0-84ab-82ef6e36e03e", "value": "97318da386948415d08cef4a9006d669", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671965573, "uuid": "9d77bc35-c28d-45b2-b8d9-bae47e9bc8f4", "value": "6144:Gkw/qYX3AwFBEspSS2hAYZXao706TnQpOcwr:YhXhBEdpAY5a5eN3r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671965573, "uuid": "5a5bcf6b-f9d0-4ae4-bacb-a271c63b96ef", "value": 246145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671965573, "uuid": "4a9228bc-a530-43fe-bdeb-89e0505e023b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671965573, "uuid": "43bf23ca-cf53-49fc-8b8d-fd08999dd77f", "value": "Fatura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c095706-8409-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671941205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671941205, "uuid": "ca00681e-1a4c-451b-8e20-d19b91f32f2e", "comment": "Malware payload (Smoke Loader)", "value": "04561fb98fc371b2ba74fa70ff8e66be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671941205, "uuid": "800ba490-c8c0-4c43-956c-bfb11b37a1bb", "comment": "Malware payload (Smoke Loader)", "value": "95ed83ae2461271437cb113355673df5e7cdba4a720ec57ec3f2db857ad62a65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671941205, "uuid": "80aa6b81-8501-476d-a88d-0e38f187a5e6", "comment": "Malware payload (Smoke Loader)", "value": "45ae22e63b0bdd26f552ebc6b94975d9a7020278", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671941205, "uuid": "37276071-4e7c-4185-a81d-2e8b0537a0ac", "comment": "Malware payload (Smoke Loader)", "value": "754f263c3a8ab5a52d99924ecbc8fe431831650bb3bd027aac480c01ebb458cf6a67c29a489686882dd4f3636e8c0dd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671941205, "uuid": "82e40aef-8543-43bc-9171-d6049b19b195", "value": "T1D424BE0CBA52C066C15256308E1D9FE8677AFC315B615A2F33443F5F2EB0EE05A7A3A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671941205, "uuid": "ec8e3636-c4f8-4d61-a7a6-6e1fc96de3f6", "value": "1ea9f0326cf512ac0eb7dd4bc1a00a19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671941205, "uuid": "937dd2a5-f787-4b4e-94c1-080ee9a270b4", "value": "3072:qDF6BLhk5MxrVBOXDA1NUslkIhauDmr5af/ln:LBLhnx72A1NUsllaMIG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671941205, "uuid": "b3b45e50-d0ac-45d4-8a51-9abe9fa3942f", "value": 228864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671941205, "uuid": "20f729d1-6c91-40e2-a18c-25ae3d22e845", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671941205, "uuid": "ecac3285-2bad-4418-bb03-98261b8bd367", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c129996-8429-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671954842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671954842, "uuid": "30138f03-2f4a-4d26-8b09-e57f359a7873", "comment": "Malware payload (RedLineStealer)", "value": "376cfa74d8a65fb5836828c55cfd8fc8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671954842, "uuid": "d992ee43-3c30-4424-87b7-24a97c3973f5", "comment": "Malware payload (RedLineStealer)", "value": "99b7396773e11d0a1d44f674310025344f2d8c9d2813d33e9bd7dd35ac5f2360", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671954842, "uuid": "f601f78f-df08-41d7-ba4c-32deebc6fbd5", "comment": "Malware payload (RedLineStealer)", "value": "351c94238b50a6b3fbfb1ad538b6b2afa87b4dfa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671954842, "uuid": "b66271d1-7cb1-494a-9b00-4badc0840212", "comment": "Malware payload (RedLineStealer)", "value": "e701698b36085756a0f6770f0cecfb86f0471a54423c64f91d35c4c8bdd8bf7cd5d58ca184e9bc6880b47462f1b51fb8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671954842, "uuid": "16bd1b09-6946-4ed3-92ea-30aff83b30a6", "value": "T137942617F4834039D462D536CEA9BE6C68693C607FDCEFEBA784069F0B246D0A52056F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671954842, "uuid": "4a3a4225-a577-424e-a531-0577f7dd93ed", "value": "7e7c1082b38a4734d89e1f235c71c850", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671954842, "uuid": "e476dc9f-dc6b-4002-9782-7f77a8ad9dd9", "value": "6144:Wygxer6dluLigEBBY2o1FhZRVPjGAOngeijc+/B9IVmoGP7:Wygxer6dluLigEZoNZaJOf9OQP7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671954842, "uuid": "a659695a-bbbb-4942-85f5-9265a522dc91", "value": 408064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671954842, "uuid": "43608d6f-e558-47ce-b64b-6f058d7edad7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671954842, "uuid": "7bd14488-6cd5-48c1-b8ad-2c8f449960fd", "value": "376cfa74d8a65fb5836828c55cfd8fc8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f3ce219-8459-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671975463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671975463, "uuid": "23d9ac0f-20da-4c1e-9f38-10b1724b338c", "comment": "Malware payload (RedLineStealer)", "value": "d5225490a6d5fb75a9d3cd6dae2ab934", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671975463, "uuid": "195be874-6cf2-4aa2-9e34-f5054dc58aaf", "comment": "Malware payload (RedLineStealer)", "value": "99ebbec85541372979503475f0082880dfa8a292d1bbee151b178db8db0a2d65", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671975463, "uuid": "d8728ccc-a765-4176-9321-161862d1c341", "comment": "Malware payload (RedLineStealer)", "value": "e1ba34a4b8d896a1eb4fb29205344edcf7415fd7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671975463, "uuid": "6faf10ed-b613-4c89-a33e-2aaa6b25b27a", "comment": "Malware payload (RedLineStealer)", "value": "1f6e9c2d3a180dffb93d7e6c4ba317276260ffc5875a2049de6fddfbd8cbc89f6c7ff7e13b13bcb9bfaeb73c0d3b54ab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671975463, "uuid": "a5292c5b-8abe-47ff-be7c-ce88922075a1", "value": "T10C74E1002294DCA2C7C24B71496BE7E96B7B7C919AA796F33744AF2F3D701B09D12247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671975463, "uuid": "42b8e1e9-f7a6-4640-9532-7315b8bf5d71", "value": "8514760d95d5a493235b8748f65885e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671975463, "uuid": "53ffd38a-31ef-45db-8935-8858b3df72da", "value": "6144:iILXENKoULg7nT0Km1vCT/PCK48G4J/4GymI:FbvoUs/av+p4Z4VMm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671975463, "uuid": "20fc72dd-24d7-4e55-838d-695361303e9c", "value": 359424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671975463, "uuid": "5c502c12-83e6-4370-90cb-c8752812dc56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671975463, "uuid": "1867cd0b-51cd-422e-9bba-9b889f6e9470", "value": "d5225490a6d5fb75a9d3cd6dae2ab934", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f141a036-842c-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671956407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671956407, "uuid": "01479453-5256-4d77-8867-350f96cda77c", "comment": "Malware payload (RedLineStealer)", "value": "8dbb3c2f474bf759840892da1e348fa6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671956407, "uuid": "e708386c-2662-4231-9616-6f4a520b5b76", "comment": "Malware payload (RedLineStealer)", "value": "9a48ec1ff7995f724b479d97b0fd21fc0ee9c6c1598a39192ec677b648087602", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671956407, "uuid": "045a8938-fcf6-41ee-bb72-217259fa957c", "comment": "Malware payload (RedLineStealer)", "value": "cef87545c579f1ed36dbdee7a1785235e5ca728b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671956407, "uuid": "4dcfefa7-d4e6-4cac-a2d7-858ac7adaf07", "comment": "Malware payload (RedLineStealer)", "value": "833635f9a74cbf658740d23b92cb12ba61a7561a55e11ebfc72b1d729d494972f048818968764adf09cbdc35d778b3f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671956407, "uuid": "140ce956-ed03-4578-8a3c-efcdead09dc1", "value": "T18F946A18B890B33DF46700375EEB467A89E9656147EF28E7D39486FA4B102E075332E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671956407, "uuid": "eea8bef6-c328-40c4-9810-8e7d1974f9d7", "value": "7e7c1082b38a4734d89e1f235c71c850", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671956407, "uuid": "71cfb7b5-f2f3-4dc3-aed4-6f5f182f9ae6", "value": "6144:6ygxer6dluLigEBBY2o1FhZRVPjGAOryQjVDKHu2Sxhvh4OjSn7yGP7:6ygxer6dluLigEZoNZa9PRDKu2kELP7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671956407, "uuid": "19715596-ae02-44e1-b946-69e2113b73fd", "value": 408064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671956407, "uuid": "9d4faef9-c4fd-4324-80ec-30ebacfae2bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671956407, "uuid": "da7c7722-26d7-455c-b8ea-a8537a42809c", "value": "8dbb3c2f474bf759840892da1e348fa6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6c59f4f-8449-11ed-9db1-42010a9c0080", "comment": "Malware payload (Formbook)", "timestamp": 1671968845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968845, "uuid": "0a34c923-b65f-4085-abbe-2c3e3553626e", "comment": "Malware payload (Formbook)", "value": "4a1c5227914a9c9282c5dcd651a0ccbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968845, "uuid": "d154ec78-50e4-4381-a919-894f3ddd2158", "comment": "Malware payload (Formbook)", "value": "9afee5e6dd1d97f008641020ac405b40512c4c8f3ac1a9ee278eb75d18556bd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968845, "uuid": "929d02b2-596d-427a-b94f-0f8050102d32", "comment": "Malware payload (Formbook)", "value": "f4e41cd45bd8786b22dcae6c78c94ec9f2a810a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968845, "uuid": "36616f0b-8195-4dac-8544-95729cc7af20", "comment": "Malware payload (Formbook)", "value": "4898ca4bf6935faabcdb72c6202e180adb43343ad3b9d39e45532a6d8791c999484375e8c758240f0e06924df2c6464e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968845, "uuid": "76da0e49-3136-485a-9928-80ae05d64b09", "value": "T19834126A3DE948ABD032C7726972F7D86BF271005364764B97A04FBD6C261D3BE04183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968845, "uuid": "7c036cb9-73e0-4215-b963-cf7b0c6f15c2", "value": "97318da386948415d08cef4a9006d669", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968845, "uuid": "1a4045bf-6e36-42b2-9fd6-95fb1348005c", "value": "6144:LkwMj35iWQXLGEp9Wge0p7+ubCCFd5VYaoVAbqpYEe:i34WQbhmge0Tl5VVoibqpYEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671968845, "uuid": "95b117f4-4e9c-488e-b4e8-8be8d7f53f6d", "value": 248192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671968845, "uuid": "13e1312e-ce29-4291-8074-7339a7664d58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968845, "uuid": "e50c733b-9746-46d5-ab6a-709775e4adf2", "value": "4a1c5227914a9c9282c5dcd651a0ccbe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "879a6494-840d-11ed-9db1-42010a9c0080", "comment": "Malware payload (njrat)", "timestamp": 1671942916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671942916, "uuid": "e63935f3-860c-4126-a000-c422dc17603e", "comment": "Malware payload (njrat)", "value": "b510d18d2aa0a1c6e1f268fa888454d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671942916, "uuid": "41f37782-0928-49a3-ac72-3f70a913ae07", "comment": "Malware payload (njrat)", "value": "9b128bead261e37e627633f1c1eaa0e242f0681b07074badfc03c0f59120a5b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671942916, "uuid": "40c371f8-a658-43ef-852b-0e5cc82e1f04", "comment": "Malware payload (njrat)", "value": "6fa648be32432436ac88b5461a01a535b60a2892", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671942916, "uuid": "08e0a33f-e15b-4799-af79-53178c3b8d32", "comment": "Malware payload (njrat)", "value": "12de443122376d5ca2f4cda56e6240d79a60844e2ca5aaff69d7b7d63e1258d5378692bb9ab2b0585c901be46686914b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671942916, "uuid": "51c5f7f0-913b-4525-947c-1b845f37e919", "value": "T143540F602A050EBCEFE0BA74EBDD536513A52E92017B58CF13D03F8A3537E53BA9A055", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671942916, "uuid": "1e78e816-37e8-47ba-80eb-fe14d359223b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671942916, "uuid": "ec800282-7781-4dab-aca6-54d995ab8f50", "value": "3072:eU0c0PAZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ+ZZZZZZZZZZZZZZZZZZZZZe:6+GIIIIIIIhIIIIIIIIIIIIIIIU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671942916, "uuid": "5caf96f2-a11c-4538-9ce9-bf2c85f9d9f8", "value": 294400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671942916, "uuid": "1ed95d5d-d8be-436d-b442-ef21e8de1b7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671942916, "uuid": "a76704f3-4839-4bed-8362-618f8b5e9aad", "value": "b510d18d2aa0a1c6e1f268fa888454d7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61c2cc96-83f4-11ed-9db1-42010a9c0080", "comment": "Malware payload (Blackmoon)", "timestamp": 1671932115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671932115, "uuid": "4cabfe9e-15af-4437-838f-17dbcbf1dd11", "comment": "Malware payload (Blackmoon)", "value": "b4c0aeddabc01a322b91450f628e6b57", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671932115, "uuid": "b85b780c-0850-4063-afcf-05e065ae36b5", "comment": "Malware payload (Blackmoon)", "value": "9c8bd8c1fe946a4fb8515aa4939edce7984cc733737a2ca7463574a790fbf1a5", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671932115, "uuid": "aa355cd2-ba9a-4b53-8ff2-3bbe47ea8af2", "comment": "Malware payload (Blackmoon)", "value": "5ccda00f6dc9226006e833eb6bd37870359afd3e", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671932115, "uuid": "4219c7e9-2306-44eb-8e29-04818b62b401", "comment": "Malware payload (Blackmoon)", "value": "e4b03ffe01c0e6f48393abf16c557b2b9cdb26ac7aa8a31c61e55ef1db6455da44d2860dced669f49b4e32f17435ff08", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671932115, "uuid": "65ee9910-206e-4cc9-8f86-011a69fc13fe", "value": "T14494F12276018A25C3DC237AC1528E8892104E9D7D39E41F29757F5C3FFF1CBDA1A66A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671932115, "uuid": "2d94578a-48cb-4030-ba87-2b93fc2a7dbb", "value": "cf5bbf79fccf87cc47366b3ce2e1e762", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671932115, "uuid": "2e452376-d800-4703-ae88-e6de3e116793", "value": "12288:/iFlNNrTkzkWX6WAcGfXaeHylfeejTmPBb:/iFlPEzN6WGfXPHwfeejT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671932115, "uuid": "e6c2fb79-606e-48da-9852-c5fc7df4be0c", "value": 436224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671932115, "uuid": "5e757860-809c-4919-aa6f-b10603257cfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671932115, "uuid": "5c2601b9-2401-4449-a3e7-452386b5ada1", "value": "b4c0aeddabc01a322b91450f628e6b57.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61a545e5-8477-11ed-9db1-42010a9c0080", "comment": "Malware payload (CoinMiner)", "timestamp": 1671988379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671988379, "uuid": "85f6d89e-87e3-4131-a2ab-e1ddef83be50", "comment": "Malware payload (CoinMiner)", "value": "15f7fc6fcc618de2775d6e1aa3e4ae9d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671988379, "uuid": "6366d00f-db77-47a9-a929-a1e68daa856d", "comment": "Malware payload (CoinMiner)", "value": "9cf5b3676ddc2e66483d1894dc9a2a2bd02bfaa9926822451b5af1db4bf98269", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671988379, "uuid": "ad8b99ff-6770-4aff-a33f-49bd110a6fb6", "comment": "Malware payload (CoinMiner)", "value": "4e2d78252171d09a13765940d7a84f203d3f58fd", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671988379, "uuid": "f99bd373-b9f8-4410-a430-55077f110c01", "comment": "Malware payload (CoinMiner)", "value": "40fc5c400614f22af7c99ff967e1775b12bc61a636af180b6d4711fda0770f5cb1ecfe0a65d9c88dd3f1997d64c43738", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671988379, "uuid": "a28c4120-093c-4521-8053-db88fa3f3241", "value": "T1DAF54B4367EA060CF1F76B78AAB701744A37BD956839C64D019C650E0FF3A4498A7BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671988379, "uuid": "32d27a90-2bfc-4805-9a92-f28834b6eb8a", "value": "d11d5ddbd18f407d160bd7657d0d7147", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671988379, "uuid": "9a0b2d7f-86a7-4f38-9fd8-3b89c21747b2", "value": "49152:tHabm7rMbsxRipP6Sa6HDu6Jd69/PvC03YwvhlBXwIl2urt2XoA2a:tgbsxRSySL4fCqYuTrtss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671988379, "uuid": "3189fb80-85f8-41a8-ad33-b7d20c8aae04", "value": 3422720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671988379, "uuid": "16efed6a-adc7-4df9-b37d-343698a38745", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671988379, "uuid": "4c9b3995-112b-4601-b9c6-6e10b7373c8f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01297a34-83ee-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671929376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671929376, "uuid": "103a49c2-cbb2-46ba-b291-3cc452e25a9f", "comment": "Malware payload", "value": "aceecfbe0cb56693861c476989911353", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671929376, "uuid": "b52d97f1-aaa6-4a85-8eee-91140911fc82", "comment": "Malware payload", "value": "9db9183eee5cecbe151e9bb77cfc066cd278dd682c4d541871c9720a7473e928", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671929376, "uuid": "5c0bcbc9-63ac-4f4d-8ab3-1627c32303ae", "comment": "Malware payload", "value": "69b345f1cb419d733ee523a2d56ae159c7bb68cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671929376, "uuid": "bcd18768-7321-4539-bef9-fd87eb4e72a9", "comment": "Malware payload", "value": "8f7286160e38ef402069c4eeb4197fb283aa1c740ee84a7248193ecbf7e093ad3b7d86fdda2098837fe16fd37be96d6c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671929376, "uuid": "ecbeef6a-bbaa-48c9-85f5-a7fcb6cf6398", "value": "T12075236275C01470D5721D3059FC63B9AA3CBE315F788A9F9398363EAA302C19E39767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671929376, "uuid": "84a785a9-acb7-4ff6-b8e6-5ace6716ce09", "value": "ae9f6a32bb8b03dce37903edbc855ba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671929376, "uuid": "2893ac03-9847-46e2-90ea-00021ec400b9", "value": "49152:084cLhOOomk80Cm1nkbVvM2k9GmBsZVSs8J:6cLhOOombBm1nkpvM2ssZ03", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671929376, "uuid": "097b7387-a387-4df5-8206-fdd2fd29456e", "value": 1684333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671929376, "uuid": "ecbd28d9-0406-4ac8-b113-3e7f67eaf58e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671929376, "uuid": "8699608b-c29a-496e-a652-771e0b430b10", "value": "aceecfbe0cb56693861c476989911353", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e74efaa9-83f3-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671931909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671931909, "uuid": "293a23c5-164d-43d3-840b-9b092cfe56a3", "comment": "Malware payload (GCleaner)", "value": "b7ffb69183dfe170341969fe1e090880", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671931909, "uuid": "5fafc3a8-ed92-4a00-a216-73970f243ebf", "comment": "Malware payload (GCleaner)", "value": "9e03316d1d1ae4c116367b07c100664c92aee9e5af0bfe0e3d28b7036a5110cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671931909, "uuid": "f47ec75f-6f78-445c-98ca-aa974bda2caf", "comment": "Malware payload (GCleaner)", "value": "324bea0cfff1fd1664ce68505594d0763a41178d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671931909, "uuid": "cb736efa-a152-48c1-9c8d-ecbb4aacdc00", "comment": "Malware payload (GCleaner)", "value": "fed8202b6c78791d89692b93c74600de0e5490695bc2e83f1fa0ead488b4026909ad6ecd4fe328bb0887244ffda2686e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671931909, "uuid": "8301f7f9-d14c-49cd-a8b9-a5bee4cd5174", "value": "T134953300AAF4B9B9C11DEA74AE94840177BA3310277A416C49DCFBCBBA1D58CC797B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671931909, "uuid": "9d424a3c-0ea0-4c74-bf01-55b025a0af83", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671931909, "uuid": "1141f3d7-4ade-420f-8929-39fb8df1d0ed", "value": "49152:Wi9vCKpqPS+QtcQ+NhSLvCjXiGBCP26OyZk8HPZa1:Wi9qKpq6nQvXJ6+8HPM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671931909, "uuid": "57f72e84-3847-4c7f-8630-0d3652f7b3f1", "value": 1978666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671931909, "uuid": "4ee32e6d-490c-46e7-b9b7-84093bb5dcca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671931909, "uuid": "d2758b56-af38-4911-a582-962535ef1ae2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1596e9e3-8485-11ed-9db1-42010a9c0080", "comment": "Malware payload (Tofsee)", "timestamp": 1671994264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671994264, "uuid": "c38f2851-c5cb-459e-938c-fa3f7bd86791", "comment": "Malware payload (Tofsee)", "value": "85b1f8f40a0c3549521714fe84cd61fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671994264, "uuid": "ae698a7d-a9a9-4fc2-9da2-9db94ae1c292", "comment": "Malware payload (Tofsee)", "value": "9f283950403d16ec6a61847356681198ae3204e8cf74bd280e41b06118effea3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671994264, "uuid": "10091405-b26e-4820-85ad-c0459d0b60ca", "comment": "Malware payload (Tofsee)", "value": "3bc842a4c47f9b3ad1c31be8f273005b07ed8b82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671994264, "uuid": "3aa896dd-8fc5-4cee-9b5a-b762165ee087", "comment": "Malware payload (Tofsee)", "value": "48c345bb4c436a6833f9ef7a0a8ebb8f5946fe4ce9c1aa466e5c2d140a3361ec91de5fb29a42805ee64f4bbdd889e291", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671994264, "uuid": "5f18e247-7197-40b2-920f-9bfa8ba2d7b4", "value": "T13F64AE117391EC62DB520A74C875EAE42AE9FCB15913C356325BB71F3FB03A1A4332A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671994264, "uuid": "027c6896-9a67-4181-b2ec-84b6aa4d261a", "value": "8ee0a6bdd7d8e9bf5eca4ce8283f3661", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671994264, "uuid": "ab8b6170-65b1-4d5b-8140-390643c70f08", "value": "6144:/aLs0Riz2n3R8m40Pdy/YnjRR0cSpQTtyzsduHNIvD:/aw0Riz23R8mXdyAnjRR0TCtyYduHNI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671994264, "uuid": "6cc24aae-037b-4133-ac7e-459e1014159a", "value": 323072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671994264, "uuid": "8d0d7ab8-1e59-4983-aa01-d1e6f38d836d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671994264, "uuid": "a4fcfddf-63a8-4deb-a3f4-4411b3f47733", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30e6ea01-842a-11ed-9db1-42010a9c0080", "comment": "Malware payload (Amadey)", "timestamp": 1671955226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671955226, "uuid": "397ede2e-97ad-412a-badd-3ec54afdaf21", "comment": "Malware payload (Amadey)", "value": "c9b78c1241b248e5c2591a736accc6cf", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671955226, "uuid": "7d8c4584-eca1-475c-a412-7929a8898f5d", "comment": "Malware payload (Amadey)", "value": "9f4d6a78abe9b48124b1858aed3a3ed5cc90d8b726c6b523559272581550d987", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671955226, "uuid": "72bdf74d-86b1-425a-b96c-0147892c98dc", "comment": "Malware payload (Amadey)", "value": "caedb82a5517e2be56fdd397d8678d7a2010e477", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671955226, "uuid": "390a1217-941c-4793-acf0-f25cf7aa6548", "comment": "Malware payload (Amadey)", "value": "a124f9817f8d5597e658ff5c7e824a725cdc7e0e47e3d96845b8ed9c72ecaccd6d8da294cce0a9aecd793a0498ca03d5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671955226, "uuid": "bf2f0122-5089-4308-b886-39a873250134", "value": "T1AB24AF102690DC6AC3D245715D2BE7E82B3BBC918A235AF737447A5F3E342B09E16397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671955226, "uuid": "61176b65-a340-44f5-98c5-1338874fa987", "value": "78b36debb485b88b8de5929ea52f861d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671955226, "uuid": "17746a35-f1d9-4d3f-ba6f-4e8778fff12c", "value": "3072:QlmBz+Lpbm5+QpjnosT9i2tZ+Bfr1CUtJ/a2sD5yKyw7RkxmJZs:Rz+LpbfUDHi2tZ+BRCuJ/a2YmGymI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671955226, "uuid": "72d86180-2e19-41ec-9a1c-2b8c86fe2f46", "value": 228352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671955226, "uuid": "71db88d3-50ef-4f7d-9093-64decd5723a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671955226, "uuid": "f07cca13-a09b-451f-8c15-339dee59de32", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ebda384-8448-11ed-9db1-42010a9c0080", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1671968268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968268, "uuid": "01144166-728e-4574-9715-504264a1d893", "comment": "Malware payload (ArkeiStealer)", "value": "be738382dbad8b7464b11c528ebddb45", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968268, "uuid": "7156ea9a-b159-46ff-9d0e-fefe9c9833f6", "comment": "Malware payload (ArkeiStealer)", "value": "9fa94a3f17c838980aaeeb6bcd747ec663cb44c198b7c69f52dd23f39d282c87", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968268, "uuid": "29c29d5e-079d-4fe1-8cd3-37257e86cb4d", "comment": "Malware payload (ArkeiStealer)", "value": "dafeca3a1f94a721966898782a65ae079b98aa5b", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968268, "uuid": "f5475b80-c34c-4aa9-85a7-964ce547cf6e", "comment": "Malware payload (ArkeiStealer)", "value": "7d37dbf338dcac4b3c01f9b4a8bb257960ef25ccc4039b61446e17e410a7def91394fd6b98794cec19175ba5ca58bccb", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968268, "uuid": "cf3ef5be-399f-4f59-a12e-3bd5baef92d8", "value": "T1C665388FB260DAA1EF914F78130A4D631851DCE3BD01C86FB5C2D59E16D22AD6C64F8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968268, "uuid": "0c1a0436-2352-4d22-b2ad-fa4afa2b34ca", "value": "9f2c76418357be5cdc291649da90bd66", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968268, "uuid": "7a747901-7697-42fc-9be1-5ee05f1f19ea", "value": "24576:RwZgwzE8j6NuwKFgEmvg20iiCkYpgZO8WwFDC0TbjbY+wUcOJha3ByBeJnXE1+PV:RwZfzNwKnx/irDuZOfSLbD5ABO8nXEOV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671968268, "uuid": "a715e066-375f-4178-8be6-9582222bda3e", "value": 1444352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671968268, "uuid": "99d83d5c-db82-451a-b0fb-6c7c2701e13e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968268, "uuid": "c842d8dd-0601-42b7-9eec-7c0a40ad5984", "value": "be738382dbad8b7464b11c528ebddb45.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "956f3df3-8430-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671957971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671957971, "uuid": "c33ecec0-1ba2-4ac8-998c-6143a0fb5082", "comment": "Malware payload (GCleaner)", "value": "be3db186e873c7a691124b18a604826a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671957971, "uuid": "5057cc18-32c2-4f68-acdc-5b9414e782a9", "comment": "Malware payload (GCleaner)", "value": "9fe0112c4400d3b9fd4eac40857f920c380930a127915c4165172698e09f4b11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671957971, "uuid": "6c911362-c36b-4c81-9ceb-743c9d6a12c1", "comment": "Malware payload (GCleaner)", "value": "cb651e244e00a6744237ae6464b26f04da625944", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671957971, "uuid": "8fd35e44-549b-48dc-86d6-1e9e7c8b4c8d", "comment": "Malware payload (GCleaner)", "value": "695061df451b7d8c44790a7514980798c0b7f325c2d8b1b8226646f6bbe8ea302e56396a90984b6e51b889153e110f62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671957971, "uuid": "ca9f8cbf-933e-436a-b202-e07debc633c6", "value": "T1808533D9F9E5697DC16CC278AD10D414B174BFD01326841C4AE8BB9BBF79A0F9B0B212", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671957971, "uuid": "1b162e63-1afa-4861-a29a-2ab86724e65b", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671957971, "uuid": "54747d58-41fc-49d4-971c-4d5a5b50eff2", "value": "49152:ei/CZS7jtz8LN65p2/s+xJH00XnpG0ZaX:ei/CgIE5pQsyVXXpG0MX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671957971, "uuid": "d4f3ad7e-33fd-4f6b-bedb-1a372dac8f44", "value": 1813761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671957971, "uuid": "8e24a8e2-0bad-45cd-af25-ab9e444fceff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671957971, "uuid": "e3ba1a9a-d9db-4a4f-94b1-46fe6985f57b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f64d703e-842c-11ed-9db1-42010a9c0080", "comment": "Malware payload (TeamBot)", "timestamp": 1671956416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671956416, "uuid": "3744c7b4-a9cb-4921-a798-985fe5785c1c", "comment": "Malware payload (TeamBot)", "value": "f24a70e862776b197eee8b043c785205", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671956416, "uuid": "bf380f63-eac8-4e48-a05e-78f25b4095c9", "comment": "Malware payload (TeamBot)", "value": "a20d01ec10befe3085f4d1c9037d849ffe3fb9c5e8b7eb826e056970a42f5c9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671956416, "uuid": "27f6450d-3056-4c4d-9699-f23951ca35da", "comment": "Malware payload (TeamBot)", "value": "fd48071a71225cc58f5e077af1cb98ef229bdf11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671956416, "uuid": "95b40ecf-21a8-4c27-83db-eb4483344635", "comment": "Malware payload (TeamBot)", "value": "5cf4ce3e7b598311cfb370de94f4248d5468d7923702c5e5c0eaa7cedcf26058d5596526fa5a00b5a295d4c0a1b6d67b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671956416, "uuid": "859b2ced-a2a4-409e-ad4e-4847d8ffb00f", "value": "T1B8F4120CBBA3E07AC14605754958DFA1AA3DFC72AE60953F33107B6E2E70EE05765362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671956416, "uuid": "89d376f8-6a76-425e-aacc-faffea989d67", "value": "1ea9f0326cf512ac0eb7dd4bc1a00a19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671956416, "uuid": "aa1104d8-0429-48a2-886f-89a203d82238", "value": "12288:ffCtDbV05KgEOWMkIhb01L0/rdQ7zoFFJT4ydOHxAmfqQIxkJB64wTjPyk/jd:i305Rk/Iho1LzosxAmKxkP6RTjPT7d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671956416, "uuid": "77bbe16a-4df9-4103-9823-d9864b74079e", "value": 758784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671956416, "uuid": "247ff3d5-153a-42bf-a448-533fa92ab4d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671956416, "uuid": "86f94b4d-0e71-420f-84b3-57feaaed2a38", "value": "f24a70e862776b197eee8b043c785205.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44bc5b82-8451-11ed-9db1-42010a9c0080", "comment": "Malware payload (DanaBot)", "timestamp": 1671972009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671972009, "uuid": "4cb8670a-cf0b-41c4-9698-ae88d4853c80", "comment": "Malware payload (DanaBot)", "value": "fc06223e149202f91d3bd8ca7993c2d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671972009, "uuid": "0dbd047f-1c5a-43d7-b4e6-863783a99751", "comment": "Malware payload (DanaBot)", "value": "a2322e86cae01329ae93947d554093b7254ef38f9febf4ac62efeefa8c2dc76d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671972009, "uuid": "2ab43dc2-5fbd-4e3e-bb72-1705ceb89db6", "comment": "Malware payload (DanaBot)", "value": "a9b9471ce72bd5e5b991e1985e5de0672bed06e8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671972009, "uuid": "1920c9cc-56d0-432a-8e9d-c2f1f287e75e", "comment": "Malware payload (DanaBot)", "value": "e6b9154635505ea664115279e86e352392972345a695aaafd51b3a29dd666e05ab612992acc9cc8a54e22e831d6e55f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671972009, "uuid": "a6bfda90-faea-4542-b3d7-80d99717d67b", "value": "T1CF35232075A4CC24D2D6093059DBD7D9A63B7DD0AF639AF26A413E3F3D712B04E1A287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671972009, "uuid": "f0add12b-8bfe-4121-9bf4-4d6d5a488166", "value": "7b9daca6da068f54ad4e1900288e8efd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671972009, "uuid": "a13082e6-12c0-48e7-80ab-caea054c05cf", "value": "24576:7nSCQElvqR2EmJAZfgd48lDSkxJUzljYQLZuyy5ikp5kfC4f:DS/ElQ2gVgdJxMljRZuy0bkfCG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671972009, "uuid": "ddbbbfbc-965f-461b-8f87-e4d54b4bca72", "value": 1128960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671972009, "uuid": "b5b6e12f-57db-491f-b4ff-26efc4a470ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671972009, "uuid": "84e38bad-9757-4987-aa3a-a3683b2be870", "value": "fc06223e149202f91d3bd8ca7993c2d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eda0b536-8464-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671980453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671980453, "uuid": "2537f665-d2b2-408a-ab9f-1b2ca41ed80d", "comment": "Malware payload (GCleaner)", "value": "13a22bf60e70bc11325c199b99a560ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671980453, "uuid": "2bb1897d-f902-48d2-9b46-7330eb65ef73", "comment": "Malware payload (GCleaner)", "value": "a25c1c6a162a98df517198562323575695ae86c328db9d5cce343e368448d788", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671980453, "uuid": "7a72c3cc-2b57-4811-83e5-7a9e6a2c2dff", "comment": "Malware payload (GCleaner)", "value": "40aff460ff4c043e7db2139713a02927d8e10a42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671980453, "uuid": "0d671196-d66d-4c32-a794-a59b40947018", "comment": "Malware payload (GCleaner)", "value": "ac3d43120e2ef370e8bc18e07ee79cf060bb5869384a8e3296d71f4e8ca25a9e1f6993b20d0514f81060d6eeb58a5f72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671980453, "uuid": "ce559244-1853-4879-94a7-1a6bd176efb0", "value": "T1129533D0F5A44C76E19DC7F49A0AE52472B42F801B3F9A1E09E9ADCFF768168D303646", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671980453, "uuid": "fe5a88a7-ba98-4a5f-ba25-d6d1c340a573", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671980453, "uuid": "ec5bac2f-98de-42f2-91b9-373cadfbc76a", "value": "49152:uiXc1AZvA+pUBVzIT298fgoMa66vgcfaTasZa9:uiuN+poVUfgn2gGGhM9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671980453, "uuid": "7ae1b22c-ed96-4bbf-9050-029548f61e65", "value": 1986281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671980453, "uuid": "ad5b10c9-7b56-42d3-afe6-2f4f6fdb596a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671980453, "uuid": "34168d08-d5cf-4981-99bf-68ac0783f466", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "220db267-8464-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671980112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671980112, "uuid": "36f65dc3-a7f7-4067-9517-018768e58844", "comment": "Malware payload (Smoke Loader)", "value": "7a9d771d11b6a787e2d996aa04a27dc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671980112, "uuid": "f1e712ac-6ba7-44ea-9704-806ca159f056", "comment": "Malware payload (Smoke Loader)", "value": "a293ba418aed6ff819fb465a96e6474533d86b7650ecfa8c0e499e034dcf5285", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671980112, "uuid": "d72419d2-a9b5-4880-a034-ed875f457e70", "comment": "Malware payload (Smoke Loader)", "value": "0e3d46eb6cac50acd78385eac446e41114abe19a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671980112, "uuid": "2c066a21-fd49-4b37-aa30-696faef1e722", "comment": "Malware payload (Smoke Loader)", "value": "2b35e1d86c98fc1d23f9bbe99b3e0ac4419160c7cff61811dc08cb7be2670e64f325c3c766853e251ab72d7454b91f4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671980112, "uuid": "956f4184-0b56-4f94-8527-8cddf0fc64ca", "value": "T19434AF106290CCB1D7D20470592BD7E92B3BBCA15A6755F776887B2F3E702B0B926347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671980112, "uuid": "85e274d7-f02e-4423-8f1d-ac67a8d9929b", "value": "8514760d95d5a493235b8748f65885e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671980112, "uuid": "b5d2af86-c25d-4fa0-af26-34309e023210", "value": "3072:8Ea5LEHBzq5flgvVM/1uou24bxM0ybprLtXdCKRR3HFtJ/tmwDPAw7RkxmJZs:8ZLyxylf1uouLEJNjzJ/tuGymI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671980112, "uuid": "606189d1-6dcc-4fc0-981b-c35471cf8fad", "value": 237056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671980112, "uuid": "3986d82a-7cb5-4797-aaa7-007f51f49824", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671980112, "uuid": "1a1fb25e-5184-4e99-a641-47c6c93640be", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4929517b-843f-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671964286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671964286, "uuid": "30565bea-67f2-4cf0-b4df-dacc40627d62", "comment": "Malware payload", "value": "0e3e5b640f82a57cbf86c687ed7269df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671964286, "uuid": "7a2d02a6-c153-4be3-a5a0-2dcf8ad8af30", "comment": "Malware payload", "value": "a50e1d974def99cca48fe68a82b7f2e0229f42a94c52ea716c9f921f7ee241c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671964286, "uuid": "ad092b98-2bf6-4be3-9fa7-21cd7da24bf9", "comment": "Malware payload", "value": "b0ee291ddddedf3f945c90e31b537833ae240fd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671964286, "uuid": "379a0de8-5e7e-48ac-a6df-93ae06c50f70", "comment": "Malware payload", "value": "614a42054acaa62b63c91534e3125baf914533767c284f26f5b98a33e3dd0648ce445880f93966a643d276595a96baa7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671964286, "uuid": "133dcdad-0956-4cca-91db-31870a3297fd", "value": "T185C10E419EEE50DAF227073017EA73BB16B6F9B1441EA2F830844A599F307D0C862FB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671964286, "uuid": "b550a07b-a3d6-4f08-81a4-31c27bf12aed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671964286, "uuid": "f1369eda-2dd6-4b78-aea7-39e7beb2c35e", "value": "96:0Zv79ILCFmOf3lNa96k8w/g2mvxd3ojmrl:GT9I+FZfVNa9f8w/gHxdN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671964286, "uuid": "d04d9326-59ae-4b30-b300-e1b5de09e5f6", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671964286, "uuid": "48506d84-8c82-4499-a488-d054bcbe1c13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671964286, "uuid": "8d3022c2-c852-4c5e-a8fd-017450bfd36d", "value": "SecuriteInfo.com.Variant.Marsilia.2083.3742.20818", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d28c9f5e-849a-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1672003601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1672003601, "uuid": "83281457-c414-4f76-9c9d-1246422b4bc4", "comment": "Malware payload", "value": "50f804359c6b83fc9da96cafde2ee18e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1672003601, "uuid": "2bcec231-4c3a-4baa-a388-b1b4737449ae", "comment": "Malware payload", "value": "a6e83ddb142d408c3dffd57e2c493ef1eb3fba71c3c17e8c12b11aafc652d5f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1672003601, "uuid": "1b7ff2db-5d69-4710-b467-40f2caec9e5c", "comment": "Malware payload", "value": "7d374ebcb436b10b29c4df4ce04fefff7a4dfed3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1672003601, "uuid": "b64216b4-9e80-4087-b72b-e48e697c2ae8", "comment": "Malware payload", "value": "f1215d87d9a58ba8cef96ccb633f44db60f8150fe33de070cbf6d99bbf72e3fc44205d41bb68ba521eb136770379a843", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1672003601, "uuid": "7805248b-77e6-4f89-86ff-f1d8ce0fbad8", "value": "T1AB9523D8F6B81EB6D0DCC678BD95D058B6206B920B1B424D09DEB5CFBB2942C8353367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1672003601, "uuid": "8df36cc5-ed2a-4e99-ad9a-c4b7ad36a9eb", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1672003601, "uuid": "a8157522-d1ca-4d20-a94b-3ad0425b7df2", "value": "49152:uiXxMn4q86OG5ufkAT8tmW0IX3M0V8oULaeZZat:uiXE86OGHAT8ioXVMfMt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1672003601, "uuid": "c0ad23b3-e76f-4a19-b94d-ae5eca85a2c2", "value": 2009243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1672003601, "uuid": "6a790ec5-ca39-4a41-a740-de7b636fe332", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1672003601, "uuid": "d5ecbec5-aa40-4ec1-99cc-341d9b9945a4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18189e4d-8448-11ed-9db1-42010a9c0080", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1671968069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968069, "uuid": "a49bd02e-3a3a-491b-9167-6b998ff32840", "comment": "Malware payload (SnakeKeylogger)", "value": "5bffb7b4b3e832e45706182840132e16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968069, "uuid": "0ab3c960-9c8d-4bd2-a93b-dfdc4a6595fa", "comment": "Malware payload (SnakeKeylogger)", "value": "a74b4aaa3b9e02a2a846ef6d5a490807f0b0a34ea224d10a9e7cb40684335a3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968069, "uuid": "e6b153d9-8053-42c4-91d6-c1be49e979a5", "comment": "Malware payload (SnakeKeylogger)", "value": "efcaecd148b9a58571e46ca373c984d897b2b8b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968069, "uuid": "4d2be55b-66da-4ec7-8388-2fc5252642e7", "comment": "Malware payload (SnakeKeylogger)", "value": "1d57eb9fa3ee2563046e5cbccc64295e29135b2f3ce3bb79c7cc1fd11a35411204668aa780425af06d5ca162ea4188d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968069, "uuid": "59d484a6-2262-43a4-a98d-d9601401d321", "value": "T1BB34129961C5D07BF8D246365132A727DBF3C60052E11A0B2F808FDF3E767C2599EA86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968069, "uuid": "0030813d-0e39-464b-abb7-0c157a35bbf6", "value": "97318da386948415d08cef4a9006d669", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968069, "uuid": "57e9682f-f560-4c41-b62a-9272c822e01e", "value": "6144:fkwHWYu4Uy3bOa7+6wmGI3kqvCaf3kZpYHi:TUiwAvjkZpz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671968069, "uuid": "e3f116db-8bf8-4a94-9133-518e095988c5", "value": 240342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671968069, "uuid": "92c181b6-64a9-4f0b-ad51-1f900511f5bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968069, "uuid": "8b010541-a9e7-4102-b120-f2c5b0cf7dd5", "value": "5bffb7b4b3e832e45706182840132e16.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39b9a43c-8413-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671945362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671945362, "uuid": "609c23fd-7280-4daf-ac92-9d818935a849", "comment": "Malware payload (GCleaner)", "value": "c2f49d17873b19908eae7dc342c58bed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671945362, "uuid": "5a26c95c-4987-4ad1-8d81-103336405c41", "comment": "Malware payload (GCleaner)", "value": "a758b9c24eace3145cb0339b52cb6dd6d88034e7188b1bfc25dbdbefac05b268", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671945362, "uuid": "1df5fabc-8cdf-4387-b685-4a2b98c30a0d", "comment": "Malware payload (GCleaner)", "value": "162382781c2d68162303ec678e1cccf481dc9b8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671945362, "uuid": "ca8c0af7-45f4-4f1a-9330-b692e96c7e6e", "comment": "Malware payload (GCleaner)", "value": "f1326d4bde9009ee6d564ccae1f6d5d06c0a2ad3c6a9696c7a78d6f89cf86bcd4c172af2378364f1f6a8db36e28f27c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671945362, "uuid": "d4806562-e75a-4682-99ec-e8d0ed5216a8", "value": "T1728523E8FBB195BAE27AC0394E00C4087171BF840F195A4EACECDA9B6F7550C572B746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671945362, "uuid": "d5374891-be42-46aa-a768-26c0415885fc", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671945362, "uuid": "5101eb24-bfad-405c-bfd8-5449fe334a80", "value": "49152:qi+gMGAeFyhGjjE+lo+TdrAJ5SnYwlgKkKZaH:qi+giphGjjBDJEiFlhkKMH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671945362, "uuid": "58561192-a5e2-4c64-a216-3ffea4f3e18f", "value": 1840492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671945362, "uuid": "223d58c8-5e65-4d72-a667-7dfe989d8971", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671945362, "uuid": "14e8c536-f0a8-40b5-b85e-36f41823b009", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78efc34a-8454-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671973385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671973385, "uuid": "803b2dc2-eee9-4afd-80fb-8c46ee427394", "comment": "Malware payload", "value": "cb0aa7fced6b388ba32b33e27713f484", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671973385, "uuid": "03929eff-034e-4e57-82d8-a2193fbb6d4d", "comment": "Malware payload", "value": "a783824b966dc801c04201f7251aeb70e2ce8c33293539ab160828008ae11c39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671973385, "uuid": "d6459ddc-4a9e-44ef-8380-711363425f6b", "comment": "Malware payload", "value": "f3e6dc144b133353306b14695f58dbaa81b49f32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671973385, "uuid": "a3972fac-7aa7-4d21-a94b-2790bca66810", "comment": "Malware payload", "value": "640955488359c2dfc8a44eaa7a7d74b11f362a0cf25330b8e23c6aa396746c05e1211b053c9cdc87f4e849568cc0cf10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671973385, "uuid": "ca2512db-7df9-4bde-b9c9-88738cf584f7", "value": "T126864A03F89191E8C1AED13086269263BA727C484B3027D76B60FBB52F76BD46F79354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671973385, "uuid": "c233fb43-94e4-469e-8e12-62a084851d45", "value": "87fff2010412aad37f9c0bec93dd5d32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671973385, "uuid": "7f2b34f3-1bd4-4384-b7cd-9cac57975e27", "value": "98304:Z5wzP/CoM1IdClLE0gPv1S4F5GFTvdEQusih:3wz3CozMLXgPv1S4F5GFTvOBsC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671973385, "uuid": "3476caa7-5ecb-4a56-b5c9-b69332b3d2f3", "value": 7900160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671973385, "uuid": "fdb94f52-9e71-4978-afdc-d060bf9b0317", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671973385, "uuid": "6ed0c605-2a41-4289-9e1b-ac96375c0f61", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e9e5b04-842a-11ed-9db1-42010a9c0080", "comment": "Malware payload (RecordBreaker)", "timestamp": 1671955249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671955249, "uuid": "a759bb96-4c88-4cc2-bd65-49a3bb83c868", "comment": "Malware payload (RecordBreaker)", "value": "027a39b21dd2e44e525dbe8a7e16b85d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671955249, "uuid": "a3c3cb92-440d-46fa-a6a3-8672b828e16c", "comment": "Malware payload (RecordBreaker)", "value": "a80738e33d866997b550996b78a79e488072857e5288190aad26786841e4cfc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671955249, "uuid": "1911c7ec-63ce-4746-9938-2d4298c9f1b8", "comment": "Malware payload (RecordBreaker)", "value": "17a78c9255aa4f34c63c9258ebed34fb4b8951bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671955249, "uuid": "9a324a39-feeb-4c30-8b19-d65372b74393", "comment": "Malware payload (RecordBreaker)", "value": "388850830d39a70c557fbe5e0ac5c20cb796af4f1ffbec9540424b07355d0fe869bf2d70007762b879c33875d3646065", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671955249, "uuid": "22eb6e5c-859e-4c64-a93a-4de2adf2b499", "value": "T1E324AE146294CC62C3D24970583BD7E92B7BBCA19E635AF337087A1F3E701B09A26357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671955249, "uuid": "f5068dc8-dcf8-45cf-a897-2a457ccb9210", "value": "78b36debb485b88b8de5929ea52f861d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671955249, "uuid": "12f626af-0a24-48c4-8c1d-ad260aac747c", "value": "3072:WlKMLdUJt5VtomgfcoREb2abdrQ4eBfPC4YKtJ/oIFb+gw7RkxmJZs:eLdUJFg5EbICQJ/V5GymI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671955249, "uuid": "89ada618-acf8-4174-82cc-a2db21d13fe4", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671955249, "uuid": "f2f84b0a-b0fa-41c5-a48c-4b7f3f7f34c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671955249, "uuid": "62e789e8-4573-47b3-b63e-f627ab5d6cb5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c506d39-84a2-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1672006704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1672006704, "uuid": "f5eff3de-af51-418d-8056-d2183bb5416e", "comment": "Malware payload", "value": "32e2938533598496e97070a73f42bb88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1672006704, "uuid": "e9015aa9-5f5d-40d8-9ab0-6eaa13d61556", "comment": "Malware payload", "value": "ac11fed62d81f2d45fecf3786b6a2e93e604e56c90dcfe3cad438bf9684e127e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1672006704, "uuid": "da7152bc-6ca5-487c-a125-05a8b3861685", "comment": "Malware payload", "value": "47c1592b43834ea631902e2d8050f28ac646619c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1672006704, "uuid": "0914648d-ac1e-4927-8230-8f47f711a9ab", "comment": "Malware payload", "value": "e1572bbb4ee8825f7df00e73df285d92444708163aa944898634a499aa0642040b63da7f0825cdba525e9ca2d248e3e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1672006704, "uuid": "962e1017-93e2-4737-afab-19df68c8b8d0", "value": "T16634BE01E693D4A1C55708318919DBA52B2ABC21FE64DD3FF340BA5F2EF0291A5E6337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1672006704, "uuid": "e7aa2f7c-bcc2-419e-8359-9bfe5983c0f0", "value": "6a8f260c43148885d76dffe1ee7a8503", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1672006704, "uuid": "8eb7fac1-abc8-46e9-ac77-47f382a14e6d", "value": "3072:PPnX+LnXq5zvwby4A+hcj2qSpX9J4blS1g/tK8FPXLrcSb54VIcVTuh:eLXYkyRPj2qotMtK8FPDbIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1672006704, "uuid": "299b2d16-73a4-471f-8fca-44925568d2eb", "value": 237056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1672006704, "uuid": "d966d214-8141-4e21-a26f-f22b1807e952", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1672006704, "uuid": "6f9ce760-dbd4-45fa-bb45-f0f65d67db5c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b12afa7-84ac-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1672011051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1672011051, "uuid": "4e0e3174-4496-4101-8327-e08bacb86cba", "comment": "Malware payload", "value": "d28df046a6e01beabd8b3e07848b0a43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1672011051, "uuid": "45d4e6c7-cc59-4d83-b5c6-8b15100f7841", "comment": "Malware payload", "value": "ae0cb309905cb2e8f77e6893db7725eb9ab43b122f3047444bd132a3b382926b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1672011051, "uuid": "015facd5-969b-40ad-9be0-667554fa75ea", "comment": "Malware payload", "value": "9db28ba915eb8e28e4714bf87b8b824a88741f1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1672011051, "uuid": "3a5985bd-f4c1-410c-9b49-8b4d826fcdeb", "comment": "Malware payload", "value": "f4081e03a15dab9209145ad0bfba29ba295545c3b53175d4a3b09c486def247f6c37c3ea839ec29826166c55c89eded8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1672011051, "uuid": "a65c96db-bfbe-494e-bd35-4fd126a8d6d8", "value": "T18234CF00B292D065E51308305D1ADBE5AB2EBD61BE55DD3BF740FA6F2EF219092E6313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1672011051, "uuid": "eaac5378-ea6e-488d-944a-3d48b839b201", "value": "6a8f260c43148885d76dffe1ee7a8503", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1672011051, "uuid": "37167023-1b0a-4f53-a655-d6e9d33731b3", "value": "3072:XVmwLUF51n0B/+1dUQsLsyrYwoKWfRCRlS1g/tK8bA4dLLrcSb54VIcVTuh:HLUSNQ2syrYwoKVPtK8bJHbIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1672011051, "uuid": "36b42f7e-3324-4499-b7a9-fe9bc5cc5bdc", "value": 237056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1672011051, "uuid": "cabafbe6-87ff-416c-a9c5-862673e279d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1672011051, "uuid": "9a126ac3-0d98-401e-add3-8604e57db606", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7683d743-843a-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671962214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671962214, "uuid": "668e0bb3-47cc-4887-9444-723adf814416", "comment": "Malware payload (GCleaner)", "value": "4e254f5b6340961876b64c0e0be9413b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671962214, "uuid": "ed25efff-01f1-4c59-af35-91ac186d9f01", "comment": "Malware payload (GCleaner)", "value": "ae49c324f360d1c766e89cf601f57ac604067119948bc9e44b8b2cf3f087472f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671962214, "uuid": "d15c8e81-116b-439a-afc1-df9cf71fa5ee", "comment": "Malware payload (GCleaner)", "value": "169facfaf1ea1bb33a208d45f02722a55e31bac2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671962214, "uuid": "7bf7dc56-1570-4156-bf08-7fa7b9f7bc06", "comment": "Malware payload (GCleaner)", "value": "87e9e07389832837defe92304ed385f0bfa7ad487bf965ae47a6b070536c4c92140398c86577b054ef553714717e74ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671962214, "uuid": "3bb5b694-b58d-4bfc-bccf-ef31138c002b", "value": "T10D8533E3FAC91A77D29DC170FD954A4472A0BB826B0DC51C12E8EA47BB2D64C6317723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671962214, "uuid": "ac55661d-bb03-4342-b053-d6f8e1580274", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671962214, "uuid": "1e3df64e-b15b-4e0e-a0e9-4b1a07952b55", "value": "24576:9izipouwodi13l3b3GPYXmVBkGJ4I8vijq27GFxofAmbYCWWAcxrXYpDesL6euJo:WiWuwKS3bOvJeiIFi9NWGx7YB5ZaW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671962214, "uuid": "4b1ff5d9-8719-42a6-a551-4032a5c7523f", "value": 1834384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671962214, "uuid": "808cb1d6-85ba-414f-aaba-b74871342215", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671962214, "uuid": "8bed7434-7519-4ea6-82c8-3a16b7a2d5a3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d180291-845b-11ed-9db1-42010a9c0080", "comment": "Malware payload (TitanStealer)", "timestamp": 1671976372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671976372, "uuid": "5c8574f4-28a8-46d8-a634-e15034fe2963", "comment": "Malware payload (TitanStealer)", "value": "01e2a830989de3a870e4a2dac876487a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TitanStealer", "colour": "#EC6200", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671976372, "uuid": "0a667288-8f50-458f-8481-c97df18d0a48", "comment": "Malware payload (TitanStealer)", "value": "af58e830feef2f4086fb52dafda6084b3b85c6200f4cbc35a5460fb703dd39df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TitanStealer", "colour": "#EC6200", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671976372, "uuid": "c56217d8-bad8-4385-a31c-82b50fdcad27", "comment": "Malware payload (TitanStealer)", "value": "70f91a528227f6746fb932deb2b3f1e4011953ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TitanStealer", "colour": "#EC6200", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671976372, "uuid": "36ca3fd2-9a20-4376-8716-d811f39a75b5", "comment": "Malware payload (TitanStealer)", "value": "7c007f294653155d04e0adffe8ee2316fc039c33932c03a04d86144dacc8a23a34d04db405b720808906ac63b5ecf73a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TitanStealer", "colour": "#EC6200", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671976372, "uuid": "ae7dd042-41e0-4503-a3bb-aaeeee61ac87", "value": "T1BFA529A0F9AB04F1F64359314CA753AF23346E095F3ACAC7D5547BA9E873AE20833165", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671976372, "uuid": "52d602b3-317f-4e71-bd85-b3ace76bafe9", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671976372, "uuid": "26d35c2b-f26b-4387-95f3-7f1ddebf1de9", "value": "24576:pYqedPg9t9i+K8UOKU3R0Jp3coDyTjDmH3BbThj7eQSjEo8g5hm5o6CmqzCzSOdy:pqgTqJBcob9NeahKuo6COSeNWYq1UI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671976372, "uuid": "1c403f08-f8fd-472a-9c34-fb47cabc3c67", "value": 2068480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671976372, "uuid": "d8f70924-e7c2-4737-bdd3-edcb5ff058c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671976372, "uuid": "400af61d-9a2c-4e75-acc3-d2696dbbcd2a", "value": "01e2a830989de3a870e4a2dac876487a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e4c2d32-8493-11ed-9db1-42010a9c0080", "comment": "Malware payload (CoinMiner)", "timestamp": 1672000426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1672000426, "uuid": "1eac5bce-9306-4e0c-a34b-75da2e1040aa", "comment": "Malware payload (CoinMiner)", "value": "ab7c0f8607b9b71630eb684591446eb0", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1672000426, "uuid": "058d14d0-0e40-4bf7-b3f5-ce124d16f956", "comment": "Malware payload (CoinMiner)", "value": "b0302fe3b0973c3f18a2cebccad7920fda170c9a52ce8151940cd2e267e22eb2", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1672000426, "uuid": "9a7b2f4d-64b7-4425-a029-3cd927178635", "comment": "Malware payload (CoinMiner)", "value": "42acc2ca74a3df033d143a8581db5e5290bb883c", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1672000426, "uuid": "97598a82-7ffd-4230-903b-e46e4c1349e7", "comment": "Malware payload (CoinMiner)", "value": "1ddd0b8569bf939707f370d4067ce626068b44f3e0de6a52f430056f3e2269da3714ace5453ded3a383d30d3e81b4396", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1672000426, "uuid": "c935749a-4639-4bcc-ae55-981b27875899", "value": "T175F54A4367EA060CF1B76B78AAB701744B37BD956839C64D019C750E0FF3A4498A6BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1672000426, "uuid": "2fb629b0-0a46-4918-b185-060ba69c290d", "value": "61333fcc0ae442dc4eb662bf04a018ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1672000426, "uuid": "4c13d11f-90a6-4aa0-8cc8-8804946b636f", "value": "49152:7Uz++7yAnJ0mHnw+JxLip9+/f6NDK6+umt6FC0SzEsgxlpwIsEnlwUWoZx2Jp3:7Uz++7yAi+JxLSw/40KC/z5XEnhPD2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1672000426, "uuid": "91bcc776-1ab6-4ec6-afcb-2790321ba68c", "value": 3470848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1672000426, "uuid": "efe4e760-bf2c-483d-bdc5-1b434c609e6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1672000426, "uuid": "151f9739-3d37-4c27-bff0-c29537fae42b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28a64bfa-83e7-11ed-9db1-42010a9c0080", "comment": "Malware payload (Amadey)", "timestamp": 1671926436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671926436, "uuid": "c994580a-80c6-4fd7-b995-1fbd8834833a", "comment": "Malware payload (Amadey)", "value": "f9a012749b8c926c89dad7c0d200103d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671926436, "uuid": "a8481eb7-5502-444c-abdc-4650c4b67a9b", "comment": "Malware payload (Amadey)", "value": "b04808b3807c3fcaccf1f7199c3a9237ae596b726af2e9f843789f1566cdd6f5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671926436, "uuid": "68d6b8ce-23ff-4ae5-9774-0c0b1c0b3d86", "comment": "Malware payload (Amadey)", "value": "df448cf1ef2d1fcd87f1648be000efc22fd239a8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671926436, "uuid": "e720180d-c082-4d61-bf19-b1b16bfc0fc3", "comment": "Malware payload (Amadey)", "value": "056b6e82ba047212495c0a8fa6fb67e226493541d95f64126b3da9fc72b2dcc3441a3cbefa3fbd93c1aafc163f7fed5c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671926436, "uuid": "4acd7bf7-8092-4250-85f5-cdc38b9c9432", "value": "T15F24BE1CBB92D467C54249349916CFE4AB7AFC714B616A6F33007B1F2E70ED0B22A365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671926436, "uuid": "89c7aab3-d53f-4d41-8e41-92135012d64d", "value": "20c459d943d7c19ddc9a1be25fe9460f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671926436, "uuid": "3fe7ee55-2ea9-4e6f-a75b-fa70d7ca3cb2", "value": "3072:SmEjJLDcW65Bl0nadghOGp80QF21rKVvQ4TznauDyjG2f/ln:mLDZS0adghzb1rKVv9naMVo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671926436, "uuid": "de430beb-fbe2-42d4-a3ae-0a38e71a6b1c", "value": 229376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671926436, "uuid": "d61d2ad2-b178-4cdc-bbb9-eee6232442aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671926436, "uuid": "abd39533-5362-4af1-b802-f8b0a3282bd5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "032d79b2-840b-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671941835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671941835, "uuid": "2cc68db8-ef6f-4acb-992e-7b0c546488f3", "comment": "Malware payload (Smoke Loader)", "value": "19c7353483b6c61f052e413087307f46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671941835, "uuid": "12625d48-2cd9-4b71-8349-59773438e59b", "comment": "Malware payload (Smoke Loader)", "value": "b2460eb16f31133c7f67522b0f65a5ba24c209d87c94484b38d398dd4e7d293b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671941835, "uuid": "642398c2-fcf2-4c3c-b82c-0f1027b19fdf", "comment": "Malware payload (Smoke Loader)", "value": "043f2c9f840d4d1b9879301eecbdb070368460d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671941835, "uuid": "7b73abea-5e3f-4e4b-9476-236d7e87c31c", "comment": "Malware payload (Smoke Loader)", "value": "ce4fd4a4c53c067f00c00e088ebb10200b9f2cc69639930f99026dbbf37c200fd4eeedb08539556e88c7b144bf2c5abc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671941835, "uuid": "49e42a1b-a06d-4aa5-a14f-4bcf6c8ed788", "value": "T11724CF0CBE92C1F5C1514530AD29DFE56B7AFC708B619A2F3340375F2E74E90866A3A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671941835, "uuid": "b9846b16-4f4b-4163-80b0-f4f3daaf3f42", "value": "1ea9f0326cf512ac0eb7dd4bc1a00a19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671941835, "uuid": "393cafda-37ab-4e46-b3f2-138c974d3d0d", "value": "3072:CDThLRr5aCnfm0qrmBiJ6006S4W7ZFccVMn8FINEdauD9/+m1f/ln:ULRrH2mYc0JEbPdaMImz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671941835, "uuid": "142537f5-0e44-4496-9013-f804ca1685ca", "value": 228352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671941835, "uuid": "907d2a81-2d03-481d-a6a0-bbec9e0b3e40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671941835, "uuid": "bdde2a7a-5389-4414-bd99-c92bda033a95", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7694969-842c-11ed-9db1-42010a9c0080", "comment": "Malware payload (Stop)", "timestamp": 1671956418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671956418, "uuid": "495328fc-4922-4534-b377-2aaed636b03c", "comment": "Malware payload (Stop)", "value": "7c24e7b69fb12ad039f3b7396dd6fd32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671956418, "uuid": "f894624d-3995-4346-94fa-4f7a32f928b9", "comment": "Malware payload (Stop)", "value": "b26be32b965b6866a98ac406006082067f1343cc134ad210c4f51621432624b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671956418, "uuid": "79461cbe-db04-4dca-b269-32fc42e9939f", "comment": "Malware payload (Stop)", "value": "3f68285a80953248f7fa6fe7b9db41ac9907e45e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671956418, "uuid": "1f7348d8-dede-4e86-bc59-231434854c26", "comment": "Malware payload (Stop)", "value": "c2c8d268e8bbf17892988e2ce3880e44880f1f89e0daf749d4172161bb827147b4a2796cbc64498a21e3a75ddede8511", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671956418, "uuid": "45836816-0485-4859-aab1-2b9532fe6b50", "value": "T1E7F4121DBAA3D065D41645708C16DFC843ABFC341F61156B37083B8F1A74FC2AA6A3BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671956418, "uuid": "777cc5a4-6d2b-410d-a8d2-33de62f28aa3", "value": "1ea9f0326cf512ac0eb7dd4bc1a00a19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671956418, "uuid": "bd982cf4-4367-4b87-9a9f-3cbb890e8653", "value": "12288:+8eeF6ydsY56HpajkOX98MTK+n3V0YW4AQwIx/dvpaMC+uH:O2hT52168MTKcF0YWQwIx/buH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671956418, "uuid": "212dafec-314e-4c47-81f5-2b907aab5c93", "value": 759808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671956418, "uuid": "ad95ee79-2a05-4e23-b558-eddeb1650992", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671956418, "uuid": "13ca52ca-b000-4f03-9d79-9f8500ee1ff3", "value": "7c24e7b69fb12ad039f3b7396dd6fd32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3b072c2-8448-11ed-9db1-42010a9c0080", "comment": "Malware payload (zgRAT)", "timestamp": 1671968357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968357, "uuid": "0cc29590-dc18-40c7-be74-c8557cb81902", "comment": "Malware payload (zgRAT)", "value": "2b65a93638954e06be61b462a5db9c9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968357, "uuid": "4f797a18-bbc7-4914-b541-252425953689", "comment": "Malware payload (zgRAT)", "value": "b2e6ebdde50250719724fb53220d067433b9cf2a750734c42c436da0c6e25d2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968357, "uuid": "8d7b75c7-f386-4357-944b-0d5ae9a3a12b", "comment": "Malware payload (zgRAT)", "value": "6b8a123b8b2ec341d00c811902dfb681de11cba7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968357, "uuid": "7082c2e5-ad82-4008-8461-c57eca0b5f1f", "comment": "Malware payload (zgRAT)", "value": "ba72efc3d8cbfaa11e7f31ba2a464555ef088e8c545375df0761d44f531ea09450aa635f2f5876fc0f9823a97f638013", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968357, "uuid": "c7968edc-872f-4b03-80bc-09ee54f698bb", "value": "T17C35017C750B7B67E22760FFD445AAD12698E3D2C1DA6A710600BE178A17C8385723FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968357, "uuid": "b72e4097-2bbd-48d9-98b6-b2c0b8a0214e", "value": "24576:8dvqhtXG2fKA/8TOQp4JeuaIpIiiTgUc33f53GtUwe8PTWs:kqhtXtfAOQqJeuaH9GfNG1PTX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671968357, "uuid": "50d3cca2-a88e-4285-9f8a-3b35725c1abb", "value": 1079808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671968357, "uuid": "e7407687-f0dc-4ec6-925e-0aa038981e98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968357, "uuid": "cf669336-e5cb-4fde-8e47-a083844ae089", "value": "2b65a93638954e06be61b462a5db9c9f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af9e0965-8403-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671938688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671938688, "uuid": "2c56d777-ec87-4996-846b-ebfb1eeecb2e", "comment": "Malware payload (Smoke Loader)", "value": "76e6e2b187f524abcd8abe0eabef5354", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671938688, "uuid": "0655b2f3-7e55-4858-a1dc-758f2e1f1098", "comment": "Malware payload (Smoke Loader)", "value": "b354a8ec3709c8992792894fdc71f0f710546a26eb46f7a07ef4f8d62f8fa4e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671938688, "uuid": "c900393b-4ded-4949-a95c-982ef061f30d", "comment": "Malware payload (Smoke Loader)", "value": "e81a59d9f15d7c92948ede075502535a2e5c2131", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671938688, "uuid": "873f932a-75fa-429d-84a6-6913b00bfcc0", "comment": "Malware payload (Smoke Loader)", "value": "24be976daee5dd6df9517206d30d0e6b135a51c858ebd7df6d4fe5ab2399b2dec2cfa03378423868d67dddd0828e1ca6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671938688, "uuid": "3d4fa061-ea81-47de-aa85-16c95574e482", "value": "T13D24BE0CBA93C076D5A14A3089158FE46BAAFC319F619A2F33143B5F2EF0ED155363A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671938688, "uuid": "f5814e9e-3e87-4e46-acf2-f2d0895939b6", "value": "1ea9f0326cf512ac0eb7dd4bc1a00a19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671938688, "uuid": "70a2d4e8-eee4-4dd7-82ae-3357d2d6f431", "value": "3072:RDJCGMLn25F2uKDvQnv/3Ld+bFBTdIN7HF+5auDUcV4f/ln:+GMLnggQnvvhSIW5aMUt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671938688, "uuid": "a811039d-6ec6-40b8-849a-a462345155e5", "value": 228864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671938688, "uuid": "83079a43-6e47-4ae7-9b9b-2a72bc56449d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671938688, "uuid": "4ddedff0-3949-4516-a0a0-63df0fade3df", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dae2fc4-849c-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1672004156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1672004156, "uuid": "51cee41b-c553-4586-b929-298db9b71e08", "comment": "Malware payload", "value": "72a5abf77915da4a5ba879d43e4c2a95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1672004156, "uuid": "40e1deb5-dacb-4ebb-a72d-fcc65f8ab4bc", "comment": "Malware payload", "value": "b35a1d9396994d9701301ef18d0e53dc3f74c2eec8322c939cc4982063952088", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1672004156, "uuid": "46c4be61-9917-4661-a352-f3a12226bd09", "comment": "Malware payload", "value": "c6feae2b234ebe9fd6db86cc032e6665575ab8a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1672004156, "uuid": "8e165f97-0a4f-4a59-8b13-175005126655", "comment": "Malware payload", "value": "905174720e11b4f7a7ac5670a660878c1f9fc519202a95dac7b65b8c458a0b3fe12129aec870b6c16d8a1ee4f5ac0437", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1672004156, "uuid": "69a1d034-f0fe-4c8e-911f-17c8e308a4bf", "value": "T17CF3385D72A450B8E177827C89A11607F6F2B8514B219B9F03A047BE6F276D1ED3FB20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1672004156, "uuid": "1222bd23-dde6-4a4d-87a1-c524d9415ff9", "value": "9dc1e1ff3c86dd9b09202a7da69d6ea6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1672004156, "uuid": "073f7986-f932-4e6f-b110-37e122f10feb", "value": "3072:gcDMgvVIhARGoCiov0h7rfxlMJFPczVOqJ:TwgtOWCiovk4EzVv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1672004156, "uuid": "1586ebdd-6bf6-4dfe-ab8d-0604ccd1a9e8", "value": 160704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1672004156, "uuid": "e40bd226-5d18-4875-9993-c83ddd1f0965", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1672004156, "uuid": "9185b4a0-4788-4549-9b0e-5b3f723d7caa", "value": "7ff9948a0000.shlext010x64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "092ee62c-849d-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1672004551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1672004551, "uuid": "711928d5-54bc-49cb-be91-ae605baf01de", "comment": "Malware payload", "value": "50955e7caa52706d4d40368e73b5e58b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1672004551, "uuid": "a3370c0f-9d28-4525-be89-20bad66df1c9", "comment": "Malware payload", "value": "b5418200a6c83727fbd8904aedcbcbf0f1a30ec3275bd2dad62fdb0a8d0062f3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1672004551, "uuid": "3a828c14-03ca-4b02-b7f2-7675c3c7666f", "comment": "Malware payload", "value": "5434ca1ea103c3a996c1ba528ac318e1135425bf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1672004551, "uuid": "1ccafab9-f60f-4b63-9574-082810f6b813", "comment": "Malware payload", "value": "1edf6ff86eb1fc06fd3f86a4c49a313de60aae7236120fe7a9554098c80f2e5603b906154893f48a5c2c389d9d2eb7cd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1672004551, "uuid": "97bcfa86-8060-4c1c-bd33-17fa7965cef9", "value": "T1AEA33943A72D0F83C4DB99B12DB72BF1876DB97112A361C1690BEE9003739B81517FA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1672004551, "uuid": "f2a9cdd5-bc60-47e6-b834-2548deb2fad1", "value": "1536:7QQfckMzQzgv9OtAC0QptczD3z+FavgxTXvEmL49VqFjtUfkjX:7xH/JFDtczD3mT7vEmU9VqFBUfkjX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1672004551, "uuid": "e3c2284f-01d6-4921-9fc3-3abd7e5eeca9", "value": 99023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1672004551, "uuid": "8b28bfc8-5fc0-4568-88ae-e234e8b93a79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1672004551, "uuid": "373022a9-4ba8-4207-a77c-12c9e4d15383", "value": "50955e7caa52706d4d40368e73b5e58b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b08bff6d-8448-11ed-9db1-42010a9c0080", "comment": "Malware payload (DanaBot)", "timestamp": 1671968325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968325, "uuid": "3c43c62b-ec7d-4079-909c-461e5acd6de2", "comment": "Malware payload (DanaBot)", "value": "70fbc839f4bc8b75f5830322b03f3434", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968325, "uuid": "3f7475f4-8f90-45f8-9c3e-e73292981e0f", "comment": "Malware payload (DanaBot)", "value": "b58d6ca8e7f73937790a1e4e2ef29835d3190e672f4225d06f3fcfc3c70035ad", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968325, "uuid": "5697e885-2a26-4403-8f6d-3bb4be6f3664", "comment": "Malware payload (DanaBot)", "value": "f98f5826318f8410f11f5ebc9cced80df5c013d5", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968325, "uuid": "5b878372-d9ee-4475-9c6b-678f5d64063b", "comment": "Malware payload (DanaBot)", "value": "43526965bbc9fcb3589436fb6569e686154f9bbfb8e20da76555e674ab9cde59b280eb14925e30e41f130ed213e8ddd7", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968325, "uuid": "4ebb2c3a-c05f-4d82-8275-85a9946d6e9a", "value": "T1C035231CFB66D067C61156708917EB945B69FCB05B02AE2F37043A8F1CB0F90976F2A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968325, "uuid": "bde424f6-b193-4579-a437-c6eeff0c460c", "value": "1ea9f0326cf512ac0eb7dd4bc1a00a19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968325, "uuid": "eebc3c16-952d-4b7b-8ff7-e2f0c7aaea5f", "value": "24576:yPVT3zgw+Y09Shzna20ZUHwXM6oy+yKcVaGh/IUEldTo:yPNjx+Fl20ZKw8Jy+LckGh/wto", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671968325, "uuid": "7fe5766a-6595-4b0c-a56b-cc9edf594b7b", "value": 1130496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671968325, "uuid": "0a2598ad-3a89-449a-a66a-08fa6cfdd846", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968325, "uuid": "5ea4743c-7f05-47e5-99af-8a3096c87816", "value": "70fbc839f4bc8b75f5830322b03f3434.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "515e4516-83ef-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671929940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671929940, "uuid": "06c80696-1fc1-4006-b0c1-9024a37d14fa", "comment": "Malware payload (Smoke Loader)", "value": "ee95ff2755305e8eff9f6e1d2e3e5aeb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671929940, "uuid": "5efd77b6-e156-418b-b179-85147d1c59a5", "comment": "Malware payload (Smoke Loader)", "value": "b606df43759b25e1300a9042370170e20f3f126aba31673b8d952fc11397c04c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671929940, "uuid": "d28af173-ea88-4356-9033-89bb222aa043", "comment": "Malware payload (Smoke Loader)", "value": "8eeab94b1432530e8d0decb35ab0d6448ca183ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671929940, "uuid": "5f74a859-29a9-4756-89d3-6204cb763f0f", "comment": "Malware payload (Smoke Loader)", "value": "3514ede2f25184b849d9b06ed6d4ae201ccb85490220b9dedb5bf8cebd9e155ceed9729619fc48247a5637bf97f664ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671929940, "uuid": "c7b1401e-dc15-4c62-a834-ce2258e23eed", "value": "T15624CF0CFAA2C066D15155304925DFE0AB6AFC715F611A2F37C43B6F2E70ED0A67A3A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671929940, "uuid": "49ee3684-ab21-4d15-b01a-f527124e2a6f", "value": "1ea9f0326cf512ac0eb7dd4bc1a00a19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671929940, "uuid": "da3838c0-ce09-4b28-b541-da1874fcbe01", "value": "3072:YDenLl7x5mlAN8XJdMehkP1uzL5auDXUgaRuHf/ln:rLl7qliUJdbhWuxaMAC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671929940, "uuid": "06d1f526-07a9-4b8f-a004-c36a802b3b1f", "value": 227840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671929940, "uuid": "8561e81e-dabd-4a2a-bfe0-0256ff918fb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671929940, "uuid": "9ff73a5c-5a82-40ce-937e-d1e3ba819848", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b87fb2ba-8432-11ed-9db1-42010a9c0080", "comment": "Malware payload (RecordBreaker)", "timestamp": 1671958889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671958889, "uuid": "fbdad66b-57bf-4f32-af82-ee9f2740a51a", "comment": "Malware payload (RecordBreaker)", "value": "b4073f05b4d23c45a0babbff7b099962", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671958889, "uuid": "a2c2762f-3e94-4a9f-ada5-51ecbbe8dcd0", "comment": "Malware payload (RecordBreaker)", "value": "b66104deb150ad022bbe85098abd48a52d7d7ce9ffe3f637bff956ec38f4be28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671958889, "uuid": "b0b3c07b-d6ad-4153-8ee7-49d6cd9e1e0d", "comment": "Malware payload (RecordBreaker)", "value": "d47903c94d546354cf0b0aff6b2e7f0afd22120b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671958889, "uuid": "20851e79-5609-47bf-b096-4a6914751415", "comment": "Malware payload (RecordBreaker)", "value": "23d4f7487d6e1fe098f2ec0c322bfe030ccbd540f7e2b877cc27573378f2fe4f912b0c84a078a3c52a5d0a69be840c7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671958889, "uuid": "c34b2343-cf6e-4c58-96ef-455b3a66eb58", "value": "T1C924BE512690CC76C7C34571A92BD7E82B7FACA18E635AF327447A1F3E701B09A1634B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671958889, "uuid": "da83b40c-3ea1-44a9-be0e-6d8d06ded081", "value": "78b36debb485b88b8de5929ea52f861d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671958889, "uuid": "39b3899e-2767-434d-b142-813a3823297d", "value": "3072:hmgtMLkdAt5uwLZWs4XZl2svdK4QdG+PP3tJ/hEfFZw7RkxmJZs:9eLkdAOy4Csg4H+P1J/SNZGymI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671958889, "uuid": "0d27bd32-1079-4c91-83f3-a46aa7460f3c", "value": 227328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671958889, "uuid": "964411f0-3de0-4199-9ef3-91bde649953c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671958889, "uuid": "159e8724-c2a6-42a2-9418-fcd4edc3adc6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7649e440-83eb-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671928284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671928284, "uuid": "136d02ff-1a8e-4ef8-9aa3-523c34bebf76", "comment": "Malware payload (GCleaner)", "value": "2461fdcaf28dc819616ea1428e59391f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671928284, "uuid": "337b9602-c7de-4b2d-a36f-9b8b2f2cd99b", "comment": "Malware payload (GCleaner)", "value": "b83efdec1dbba761fe28c896f1a25ef19aa8f4190484f4937f7fcae642779d72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671928284, "uuid": "d0ee8199-f80d-4cbf-9409-55e00c028e3d", "comment": "Malware payload (GCleaner)", "value": "6a43f2f040745e9601801754b1635a669ac35952", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671928284, "uuid": "d7d1555a-c42a-4ad2-828f-cd52fc94b89b", "comment": "Malware payload (GCleaner)", "value": "78f72807977b18ddb2808826c9d5e537d4befdcd843808557f31ccc1b22d53041bd0666364b3fe9f0e89ae084edf1de6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671928284, "uuid": "8c118719-f639-46af-b432-93d57a4ef80f", "value": "T16D8533D6B97048B3E06FC4B1ADA4E0D87635EB900B26CB2D51D4656F3F3110CABEB246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671928284, "uuid": "c6e40d6b-f6ca-4c84-b869-2e2d39a499e1", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671928284, "uuid": "d8d362b8-a711-4908-8af0-6411a0df1c35", "value": "49152:Gi+DYPKFj9PXG9m7uJZiHdFButiIh4Y3Q5Zat:GiFP4JzuJZiH/iiIh4z5Mt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671928284, "uuid": "2d4cb0c3-e84e-4c36-880c-061b0873e656", "value": 1846686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671928284, "uuid": "150c8932-6ac7-439f-aaaa-9820b41660a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671928284, "uuid": "79e07992-89ee-428a-a52d-9705b318dc5a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e6a0e55-843c-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671962952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671962952, "uuid": "546d89bf-fefd-4a07-a03a-9e663a9ac073", "comment": "Malware payload (Smoke Loader)", "value": "66be86586e83d6501d51de5b7fdb0f2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671962952, "uuid": "e0ac05e4-a4b2-4d5c-a2cd-b6723464f7bc", "comment": "Malware payload (Smoke Loader)", "value": "b8e04892b1115677a4ae47a0dc3c981d1dea93041c14eab7dee1dcbeeb93cd23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671962952, "uuid": "1813ad66-20f4-4b9e-b720-fdeb0fc2d8d0", "comment": "Malware payload (Smoke Loader)", "value": "95761b3b652a6b7117551e5bdd9a8a9f04d96dd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671962952, "uuid": "2c033e2a-fd3b-4eca-b732-68e7e1464b27", "comment": "Malware payload (Smoke Loader)", "value": "93427e87f8b651f2b1c4f783c1527316a053b8e30f4c9e2010e859fbf46870a5abe0f535205de6c033aa878b2134ef0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671962952, "uuid": "b7209d18-94b6-4723-b955-e60c482481fd", "value": "T17D24BE117290CC62D3D24930992BD7F82B3FBCA15A6759F37644BA1F3E702B19926387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671962952, "uuid": "519bcf0f-8118-46d1-9ed9-6e1a5ab79c47", "value": "7b9daca6da068f54ad4e1900288e8efd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671962952, "uuid": "970c579d-15a6-45c7-9c92-5f07341d3b0e", "value": "6144:4LhRezK6um7f1KUshAnKl3KSJ/TJmGymI:4++6um7fcUshAc3KSVTwm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671962952, "uuid": "0ac9032c-d817-4faa-bb83-172d136310a1", "value": 226304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671962952, "uuid": "07974fb8-ea72-4c9b-84f6-b06720bc7425", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671962952, "uuid": "ac8f1f20-659c-483f-a4f4-6d47c1261eeb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b461e552-8417-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671947286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671947286, "uuid": "7050c54f-e110-4fa1-9da3-83e4d151576d", "comment": "Malware payload (Smoke Loader)", "value": "edcea135e949beb8f8badbcc96558de7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671947286, "uuid": "3cabce37-fd6e-4da6-b69f-ff1cf4be7846", "comment": "Malware payload (Smoke Loader)", "value": "b97d412aab8a2161264c703125ac87abd8d149c50feceaa0dbce5287e6aae31d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671947286, "uuid": "df4fdabf-0c40-4c6b-b636-6a5a688464b4", "comment": "Malware payload (Smoke Loader)", "value": "f169559926244499d535e66ba9197ad07c0da023", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671947286, "uuid": "7896f0f3-8569-495f-9bb0-97f0aa0d571f", "comment": "Malware payload (Smoke Loader)", "value": "973000aeb118c49db8535c4a3f2df712aa00734f5a13a4029db4c8ee30e4173b5c5db3e74b8efa097bcdcab3f88aade3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671947286, "uuid": "0ed2d8a1-6eac-42e0-b716-bafa4c2a1e6c", "value": "T17D24CF0CBA63C465D56146308A19DFE4676AFD308F210A2F37447B5F2E70ED19E6A3B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671947286, "uuid": "29f5ec61-6e58-4336-af06-30a594a4538e", "value": "1ea9f0326cf512ac0eb7dd4bc1a00a19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671947286, "uuid": "00f0e0c4-1bbf-4907-b431-9595fdd8a3fd", "value": "3072:rDifTLNzxy5hFFrWIUuINkAySIhBGdNWMzKauDTj4m1Pf/ln:ATLNzxQFtW2INkAySoHaMTjTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671947286, "uuid": "77f2eb60-3cd0-41b1-94ca-0fc809460f68", "value": 227328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671947286, "uuid": "8dc5ff1f-baa7-4410-a64e-8384c130bd73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671947286, "uuid": "cf548d91-e6d6-4438-860a-ce3a7b57e19a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f989038-8423-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671952324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671952324, "uuid": "c1d0fb0a-b254-434d-a78d-120f56c37d71", "comment": "Malware payload (Smoke Loader)", "value": "d9897e0a2a42aa523ad3746139e13ba7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671952324, "uuid": "811bf6b3-b6c5-4607-b45d-ededaf5cf307", "comment": "Malware payload (Smoke Loader)", "value": "b9d55c141a2581cb43a3a2759fe135a90a32082046544924ff07891d7e0d7651", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671952324, "uuid": "44eae1c5-ffdd-4de5-921a-6b6bd7602215", "comment": "Malware payload (Smoke Loader)", "value": "32056d9bf1c56eff2cbab6377a8bff53a4f09ba3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671952324, "uuid": "a5020157-9b01-4996-ba57-7a9894c7f619", "comment": "Malware payload (Smoke Loader)", "value": "c506894d7acb865d79e849a0bc2b3f2eec2fe1a87ee979aaa327fee224f32219ebe97aeea836901add77b7240783d91a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671952324, "uuid": "880973f6-5fbc-4faa-88e3-14a07b72a97d", "value": "T18924CF0DBA93C476C15015309A29CFE4AB6AFD719B601B2F33403B5F2F70E9166793A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671952324, "uuid": "48bfe7fa-68ed-4136-8870-1ce329b88afc", "value": "1ea9f0326cf512ac0eb7dd4bc1a00a19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671952324, "uuid": "7cceac89-80ec-49ed-82fe-ab1789bc5b92", "value": "3072:DDW+6YLT/15+HykH4nqwVhpk729YKByauDI2f/ln:T6YLDGHt6qwVfk729YRaMIo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671952324, "uuid": "5f50d177-5de5-4a3a-b281-03296c02ce5b", "value": 228864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671952324, "uuid": "d9f7a3d4-33ce-4b33-be45-82b51c4f9e71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671952324, "uuid": "3a6a6056-6763-42dc-82e0-e444d5d3f6a2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdae8883-849a-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1672003673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1672003673, "uuid": "7ae43880-81a4-45c9-a011-01a0782772d4", "comment": "Malware payload", "value": "a5079eea45e62fade575b701ec3e9e76", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1672003673, "uuid": "7e15ef39-510b-41a7-852a-ba1c006b4f92", "comment": "Malware payload", "value": "baa971787d9402b5514d12068db787da201df109a9e19ea84920c564ef089a62", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1672003673, "uuid": "de54b077-6ef3-48e3-9872-63d0f819333b", "comment": "Malware payload", "value": "8558caa5fdb8216f93e85dd7bf1c233c1548128c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1672003673, "uuid": "457c7db9-cd4f-4fbb-b4a6-ad51d14524e4", "comment": "Malware payload", "value": "dd30ccd0786463cfc73b67cb858edc53094c2d8b735fee4064a0845ab3d4359c35529b894915e8d5db5f756f910f02f1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1672003673, "uuid": "a7761830-af25-43fa-ac19-445d33b1aa72", "value": "T176D3956EFA12EBBEE16C863107F76F70D39531A22AA1D341E16CDA181E7125C2D4F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1672003673, "uuid": "47f1b1ca-3434-4c8c-9ec2-345abe7b7b48", "value": "3072:jGTyrDxJWwAfr9f3yJddxUEJmTDmjOrWcpu3NJFARtRVJhGvaZqhZYiDhB/ZZ9BW:C+nZSZMnJeUmkASFxBKvXZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1672003673, "uuid": "4ed32c35-be30-42c9-af70-66e16f49626f", "value": 134222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1672003673, "uuid": "9650458d-8ace-436c-9373-2af42382a343", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1672003673, "uuid": "ee866ac1-c0a8-4459-95bb-a08e9580246c", "value": "a5079eea45e62fade575b701ec3e9e76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5ff764f-840a-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671941705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671941705, "uuid": "bbb4191f-7c16-4c94-b8b0-5dd4bc671ccd", "comment": "Malware payload", "value": "80120403337f152e983143b3f4b3de82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671941705, "uuid": "83456bbc-ac71-4819-b100-7dce231bfec3", "comment": "Malware payload", "value": "bad6138fbedaf6b9f6afb68036c2b7206dd9959294784a167980da07a342265a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671941705, "uuid": "d2a461eb-aff9-4952-98b3-0c1e3b11dc45", "comment": "Malware payload", "value": "11398bac32652b397ce99fff6c3e50467b490c88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671941705, "uuid": "120cccf3-a8b5-4a63-9603-7b637e8359a5", "comment": "Malware payload", "value": "5b6b3e94b95537307db43670527cec8646547ea30d7fa2e2ba36cf22e290ea26a0b2446815853d2f4bcb3358d7dff039", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671941705, "uuid": "e3844339-b0ea-42b9-a1d3-6c392eeb5b0f", "value": "T12AB3D0217900C037C453A1755434D6E2A73EBD221AB5EC4A3B982B6D9F722E177BE34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671941705, "uuid": "04c7fee4-8787-4f64-9468-916067441456", "value": "1ea9f0326cf512ac0eb7dd4bc1a00a19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671941705, "uuid": "22ffa151-0b11-436f-a9c8-a39c7aa881e5", "value": "1536:qDFCQLhPU4Vp2Lg/utk5rJ0Qso5EagrVKodoetyufN7Yjj/q0A1NUM5M:qDF6BLhk5MxrVBOXDA1NUsM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671941705, "uuid": "df7ceec1-81e4-4716-80a2-f01c0d32b122", "value": 115248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671941705, "uuid": "35b83c3c-6a40-46a8-acce-9e7f0644305f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671941705, "uuid": "7d904d41-dbe6-438a-9fed-06f9bfe73b5c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a77be43-843f-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671964288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671964288, "uuid": "2f2dd73c-8d61-4ecf-833c-87c1748ae65f", "comment": "Malware payload", "value": "eff62daebe6a245573c619e4beef2a3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671964288, "uuid": "b6f40f82-a83d-4ee6-8aeb-ec0ed0ee1c37", "comment": "Malware payload", "value": "bb54c9a7ad63b674a1afe299d70c0ac67e399d1b055fee7bda03645ee2ae338e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671964288, "uuid": "59d221bb-c03c-4aeb-bbc7-d4274e9a05b0", "comment": "Malware payload", "value": "e4de9e23b124e8289f2942b4a5ed6f304330d8cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671964288, "uuid": "a1945b0c-c851-4f4f-9f69-8d4be5450586", "comment": "Malware payload", "value": "371dbb42a80c9e9825317792131f09979d64f59838856acc38b60412ce546a0e2c53b8ae0da1a77bcd88a6c1344b9a42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671964288, "uuid": "80a8863e-6448-4eb1-b94b-734a8e8111b8", "value": "T146C1CE015AEF50DEF23707716BE6B3BB0565F9B1852E61B8708489995F31AC08C11FF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671964288, "uuid": "2b421f55-9fd3-4c6e-80c7-25c64ed9d233", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671964288, "uuid": "2209313a-fdc7-4941-9c22-d9f7efd90dc6", "value": "96:QsTr79hCL1bhycGdH8uaRXtyuvk+1OAYysds9vk+1TbGvvqd3ojOxHrl:Q+X9hCL1bhyc33vksYylvkUb+qdth", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671964288, "uuid": "21bd4289-d5b3-4892-8f54-646c51a5452e", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671964288, "uuid": "88d97b66-8d9e-4308-a823-7310f25bf229", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671964288, "uuid": "0db21fcb-8774-44eb-9695-fbbecfc024ab", "value": "SecuriteInfo.com.Variant.Marsilia.2083.1096.3491", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f35d47a-8444-11ed-9db1-42010a9c0080", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1671966363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671966363, "uuid": "b5fd9c9e-9346-4e71-89a5-8978be20fc0f", "comment": "Malware payload (RaccoonStealer)", "value": "4225a2ed582703c8381349c08d06cff0", "object_relation": "md5", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2525", "colour": "#7D3FF9", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671966363, "uuid": "56a9e8ec-d24b-4d3f-948d-26322f955d8d", "comment": "Malware payload (RaccoonStealer)", "value": "bb89a3b911cc6605ca9c9bb8ca944c852b8aad384d63729de7eabe6f887b183f", "object_relation": "sha256", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2525", "colour": "#7D3FF9", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671966363, "uuid": "bc0ed840-a5b4-4d08-b124-c5939ad285a2", "comment": "Malware payload (RaccoonStealer)", "value": "5625660b6dd6bd26ffe0b3e5cd38747e93d13e2a", "object_relation": "sha1", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2525", "colour": "#7D3FF9", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671966363, "uuid": "19ee7ced-9839-472b-894f-4bf7b6452b24", "comment": "Malware payload (RaccoonStealer)", "value": "90bca5b18f27a76d09883074092ed6ace7d20ac4e5b391de0f23725bc3859f3b396f24f02d34356816eb588f4a8c5629", "object_relation": "sha3-384", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2525", "colour": "#7D3FF9", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671966363, "uuid": "a795d818-5797-4a0b-b030-fe4650407c1d", "value": "T13FB53348082038B1DB93461D66E7E7CD638A229D87A7E7E875CC3D0BA87957513A0F7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671966363, "uuid": "ba6e79e5-6912-424b-b078-7458d305b0fc", "value": "49152:LF/XQqX3nYIjZj8uj9P/dmhdfpORB6+l+X+rML4K1aPlcDfRf:LBXn3VjekP/QhdfpOT6+gOwL71aON", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671966363, "uuid": "75d56568-de24-48c4-b82e-0aec4a2468fd", "value": 2436191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671966363, "uuid": "3b7ae8f5-37ec-4477-a5dd-6a27d328403a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671966363, "uuid": "cc1304c1-7546-409a-a911-a0fe32239f8a", "value": "SetupFile.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33a02e5d-8415-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671946211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671946211, "uuid": "39e418c2-c433-425a-b7cd-cb28a87f8c60", "comment": "Malware payload (RedLineStealer)", "value": "e9c6e3ee6fcf4dd08a15d822595d5c1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671946211, "uuid": "c9626c21-8fb1-4cb9-a215-0a423f635fcf", "comment": "Malware payload (RedLineStealer)", "value": "bc4dc45911984781969f571226d1243e4b5fa76e988726b992f84950b697b3ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671946211, "uuid": "ee74cd27-9cc7-4bba-8117-0d71fd754be2", "comment": "Malware payload (RedLineStealer)", "value": "e45b0f0314b1ddb5e9eff0e40be301be478d42f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671946211, "uuid": "19f3c1a1-7e68-4317-8f94-35907f482904", "comment": "Malware payload (RedLineStealer)", "value": "4622e4112a38178457506064cfcaf5b84c5c221bb6e7da4a52b85c38801c3f18b833d5f40fa92d0a5580359c25645d34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671946211, "uuid": "cad3b8b1-11d8-46f7-ae9c-25ffc0e47420", "value": "T15384F10CBF62D4A6D65145308979DFE09B69FC315B62663F33447A6F2E70FA082363A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671946211, "uuid": "eaf2144e-d118-48ae-b661-307e2550f667", "value": "1ea9f0326cf512ac0eb7dd4bc1a00a19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671946211, "uuid": "441a7db7-579c-4293-b2a0-68fc97d95ee2", "value": "6144:ijL/cYCVJCPd4yG+/ilmRpCdOT//yImccnJlxpaMIJLI:ijLcpUPd4yHWmSgmIHcJXsrJk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671946211, "uuid": "d72c221f-f6ed-4aaa-9164-1b193b6e08df", "value": 384000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671946211, "uuid": "156d1f39-b834-44dd-9f38-cf91ea7f0fb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671946211, "uuid": "4fba1797-212a-4526-84aa-c30c0f40a042", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31af3236-841a-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671948355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671948355, "uuid": "531445c2-0595-4b43-aa04-ebc2e311ad85", "comment": "Malware payload (Smoke Loader)", "value": "ec961afe6b3c65f641c7e29c6498d7e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671948355, "uuid": "6f095845-d445-4b2f-b587-a4cddc1884f7", "comment": "Malware payload (Smoke Loader)", "value": "bd4643cdcd38787494582786113478891144af5c0054af9f595a99182b0e8181", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671948355, "uuid": "67406cd0-7112-4ace-8f13-d62faddc68a0", "comment": "Malware payload (Smoke Loader)", "value": "d786a53b58c50a88c5a25b411cdbf9557db722b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671948355, "uuid": "e05ee016-2840-4e1a-b487-ab094a06d23d", "comment": "Malware payload (Smoke Loader)", "value": "36ed1d2667c1155a3c6201aa3df7e655fc45792dd0d3432195c86df6e19a1ef670436d180dc46b2a2b018e62636e9367", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671948355, "uuid": "2917477e-b197-4c32-a482-00e71a0c27ac", "value": "T15024CF0CBA62C479C55205308D19DFE46B6AFCB19B625A2F37503B1F2E70E90953A7F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671948355, "uuid": "3b8938c7-b002-47b4-bcfa-4dfff46d14dc", "value": "1ea9f0326cf512ac0eb7dd4bc1a00a19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671948355, "uuid": "3d0d0451-e4f9-49b8-9772-23c75aabeef3", "value": "3072:4DnL7LHG540F2euC7eN8lyVZa5umHuW8C+auDWoJw90vf/ln:87LHR0sgyVZyum+aMWoqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671948355, "uuid": "031422db-13c2-45c4-acac-46d598ced073", "value": 228864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671948355, "uuid": "930e740f-69f8-415e-97a7-733b6c73c0ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671948355, "uuid": "e5f73536-36ba-40c4-8770-6b7e6c0b94e6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa72beec-843a-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671962436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671962436, "uuid": "6d98259f-e3b5-4fd8-944a-7b738d2ed7a0", "comment": "Malware payload (GCleaner)", "value": "8cff680c70ae12ec8b77d0877b2c52e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671962436, "uuid": "3567c5f1-a7e2-46c9-9ada-1994d4e21a4c", "comment": "Malware payload (GCleaner)", "value": "bd77ee1f7b528c7b6424488d0503d3cc213b2ed241655a986c2762f2eb253d70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671962436, "uuid": "cb184bd0-6f93-43bc-98e9-42adf95419f9", "comment": "Malware payload (GCleaner)", "value": "951f3cecb495305ad2b988d5bf851c2b7be0edb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671962436, "uuid": "c29a9aaa-3892-4dac-b6ac-64538d73e44e", "comment": "Malware payload (GCleaner)", "value": "f0aa0aaec9ae18fc9db879cd64794192c998e6067ae0fa9b5150d72088aac9d09d7a28a5e61653a6361cbf6d255f9853", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671962436, "uuid": "1ca2e4d5-707b-4fbf-a6bf-18e25739f167", "value": "T1938533C17ADEC976D03EC5702E41BA447620ABB41B3E861D29E9C4DF7FE950CE187A84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671962436, "uuid": "cd202a25-6683-4f91-bc72-bf787fa2d32f", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671962436, "uuid": "573da3f0-1543-437e-8424-9ea894ca50d9", "value": "49152:6iQViQxQI1dxatEqHQW16q7U6e2+6NytflGypRTZaN:6iAPxQI1LatEqwW8qf5FNQtBMN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671962436, "uuid": "f957b37f-d1f0-460e-b1a9-129ceb88d4fe", "value": 1809143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671962436, "uuid": "df4f1e9c-a85d-43af-af4c-ab492d2e3b5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671962436, "uuid": "ddc08515-69cb-4fbf-90c1-059301bdbe01", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23f2d3cf-8465-11ed-9db1-42010a9c0080", "comment": "Malware payload (Amadey)", "timestamp": 1671980544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671980544, "uuid": "bf439cc3-f3b8-45b9-867b-03e64cf2e73e", "comment": "Malware payload (Amadey)", "value": "129a8da914ebc1e3b73dd61a51f39129", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671980544, "uuid": "eb21d7e3-ef87-47d8-8872-997510e3fb0c", "comment": "Malware payload (Amadey)", "value": "bd80ef2539c7fc6fff009257852374b2b9a24ae17e2e4aa2017e95edd0624aa2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671980544, "uuid": "ccf0c5b7-64c4-4a82-afc0-b3b16d45a41d", "comment": "Malware payload (Amadey)", "value": "71fb39b940654f3c988c0fad929074315921387d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671980544, "uuid": "e663c51b-61e7-4022-a492-9a129e9d1c9a", "comment": "Malware payload (Amadey)", "value": "18c49d07b8a76eb85c9fab19485c6a801c97d4492af50e05ebc96a1bcdcfc6abe2db0e4f373aac5d785ef31e7f6eeb46", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671980544, "uuid": "f5f08caf-6129-4956-8aea-215ea6ea8dd5", "value": "T1C234BE107690CCA2D2D24971492BDBE82BBFBCA14A671AF737046B1F3E711B1A916347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671980544, "uuid": "bbbe8907-4f69-46e9-b13d-22e1fe028fc2", "value": "8514760d95d5a493235b8748f65885e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671980544, "uuid": "19109686-1d05-498a-9372-a6128ee653de", "value": "3072:840+Lyx+q5RxPy2aZeskbM872PYZBtRtJ/wDyHw7RkxmJZs:8QLyAR9XZa2+J/wOHGymI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671980544, "uuid": "957e376f-591c-4bf3-97ea-575c018be47b", "value": 237056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671980544, "uuid": "6d4fc826-d762-458e-a264-dcb3810522fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671980544, "uuid": "8ac4acfe-4900-4016-bfca-4510fb060375", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f07d87a1-83f7-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671933643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671933643, "uuid": "d914c68a-19ea-42ea-a2bc-6e7f3e657e43", "comment": "Malware payload (RedLineStealer)", "value": "757402e563709545d2256e7cc10e6ef2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671933643, "uuid": "6eb26be9-49b4-4b3e-9f3b-f90de74409b3", "comment": "Malware payload (RedLineStealer)", "value": "bda41712f399de0acd28ee9f9490364f1ffe942d2f5ef252fac0f4cf52ee3534", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671933643, "uuid": "7c27ff32-e4fc-470f-96ff-79849e0451f5", "comment": "Malware payload (RedLineStealer)", "value": "ab609c25c7e1a2e14aacb96cf43131d8b431ddfb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671933643, "uuid": "c4e49c89-b30e-48ed-9b42-897dfc656662", "comment": "Malware payload (RedLineStealer)", "value": "23ca30426756fa098015de03922ebc14cbfe378b36ff3ef86b38e17ec04d9dd08f67a2c34142a95806755fede3cdeb5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671933643, "uuid": "87fb164c-c87f-43b5-aaf9-aed26ef667ce", "value": "T17324CF4CBA92D466D1510532C928CFE0AB6EFC719F61563F37103B5F2E70ED0AA663A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671933643, "uuid": "35564d20-b969-4f3c-a555-95db6bf9677e", "value": "1ea9f0326cf512ac0eb7dd4bc1a00a19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671933643, "uuid": "7abce5ec-9a35-4c03-9b5a-93d63dc90b9d", "value": "3072:GDeawy6LB0524Oj4fOJRL/WUauD2h/f/ln:0h6LBj9COn+UaMut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671933643, "uuid": "97500afe-5195-4b38-843d-b5f123e7af1f", "value": 228864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671933643, "uuid": "c5587be2-d70c-4ee2-878c-819b5caaca89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671933643, "uuid": "bb9d3671-28da-4ba8-a1f4-32a4405cd08e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49a0ba26-8459-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671975454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671975454, "uuid": "3dae2c4e-8405-4c83-96ff-e119a7d6344f", "comment": "Malware payload", "value": "9246357e6a28eccb1aebf7b5bd86de22", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671975454, "uuid": "ce28fdd4-5ca0-4b4c-8fcf-e09e793ee087", "comment": "Malware payload", "value": "bfb100069255041be2224ff1b426f8d8b756510ee220af750b9a5f41f4b390b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671975454, "uuid": "4b1bba0a-cc27-4f83-8e29-7944c6017bdf", "comment": "Malware payload", "value": "d22d0ebc7640ab9e84b0aa7e37e21d97abab09a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671975454, "uuid": "e5677bbe-55f0-4ba4-890c-12eedd7677a8", "comment": "Malware payload", "value": "89972ea0369978779d3d84815ba1108270f56a9be75ffe6bf0a71eff76ae53cd1c9eb589aa1502862fb21a1649177fb5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671975454, "uuid": "ba6400aa-48c2-42df-8ed3-78f44cb1b116", "value": "T1F7A52312B1C68471DA321A3865F9DB709D3C7C308B758A9B63E82B2D5F741C19739BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671975454, "uuid": "3ceaef10-34f0-4908-a21d-aef99db6a9c7", "value": "ae9f6a32bb8b03dce37903edbc855ba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671975454, "uuid": "8d7cec55-a5c6-49d4-b8fd-61737d9ee047", "value": "49152:pyARx9L5M+t3paGzqh6FHh6zs16fjw+sTpiWH4JMdXr7:pyARxJ5M+R0GzqhqMzssrw+Upj4JM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671975454, "uuid": "ff85d15a-ce28-43e7-ac93-32bfba5ed4a3", "value": 2102573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671975454, "uuid": "e51e2848-6321-4eba-a201-dc86689e0f47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671975454, "uuid": "ee8a6d04-544d-457c-b458-cf0f37a3db90", "value": "9246357e6a28eccb1aebf7b5bd86de22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0df1a17d-844e-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671970629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671970629, "uuid": "6c079402-821e-4715-98df-0d1098d51537", "comment": "Malware payload (Smoke Loader)", "value": "a168f51782dd48624c9a272ae9479115", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671970629, "uuid": "976085cd-70ac-4dbf-ac23-8be07567f0bc", "comment": "Malware payload (Smoke Loader)", "value": "c21451d760a6bbd97d53983e0f557eb679197d5715a39e12477733220ac7ae51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671970629, "uuid": "3f1a877c-329b-4bf9-93a9-cb6cc2d82a17", "comment": "Malware payload (Smoke Loader)", "value": "0e3e3a46f5dbacd2f71498665319cdc269a1ccc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671970629, "uuid": "b87af85d-a1df-4fc0-89ae-1c42be48e334", "comment": "Malware payload (Smoke Loader)", "value": "d7e940bb776f44f81e5c7d3a90d81090b8f19ad1a8c8aaf0cf9a7d55abccd40999bbb008bae9a2713ee52970be7ed9c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671970629, "uuid": "374ce552-0eca-4c3a-aab5-82495c99ad12", "value": "T15A24AE112694DCA1C7C24571892BD7E86B3FBCA15AA74AF336487B1F3E701B0B926347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671970629, "uuid": "12572d6e-36e7-4058-9abb-1a513f5ba34e", "value": "7b9daca6da068f54ad4e1900288e8efd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671970629, "uuid": "143909db-f9de-44a1-99d7-5d8c384034ad", "value": "6144:BML+RFuf7Fj2mllIXu3LqxR2eLJ/05TGymI:qmI7F/lX76R2eLVCm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671970629, "uuid": "2ee28f7d-b66a-4485-867f-4d2a3a7437e7", "value": 225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671970629, "uuid": "bc09b7bf-ab1c-41cb-915b-475848b7a486", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671970629, "uuid": "c606e267-1837-4748-959a-841d89647bd3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e014fd9c-8435-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671960244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671960244, "uuid": "644e0a32-eac5-42f5-aafc-dc05697091e5", "comment": "Malware payload (Smoke Loader)", "value": "164c4ddca67671cbf6c685d02b5cfe0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671960244, "uuid": "ccddccf8-d32f-4261-88d7-f443c9faf639", "comment": "Malware payload (Smoke Loader)", "value": "c2c3dc0f8d64d9ccb7a7c447d135a885b3123ea1747f77fc3fbb25c1e111e544", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671960244, "uuid": "09ff81bc-f8ff-42bf-9f9a-48c9f249605b", "comment": "Malware payload (Smoke Loader)", "value": "20c5217322ea3ef578d0c67897a8d113568766c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671960244, "uuid": "6d8d2a15-ecbc-40a0-a389-c119b4393e6b", "comment": "Malware payload (Smoke Loader)", "value": "427572bb70fe78bb5d133c9d0d6e27d3ccc8cf37bc291e638b11dd7c886f92611d58487382bd2a37d3215686b9244e08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671960244, "uuid": "dd2c08d0-dbdd-4151-98a5-8f779faa6492", "value": "T1E324BE21A662DC76C3D24930592BC7E82B3BBCA15A2355FB37043A5F3E702B09D16367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671960244, "uuid": "9a8951e2-2d17-47e2-b05d-beef33677951", "value": "7b9daca6da068f54ad4e1900288e8efd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671960244, "uuid": "9d8b74c1-24f0-40d7-827c-d9ee10b5411b", "value": "3072:VMDLFtRHWpT5N9ZNR/R5OzqL6py5nC9+tJ/lyj2c1Uw7RkxmJZs:2LvRHKLHNR55yqL64C9QJ/wuGymI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671960244, "uuid": "eb938869-8626-404c-adfd-39a96f631b64", "value": 227840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671960244, "uuid": "28beb461-e9f9-41b2-b445-bc5167e82134", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671960244, "uuid": "1f63bf3d-3380-4f8b-86fc-9bd262d35610", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "886f2ffc-8449-11ed-9db1-42010a9c0080", "comment": "Malware payload (CoinMiner)", "timestamp": 1671968687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968687, "uuid": "f8d94d8b-f021-4474-aead-51b6130b4928", "comment": "Malware payload (CoinMiner)", "value": "c6d73b5ece49beea2dfaae5d15aaf774", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968687, "uuid": "fd4de4e8-8618-4f75-b132-5e65d82a201e", "comment": "Malware payload (CoinMiner)", "value": "c2f9fe4b1609463c3897a3813e0c787af7a50d100017c52f91172f6dadb5bdc9", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968687, "uuid": "5b41a404-219b-4d49-8d31-53b9ed174d60", "comment": "Malware payload (CoinMiner)", "value": "a57c01512c78ae42cba8e604ac10e0e0f8dbf286", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968687, "uuid": "9ee0fcd9-a232-4236-b004-3dc9ba19b07e", "comment": "Malware payload (CoinMiner)", "value": "cc9d01ad9dcf241e20228008dea71516fd53970653d36ec6fa460ae2b487bada154a88a26587a463080ee1fd0385a841", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968687, "uuid": "1a0f12c2-c340-4e1a-b7b4-9cd1db0da501", "value": "T12B15EAB2FF999F32CB0456B6ED7004089567C2CCE11B5F0BB5856870DE9EA2829F6D34", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968687, "uuid": "fe9e037b-e98f-4e43-af25-b88ad321c494", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968687, "uuid": "e3b7cc31-c202-4db3-956a-a02938393482", "value": "12288:WDBClhuCf/yRqn/MzetFCwrT92aSxNhlngQU9LxS2WlpbTvF:2ByACfagn0eFBN2awlgrMplRF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671968687, "uuid": "a21bd9d4-b7d5-4e35-a0b3-2ac16633b3cc", "value": 942408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671968687, "uuid": "2d74f6af-335d-4d05-b155-c67aed54b07a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968687, "uuid": "63bc1b98-db3e-467c-b6d4-525033271163", "value": "c6d73b5ece49beea2dfaae5d15aaf774.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57ec0583-8417-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671947131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671947131, "uuid": "2b696ee8-d9a9-4ff7-abae-07e0d7e70dad", "comment": "Malware payload (GCleaner)", "value": "d2b17f93edf289d22ef946ea9c4c3df6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671947131, "uuid": "3e24ee76-fd66-480c-92da-2d33107d45b3", "comment": "Malware payload (GCleaner)", "value": "c31f83bae15763544df548bf74059f621bea9bdd86009221985b85ed10b79504", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671947131, "uuid": "04cd6cbd-9ff6-4cf8-a1d0-ca76f2b57e41", "comment": "Malware payload (GCleaner)", "value": "a526946ad795e96698c6ef5afcc72540eef42adc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671947131, "uuid": "0b599392-55cd-4f00-a9cb-217697d543a5", "comment": "Malware payload (GCleaner)", "value": "774e2ca5978469f4b143befd8f9de0a789720705389366cbbae0bc780a5a8607ac6e9e58420ad00ef4fa9b6ac01cf49d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671947131, "uuid": "3d8746c2-2ca4-410f-b721-5624d5fa4eb0", "value": "T1DB8523C57BE89E7DC07E8438CD86C0A43126FBA1672EA52E1DDDEB4B236120C9753356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671947131, "uuid": "aa673c82-6074-4859-8200-a604b21593f1", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671947131, "uuid": "a4e8642d-3f72-44b3-acdc-21e5baa14451", "value": "49152:iiKKa2cp+deM1YFqM2CXJcoH95ueOXnzZaU:iiYp6J1yqMJWod5u9nzMU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671947131, "uuid": "e056c09d-b17d-4840-844a-fea75ac74aff", "value": 1819307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671947131, "uuid": "01b1fedc-d4d2-4910-baf3-c013f4f2166d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671947131, "uuid": "a81b8a92-b484-4b75-bef3-51daae76ead6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66e9ee92-8419-11ed-9db1-42010a9c0080", "comment": "Malware payload (Amadey)", "timestamp": 1671948015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671948015, "uuid": "9cde8f7c-5d4b-48b8-8992-97ff2828056b", "comment": "Malware payload (Amadey)", "value": "5cd76e4f63b636864e48e6193b73f84a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671948015, "uuid": "8dffa4cc-c749-486e-b048-818a0771cb38", "comment": "Malware payload (Amadey)", "value": "c368d8157b50358f25ab40f1c11c5541bef50dab98fe51b08057aa65215748a1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671948015, "uuid": "e3cce0d4-c197-4d2e-9263-ec218554df4d", "comment": "Malware payload (Amadey)", "value": "65cb55c781e4277a3cb49e4eca4b18f937e0191f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671948015, "uuid": "a3cf89d8-b5f9-494e-8a42-446602da3805", "comment": "Malware payload (Amadey)", "value": "c49755e353e8288f14d56fcca294dc230fc9b6fd49bf6cb2cd79bcc260d2e5eb6e68e6bcf6bfeaa0cddd948e516c18e1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671948015, "uuid": "287e9463-3a6a-43b2-8f4c-db856d69d774", "value": "T15024CF0CFE92C076D19249308959DFE0AB6AFC705F615A7F37447B5F2E30E9096263A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671948015, "uuid": "efa7bfa4-1820-474b-9518-1ee00f39f1cd", "value": "1ea9f0326cf512ac0eb7dd4bc1a00a19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671948015, "uuid": "9a2a9362-8d15-439b-9b26-94b4465e7730", "value": "3072:aD6FL545VprivhKDA/d1ZlXQUULKDGym99auD06B2jcoWf/ln:jL5wprED/lMLKjm99aM0xpI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671948015, "uuid": "b892a700-4bfb-4c71-8780-c3403f8c2899", "value": 229376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671948015, "uuid": "215cbc47-4895-4ab5-ac0b-ca94509ac233", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671948015, "uuid": "1fb7fd5a-d7c6-4f17-99d4-46f65f8329f3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d69185f2-84ae-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1672012197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1672012197, "uuid": "63743150-f190-45dc-b2d8-6613c8d2f651", "comment": "Malware payload", "value": "e2d2413f40817bd471245d3844ebb9e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1672012197, "uuid": "cb66a43d-9b55-43cb-94b7-18bb31df5714", "comment": "Malware payload", "value": "c6c9207d124fa2ab20f5bf326cb5c3f01c788494650fcc62990fc7ba08db877a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1672012197, "uuid": "3f97166d-6632-4299-a827-5367e8ac3a02", "comment": "Malware payload", "value": "565ea0fba586a57ce452ff84b8ec0a759bf9d63e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1672012197, "uuid": "7ef08560-c69c-49c4-8e79-fb38951b7c3c", "comment": "Malware payload", "value": "88056ffc0223320dff3c40581c50ebcaeefecbdc93b01bc5cda12f87e161172904c92c38fa49f60cffaf73f049d3429b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1672012197, "uuid": "4eb7b7a4-02b4-44dc-99f3-d5857a1da383", "value": "T12895238ABDE04E75D06D91B0AD84D814F1727B90332A4B8E74C856DBFB36E48DB4B352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1672012197, "uuid": "9ce3712b-57c0-4e05-9c99-3556e37c93a4", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1672012197, "uuid": "c03aa90f-2173-4b62-ac1f-cc897f196c32", "value": "49152:mimj9UNls2q3XXz+1tYP/R+/H1zu3qwZcG7cahP4QQ1nNqyl02Zap:mimSnstjii+/1i3rZX7ZhP4pFO2Mp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1672012197, "uuid": "1e72f9d4-3e86-4eb4-aec6-e0974eb78787", "value": 1967916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1672012197, "uuid": "18ce4c5d-b881-4109-a427-ee55d6516df8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1672012197, "uuid": "b52a8008-511d-4ec7-8329-293ba3ded085", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4193da4c-842c-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671956113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671956113, "uuid": "4cde39f6-72d6-4861-9ffb-410b3fe545b4", "comment": "Malware payload (GCleaner)", "value": "11c0b2e6836de650c2f8c2cec607fb21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671956113, "uuid": "44f6310d-4fdf-4298-9c74-0cecc2682a46", "comment": "Malware payload (GCleaner)", "value": "c6d9576b698247cfbddf9fe2eaa26084d162bce0be748c22881170ad0889f770", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671956113, "uuid": "f846c256-f55e-46a7-ad11-63ca89cd7ab6", "comment": "Malware payload (GCleaner)", "value": "d8099e4343bde71fa436c886d1281451729ee8a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671956113, "uuid": "48075922-342f-41f8-9216-8f02697261dc", "comment": "Malware payload (GCleaner)", "value": "1405e1fbef174048d6a0abf807d94ad4c69e6d008137df81b2a85d19b87364de9b8142fc93a17ff34a7c86cbeec28e32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671956113, "uuid": "1afc7455-b816-488b-901e-34e8eed1763d", "value": "T1699533C2EAD0D57BD16FC3748DA6A1D03431AF903F5DA30C48D4A2ABB4B927C5B1365A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671956113, "uuid": "fc87044b-c8c2-4b50-90e3-d7b39041bdd4", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671956113, "uuid": "ddee4e30-56ba-4126-aa5d-08acd4bc0246", "value": "49152:6iG8TZ/gBPHXiH6z88jqCdbYUaNazBmUge4tZaw:6iVZGWQqCdVUaBge4tMw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671956113, "uuid": "7401b2c9-f77b-45c5-96e0-4d9cc34f23d7", "value": 2014647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671956113, "uuid": "24f71e84-bbf3-4d47-a4c9-5504a0b040d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671956113, "uuid": "3e85b4f2-2c2f-4228-ade0-5fea923097cf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba2873ea-8448-11ed-9db1-42010a9c0080", "comment": "Malware payload (Amadey)", "timestamp": 1671968341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968341, "uuid": "6d9e2fc4-5333-4aa9-8d28-15026ecd559b", "comment": "Malware payload (Amadey)", "value": "36061947a672830f35ced9f9388cf53e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968341, "uuid": "bfd66f48-a797-4c70-9a85-eb29627ddf3e", "comment": "Malware payload (Amadey)", "value": "c72a3d49ad7e7de6062a155aa97d87fadfe422707aec94bce9699f24db9589e8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968341, "uuid": "1aa63498-2a0e-4463-a67a-585a6fb55415", "comment": "Malware payload (Amadey)", "value": "bf6f2c6aa4796f5f872110fc2454fd995f90f1ab", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968341, "uuid": "556b2df4-eeaf-4feb-bc2a-2b7e9257b089", "comment": "Malware payload (Amadey)", "value": "48d28e99f053f40e75338bd8ef7d6c16d7fb36084e7ded70785779b17809ccb362225facf88fca976bf403b497fae483", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968341, "uuid": "17e54f93-a515-4a8f-bf88-974f15fcc125", "value": "T1F354D00CBA92D462C1455E3189199FE4E6BEFC315B215A3F33543B5F2E30F90A66A3B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968341, "uuid": "6ba78122-691f-4420-880b-af0af157dce5", "value": "1ea9f0326cf512ac0eb7dd4bc1a00a19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968341, "uuid": "d9140983-e4ea-4278-b79a-3bd7010326fd", "value": "3072:OD3kLr15SegTZ2+DtVuaCbqMRVpZzevCKfys6c3nOLRKznPfsEkauDGP/aHCFf/Z:lLrqegVFtVIfXP4PfcaMda", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671968341, "uuid": "f8377549-e6f7-400f-9d2d-fbdeca9808a3", "value": 283648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671968341, "uuid": "90d59442-ccac-4726-8aa2-ac09c6690c1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968341, "uuid": "878ed4bf-2bd4-44de-bbb7-29517daaeb0a", "value": "36061947a672830f35ced9f9388cf53e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "461cc288-843f-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671964281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671964281, "uuid": "8aa260cc-b8a0-4b07-b676-cb8eb962c843", "comment": "Malware payload", "value": "e51035c0278085fee8018ca14d93d8d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671964281, "uuid": "0a2d5bbf-ed83-4990-b40b-d2f82485ffa4", "comment": "Malware payload", "value": "c7340f9c3dee698841d6ed42a64461692f76ff077dbc13057b069a003a27b4f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671964281, "uuid": "b07f6a60-8e7d-4243-970a-a792cdc15f06", "comment": "Malware payload", "value": "cd95cd9576cdcc3965dc28828720ffa9209cca61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671964281, "uuid": "dc8210cb-32b0-4568-ba74-6412aa06776b", "comment": "Malware payload", "value": "e5339b43f7b71c19fbad34791b525c40d3e74c4f4224c2bf1235b07ccb17a10f52d28832ace55037859b807d0cdb8d36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671964281, "uuid": "ec697b61-8f29-45a1-b04c-348c45b957ad", "value": "T19CC1F1115FEE50DEF227073067E6B3BB1266E9B5592E61BC70844A9C9F31BD08812FB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671964281, "uuid": "1e35e332-201a-42ef-a8c6-1401ab92424c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671964281, "uuid": "a8315525-0359-4c9d-9bf2-390f9531c14d", "value": "96:Ndf/79NzL1bhycGdH8mGQOtzsLvk+Zp88K/8SMYYKd3ojSrl:Ndr9NzL1bhyci1OB+vkWC8K/8jKdV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671964281, "uuid": "3d8b97e1-75bc-4c12-a565-eaeee41c6fc2", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671964281, "uuid": "11de0641-03e5-4a76-ac3a-5672cb0a1e9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671964281, "uuid": "c1f8b44a-474c-4b51-8c9c-4c163ae7e452", "value": "SecuriteInfo.com.Variant.Marsilia.2083.28807.18176", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd3a5888-8449-11ed-9db1-42010a9c0080", "comment": "Malware payload (LaplasClipper)", "timestamp": 1671968829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968829, "uuid": "9e432261-c130-415c-8293-40577e3a1395", "comment": "Malware payload (LaplasClipper)", "value": "4a75f7dda9143bb7d91023698154c3b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968829, "uuid": "b916de20-d36a-4e9e-aec9-482157658bf6", "comment": "Malware payload (LaplasClipper)", "value": "c78d7e44e0997c3dc22b3a81ce8964e4069ce2dceb020dbfacad153d2e9a4e82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968829, "uuid": "9029d9c8-bfa3-47a5-9428-20ed181aaeed", "comment": "Malware payload (LaplasClipper)", "value": "75474a0111a61ec35fc3a2138a9bfb00a066fb6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968829, "uuid": "1ace450b-e444-4b9a-b361-4f2e23452977", "comment": "Malware payload (LaplasClipper)", "value": "17de857048f87ae3701347105723b2a80aba74a7377c24d405ac227db62068fc911a8c10cbebae46f1be06846b8df372", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968829, "uuid": "390dfd01-3d99-434f-8fa5-e0c5f0ae87de", "value": "T12E66237721290055E0F58D3ECA27BDD572FB53678B82AC7D84DEADC12B02BA4E602753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968829, "uuid": "b612a327-0f22-457e-ab79-be9f9d741f88", "value": "ce26abf4781cac630107d46b9c76d477", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968829, "uuid": "795d45de-b664-4b6e-a8d7-fbd86d93cadf", "value": "196608:t7n9Rg39ZnwUTA7/T0R7aYERaXmH1YNXc:tzTYZntTak7a9ILN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671968829, "uuid": "dbff3851-ee0a-447a-9881-6874c676999d", "value": 6745600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671968829, "uuid": "e21d8a6f-9233-4d59-874d-4916e3903c3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968829, "uuid": "4a1ab7fb-6d91-4f88-85e4-07d71656bd65", "value": "4a75f7dda9143bb7d91023698154c3b6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e3e952f-843e-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671963892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671963892, "uuid": "cea7a6b2-9d46-48c3-9261-f0ac408037dc", "comment": "Malware payload", "value": "009cf88a439f4fb607938cd666d5acdd", "object_relation": "md5", "Tag": [ { "name": "reg", "colour": "#BE1AF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671963892, "uuid": "d8eb5db2-5b31-4a2e-a4fe-b88504bba8d4", "comment": "Malware payload", "value": "c7f6b67d13fe12204b1169b28487df1189ba680e0c6d16e879ed533a38835bdf", "object_relation": "sha256", "Tag": [ { "name": "reg", "colour": "#BE1AF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671963892, "uuid": "8f6d33f1-08ec-4330-a9d4-a682be9442a1", "comment": "Malware payload", "value": "b40cffa4ee6d850d1e804dfb4ebe0a0b58539f2c", "object_relation": "sha1", "Tag": [ { "name": "reg", "colour": "#BE1AF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671963892, "uuid": "2409d0b2-db4b-4b00-934a-3aba82c8172e", "comment": "Malware payload", "value": "b50425cad1a423f7913b548025d4e2d4fe5d7674467cc39428d2bd87f8ed7ea428fa2624f5cc2771610ab7273785058c", "object_relation": "sha3-384", "Tag": [ { "name": "reg", "colour": "#BE1AF2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671963892, "uuid": "db6787e0-7938-4a55-8734-d299551a201d", "value": "T11732B43A8D36FDD043BE39D090502D522C9D2E5BCBB54BACFE8408B92C94691DF2A59C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671963892, "uuid": "efc91b42-7b70-4869-939b-4a52df6d2fa6", "value": "192:Pm1i6Hf7cLw2+KgR4BpEChrvkgWjn19lfEwh3ZdM37qoKKfmP6hpywodRQp6yn:P7s2+bMpzrvkXLuwhL47qoK56h0wodRC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671963892, "uuid": "06b0cba5-a64a-4eab-9984-1721c36d1206", "value": 11559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671963892, "uuid": "6733bfd3-2cfb-477f-a24c-5cf22259d979", "value": "text/x-ms-regedit", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671963892, "uuid": "9baa8111-f285-4b40-870b-5f24edc4b826", "value": "GDZHWWDCKGR%r%r%C%l%i%c%k% %'%Y%E%S%'% t%o% %c%an%c%e%l%b%0.reg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a57133b-8448-11ed-9db1-42010a9c0080", "comment": "Malware payload (Phorpiex)", "timestamp": 1671968234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968234, "uuid": "8fecad7c-b748-4ad2-aad3-a0206f763b00", "comment": "Malware payload (Phorpiex)", "value": "32a03dc5b2a3f2e4cbd82c04c9a06462", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968234, "uuid": "d449dab6-c35b-404f-86d3-97bfc660d93f", "comment": "Malware payload (Phorpiex)", "value": "ca67bd50585d85995ec8ec29cb0e4abd29c6378ebd791c54eb94964d9fba0be7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968234, "uuid": "5dcd498f-2a6f-4d45-8322-e8980afd17f4", "comment": "Malware payload (Phorpiex)", "value": "e692af623b8f0dad48c49ca375b0f65c10f81951", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968234, "uuid": "037f45b7-170e-45e0-96ba-e2e199f1c895", "comment": "Malware payload (Phorpiex)", "value": "4f1bc8b3fe36e08ba9f558732b9b3e181389047a528150b54258aefa75212c25649666876be73d4301a52a2b545fc6af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968234, "uuid": "a11e2043-1dbc-4b0b-ba59-f274b84db5ab", "value": "T1A5F2F710EA00D03AF4F680FFF2FB056E5C58AFE8434A98D712C569AFA7316D56932497", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968234, "uuid": "e4e13e45-6bd4-48a3-a50d-5f7a0e34d8c9", "value": "768:sH3MuYuJJXY8C5QrhIehOnH7proAu/kCg9O9iEFU1wFPDi51jbVaWwJM+:83Mz8pr+ehOVEn/g9u1ti/jQWl+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671968234, "uuid": "cd992cb3-ff0c-4444-86d5-3c953bdeed70", "value": 37384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671968234, "uuid": "60710543-9bbe-4c08-b3e2-387b170d5e4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968234, "uuid": "4b7d4684-ca21-4ca8-a62b-27048a851d2a", "value": "32a03dc5b2a3f2e4cbd82c04c9a06462.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12f16edd-8415-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671946156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671946156, "uuid": "afe8a2e9-a53c-48a1-93c3-8eed889910de", "comment": "Malware payload (RedLineStealer)", "value": "21fd2a38a381a5ffb302eee3427b7999", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671946156, "uuid": "96f5880d-bc8f-4e0a-b41e-2617be9e15aa", "comment": "Malware payload (RedLineStealer)", "value": "ca8b74d4dc1ff0b5876a702b0ac9450854ed7219cf968c94dd02d7713c8489e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671946156, "uuid": "babe7d74-e7a5-484e-8556-ededdec9a09c", "comment": "Malware payload (RedLineStealer)", "value": "afa1eace436c9bec6167c75e4e7e79e48e87b004", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671946156, "uuid": "ff010ed3-aeb7-4518-ab1d-916110411c6b", "comment": "Malware payload (RedLineStealer)", "value": "d3bfaf5878bbccdcbe61c774554e18475199459daeed19a4a7672ea43c630f9eaa9d032035d8eff28de8305f6068d83a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671946156, "uuid": "954292ed-fa9e-482a-b5c1-3e19b2d0b549", "value": "T1ED74F11CFAA3D432C99146388816EFE81B69FC705F20567E33147A5F2E70EE1557A3A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671946156, "uuid": "da88cbcd-4bae-493a-98ff-a7be558acf24", "value": "1ea9f0326cf512ac0eb7dd4bc1a00a19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671946156, "uuid": "1c4d3375-36af-4f03-8d31-9fe73dcd2a16", "value": "6144:JLV2zgRDxIByVtzOPW+Upjn87mdqwHyvVwPaMqCCK8:Jx2zgNOyV9oW+UjhdqwHyvjzCCK8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671946156, "uuid": "02186b0c-4562-4fcf-96fb-06fa5abbd93a", "value": 351232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671946156, "uuid": "3c866e0d-fd01-4051-a96e-14d6ee5e6c0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671946156, "uuid": "9c3248c0-c188-420b-8a81-1462b071d525", "value": "SecuriteInfo.com.Win32.Evo-gen.13722.27998", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3b2904e-8476-11ed-9db1-42010a9c0080", "comment": "Malware payload (Socelars)", "timestamp": 1671988141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671988141, "uuid": "ca4e18c2-8057-496c-a52b-578b1f24cc78", "comment": "Malware payload (Socelars)", "value": "c0d181d86bc83c6fb9d4d63d1b468043", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671988141, "uuid": "04f53688-abde-49a5-93d0-9b75e304a384", "comment": "Malware payload (Socelars)", "value": "caf74292c323c1938f0b074f4cdbb3a46449427915b05023e0142ecb9ff52dea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671988141, "uuid": "6e79db4f-5819-4793-a20c-1d4cd687a9e6", "comment": "Malware payload (Socelars)", "value": "a3259aff0cf014a506d0eacf02cca9954523b1b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671988141, "uuid": "dbf7cc0c-fc72-4427-b40c-9333dbb7d2bc", "comment": "Malware payload (Socelars)", "value": "033720f409b87ac3e5c71b6410b80b62861d21a9919c6eaca29a967c427e02ba8463b64d9f5719dedf306431504bf716", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671988141, "uuid": "929e38e7-3db4-458b-b41c-2492504fcd25", "value": "T19DE4236C68727666F9583C3D258DC13B3774CC1819F516EA68E0BE237D37F41B89AA02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671988141, "uuid": "4d35a685-e898-4143-a33c-5481de47a413", "value": "526d106f2e7b63f735e9ba641d6bbefa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671988141, "uuid": "488d49eb-299d-4159-9880-47fc4143acc2", "value": "12288:eqlMhfymUyZzk8ri+hcGgn9cJBJYGahyHY2oSjPWCBzZ68:e5kxyZFe+hcGEXGwiY2jy6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671988141, "uuid": "7fdbfaab-d02f-401b-9d09-143f766ad19b", "value": 691200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671988141, "uuid": "22ba5b46-1c7d-4ffc-933e-a192c957e802", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671988141, "uuid": "2ff0eff3-3193-4c47-8115-04fb72271493", "value": "c0d181d86bc83c6fb9d4d63d1b468043.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77f44ace-844e-11ed-9db1-42010a9c0080", "comment": "Malware payload (Stop)", "timestamp": 1671970807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671970807, "uuid": "c475e0df-5903-4129-8de5-cf21b07fd49e", "comment": "Malware payload (Stop)", "value": "05778645b4fac7d10e26c0e960806afb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671970807, "uuid": "079dc3e4-e129-45e7-9450-3642a66014cf", "comment": "Malware payload (Stop)", "value": "cb9b8f9f9aa26e34b42b1544d33284889353bcd6a2b15f6fc2b09664bd9be0b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671970807, "uuid": "7b453bc4-7f52-49c4-969e-ef21e99ca494", "comment": "Malware payload (Stop)", "value": "f9dafaa24102c513b7ad66262f87456794c9a042", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671970807, "uuid": "61633f98-0088-4556-a635-37f6704907df", "comment": "Malware payload (Stop)", "value": "fc060cf91aca4b17144f18f43b0e73572d417c19b2a9c4fd62c3656f9ee90d0ec51c7e6c078e18849538c0203a362314", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671970807, "uuid": "f9352603-2170-42c5-8f13-6d2b5fdff2d0", "value": "T132F412117660DC76C3D24A719A27D7A43B7BACA04F2746F722143A2F3D712B0692774B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671970807, "uuid": "03185145-1219-4d06-b896-1852d38a85a3", "value": "7b9daca6da068f54ad4e1900288e8efd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671970807, "uuid": "ff573c78-b28c-4289-bdd1-e77e0310e979", "value": "12288:RbYk6j+k5jW/opt2NkcEgtSKk6cDG+nj7+xHGRtKYzq0B35Jw/+W+HVxm:yk6jZjrpD3H6cbRR0YzDBJJw/+z1w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671970807, "uuid": "b342c742-fab5-41c0-95b9-8a0fa91c72c1", "value": 757760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671970807, "uuid": "b9868949-94af-4397-a5d8-e8a0ae8495f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671970807, "uuid": "4dd17113-192f-480e-91aa-e6919c7d6903", "value": "05778645b4fac7d10e26c0e960806afb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a90be68-8486-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671994809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671994809, "uuid": "99e0fc5e-e9db-45f2-80df-fbb8ce7884c3", "comment": "Malware payload", "value": "f006fb4211ed1786d24b97c8ae2a45a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671994809, "uuid": "6fc7f830-bb85-4ec6-8837-7ddd174654fb", "comment": "Malware payload", "value": "cb9de5e775eed191d4ba08695b082ce3135286b19e91214c3eefe6b46c28903f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671994809, "uuid": "7f063eff-6e7e-461b-a2c8-b4eac4fa9bd4", "comment": "Malware payload", "value": "c4e978c0177ea8188f8504f12ef94304f204338c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671994809, "uuid": "f4b20b10-7f74-4b42-87d5-7413a8927a2b", "comment": "Malware payload", "value": "e272e35214a4ce8b6ae68ee337c232c4e82fdcf3f17cff192353c22c0cb36a6be5a406b6336f2e210ab9bff580f02421", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671994809, "uuid": "9d52219d-123d-4b12-8803-034bc071af38", "value": "T184864A03F89191E8C1AED13086269263BA727C484B3027D76B60FBB52F76BD46F79354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671994809, "uuid": "226a2ff6-6068-421f-820d-c505e1b3ca19", "value": "87fff2010412aad37f9c0bec93dd5d32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671994809, "uuid": "1a2478fd-2dc6-4dd7-95eb-f78b8d819985", "value": "98304:x5wzP/CoM1IdClLEAgPv1S4F5GFTvdEQusih:/wz3CozMLzgPv1S4F5GFTvOBsC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671994809, "uuid": "0766c6e4-8a22-4d40-a895-c993f60b34a0", "value": 7900160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671994809, "uuid": "9eae437f-213e-4bc5-803a-36d2c8c52ea0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671994809, "uuid": "d5bd4cd0-19c3-4cfb-9f31-4cd8cbc628a7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f362a8ad-843a-11ed-9db1-42010a9c0080", "comment": "Malware payload (Quakbot)", "timestamp": 1671962424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671962424, "uuid": "e365cec7-6ddb-42b9-a02a-388e614c982b", "comment": "Malware payload (Quakbot)", "value": "a17b20b3a4ff431c1e6a514da2bff5cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671962424, "uuid": "58c35558-9efc-4f5a-8f98-e5648a58f628", "comment": "Malware payload (Quakbot)", "value": "cc0f26f1393c75c4e1eeb435b288fa4ad08641a118a34a41a9c7a7790b122f32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671962424, "uuid": "8bdf4bb8-e36a-4b6d-add1-a5bab6281676", "comment": "Malware payload (Quakbot)", "value": "2dc523a3d063c02abb1e298bd917c9011cf74c71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671962424, "uuid": "c284dfec-089d-45ce-951e-7e8031854708", "comment": "Malware payload (Quakbot)", "value": "f1da44709978cc5da5aa3b9c00049a187338656607305df17d8c25c29040a3f4b73c06d61e4395d8ab510c3ff8af5266", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671962424, "uuid": "9875acf7-58e4-4e74-a46e-ea2aa072f595", "value": "T1CCD533A23EDFED7EC1E8D735742B8F5EA7785D51829490838680ECC9827E757480BA12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671962424, "uuid": "1b11dabc-7e15-455d-8d1f-1e222f67dbfd", "value": "9a8a945048954f6b01f69e0bf3cd5954", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671962424, "uuid": "9e9713ee-1c34-4efe-ae01-5d63f96eafe7", "value": "49152:hLe5rv1RVoqCjtnf7qmyL0lSF9S/6naze3cJETvlSMLgY:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671962424, "uuid": "982c604b-9dd6-4716-abf2-c3e1fab0921f", "value": 2941440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671962424, "uuid": "dd0e68da-1c86-4215-b51f-a4a7b150d09d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671962424, "uuid": "bdffb66b-4793-46d1-94d4-6a846fac7117", "value": "nequ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "389b2aff-83f5-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671932475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671932475, "uuid": "7ac4eaff-0851-49dd-9a39-91c88be25066", "comment": "Malware payload (Smoke Loader)", "value": "1ad8265cf1a7a55c3792e39cf67e482c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671932475, "uuid": "4db59dc5-2f45-491f-b0dd-787d60d16b65", "comment": "Malware payload (Smoke Loader)", "value": "cd200ef3e978d8a64016d8066bd09bedd729e2b927269a757fe6b3b66de82fbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671932475, "uuid": "61ded41e-187b-4b92-8b06-11eec27ee8f2", "comment": "Malware payload (Smoke Loader)", "value": "3a9ee204c23150375acd951bfefb64f02ba4c91c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671932475, "uuid": "e5530375-f7ea-4844-8afd-3f6c113981fd", "comment": "Malware payload (Smoke Loader)", "value": "9102381743830407ca52cd9724fed2e89542f8bfef63eb68b474a50ecae9777a4a5312a777e16238314e5e4e08b2d308", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671932475, "uuid": "e22ac121-2d91-4d28-bb91-721b02a9b359", "value": "T19A24CE0EBB92C077C55209308819CFF46A6AFC755B61562F37403B1F2E70ED1966A3B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671932475, "uuid": "49fe1eaa-1723-4d30-8217-45061501313b", "value": "1ea9f0326cf512ac0eb7dd4bc1a00a19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671932475, "uuid": "debec38c-08e1-49e3-9140-c8fea70df724", "value": "3072:zDuR1LrE5+iixcd/oljy3T3Apu8GiSR7LXauDgCfEQEf/ln:01Lrvii+dQljmApu8GZ77aM1ED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671932475, "uuid": "f8be39ee-d0c5-4496-bd78-5ef7a6e4327a", "value": 227840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671932475, "uuid": "ed5b6629-abe4-4c4f-902f-e9b509e3431b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671932475, "uuid": "9277847f-f01d-42e7-a8ba-92e96be7ec7c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48750395-843f-11ed-9db1-42010a9c0080", "comment": "Malware payload (AsyncRAT)", "timestamp": 1671964285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671964285, "uuid": "c52edc41-35b2-4003-a2bd-a38dd9919990", "comment": "Malware payload (AsyncRAT)", "value": "533f876556e02dec453f6fa4c2536967", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671964285, "uuid": "0a8c231d-21b9-4229-97da-2e21b89b1103", "comment": "Malware payload (AsyncRAT)", "value": "cd2c63e16f4c1e79e7763c278146acae54dca752c25ad46d47167f69d70d714a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671964285, "uuid": "3cf8e795-744a-4103-8dfa-545c3c20ecc8", "comment": "Malware payload (AsyncRAT)", "value": "a4abdc1e4b26623e2be6c3715c1a75a5a6e2c397", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671964285, "uuid": "1885112e-5dc4-4ef9-9011-b43205cfb464", "comment": "Malware payload (AsyncRAT)", "value": "012bdae86a224cbdeb088746b6502d7a55b64411d6aee81544140e4a940deba1a84d64877632f840a337ada0e431f46f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671964285, "uuid": "dd0be89c-647b-419a-88de-cfa3968295f8", "value": "T1BFF6FBDC726072DFC857D472DEA82DA8EA5178BB931B4203902715ADEE4D89BDF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671964285, "uuid": "81595c4e-f237-4191-9ec7-9cfe36b8cd8a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671964285, "uuid": "8fa52e4e-86a9-43b4-9c26-b399b8971ab0", "value": "196608:6nMPXMnhoMskO1/6Bstbu5F5bciXk0H+TnrgC8d:6nMQdCJEl5o+Ha8jd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671964285, "uuid": "9e417580-5f34-47a8-b2e8-683b98ee1076", "value": 15366144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671964285, "uuid": "0352b4ce-13b2-4ff6-8af2-34c0db4cb526", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671964285, "uuid": "49a6aec0-80af-4b15-bdc2-fb48095b8fb0", "value": "SecuriteInfo.com.Variant.MSILPerseus.238084.18099.17658", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7731617-8437-11ed-9db1-42010a9c0080", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1671961008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671961008, "uuid": "7d13391e-4abb-4242-ac95-28116165e36e", "comment": "Malware payload (ArkeiStealer)", "value": "f5fe0da0e9cc0ec42a8a146f818c571c", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671961008, "uuid": "51bb143c-b211-4031-b810-4ea18a6be904", "comment": "Malware payload (ArkeiStealer)", "value": "d05d987da11e0cc365f6b20f8d72d9f87f4d589c81fd87932f92812b9edb4b9a", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671961008, "uuid": "263c6365-25ff-43d1-ac0f-499de9dc0a4f", "comment": "Malware payload (ArkeiStealer)", "value": "7fd86dbe9e494a9eb1e2ec6864f52be4916b546a", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671961008, "uuid": "474645bb-9249-4c6e-84c9-19047006477d", "comment": "Malware payload (ArkeiStealer)", "value": "50b9a867be006484f52e0adeb205e93bdc2f4013e1f71e9b288ece0b8951b90c951127a245d62a8adb8f2f51670a25da", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671961008, "uuid": "4f6d7217-1805-4c83-a222-295e9ffde51c", "value": "T199A533C9CF17811DDA3D5CF44C5ACB6786BD81034E08CB55FAB8856ED83B88D2296A3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671961008, "uuid": "1f520f6c-bcdd-4f18-b766-b4dec3432141", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671961008, "uuid": "71d5949b-5301-4dfd-b63f-928fcfd8a607", "value": "49152:YflEAzfSbbROFPd55lppzi/CLOJzVQd/Ia4oxNJRWaWj:CdeHRYlxppzi/+OJaxI3oxNJW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671961008, "uuid": "0a50dc25-7e8b-411f-a726-9a0785a2c7b2", "value": 2141960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671961008, "uuid": "c4954c1e-a43b-4944-805b-7bd307a684ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671961008, "uuid": "a8f59332-f6af-43a7-a785-d01013a1b736", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6e2ccc8-8476-11ed-9db1-42010a9c0080", "comment": "Malware payload (DarkTortilla)", "timestamp": 1671988173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671988173, "uuid": "2b5aa3e6-f737-468b-a10f-4c704b8f45c5", "comment": "Malware payload (DarkTortilla)", "value": "34844b45021401cbc25ec15dadcf965b", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671988173, "uuid": "d8c738b4-360c-4c34-a2e5-1677126569d0", "comment": "Malware payload (DarkTortilla)", "value": "d0bfc35b60cf80f2b52779d06d08ddf2d01f784b0f28fed75d58aa3366656a3b", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671988173, "uuid": "5dd60abe-87c1-4fd6-8bd7-8210e5ccf36d", "comment": "Malware payload (DarkTortilla)", "value": "699bf02970681b81664ec01a28b567334f8603e2", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671988173, "uuid": "01dc2e40-529e-4dde-bafe-7debbf2c46ad", "comment": "Malware payload (DarkTortilla)", "value": "fa33f7a6e0630eade21975d1764c56ed23c1e30cd4fd72a56128732b7102d261b97e37a802cdc38d6ddffe93726f2580", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671988173, "uuid": "db98216a-5795-4d76-b7aa-ceed766e94e7", "value": "T175F45A2687D0562DF16A617C5F648968A3D3CCCE5098B0EA3DD6CC438DEE6FB62244F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671988173, "uuid": "0cd9246c-0728-44a4-aae3-1250fc94a91a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671988173, "uuid": "3705a5f0-f710-4a0d-a0ea-44345b851b83", "value": "6144:Rgh16a/Vh27W68yJvxUNL51T/2KClQWvgMSy35hu9yeoPO/912D09u5E9d1EeZMg:wFb23KElXlA3D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671988173, "uuid": "da6b641d-4ecc-4dcb-acc6-c742b39c788a", "value": 791040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671988173, "uuid": "3c1b3124-c53a-4b77-a916-985bdd564d9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671988173, "uuid": "1e3d1910-6633-4ff4-9159-a2e93ba85652", "value": "34844b45021401cbc25ec15dadcf965b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "393207d2-84a0-11ed-9db1-42010a9c0080", "comment": "Malware payload (Pony)", "timestamp": 1672005920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1672005920, "uuid": "0a81cc11-5b44-4f72-9a14-2af1d0f485f1", "comment": "Malware payload (Pony)", "value": "af46454be7e00c3c277233a2c10f0dd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1672005920, "uuid": "d7f3c155-42a5-456f-b796-57f0fcf4a287", "comment": "Malware payload (Pony)", "value": "d28d9df11b70bc1ebc1a52688d78818abb4a5f4b0af1292d0b1b1457984fca24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1672005920, "uuid": "f546bfa1-984e-4a7e-bb9d-db8386da350c", "comment": "Malware payload (Pony)", "value": "5f2fd1a603187c7c4d6147f85532063ca3bedfff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1672005920, "uuid": "5bd03ab0-2fc0-477c-be00-77f3c1fda960", "comment": "Malware payload (Pony)", "value": "e4c8e14480728868c032b88fbff7a2fb3586538b304ac1a88c9142bf6eb37aeefb8289539cff8af4d81a8aed708834dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1672005920, "uuid": "b998e26d-b9c8-40df-b531-002f26f99761", "value": "T1B234029B89EA4E35C285027DD52342E812B2D40D56C5DF27DAEEBD704FDBADD2C83902", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1672005920, "uuid": "00dc1ef9-c7c0-42e4-8e95-86170f9f22b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1672005920, "uuid": "3fada08f-8355-48b8-b593-c701a5f482d9", "value": "3072:SC8V0EKFWFT7HYfay0+iK7Hj8LqTI3+7JzebG+06bDZlUUZFTG9JU1nrlc3SFVvY:j8FPHYilWoL4dFCn7/rRTGFsQGgDT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1672005920, "uuid": "fc2c868d-e025-4fd4-963b-142b5179a23d", "value": 243712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1672005920, "uuid": "0042e1ec-95ed-4659-8806-93c9055a4e7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1672005920, "uuid": "5eb9d394-82fd-4021-a460-20f006e27bef", "value": "D28D9DF11B70BC1EBC1A52688D78818ABB4A5F4B0AF12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b062ca84-8449-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671968754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968754, "uuid": "8821b161-7335-4689-b756-b90a8db612e3", "comment": "Malware payload (Smoke Loader)", "value": "233b4a18809f7ab020ac61d4657c6113", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968754, "uuid": "71fa7000-9a7f-44ae-a4d5-94f95aaaa681", "comment": "Malware payload (Smoke Loader)", "value": "d469d2a733240cf3839366dd1c0ec57ae6b218304894afa7236606d8cedf488b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968754, "uuid": "11cdc299-c141-474f-b124-45b601999f76", "comment": "Malware payload (Smoke Loader)", "value": "676eec649b4749f28709a3bc2e6106c2464629cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968754, "uuid": "bc23455c-dce2-423c-8489-f1bb842ad317", "comment": "Malware payload (Smoke Loader)", "value": "2c054b8f6a9982156dddcf67568f95a0b8b7f272ae69aead48e5466028e83f5fd02daeeadf1120ef66480a371c8e413a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968754, "uuid": "c83c2af2-4829-4683-9163-c48476c0da11", "value": "T11424BE0CBAB2D076C55249708925DFE0A72AFC715F61966F37143B1F2E70F80962A3B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968754, "uuid": "103bf30f-41e3-4f0c-9aff-969e74d048d3", "value": "20c459d943d7c19ddc9a1be25fe9460f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968754, "uuid": "1d33338c-39e2-4e19-9084-fb76102a2d87", "value": "3072:GGSImLVxCJ5+3RSwFmgQ/AbkLOXvCW9DLwauDAqvf/ln:wLVIy3BmgQ/AbXCWOaMnd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671968754, "uuid": "88d7fabb-c85b-45d6-a52e-54912e8a8ba8", "value": 228864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671968754, "uuid": "cc7d5310-5c2f-4bdf-9bfe-bca1c619e861", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968754, "uuid": "2c925b61-ce09-4c2e-904e-f25d805ef87e", "value": "233b4a18809f7ab020ac61d4657c6113.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09628642-84a8-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1672009276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1672009276, "uuid": "37495b78-3365-4e13-bdc6-f8d9bb68b56d", "comment": "Malware payload", "value": "6a81e4276fc5f4b5f7571f091c78dfe0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1672009276, "uuid": "a3406de2-64f0-4bd3-8f73-09703754cada", "comment": "Malware payload", "value": "d4e2957a6e9681f32543114234fb3a40735a9eb0a8ecc8bc3883daed8b6dd9c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1672009276, "uuid": "c4791838-cdb9-4b8a-81d0-d7359357e165", "comment": "Malware payload", "value": "819563e48615838fc3d0b8c060ca8ee959ed40f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1672009276, "uuid": "4c6f7359-09bf-4a91-a03f-1bb78ab7f713", "comment": "Malware payload", "value": "98630da5690bcdfd32b23c829f2d6c6da63bc6e837124082d6ff472d500fd7769628dd0dca5fb9121215d25f61f42f4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1672009276, "uuid": "11000ecb-26fd-48b0-a056-37b570360104", "value": "T1C38523D1BEA9593EC02ED5F85E04E45872652BE11B269A2E1CC8EF8BD37816CC343747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1672009276, "uuid": "818a35f2-29da-4c86-92a4-5263b0adc430", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1672009276, "uuid": "67f35a32-577f-478b-877e-7fe4b9a36c2b", "value": "49152:2iNfURJ/sMnErhaYfU0Bh8GCzyACArKtNty/pbfm0b86ASLxbPGJZaG:2iNfUXslrhaB0jVAdmtCpbVP8JMG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1672009276, "uuid": "9c099dbd-c987-4fba-a71f-5d2870c59dbe", "value": 1804868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1672009276, "uuid": "6487d8e9-cae8-4537-96f6-96c6aff598ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1672009276, "uuid": "8cbe8cba-63c1-48cb-9174-a4d3f881cf49", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bc40e54-843f-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671964290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671964290, "uuid": "a8b4148b-8447-4a2b-9036-7fbf52e3eae1", "comment": "Malware payload", "value": "6ae7ecfe7462c42abc2ec2c158c428d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671964290, "uuid": "6adf38ef-8380-4991-8b66-83db3a4f7e8b", "comment": "Malware payload", "value": "d609969b882770e71e0d5661861239aabda6d9557b814e4bb93113d8609d0e57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671964290, "uuid": "f5cb8e27-04c5-48c0-9255-8fa25a3e6cab", "comment": "Malware payload", "value": "56023d87beb502af1d29b8366067d8a51131c8eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671964290, "uuid": "1a725d1d-42f2-4f0a-8706-bf77cb93ec0a", "comment": "Malware payload", "value": "84e8aaf7933c9443a097b29c76c36760121b7e869d8f9360fd133620846b8d83b10635af56ee9d332234b6eeb4f50cce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671964290, "uuid": "f654a13a-0bb4-49fc-8761-61669584ae8d", "value": "T134C1DB015FEE50DAF23703706BEB737B1266E8B1552E62B8718489A85F34BD0C852AB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671964290, "uuid": "eef518d3-b140-42e4-9865-c2b3a554bc32", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671964290, "uuid": "08f4f142-8d47-4b64-9f99-509f750f993f", "value": "96:syP4h790PL1bhycGdH81q++UquuYtKNtUq2uToUvfd3oj2rl:6B90PL1bhycyUqulsNtUq2abfdJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671964290, "uuid": "bd8b9336-3906-42d5-bd1e-63e290d6fc96", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671964290, "uuid": "42b184e5-23a6-40c3-aba9-14b25bd3e194", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671964290, "uuid": "7e561832-14e0-4fe6-9c85-619810adf3d7", "value": "SecuriteInfo.com.Variant.Marsilia.2083.23230.29094", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6902673-844a-11ed-9db1-42010a9c0080", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1671969167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671969167, "uuid": "1e76083a-bbcc-4128-8d99-9d67e05f746b", "comment": "Malware payload (SnakeKeylogger)", "value": "3b2598a44ac0879a39dbc4f9e43e9cb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671969167, "uuid": "301c4755-f3dc-4042-8fe5-803daa18560d", "comment": "Malware payload (SnakeKeylogger)", "value": "d63f01f8b960be59265076acb45655eb356a707be923251890e3452e553b1bf1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671969167, "uuid": "d5153a1b-47ae-4118-b7ea-4d215148c9dd", "comment": "Malware payload (SnakeKeylogger)", "value": "ddc45cfa088a96e7ea9d784aa99d53b1c5249619", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671969167, "uuid": "c978abbb-5e4a-4571-b196-00aadf1708f4", "comment": "Malware payload (SnakeKeylogger)", "value": "24cfdafd7a459eda84eafcecb1a31989e16c766cc82ea0f52b844498c0338f4fdd72383e23c2bed5e52eac89a32a0557", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671969167, "uuid": "e149a9cb-6ed8-4c6f-bd4f-0de51bb8cea8", "value": "T15FF4D4858135CC61A6481EB3183330760E2D8F5A7EB9BC6491F33F928FBA7D1916CD96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671969167, "uuid": "c8b4fe31-3a74-4227-b4d8-5538bd2465de", "value": "6144:OGlwKOoPPGMiC5M9NTEWhKHSZsCFrz3VH3AmSdDuX6lkaxvL8J/nSZ:OGgoPGMiCGDlfNrz3VtelTxz8I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671969167, "uuid": "0ceeb657-06bd-46d7-a851-839e10beab74", "value": 727552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671969167, "uuid": "10b0c619-538c-413e-a8da-bd0473337f05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671969167, "uuid": "2641f0e8-1171-4eb5-a43d-1930fb5b28f3", "value": "Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38ad2f2b-8442-11ed-9db1-42010a9c0080", "comment": "Malware payload (RecordBreaker)", "timestamp": 1671965547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671965547, "uuid": "fc52396b-785b-48e4-8f58-61a929f67040", "comment": "Malware payload (RecordBreaker)", "value": "fc122a49db46a7c74859da3e904b65e2", "object_relation": "md5", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-neonbats", "colour": "#C001BF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671965547, "uuid": "35aa3e7b-9738-4ae9-b83e-78c1d05f3036", "comment": "Malware payload (RecordBreaker)", "value": "d84497ca5900380b02376ad0bd439fb87ff10af393327776941694b10dafa94a", "object_relation": "sha256", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-neonbats", "colour": "#C001BF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671965547, "uuid": "17a709d9-86ac-46e5-a4e6-c0fa3d17372a", "comment": "Malware payload (RecordBreaker)", "value": "d111a975652afd4b5e7bf122153c40b209edc736", "object_relation": "sha1", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-neonbats", "colour": "#C001BF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671965547, "uuid": "e42d9749-bda4-428d-912b-12c42fa0300d", "comment": "Malware payload (RecordBreaker)", "value": "3f9d32c8a4b989a4030fa0d31c4935cf7a7bdf7cbe77576a3c57946ecc23ec5068810f8794ea70b51f0c1b54af6a915a", "object_relation": "sha3-384", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-neonbats", "colour": "#C001BF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671965547, "uuid": "8815b5c3-e792-4648-a573-bf43ce666cd8", "value": "T16F66336BB131EB07612655040431E7CB7D903E672B2FC233DDED98DA061B689B229D7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671965547, "uuid": "e6c21274-41fb-4670-9c1d-800f6e4a9b1b", "value": "98304:GbTl/bwEOQyIQQGLucQs7y6AVwMTk6hrX2jLKCG5fCXVstwGFOph6N9Vg8W:IcVzSlvNTbCxGgMFOpW9ZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671965547, "uuid": "1dd9503b-aaa7-46df-8027-67e5d4cdd6c2", "value": 6522707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671965547, "uuid": "323d116c-ffdf-4997-bdce-ed1721151cac", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671965547, "uuid": "67792a80-10ec-4164-a513-dae80d667b24", "value": "AdobeAcrobat.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60762d91-83eb-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671928247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671928247, "uuid": "9708f0e8-6e2b-4ca1-97e5-a49c637a5d20", "comment": "Malware payload (RedLineStealer)", "value": "c0fd9c661fbfccb0ea77a538ea6cc049", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671928247, "uuid": "2e814b81-8481-48d3-b221-30ed92b925df", "comment": "Malware payload (RedLineStealer)", "value": "d95060d1ab4dff434f55b8d5a660c87783d16e16a47bb5fe30c075f7e7234da1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671928247, "uuid": "5d3abb1b-8187-44c2-9a76-50a1ccb51367", "comment": "Malware payload (RedLineStealer)", "value": "b7358df1eb0f1c4292dfca207e0617a5a8d12da9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671928247, "uuid": "3a4fc167-1398-466b-8452-940ab473759d", "comment": "Malware payload (RedLineStealer)", "value": "ab549fc59d0302cba65e29624786c9e000e1ec37dfb2849d0b2ad6e82549d31709eeca0808047733e081a0a314864d9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671928247, "uuid": "caab4662-d96c-4db9-911b-674b18b06d1f", "value": "T16184F00DBA92D036D11104B04915EBE4AB7BFD315F249A2F73007E5F6B72E816A263F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671928247, "uuid": "472b6c5e-8777-4ef1-a5be-22ca7ede4162", "value": "ff6eadc44bfbddffce47ad40ccb423dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671928247, "uuid": "f45e8efa-73b5-476e-b20b-237a7cf7bbe3", "value": "6144:iFLMx0+YGrSLdbuzsOEVhmfKJqszVI3+wsaMkQ08:Ioud6SJqsOG9tz6+g7Q08", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671928247, "uuid": "08c2e6be-6e56-404b-a127-13bdee5a2f68", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671928247, "uuid": "8e4279fa-8783-43cd-a6c5-f2d55365aae2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671928247, "uuid": "f94b1498-f2a3-4a1c-88ea-c63e0272a94e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07579a77-8405-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671939265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671939265, "uuid": "debd60fb-1d98-4e6d-8b87-bd78e85b40f1", "comment": "Malware payload (Smoke Loader)", "value": "ad84bbea8e35e6c39dd8202d1559640c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671939265, "uuid": "f182e05b-f962-4d93-bf4d-a945f8786d74", "comment": "Malware payload (Smoke Loader)", "value": "dac9de797c94ed16f9b15a95ddc6ae467d00848c1d1113d72b8c4e3023810021", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671939265, "uuid": "fc465e85-3271-41fb-bd2e-61ca05dc75ec", "comment": "Malware payload (Smoke Loader)", "value": "08a8f661ced7708740c3b60424d996351fc546b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671939265, "uuid": "945518d4-a79e-48ea-92b5-60126d11ede0", "comment": "Malware payload (Smoke Loader)", "value": "fdd36a17d708d8000cb3df9e205af9fdb50983d03b2151f6220ca780aeabd66fa093eb19c146350b8bd341dc104bc99a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671939265, "uuid": "4e4c01e6-3a1e-45f2-9a85-fc27b79297fc", "value": "T1C724BE0CBA66C036D55359308819CFE4666EFC719F215A7F33103B2F2E70E91963A3A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671939265, "uuid": "83caa5f8-dbde-4c14-bc38-a6bcddb4f37c", "value": "1ea9f0326cf512ac0eb7dd4bc1a00a19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671939265, "uuid": "e58286f6-8e20-4a86-879f-a98e18edbef4", "value": "3072:7DbhWLPU55TnWIdVt2UCPlEZc4/auDdSSf/ln:NWLPSnvdT2/+eGaMdz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671939265, "uuid": "01ba9c4a-a071-44b4-97d4-403cc0d5ba6a", "value": 228864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671939265, "uuid": "ecbfd502-84c5-4ef0-9d0d-2fd110e99bf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671939265, "uuid": "83a6f101-dbcb-4e8d-bacb-7775526c1107", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20ed279b-849e-11ed-9db1-42010a9c0080", "comment": "Malware payload (Stop)", "timestamp": 1672005021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1672005021, "uuid": "f03a5243-0168-49f8-af9e-57c927866b07", "comment": "Malware payload (Stop)", "value": "ade885da982e26adc6b611ee6c226af0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1672005021, "uuid": "956a9740-20c3-4b70-a9b4-8eb6996e2078", "comment": "Malware payload (Stop)", "value": "db6350a5d1abc3d3ede7920c9cd1ea60934b5917b3c83ebaab3cad4a52293725", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1672005021, "uuid": "f0a230a3-f3b9-42ab-ac28-aaf9b4cb3926", "comment": "Malware payload (Stop)", "value": "bc3772b05a374d5710fccfc819639ecbb1376fac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1672005021, "uuid": "996f93b5-135f-4e90-8770-881193407896", "comment": "Malware payload (Stop)", "value": "cd889600bbca4a1fb407d2173d19644b84492fb7f96e910178fac4b1022eb669f5077918573bc0e17c3c4b30d54d40fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1672005021, "uuid": "ad00acd7-e353-4dfb-a62e-cff05ae36980", "value": "T129F4130171C1C467D36228714838CBB49A79FD55BF1A1AEB77E83B1F2E31290E67A346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1672005021, "uuid": "67828b4b-c11b-4bf7-95c5-44f27f7e02a1", "value": "bcbfb27d06dfce296f146c1fb57c8a36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1672005021, "uuid": "d5cb2be1-0a40-44dc-822e-235b7980f7f7", "value": "12288:PPshPHBm0qYfAh4CzMRI5c23Ly8ZKArvHvVhLjZhRABFUTkJ+dPjpjcK:iJBqYfCbMRQFe8ZVbyUlpIK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1672005021, "uuid": "7113ff2b-ec8e-47eb-94bf-697f2c969bc7", "value": 765440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1672005021, "uuid": "add9fe92-9a75-490a-a243-11b04424097c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1672005021, "uuid": "7f03aba3-cb68-46c6-822f-187e9cf3cb89", "value": "ade885da982e26adc6b611ee6c226af0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fc52214-841e-11ed-9db1-42010a9c0080", "comment": "Malware payload (CoinMiner)", "timestamp": 1671950070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671950070, "uuid": "a0f3e514-b5c1-4c05-a335-b3cf884d4c7d", "comment": "Malware payload (CoinMiner)", "value": "96aa2eeabf2378619eea42a660fb146b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671950070, "uuid": "6acc9b7b-c1b2-4bf0-a1d5-aedf037d3af5", "comment": "Malware payload (CoinMiner)", "value": "dc31911b8ed395f23a66b2ad993a08a758c2f5ea651f54b388150d2016d97026", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671950070, "uuid": "18a95298-f2b7-494a-b375-30bdb46a726b", "comment": "Malware payload (CoinMiner)", "value": "ffce2f6ed7a93235a0894f059dd2281a028fe71e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671950070, "uuid": "77db05a0-2818-4ffd-b669-244e801f818c", "comment": "Malware payload (CoinMiner)", "value": "a257cc32e416a065e61c06938c17021c73062bb45d1b1899011e74817d3a169d012dd5758ee8a46dbf41b6b346373a38", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671950070, "uuid": "920bbee5-a6c3-4a18-a184-59f63f356149", "value": "T17D25F120E5548D21E17E013AE8636B319303AC11E621A167B2503FBE7DB35539FFA7A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671950070, "uuid": "171d2fdc-371e-4e89-b87d-8090dca746ac", "value": "84347dff909738e20f2d4eb4fb9426ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671950070, "uuid": "8e1e7266-2432-49e9-8555-6324c134469c", "value": "24576:yi8r/TvrUz3MkUSZ+Arib9fYmnuog4dG1A19k/J1pLpXtNur:Sbb9tuetM/pFA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671950070, "uuid": "6167674c-5cdb-404d-9fe8-4d8b3aeaae94", "value": 984576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671950070, "uuid": "4a7d6916-22b5-4319-aa7a-b6215856fdeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671950070, "uuid": "87f5f432-bfeb-49c2-893a-e6be2e05c26e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a44e89a-8491-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671999399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671999399, "uuid": "30777144-ca1b-4f69-8e02-8251bb7b274b", "comment": "Malware payload", "value": "b7449293439392a03603af5ab4598fd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671999399, "uuid": "68452229-d5e6-4a2b-b7f9-32dfc63fc42d", "comment": "Malware payload", "value": "dc5851cbaf5625347cef70434eae221b5f6035814e202b35660104d9487e430a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671999399, "uuid": "67e45ed5-ffbf-4d46-94e1-874bbf193aeb", "comment": "Malware payload", "value": "4a7361f8e579dddf6b5307af0ad2603d15f99fc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671999399, "uuid": "29a739cb-535d-4d8f-8835-c85d8f9b04be", "comment": "Malware payload", "value": "ee4bd68fb02ad500de3f278dd8ff2d0865c2842ff3c8685b479fe2941ab5f776df7377260d512f09e1312708517a7842", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671999399, "uuid": "7a18fe80-137b-42da-bf38-3aaa1777238a", "value": "T1BA34CF00A792E271C11309714D19CBD55BAABC61FA64DD3AF380BB6F2FF0290A5E6357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671999399, "uuid": "c0779db4-c282-489d-9ff4-ece85c422913", "value": "997a79bbc9b29ccf624aa79059ded875", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671999399, "uuid": "2c165f8f-bb26-47ab-afb0-dc66f62df46f", "value": "3072:i7pYqLLVdX55ZRBk2FrA4Uq0fa2ZFrfAJNlS1g/tK82yuIXLrcSb54VIcVTuh:lqLLVhZRBnnUqj2ZF8JjtK82yuGbIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671999399, "uuid": "cf2e1355-7c03-43f2-ba42-ae1fb1e5b29c", "value": 237056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671999399, "uuid": "a830ed67-c761-4205-81df-33e80728a01c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671999399, "uuid": "60349fec-b6aa-451e-a868-3b064885596e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07df8f5e-849c-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1672004120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1672004120, "uuid": "89a84d73-63e8-4814-a7a2-939ac69b41df", "comment": "Malware payload", "value": "707713070c2b4b1d368eb9d2aea05002", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1672004120, "uuid": "7d4cd7c2-11ad-402c-88dd-5a9913537622", "comment": "Malware payload", "value": "dd3fcb1312a1efd3175a4c58328a40e52735732196a45fc4c0ca78fc72b16c90", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1672004120, "uuid": "668a34c5-f940-454e-ba4c-67943d1e0bd2", "comment": "Malware payload", "value": "d48d37db7afeff5b8e943acaa3d4929de8b49c8d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1672004120, "uuid": "ae0a99fe-15bb-4270-b942-69d39ea47546", "comment": "Malware payload", "value": "22684abb28708d4166173eb2c24e94045b1b6ba1016747cd98afac8e4f792539e1e00a3c7d7ff0ec05dfe520bea70dde", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1672004120, "uuid": "14e050b7-5405-422a-9f3a-644d11d6fdb2", "value": "T111818460832FBB5AEC9644B051DEF0E07717257514E1850060CE6AEDDB83AE4AFB4D33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1672004120, "uuid": "fcc8f9c1-8bfa-4c64-bfd8-3116b6296a5c", "value": "24:fXzUcK441sWT7/f8m855CQnLsxjtfh3Xsng5ykX0retuo:7e1sQf+5CQnLsxjx9Xgg56g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1672004120, "uuid": "c2d64f0a-ced4-451c-8db9-e4c32bc2f596", "value": 4096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1672004120, "uuid": "4d12e8f7-fd07-4286-8bc7-cc1d69d3c3d3", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1672004120, "uuid": "c79a795a-0777-4bae-babc-dbb74b2efaa3", "value": "7df4357a1000.shc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8214712-8491-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671999664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671999664, "uuid": "87079511-54bc-4701-94c9-08e43844efdc", "comment": "Malware payload", "value": "d42a3b57086898ba97a3c57389ddaa68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671999664, "uuid": "e30ca6f7-e400-4c61-be4f-66699e49622e", "comment": "Malware payload", "value": "dd6392069f411fc80da7dce14af3d08ffb705595f99ea597ad6b000436ca1880", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671999664, "uuid": "4b744747-c9c3-4322-8f7d-acf883aa88e5", "comment": "Malware payload", "value": "3b3d14d200b577606596d2f6dba3fb617a3d353a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671999664, "uuid": "cd4fcc09-7a63-455d-8f7b-b34a2a0e13fa", "comment": "Malware payload", "value": "bb63071b612aa08e7f9cdc95382452241a24443d6351af497990be8736d392a0a7c89be70993cecc67745e496245f463", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671999664, "uuid": "604dec2b-8397-4819-b20a-369ff991f1d2", "value": "T1DE34CF01A792D071C56318385C19CBE51B2ABCA1AFA5DD3BF384BA1F2EF0191A5F6353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671999664, "uuid": "1e077891-5ae1-4259-9aa3-3fd4c6f7558e", "value": "997a79bbc9b29ccf624aa79059ded875", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671999664, "uuid": "3c0bda6e-6d40-4cf4-b719-f11b0403891b", "value": "3072:4h7VuDLhn5LCAq2v7KLUmo8pZilS1g/tK856A5FAwLrcSb54VIcVTuh:7DLhgAq2zAUuZMtK856A5FACbIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671999664, "uuid": "6ba1b93f-6f2d-4311-9796-b0a2e86df190", "value": 238080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671999664, "uuid": "bcf9d599-44b1-4358-beee-805396097123", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671999664, "uuid": "da36c913-77bd-47ca-a695-499c64800c54", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "201bc7b7-8410-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671944031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671944031, "uuid": "0a04eafd-bfc4-479f-9144-c6f3a2147269", "comment": "Malware payload", "value": "aa1ca11a0c76647e7dea4003d02a15f5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671944031, "uuid": "5f502a58-3a2a-468c-9d87-27605aa9aa37", "comment": "Malware payload", "value": "df34264922d47f5e5c9e31fe763ca7f863b4476e5017781c186d0d173c1f5518", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671944031, "uuid": "d161c18b-ca1f-468a-8c56-576627a72fa4", "comment": "Malware payload", "value": "77ddb106435209aa297bb0978f18fb8a4805cdcb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671944031, "uuid": "90a51379-df9e-4906-8feb-c269a0e9ca00", "comment": "Malware payload", "value": "d7647d3b9ac85cf991c406d5134d991c7fcdef5ec9e15f15d2d3d0cfc0c999a8c9269682034de7fd509be739f00b52af", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671944031, "uuid": "31d997f7-f603-4747-9fd3-3a75ab731dba", "value": "T109B46B0423980B8FDAAE4378F0EA1404A7F0D87A728BE7DF9B8550F59E973069D5315B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671944031, "uuid": "81004fca-f28d-4587-97bf-9ecd6a67d96f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671944031, "uuid": "3c5995ec-6744-4f89-b778-1d6e7899aeab", "value": "6144:1PuCbwcem57Ucr1NdjSd0L1xqZH1s99nRaMiNDHDk5Cw9HPTDx5xyY315vW:1ZpUcBNdjSd0LWH1iaMi5Fwx7yY31I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671944031, "uuid": "e069203e-c1bd-4aba-af83-bf340c3fe894", "value": 510976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671944031, "uuid": "88ac0bbe-8db6-4289-b7a3-146e0ab5415a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671944031, "uuid": "913b7736-cb21-4102-8ceb-f874c5453f06", "value": "Twiix.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a36171b4-846f-11ed-9db1-42010a9c0080", "comment": "Malware payload (Loki)", "timestamp": 1671985053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671985053, "uuid": "18b47ec9-f3d3-48df-9a03-e0bf3cb4e4c0", "comment": "Malware payload (Loki)", "value": "02efabc9954928844676eeb598c44ee8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671985053, "uuid": "9a1f46e1-c2d4-413e-b60d-4f12616ab742", "comment": "Malware payload (Loki)", "value": "e09911ae184264e67137f1d9a9a0e38f7f9b736aadf20d6ffb3f28edde9a194e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671985053, "uuid": "d54a2182-2ade-4b5b-be05-57ba56678fd6", "comment": "Malware payload (Loki)", "value": "9c1b25bc746486f1a076082562e74371deb4ec66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671985053, "uuid": "9c11f5bd-4c3b-45af-acbf-e6165c7892c9", "comment": "Malware payload (Loki)", "value": "8b11bd5523beef48b3942d15672d80a468c0e579a319f0b69bdc630f7c6144f6545b6223ce3947fba967bdf400540ee8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671985053, "uuid": "eeae5d1d-d0c2-49cf-9aae-86f2da5ad26e", "value": "T12E743AE0B2A5C8DFE86551B09C8EF92031936D6D94615A1F31967F2EA8B3353106FB0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671985053, "uuid": "b02c84e5-f73a-49eb-85aa-0df3f472b005", "value": "97318da386948415d08cef4a9006d669", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671985053, "uuid": "05d88c65-c314-4bdb-ac96-22303e7edc49", "value": "6144:okwCnl6tA5ObRvwRwof8XaoJduSxAIiHUOadrtd:P5ObvokXlfATk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671985053, "uuid": "1c1c8605-dc8c-4fca-b65b-7c8e5c1ab72c", "value": 363832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671985053, "uuid": "6ba55783-acc6-47fe-80ce-c300ecd612ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671985053, "uuid": "488fff7f-a32a-471e-b2dc-f078e91444c7", "value": "Advance_SOA_Bank Slip_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71ba6d28-83eb-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671928276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671928276, "uuid": "4d7f99bf-ce91-4c80-8523-46499dc93076", "comment": "Malware payload (Smoke Loader)", "value": "d3d4ed1deb9b774dfe819a20774b89a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671928276, "uuid": "1cf41c1d-aca5-43a7-8ef7-cb8908f8aa9a", "comment": "Malware payload (Smoke Loader)", "value": "e24aa90b4621386caa4df7032ce160febbe502a1abb7970e32313e6a0598eb9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671928276, "uuid": "20b92079-b557-4067-98d7-cc28f0f4d503", "comment": "Malware payload (Smoke Loader)", "value": "120ac5f489c45dd3a69851c54c5f4ff9d5c3648e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671928276, "uuid": "d539aab1-2152-4181-9ade-b8e494b815ad", "comment": "Malware payload (Smoke Loader)", "value": "0368efda308d0f1dec84e18513c76491e8cf20ec9d064cc45e0899fd54ef3000a0f9342e65b5c2d304bc0126d5d455f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671928276, "uuid": "6cf36e25-0b8a-4dad-9b43-3d1a9d03cb44", "value": "T13524CF0CBB93CC72D62145308825DFE0667AFC715FA159AF37007B5F2EB0E9095AA3A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671928276, "uuid": "e4bd93b8-04ff-4e5a-b873-3820a8583fa0", "value": "ff6eadc44bfbddffce47ad40ccb423dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671928276, "uuid": "a1ce7bf4-103b-4740-b2b0-47de9250dca2", "value": "3072:kYjEmLnrB5DBiytFN9VXPjbQfqqkRWLh8+lBjrXauDi05C1rFAf/ln:VLnrfltH9VXofqqkRWN8+lhLaMLyE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671928276, "uuid": "cd1c3940-2b43-44c4-8c41-caa2956bc16c", "value": 229376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671928276, "uuid": "44f71f61-9444-4413-8fac-aafb103929bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671928276, "uuid": "46785296-9f15-4ed0-bf9d-e1e1d31e14d5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "892d6389-83f4-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671932181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671932181, "uuid": "3a596827-c12b-4e4b-a961-4223816560bb", "comment": "Malware payload (RedLineStealer)", "value": "7651e9f466cd5fe046894d3ea4757a91", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671932181, "uuid": "d34be242-caac-4287-a9c7-c0e272b225db", "comment": "Malware payload (RedLineStealer)", "value": "e448a7badd2b06dbd62d095c5c299ed5c9eda3bccb7f49cd5bb197b08199317c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671932181, "uuid": "60d666fa-1a78-4a3b-9465-0b4548a0c0eb", "comment": "Malware payload (RedLineStealer)", "value": "c2a40d31179c41f84a035886958082c5a2f1bf27", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671932181, "uuid": "c5f58f47-dae0-48de-83fb-5f69135c2414", "comment": "Malware payload (RedLineStealer)", "value": "837688a159d43c04a509472d04cb6262c787e387b571a53f8952cf8f04f2c854b7bf1a09f9dae02714c86579e580336f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671932181, "uuid": "4340871a-f3cb-4689-a3d3-0d9653869257", "value": "T1EC74F10C7AA3D066DD5106309A05DFE8AB7AFC714F215A2F37407B6F2F70E9055263AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671932181, "uuid": "b69a23d3-ac33-4698-916b-0c866c160cd1", "value": "1ea9f0326cf512ac0eb7dd4bc1a00a19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671932181, "uuid": "b6633876-d631-4c24-a6c0-73501f44a29c", "value": "6144:ngLnSJXXK9YxyQS9xWg8EbBuGIaMOiqt:ngrgXa9YwQjgdBhJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671932181, "uuid": "f3565ae7-9b60-4efe-bb55-47b1087d43a0", "value": 350720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671932181, "uuid": "2636bd92-d859-47d5-8dd1-9078771299d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671932181, "uuid": "b801be7b-200d-4de9-b966-b440f571bd79", "value": "7651e9f466cd5fe046894d3ea4757a91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1b991ae-844f-11ed-9db1-42010a9c0080", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1671971414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671971414, "uuid": "b9427836-b42c-4635-860d-dc041fb47978", "comment": "Malware payload (ArkeiStealer)", "value": "4836c552b2d52e6fee16b226ad0394de", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671971414, "uuid": "54034be2-fbda-44ee-98aa-1845d06100b1", "comment": "Malware payload (ArkeiStealer)", "value": "e4c917ad4250ca0a1d74cea718419b88333a2c14b53acc2dd30251479baaf0a6", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671971414, "uuid": "3677c5e7-d33f-43dc-a8d3-51b23a52b1e3", "comment": "Malware payload (ArkeiStealer)", "value": "e4d7f6955c744ca43e1e9ed72a0c3ddadc2a984c", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671971414, "uuid": "4095412f-a55b-432d-b410-f4d485b89e51", "comment": "Malware payload (ArkeiStealer)", "value": "f9fe3ec1dd09887b738ad0fb20f6f021bd35e9fc56824070cb96e47aec6a93e88effd0aa2b60844ab695ec390feba4a8", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671971414, "uuid": "ce9964be-ff32-480c-bfea-ce770d8b87ba", "value": "T11434BE2166A0DC71D7C20830586BD7E92B3BBC919A6359F3B7043A5F3E702B19DA6347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671971414, "uuid": "cd0c4d92-1a71-4b8b-b61b-67f4d10377bd", "value": "7b9daca6da068f54ad4e1900288e8efd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671971414, "uuid": "68116b26-a2c9-445f-8f48-ed5106da5908", "value": "3072:eASLm27RdI5F5FxCmC9g9+ktJ/fWqLw7RkxmJZs:KLzRdgLs9gEeJ/fWkGymI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671971414, "uuid": "80ea3685-d100-4138-8269-571492b514b8", "value": 237056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671971414, "uuid": "6250b1a5-eb95-4314-b26b-4b34ead7542a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671971414, "uuid": "6abb0daa-70b1-4b9a-b32c-3e98db8619b7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1889ab1c-849c-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1672004147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1672004147, "uuid": "f1fe517b-d0e7-45df-9872-6c4210e2e5ae", "comment": "Malware payload", "value": "b5d7e2803f400d070d1bf4e7c2a38732", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1672004147, "uuid": "3289c217-e5e8-4b53-899c-52112288d2b3", "comment": "Malware payload", "value": "e7f61fe56723c46fbecf55b68523c84e87efffb346337e5dd455e741a3139457", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1672004147, "uuid": "e4f22662-01c9-4480-9a35-189879df2eb4", "comment": "Malware payload", "value": "e9a3fe12c5b5bb9e4f74a642826d676aad12e820", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1672004147, "uuid": "1017cbd6-1651-45ea-9485-ed937ee9d998", "comment": "Malware payload", "value": "ea2f2e49fa7a5e0237d9e9d465e31780ada52a08fce1c402f37bbd38bb3ae131692cb3fae7d6809ba1c365d0a20286ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1672004147, "uuid": "a630f0a5-38c0-45f8-93d5-ef62924fac5e", "value": "T1FB34CF01B252D462C56718366D19DBE05B2ABC61BE24DE3BF380BF5F2EF0190A5E5393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1672004147, "uuid": "6c784072-ac78-4dfa-a94e-36dda24fa632", "value": "997a79bbc9b29ccf624aa79059ded875", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1672004147, "uuid": "e5b7c7cf-68a1-4038-ab22-cdb7232eb077", "value": "3072:Sdpxj1Ljg75aaAAVI64JVqMzEPbfEHiJlS1g/tK8ge3VVXLrcSb54VIcVTuh:ehLcXqJVqMA7EC3tK8n3VVDbIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1672004147, "uuid": "f16610c0-beb3-4aeb-be72-97db032a3588", "value": 237056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1672004147, "uuid": "2ca1f7d7-1a40-444e-9bda-0fd1860402cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1672004147, "uuid": "be888182-d14d-4136-85e4-36854fb2dfcd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a606e9f-843e-11ed-9db1-42010a9c0080", "comment": "Malware payload (Stop)", "timestamp": 1671963912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671963912, "uuid": "0d746b7b-a5fc-49ae-81b5-270ce235b8ee", "comment": "Malware payload (Stop)", "value": "79763fbb5ac3ef82b51193d28c32b6a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671963912, "uuid": "9f8e4ab7-5a5d-4296-8f0d-7a9a7bb12f61", "comment": "Malware payload (Stop)", "value": "e8997f96b91ab5ea1fed555a7d62369a8307b0cfcbd0e32c5e9a7e430ab42240", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671963912, "uuid": "cd1db8d0-f24d-4e3f-bef7-e8425b5458c6", "comment": "Malware payload (Stop)", "value": "88dc47b65b432e06a0056a070f08ab191b3c8990", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671963912, "uuid": "6fec2a3e-5344-45a2-bf18-738c49a651fa", "comment": "Malware payload (Stop)", "value": "728ff618ab2c7a44bda34b90dc15ea09c6b8cfd0aedb1f3f7079f3277605bc0a563afa5535aa5e21b1b94cd15f58efce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671963912, "uuid": "f8da5711-e5a2-48ce-8781-e92fb5896385", "value": "T10CF412217A50CC35D6D62AB1982BD7F8273BECA48B1355F339083A1F3D745F09A26386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671963912, "uuid": "077afc0e-30e9-47d0-b7bf-f366d20356b6", "value": "7b9daca6da068f54ad4e1900288e8efd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671963912, "uuid": "ad29ce17-7451-40c5-9426-8ccd3a4321d4", "value": "12288:HGoKGtRu7wbo13n6MHLem8LgaLhrZCGM5q6DJjbwhOYgBHVKm:UGCVn6NmkgaLVYTq1OPB1v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671963912, "uuid": "67058ffe-d99b-4fb4-a1c0-aaa44fee0cf5", "value": 758272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671963912, "uuid": "84816a36-d165-46d3-9ab5-f22ba5007753", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671963912, "uuid": "470f279c-d14c-4df5-9c84-2a1844096a09", "value": "79763fbb5ac3ef82b51193d28c32b6a6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7be87120-847a-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671989711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671989711, "uuid": "db4609ce-e1d4-49bb-b779-8b0afa07bfb3", "comment": "Malware payload (Smoke Loader)", "value": "b5161ae6d0b0b9fcb80ec06ac60e0c44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671989711, "uuid": "6ba273cc-b6c5-43b3-9b31-39a909801839", "comment": "Malware payload (Smoke Loader)", "value": "e978f20e42216936eac0f247fc4d5e2fd1cb3a601e4aa198b51ffa269aa404de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671989711, "uuid": "349f3f31-77f0-4609-b9c9-880c344fa426", "comment": "Malware payload (Smoke Loader)", "value": "79fb815e6eb53bc038f97a32ba9d621f4851dcac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671989711, "uuid": "fe299c2f-68d7-44ea-824d-991890817e61", "comment": "Malware payload (Smoke Loader)", "value": "932e889339bcdca87d07e848d9f9d84b71876542307dbf144ac72ecc0ca4546e905e9da2bc7cebdaa6deaecfac89f21c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671989711, "uuid": "ffa41653-24e0-4b94-9550-83865f1300ed", "value": "T12A34AD117690CC72D7C24971892BD7E82B3BAC919A635AF237487B1F3E703B19926347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671989711, "uuid": "1b20e759-7abf-4a86-9500-f066acb68291", "value": "653b90de92b22ec8aa57fc19871541e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671989711, "uuid": "6b47d565-7355-43c1-8187-e32aa4bc647b", "value": "3072:mZaLs4M35WIvod8tasu0eXbSEChtJ/2w7RkxmJZs:TLJMbvoaYsufLGJ/2GymI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671989711, "uuid": "cfbb48d5-fcbe-4633-ae3c-79b3de776692", "value": 237568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671989711, "uuid": "187a1961-f896-488c-ae54-7546d5562c75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671989711, "uuid": "f4225cf1-fd05-4bdb-98cc-0a63206b733c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9666840c-845d-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671977300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671977300, "uuid": "bec655d9-077c-4e38-955e-3e33c1de501a", "comment": "Malware payload (Smoke Loader)", "value": "58d30432c0fdf70860dea2caa7fccdd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671977300, "uuid": "d6ad36a6-f996-4ce1-b604-a9754709485d", "comment": "Malware payload (Smoke Loader)", "value": "e99c244d18109241d4d06fd116eb651b1fb9eb06208eace3326cdf8d64098815", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671977300, "uuid": "81da8bb7-5a8d-4b8d-b601-8586c465f785", "comment": "Malware payload (Smoke Loader)", "value": "fc853b8f999e88774644bc1a927c44d4f984fba4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671977300, "uuid": "f72d9182-90d3-4b8b-b471-a283f56ff7f6", "comment": "Malware payload (Smoke Loader)", "value": "9274c1f530a843d9dede03861c8164abd2ceda356859d405e1aa0fd54fc881c2b16197c447a6237abc0c7eb6aff73988", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671977300, "uuid": "7d4cdad8-4199-42d3-b026-b1c88034946d", "value": "T1E334AD106691CCA1C3D24531492BD6E92B3FACB18E675AF337087A5F3E702B19E26357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671977300, "uuid": "1fd28211-7d7b-4670-a7b9-d667b73f0c2f", "value": "8514760d95d5a493235b8748f65885e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671977300, "uuid": "c9de44be-4716-4b41-987c-8b738811cea6", "value": "3072:OXAFZLTFo5aLGhQG+BEH6hGcBBTxmdZftJ/41whPhhw7RkxmJZs:OkZLJ9LUfah7+ZVJ/41irGymI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671977300, "uuid": "f6900a94-eb8a-4564-9e4a-381f4a5b5d0a", "value": 236544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671977300, "uuid": "52a6bfcc-ad24-4738-b370-15858ee8fa4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671977300, "uuid": "e5ba5d59-6612-4cbf-b430-e429537ebf42", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e5492ad-846d-11ed-9db1-42010a9c0080", "comment": "Malware payload (Amadey)", "timestamp": 1671984078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671984078, "uuid": "25c1e7f1-f07f-46bc-8c66-e7d440e35fb7", "comment": "Malware payload (Amadey)", "value": "0fc689590ea1401800c2bf2e9dba05b8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671984078, "uuid": "194f2ed9-f363-4af4-8c0e-e9d2e731c01c", "comment": "Malware payload (Amadey)", "value": "ea2b2bc4fa30c479c0ff9ca3bf2eb989dd486bd77b62bf0eb60c96a1cdb1056d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671984078, "uuid": "f3f9dd1a-1135-481e-8bb9-ee30c5ddf8c4", "comment": "Malware payload (Amadey)", "value": "f39bdeb0b532161f7a3c427a0c2dca1c57f234a1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671984078, "uuid": "03b0c59f-7f6b-48d1-977f-456de075edca", "comment": "Malware payload (Amadey)", "value": "9a3658ba38b33502cea008928df88987acba07f31ea4e717bcf5d04ad5254b80fc7bd77472c3ffadd5f3538c3c364b16", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671984078, "uuid": "8cdf7b9f-0c5e-42e2-89c2-34bea7ffeb0a", "value": "T18634BD106698CCF2D3D24971492FD7E86B3FBC914A6756F237486A2F3E702B09926347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671984078, "uuid": "50a5e57c-fa89-4159-923c-31e8777e1985", "value": "8514760d95d5a493235b8748f65885e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671984078, "uuid": "d161bb8d-8dc1-4b43-bc9a-5642f170454b", "value": "3072:gh5eLr1s5Fgx546XI3epIhMfQl0bRtJ/LzqPNxw7RkxmJZs:g2LZpjXIuiWJ/LzqlxGymI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671984078, "uuid": "3061776a-44b9-4c70-826a-42ad038587eb", "value": 237056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671984078, "uuid": "26466e1d-4459-4899-a62d-b7a816ec0104", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671984078, "uuid": "3ee754d7-3dc2-481a-ae4c-12906f62583c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "681645e1-849b-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1672003851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1672003851, "uuid": "94b9e168-e456-4f6d-ab74-5dba69475657", "comment": "Malware payload", "value": "c8c9b5a1191f94ad982039badaa0ca50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1672003851, "uuid": "1df4b895-f1c9-4eb0-b768-95e05e522386", "comment": "Malware payload", "value": "ea5b85fdc1b4634aad8106e82fa98b7eca74ea02865e2d23fef578f962845739", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1672003851, "uuid": "a61d7bdb-f025-4134-95f6-5cbbef8b97ea", "comment": "Malware payload", "value": "b6402f9450b32a5c1a1721195062e9e03c8ba504", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1672003851, "uuid": "58315422-85e4-4bba-a821-1c2a195c7e29", "comment": "Malware payload", "value": "bf127d452459cdd2a2e1280522a83fc6c0d750282c6fdbffdef27ab20a406eaa7d5e0093982546ae2eadd85afb338a41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1672003851, "uuid": "d86fab3d-67ff-4086-a048-0fbb78b6a0a0", "value": "T13634CE81BA92D4A1C45308705829CBE45B5ABC51FE68DE7BF344FB1F2EF0290A4E6357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1672003851, "uuid": "0562788f-481c-4203-888a-8fab1d963906", "value": "997a79bbc9b29ccf624aa79059ded875", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1672003851, "uuid": "9bbafbf4-9738-405c-9ba4-c0d0af361a75", "value": "3072:N82zVLwl5rVAwCDmCxoasC1t2NYx2w2tlS1g/tK8HW7LrcSb54VIcVTuh:PVLw5dFCSaT1ANYb2DtK8H2bIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1672003851, "uuid": "827c85bf-de1e-497d-87ce-2efaf0f861aa", "value": 237056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1672003851, "uuid": "ffcd53c4-e985-4499-a9e0-b7ed8309e634", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1672003851, "uuid": "f55aee92-e91a-4190-b569-84e27579e3d2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ff346fd-8411-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671944487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671944487, "uuid": "ce74665d-9482-4acb-8747-2cb71ac16e5b", "comment": "Malware payload (RedLineStealer)", "value": "c6c8211f6d8201310b934f270a93ab64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671944487, "uuid": "87f73d55-fb86-42b3-90c8-05fe5b4921e6", "comment": "Malware payload (RedLineStealer)", "value": "ea7ab3368ad30944e745950305595f89d1c8b34fd36577974be89ee7150dee67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671944487, "uuid": "b74f3982-8ba6-4aaa-9703-4aa2f154eaad", "comment": "Malware payload (RedLineStealer)", "value": "070c740d75269c32e1819a21615721ff8ff0b832", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671944487, "uuid": "f426e5e9-3eb2-4d69-b4d0-2f5fe9597bd6", "comment": "Malware payload (RedLineStealer)", "value": "5306f434d2b674dcfdcdd931fcadf2b65007e555e1a58380b4432d616403b7952f5040cc752a1b95b8b983cd78fad260", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671944487, "uuid": "92c684d1-dcad-401a-9496-9b4e89de93cc", "value": "T1E924CF0DBA92C062D25109308929DFE06B6EFC714F215A3F37147B5F3E70E91967A3A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671944487, "uuid": "4dada8ad-f603-4eee-bd17-d8951a37c5ec", "value": "1ea9f0326cf512ac0eb7dd4bc1a00a19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671944487, "uuid": "7d5e7c57-079f-479a-9872-5e34b067e8f0", "value": "3072:KDaPlZL5O5kpFM/tYIQ8TK+DfjxP8BU9WsL0auDzoIKfLf/ln:73L5npqmQK+B8Gj0aMzoIKfx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671944487, "uuid": "d2e8270a-d4c1-4be7-9373-c1d676d8fcbc", "value": 228352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671944487, "uuid": "f1b0ebf8-9ff1-4bd6-aa3d-64ee1dd0abfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671944487, "uuid": "c95bdf49-ea44-47ed-aec8-bccbc10def71", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9433c605-845a-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671976008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671976008, "uuid": "644c05ee-0e9b-42af-adbb-5cd5eb3bc058", "comment": "Malware payload (GCleaner)", "value": "b59b28ff51451b466d70f9ac6e7cb586", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671976008, "uuid": "5c8697ee-fb6c-42a9-9e9c-4dad778b4f60", "comment": "Malware payload (GCleaner)", "value": "eb461b2c0b780141c9c1419e24e5d69627f653eb8bbf4e35f581244e6a280cf5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671976008, "uuid": "e6e64913-1eb1-404e-ae38-c09ee661c995", "comment": "Malware payload (GCleaner)", "value": "afc7e90ed2622e85245a301e65415e2d70ef85d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671976008, "uuid": "36df9d1d-105f-45f0-89a7-14abde3caf52", "comment": "Malware payload (GCleaner)", "value": "6ed1400051751e0158f800127b9306db027c0c05a8b0b453fe2e41d6444475443aaf9d48adf702ae0f58fc4269e21dd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671976008, "uuid": "a76c4e87-efa4-4960-8b27-166f077890eb", "value": "T1768533C1B6994976C1BFCA755EE1F483B171B7251B0A942C28D4AFCB5879F2D8303B82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671976008, "uuid": "b13ed3ef-f279-472e-802a-065dc0d58604", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671976008, "uuid": "987ecf20-0cf8-4fde-b0db-c5bd2ac4846f", "value": "49152:Wi0IReKwV7R6TuP0Lf2W+C/nQwE53k8iZaw:WiNsKwV7R0uP0LfnFQNU7Mw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671976008, "uuid": "35db4ccf-7652-48d8-8925-2ebaeae4270f", "value": 1805780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671976008, "uuid": "a5a8aa29-3f7f-450f-92d2-a01cb7f7bd51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671976008, "uuid": "6530645a-81d1-42d6-a104-251a997b79ce", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff1927b9-8417-11ed-9db1-42010a9c0080", "comment": "Malware payload (Stop)", "timestamp": 1671947411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671947411, "uuid": "b3b9260e-9a37-477a-8ae7-3a533b58ea53", "comment": "Malware payload (Stop)", "value": "44080d162de67a9110817d62eacc222b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671947411, "uuid": "582b1fee-625d-4e6c-acfe-4d4685a427f0", "comment": "Malware payload (Stop)", "value": "f020cc9bd657ae41ecd186271fbafb25971b19ab3dad2494c2324daebcc9164c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671947411, "uuid": "ac0ad711-9e44-4e2c-9af7-d8fd943345d5", "comment": "Malware payload (Stop)", "value": "a5c04985805c04c3930bceeadc0ddb55a430ddf6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671947411, "uuid": "12ce5760-69cd-4235-9fea-b53b4ce6461e", "comment": "Malware payload (Stop)", "value": "7447968a474fc4e4e90b4210b682ca898081586a1a9cfd9d1da359610653f57889ecebfc92a7108fed60086e6364f55f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671947411, "uuid": "1621ab1a-46e6-495e-8f38-e2772094aebd", "value": "T1ECF4124CAA92D174C9860830ED11DFB46B9AEC358B61867F3724772F2FF0E816936275", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671947411, "uuid": "4bb9757c-d7ed-4f7f-a333-9185655c43ed", "value": "e7d9baf3434ed6cb890483f44834aca2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671947411, "uuid": "66b61fa6-0ab7-4d44-b947-5735a64b5aff", "value": "12288:npAbQ4B4NlH2/V9KYIUECBbMIJ9F35X7+Ey/M+l46eRUdTvyARwduh0E6QW8nm+y:pfA4/2/ViPqxJDJr+EyM+lleIKARwdu2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671947411, "uuid": "9ce0afc6-2420-4caa-9d1a-4ad3c6771f35", "value": 760320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671947411, "uuid": "f4563ec9-51ca-4ae0-9a20-c637855533a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671947411, "uuid": "f414a2ca-87ce-4085-ac22-0c29876bfe05", "value": "44080d162de67a9110817d62eacc222b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3675621-840c-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671942560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671942560, "uuid": "5ef7a5db-eea7-46da-89ed-f670ad0efbb8", "comment": "Malware payload (RedLineStealer)", "value": "367dcebfbdf20c836db396d937b746dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671942560, "uuid": "e4bddcd5-ebd1-42d8-8b68-2f90688e0d19", "comment": "Malware payload (RedLineStealer)", "value": "f03f253e87c36202f2d106679e503f25add063c8f9ddab8d4b0313cc19a65f01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671942560, "uuid": "391fd7a4-5601-4de4-9bf8-cb89c22efd47", "comment": "Malware payload (RedLineStealer)", "value": "f570c20f39d841c9031ad34bece52d6651f6ed7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671942560, "uuid": "e3810fa2-baa5-466b-ae5b-d6bb5eb7a07d", "comment": "Malware payload (RedLineStealer)", "value": "9241819e08f5f26afb42d32086405d8d4ad025777b5e5aa82effe64173b68c4b132ccad61faae084546ee9da993b0557", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671942560, "uuid": "6d0cdba8-8d09-4e1b-94ee-b651a18cf31e", "value": "T14D74F11CBB93C4A9D11106349839DBE0266EFD715F619A3B3250373F2E70EA15A6B3B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671942560, "uuid": "ee52a335-f28b-4fd9-b392-c2eff4fd5dc8", "value": "1ea9f0326cf512ac0eb7dd4bc1a00a19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671942560, "uuid": "8cc3599b-c2c2-4ab5-a0ec-2417d87cbbe7", "value": "6144:3/L/GJdUsfEcStYlKb3ZqYGPn/nBe8hfk9OxaM5j:3/jxsfhStYIGPn/BLhfkFK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671942560, "uuid": "330e1ace-4f6c-4e9b-bbba-7a518730c9b3", "value": 351232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671942560, "uuid": "112c7076-a7c8-4257-a800-94fe95948604", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671942560, "uuid": "f1320d5b-0fd4-451a-9d7a-d500a7c66608", "value": "SecuriteInfo.com.Win32.Evo-gen.21709.5446", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d010aafb-8461-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671979115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671979115, "uuid": "7d5c7c32-5d76-4451-ab98-484f9619969e", "comment": "Malware payload (Smoke Loader)", "value": "aa862e6a9191987f65dbfb70dc5780fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671979115, "uuid": "d7c641f4-2668-4ac8-8fb2-1a54cb73ce82", "comment": "Malware payload (Smoke Loader)", "value": "f5275586bbac7b782e66e907d5337d634621b1c6ba1894409da77e47dd5922b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671979115, "uuid": "e7061ea7-28a6-4b2d-ac90-4415ee908f33", "comment": "Malware payload (Smoke Loader)", "value": "0f303fdb41d57d8c3fd6cedc67c087ca103c7afe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671979115, "uuid": "835c3fa4-3469-41bf-baf2-eac4aad3f834", "comment": "Malware payload (Smoke Loader)", "value": "afa8a92c612cb1ef3567b69fccc21e464cadd9e2782a69a2baaf007e1356495245ab50e81360f89ee74c0791599d8a49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671979115, "uuid": "ef2a0906-8e93-47a1-ae02-191ae08e33a5", "value": "T1CC34AE107691CCB2C2D24575982BD7E86B7FAC919F635AF736047A1F3E702B0A926343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671979115, "uuid": "14c3fce6-a2d2-48bb-b5ae-1f003c0828d4", "value": "8514760d95d5a493235b8748f65885e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671979115, "uuid": "f7cb6776-f107-4c15-b435-753317e0a6cc", "value": "3072:DUwtQLYMW5+L8A0l8phmqPJZ8QBM2iStJ/Ubtw7RkxmJZs:DULnToqDXK2ZJ/kGymI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671979115, "uuid": "8298d23b-8263-4b2e-b36f-256856bee46c", "value": 237056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671979115, "uuid": "61f5af61-821b-4966-a66b-67f93b7a1446", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671979115, "uuid": "623f890e-448f-4390-956b-d233c87728cd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "557b23c1-8400-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671937248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671937248, "uuid": "e2278028-a0d3-4080-9efe-beaaf8f1aaa3", "comment": "Malware payload (RedLineStealer)", "value": "d95589c8fbd49a9f0dc47886e4b99cf6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671937248, "uuid": "504a5864-8b41-42a9-8850-d93e0bf12220", "comment": "Malware payload (RedLineStealer)", "value": "f59b8dd70f043e6af4f27668f0d0c254c28b770c0f1787aa649cf867e31006ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671937248, "uuid": "265bf985-f55e-4ae4-a335-ef899023fc89", "comment": "Malware payload (RedLineStealer)", "value": "25a60d20480a868c2acb271b452bd07b6c54d8a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671937248, "uuid": "b72c1b0e-334f-47a1-a9fc-db9273b162a8", "comment": "Malware payload (RedLineStealer)", "value": "723677a36bb4cf446ac9779e238aedf4f52f2fc8fc0e5ab7396f80c2e680e40206034ca94647b9ddfd4c33fe06548fc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671937248, "uuid": "f9a39cd3-34b0-4d25-9e93-70dfdfa0b7d3", "value": "T12D24CF1CBE92C461D55249308919DFE4676AFD71AF218E3F37443B1F2E30E90966A3A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671937248, "uuid": "2789739c-89be-41fa-bcdf-2e540cdf042f", "value": "1ea9f0326cf512ac0eb7dd4bc1a00a19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671937248, "uuid": "920ac82f-db85-4339-8485-37ef8b0e72cf", "value": "3072:NDKl5ULb05WYXDb/VH/flhf7S8fKl16YNc4JxauDeYiJ+f/ln:C+LbDYXDThfltSeg16YNcwxaMD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671937248, "uuid": "0614f099-7b86-44fc-9570-c773ba0bd962", "value": 227328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671937248, "uuid": "ff44812e-4453-4f79-9486-5288dfbd0253", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671937248, "uuid": "0a2e3904-415f-4993-b590-548c17a42323", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf19c77a-8449-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671968779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968779, "uuid": "a3da2873-430d-45f4-a091-931356cd97bb", "comment": "Malware payload", "value": "0a2794f14f77cfef2d8b83ddaf8083a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968779, "uuid": "968e3314-74fc-40a1-9b79-ca053bc82453", "comment": "Malware payload", "value": "f5b287b065a25782a51675342603b16f06098bdb31cd8cda9e926948a5074f99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968779, "uuid": "8622a159-a52f-478b-8f24-53fdb1134b46", "comment": "Malware payload", "value": "f67172036ae792b47faacecdfa2fde23e272f9ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968779, "uuid": "34dd7d2f-6170-4663-83e6-ac575920ca17", "comment": "Malware payload", "value": "332df56eb78eed96ee43b742a85bcfb787d5b1e2f7599a2a84aac2c6eb5af12fa657c3dfebcc5be1d095bc80d75933dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968779, "uuid": "9ca306c7-ba5b-492f-b68a-a1cc81d1f8f8", "value": "T1CB560225239C91C9D17A9039C9864AABE7B57C429374CBCB05A0BDA93F336F55E3E310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968779, "uuid": "6a15dfa9-3ac8-4fb2-b6c5-1976225d4294", "value": "73f4f6b0816ebeb37e57311ea1622caa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968779, "uuid": "9ff9b919-35ce-4e85-bf73-567115e4fb28", "value": "98304:teO4I/xy3Ks6JD+oule6tLnMK/ZUGrMXDzG5c0HXN3SKh1:tV44xgrwo5tLMKRUGrMTC5H3SKD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671968779, "uuid": "3eb1567f-b5c1-4080-81bc-45005b948847", "value": 6392665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671968779, "uuid": "64c6611a-ef46-490d-8e5d-1dca4c63f29f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968779, "uuid": "18db035e-9047-4e34-9048-8fa40ce29ac2", "value": "0a2794f14f77cfef2d8b83ddaf8083a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "385dbdaf-83f8-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671933763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671933763, "uuid": "2bfd8bd1-a6dd-4887-acb7-3bea1e096a29", "comment": "Malware payload (Smoke Loader)", "value": "1b57ca9b17516f359f374a2476bfa39e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671933763, "uuid": "e3805bca-2c9a-4044-a8a1-de1f666447c6", "comment": "Malware payload (Smoke Loader)", "value": "f873b3eeb2f6601a084fbfe0961fd38560f2bb36a1f59db871acfa2948dd7903", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671933763, "uuid": "e1ec8fd0-795e-44ce-9618-a3ddd0a8e4f7", "comment": "Malware payload (Smoke Loader)", "value": "6208127967b7d3fbf45ec8717d73968d77f99bd6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671933763, "uuid": "00891adf-1eb4-46c0-a995-d7a9315fb7c9", "comment": "Malware payload (Smoke Loader)", "value": "c4bbd482de75c0b427531f1c66874a5a086490bca535963a916a27f10e82e43019d452afdb19851fc312a498bf788ec1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671933763, "uuid": "ec7071da-4eee-45a8-8afb-996d99f2cefd", "value": "T17F24CE0CBA92D062D66245308819DFE46B7AFC709F615A7F37103B5F2F70EC0996A3A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671933763, "uuid": "4531541e-debc-4d2d-97ad-cfd6b32a6399", "value": "1ea9f0326cf512ac0eb7dd4bc1a00a19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671933763, "uuid": "b044eabc-b6cd-47cf-aaea-60b2a67aad17", "value": "3072:vDY/L9BL5RSgnIHTB6QDFgccPN4t5auDygf/ln:GL9B/Sr0QDnA4t5aMy6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671933763, "uuid": "f23e7714-2d1a-49c9-87e1-19fc77e28dbb", "value": 227328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671933763, "uuid": "fcf888f5-7c0e-4561-be1e-2c757ecb05e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671933763, "uuid": "5fd69b12-6c37-4954-b516-5d5e5c8ac9ab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dcd8d66-8443-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671966038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671966038, "uuid": "03b9abc3-c750-4b28-a10c-927c5278e76c", "comment": "Malware payload (GCleaner)", "value": "2e83143f02a35feff56c2372168a90c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671966038, "uuid": "5a6026e8-6fa9-401d-8241-a96e6a9f8095", "comment": "Malware payload (GCleaner)", "value": "f8cf870cb0d86a73b489f25b558a6990218a39e307fa7295ba57001ebcc05fd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671966038, "uuid": "2284ba7e-924a-422f-9a84-cbc9f3e599b5", "comment": "Malware payload (GCleaner)", "value": "81ec566f6325d471ffd206f7176a37f2e6fd27ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671966038, "uuid": "1ad22777-f8de-4dd2-88c1-1684996ac195", "comment": "Malware payload (GCleaner)", "value": "bb9844b2fd22aa661b1d73d057a9a017002131ecd39e83bd0c6bcf8f4c23d8fa08a28558e88516ff5889691daf2ced67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671966038, "uuid": "c74cd170-0374-4907-a715-9ac06232a45e", "value": "T10A8523D9FA99483BD07ED1F8DE52A42A722577703B7E585A26C4EA4FAF3150D0383306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671966038, "uuid": "a1f73e51-21d3-4a03-b303-02c8a2baf010", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671966038, "uuid": "82cd4d4f-34d7-42aa-bd3a-cdb750b87778", "value": "49152:GiOR0excX/Cj8qB9VN6d2xTfHyOw5fYMXCZaE:GiOR0McK8uN6dI/yO8YMSME", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671966038, "uuid": "6d74212e-6e16-4665-8741-224ddf0d68c9", "value": 1809868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671966038, "uuid": "d49ebb78-dd51-4e92-bbbd-b6216612bd47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671966038, "uuid": "87f7d7ff-2f3e-4c4f-a421-545e08fc5672", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ead8c8b4-8475-11ed-9db1-42010a9c0080", "comment": "Malware payload (Amadey)", "timestamp": 1671987750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671987750, "uuid": "c5095198-1521-4103-a5c8-d6bf1807a3a6", "comment": "Malware payload (Amadey)", "value": "1a15aa18ae8129dfcfe983f75b2b1b17", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671987750, "uuid": "93604dd1-b623-4b9c-95c7-73a3577ecbcc", "comment": "Malware payload (Amadey)", "value": "f9216c88f4cab9bbacbb375e4e4b5248fa7a5d1bf0c4ad1452239ef560f0ba96", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671987750, "uuid": "4d86a085-d15f-4770-aa22-12b939f44d01", "comment": "Malware payload (Amadey)", "value": "7debeced715b48e2de1d9905b56b84bc2148b5c4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671987750, "uuid": "daf260b7-94e9-49a8-8592-16e44bc89e8d", "comment": "Malware payload (Amadey)", "value": "2c2eceeb8b7eb3f7e5e65c7143825d12a57a79b06235743f9d670b41ec173eab2364c9e8f66adf7df6c8d6a8945bd954", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671987750, "uuid": "bea4c06f-9648-45ba-a233-b654c3ef37f6", "value": "T1A654CF206694CC61C7D249718D2BD7EC2B3BAD918A6359F372087A2F3E716F09D62347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671987750, "uuid": "7337ce4f-aefe-4c19-a503-759f9bd7df89", "value": "8514760d95d5a493235b8748f65885e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671987750, "uuid": "edc53ed8-400e-48db-b3a8-9c871362fa91", "value": "6144:vFYLuqDOBOJKXgWQ1Zno/HkDIuqm8zJ/iqm1GymI:u6q6O1jZcxZHzV8m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671987750, "uuid": "af41085d-19a8-48d7-9d83-b40b9e00953a", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671987750, "uuid": "fbc1ad3a-ebb3-40c7-9fe7-7208a98d0aa8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671987750, "uuid": "90a845ec-ffce-45f3-aff0-0d152bbf8f82", "value": "1a15aa18ae8129dfcfe983f75b2b1b17.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53b1a3a1-8493-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1672000381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1672000381, "uuid": "8b5b9bd0-b322-4351-bd4e-ea012a5e7e38", "comment": "Malware payload", "value": "6334e295cfd3b6dedd28eaf81dd4dcf7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1672000381, "uuid": "3ca578b4-5e8e-409c-8b27-41990aa2f1c8", "comment": "Malware payload", "value": "fa0ff97d3fbf48b5fbb63fea88593c288723c7b82bc17a020abb6e6a10f14c28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1672000381, "uuid": "5e562942-9bb7-417f-8d86-022928fc3f54", "comment": "Malware payload", "value": "585aad59d7e865cfbd8363cd2627be1ded8f6582", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1672000381, "uuid": "89b81db3-21be-438e-a7a9-9602776ca9b8", "comment": "Malware payload", "value": "3e09f88d3bcff13756667e488d6a8ee98bb63761e7a502607576319f5e3abff0d45e30bd98c57f11bbab78bd3acb6b67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1672000381, "uuid": "4e5dabb4-51b9-414a-b6d1-6108e477364a", "value": "T1F29523D6BEE4CA73C02F81F4AE82AC09B37677911B1E4A4D5DE0E61F5E5151C839B306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1672000381, "uuid": "7fb927bc-f124-40e8-97a6-2d5bf887f847", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1672000381, "uuid": "fdeeccc6-7364-4d3b-a93c-950af84c89a5", "value": "49152:uijsjUBbpSlQQISw6z4EkgYE4hVuoelt7iYQZaP:uijgUqlISw6z4EkiYVuooJiYQMP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1672000381, "uuid": "ac7b5b8c-7339-45c8-8f7b-75fd40d7defe", "value": 1946132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1672000381, "uuid": "57d9b887-0dc9-441a-a97b-a77187f767f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1672000381, "uuid": "a5d33360-2cd7-49ff-882a-bff078815dba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7703d1d6-8486-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671994857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671994857, "uuid": "bd5937bd-cc32-469f-a1a6-966145098abb", "comment": "Malware payload (Smoke Loader)", "value": "5dc8820723e243e02b5cd81dba7dd841", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671994857, "uuid": "94198ddd-97b0-4533-8f79-f99ee1fe9e42", "comment": "Malware payload (Smoke Loader)", "value": "fa2ee4d575e27dceb41ac10664c0f2ed94713fa1f78620963527047ed29e98ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671994857, "uuid": "f8cfd1a8-0996-4d65-a96a-d53f8f70ca89", "comment": "Malware payload (Smoke Loader)", "value": "9f42928c91d59b4a92e705b47f88166fc518c644", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671994857, "uuid": "0593b325-dff8-46b5-b023-7f4433223d7c", "comment": "Malware payload (Smoke Loader)", "value": "c15940abf6c31a0b9f962efec84934b49bb72cfca30492834cbc2e7c7b46454d94535a20499f03ae06ff89d1b972906c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671994857, "uuid": "ed44a9f5-4673-41d0-a494-61542d3b4ba0", "value": "T1E634C001B392D0B2C51309714819DBE56B2ABCA1BE65DD3BF780BB6F2EF025095E5363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671994857, "uuid": "834cf4b0-5799-41a5-bc18-2dd874c82459", "value": "997a79bbc9b29ccf624aa79059ded875", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671994857, "uuid": "310181d0-ab38-4e53-81c3-61f6de6d73ed", "value": "3072:nI2zVLwl5kOL80Qherl1ydL7FTVlS1g/tK8aaLrcSb54VIcVTuh:ZVLwJIheR1Qd7tK85bIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671994857, "uuid": "2ba1d07a-aa14-4b6b-959a-9e543e8ea497", "value": 237056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671994857, "uuid": "1ecb72fd-8127-4415-b9d5-25fa4e818353", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671994857, "uuid": "5549da7f-3cb8-4211-a24b-3282a6329863", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b1925e1-843f-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671964289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671964289, "uuid": "da571dde-47a9-41ad-aa98-0b214b870161", "comment": "Malware payload", "value": "76a7ebc14b56ff57b127630fa4d10df4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671964289, "uuid": "e8e7aab6-9919-42cc-b219-eea5359d4590", "comment": "Malware payload", "value": "fac5d98032b75f647d81a2e6ba452be1ffe03ea4293641db6d1bc68d7c23a3ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671964289, "uuid": "1abf260a-ac13-4f2e-8ba7-8de392bff474", "comment": "Malware payload", "value": "b8641767f98da027ded8472ee43a7fa01e4855fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671964289, "uuid": "40a51815-8a6c-49fb-a2f5-7b6265b962bb", "comment": "Malware payload", "value": "6fa18918c20c5a69235d43e1177f984ff99206f47929a804a3f1bff1fc31a246c10540a7ea02c64b69a04a5dd8bf8ea3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671964289, "uuid": "38bf4d19-e578-46e5-aa75-c3b3930a1d7a", "value": "T142C100015AEF50DEF22707705BE6B37716A6F4B1452E62B834444A995F30BC0CC61EB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671964289, "uuid": "677f0c6c-9e23-4f9a-ab2b-7424815caf1a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671964289, "uuid": "5bc2607d-fc6e-4cc0-970a-272a5b53667f", "value": "96:y879lZCFmOKd4Xthbvk+I0AY0sxvk+Iz8Bv8d3ojGrl:yK9loFZKdmfvkTYJvkZW8d7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671964289, "uuid": "ceeb54a3-7e4f-4e33-a91e-eb6954305c7d", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671964289, "uuid": "fc0d4e4b-5401-4b29-b665-bcddea28c69f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671964289, "uuid": "cee4e40a-0f01-4349-b649-2c88c8774394", "value": "SecuriteInfo.com.Variant.Marsilia.2083.9036.16697", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7898b623-8444-11ed-9db1-42010a9c0080", "comment": "Malware payload (Hive)", "timestamp": 1671966513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671966513, "uuid": "eacada82-5c8d-4096-8258-f847e8f990e0", "comment": "Malware payload (Hive)", "value": "e34ed195fdc98d923cba0e8fdf6129ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "hive v6", "colour": "#7A283B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671966513, "uuid": "d9b34c4e-2b2e-4d5b-8323-72d275883d8f", "comment": "Malware payload (Hive)", "value": "fafd35b8686b47ce520fdf66aad21ac0d151532af96a670314e27a333be8dcec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "hive v6", "colour": "#7A283B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671966513, "uuid": "08a86705-d0cb-4272-992b-350abed66a96", "comment": "Malware payload (Hive)", "value": "b6470a661dbf352c69f164389b8221cd48d00d0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "hive v6", "colour": "#7A283B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671966513, "uuid": "1341031d-c155-471e-9a65-959c2bfae2cb", "comment": "Malware payload (Hive)", "value": "f44395ce5022f5a6bcbfdcbc95717f7a1aa0caab28a6b693e6c896def161e55f4d98d379bb86a09c8bd38cfdcb9d3218", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "hive v6", "colour": "#7A283B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671966513, "uuid": "585953b5-156c-451b-a991-e39ca42db5ac", "value": "T117D45C0BE29260BCC06FC17947566632FA73BC8D4631BB6B17D0B6302E65B909F2E715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671966513, "uuid": "abccb522-30c9-4358-8ee6-2e2f078ac7c2", "value": "412bb50a8fc70ed0bd3eb7f322a988dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671966513, "uuid": "aab00ca2-512e-4d7b-aa44-7472930007bf", "value": "12288:rvt34zDh1WuachSc3kGs2jltA3YcIofKJ9hf:bFQDScrs2jlC3Yc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671966513, "uuid": "c92e4ee0-e9a8-4cb7-938a-f4d017901390", "value": 606720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671966513, "uuid": "69e94293-e8d8-4466-b145-100c907afb7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671966513, "uuid": "b1a1137a-d4a1-4f0d-83df-960dc6fbc601", "value": "fafd35b8686b47ce520fdf66aad21ac0d151532af96a670314e27a333be8dcec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce5cc6bc-849a-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1672003594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1672003594, "uuid": "aa541fbd-87e4-4d16-8c5e-b9a68b59cac3", "comment": "Malware payload", "value": "e886b4b85ee94c56e3550d56f21043ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1672003594, "uuid": "99d3cb61-6b49-4488-b6db-ddc466928ba5", "comment": "Malware payload", "value": "fc342eb398366cb13a047274c0198913388080b438bc83d7ee045ea3c1ce3a3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1672003594, "uuid": "f91f39a2-6606-483e-89fc-1b409d44e84c", "comment": "Malware payload", "value": "3f4d2750376c26d1910cf76fd0a095ff256e7d4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1672003594, "uuid": "37a28feb-b3e6-43d1-92b6-2b6f0846f07d", "comment": "Malware payload", "value": "af76066786bb9aa21dbc8e1c42eccdf598028e3749c25e2633893c51812b9f7070368d7eafd17e72edd82524cd9698b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1672003594, "uuid": "626e22b0-7804-4045-998d-c7c7ca225aab", "value": "T15034CF01A662D0B3D15318714D19CBE06B29BC61AE68DD3BF780BB5F2EF01B0A5E5367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1672003594, "uuid": "8b31d6d5-d366-4e5c-ae36-58b2b619a402", "value": "997a79bbc9b29ccf624aa79059ded875", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1672003594, "uuid": "3cb63ce9-b9d2-4b61-89a8-44f8d679445d", "value": "3072:ZSrtBL1WD5bPjm1AFnIJfEIxN44Yz16CGMqclS1g/tK8LpjyyLrcSb54VIcVTuh:yBLspPjmOFn82rz16JAtK8okbIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1672003594, "uuid": "d5c905bc-82bb-4869-8110-f739cde7d3ef", "value": 237568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1672003594, "uuid": "a96ce007-6990-4a0c-b734-44f111ca4ca5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1672003594, "uuid": "af8c53e7-6833-4514-a17c-da1fbb528568", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e524955d-84ae-11ed-9db1-42010a9c0080", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1672012222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1672012222, "uuid": "760b8ad4-83c3-416f-844d-899cb3666046", "comment": "Malware payload (ArkeiStealer)", "value": "ac4bad16e06be9521123e24602a59768", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1672012222, "uuid": "27fd9516-ff7a-45ec-a1dd-fdc6a312c2b0", "comment": "Malware payload (ArkeiStealer)", "value": "fc9798033acae0b57c451c67d6466da13cddd4206639d4231c80a6e274099619", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1672012222, "uuid": "47607191-bb8e-4a4c-a693-ca77dba33c15", "comment": "Malware payload (ArkeiStealer)", "value": "d198d9d1a9eed6b9bf007911f3b3f447630b59ca", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1672012222, "uuid": "76569a7d-b369-483a-8e49-92dc990aff1a", "comment": "Malware payload (ArkeiStealer)", "value": "6761469093af0a5c296c79a47b441442a1554e6a20c8b45d27eb0a3ae2e4410730ec8da53e596162e12a572b12302c6c", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1672012222, "uuid": "7b16c9cf-4e4f-44bb-814b-64d05c069e1d", "value": "T17874E010FAC4D06FC35309326D2ECAF56A2DBC9399244B8F3744FF0F6A7119156AA61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1672012222, "uuid": "fd055dbe-ebc4-46b2-84eb-0b1e53b8a58f", "value": "01fe77ead213bccf750c05851a809fd9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1672012222, "uuid": "d3ebe337-a50a-4924-a2c7-c28d1d4a75e4", "value": "6144:8MRLLo13UWVXPeCbKuRW1SvFkRZ6Lu7k6W85s392ZeRu4:8Gv0UQPeCGu8svFWeZwY8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1672012222, "uuid": "c4cdec37-2620-4e11-a363-fc130d4e4e2a", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1672012222, "uuid": "a3e60618-6a2a-44a8-b1bc-b0fb1b9b2d6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1672012222, "uuid": "1e45e93f-6401-41c1-a61a-589cbeb49901", "value": "ac4bad16e06be9521123e24602a59768.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2232bd55-8454-11ed-9db1-42010a9c0080", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1671973240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671973240, "uuid": "68d71246-d330-40c2-acbf-54c2b51eaec7", "comment": "Malware payload (ArkeiStealer)", "value": "15234a01df581869a1a70018803ea3a1", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671973240, "uuid": "15c93471-2207-4776-a9fb-262a4c1b6ad1", "comment": "Malware payload (ArkeiStealer)", "value": "fca7eec6767861830708182295202de8d1f46e3fc6bfca53013e6ef18cd144f5", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671973240, "uuid": "a37840d3-f427-43ab-8db9-3dfe7a12fb80", "comment": "Malware payload (ArkeiStealer)", "value": "aa451cbb46474bac043b50826e045f6b21e5d319", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671973240, "uuid": "750e2f6f-3247-4191-87b9-72b80dc40bad", "comment": "Malware payload (ArkeiStealer)", "value": "b8797c80e9f53f032c4aa579af2f0d5b189480e1bdb22e55e7722d15c7afc2cd6bb0811707c67503e90cfc80239a7e90", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671973240, "uuid": "e86cc5df-23af-4b82-8e16-27e681684740", "value": "T14434AD1026D4DCA5D7C25971982BC7E86B7FAC924A6749F327047E2F3E701B0AD26387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671973240, "uuid": "14705db4-17c6-498c-8310-bd314c28241a", "value": "8514760d95d5a493235b8748f65885e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671973240, "uuid": "c219b48a-b6d3-4b12-80c1-8cc9dafe1bff", "value": "3072:8eZyLH42BB5Bh06185HakmHTHq6DTatJ/eYjiWww7RkxmJZs:8LLHTBNh01CrkJ/eYiWwGymI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671973240, "uuid": "a42aceab-5471-461f-b726-ea4d4828fd83", "value": 236544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671973240, "uuid": "4a0458d0-9825-462f-be3a-cb44b0a0f87d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671973240, "uuid": "03a8d24b-00ba-4628-89f1-049fc2b3ac00", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f98efd7a-8400-11ed-9db1-42010a9c0080", "comment": "Malware payload (Gafgyt)", "timestamp": 1671937524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671937524, "uuid": "1f6d720c-460d-4d4e-b672-d48c8bb53b75", "comment": "Malware payload (Gafgyt)", "value": "2701c4b49342b725bdec6932bb8fd327", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671937524, "uuid": "523ad224-a025-4452-a49f-70e75ad87143", "comment": "Malware payload (Gafgyt)", "value": "fd29707a688082f4274d265624af4b1cc17a6730d1a2b244b2194b9847bdec17", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671937524, "uuid": "d48606a2-5241-4a6a-9b52-431523312b3e", "comment": "Malware payload (Gafgyt)", "value": "d70044d8c7f4a4ef7c48e6b734e7057d83274efa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671937524, "uuid": "341db223-c597-4c99-bd77-1ca1f54c6fb0", "comment": "Malware payload (Gafgyt)", "value": "40a2959c28419a65ea7c4821139ca2e861c01dfa385755171c5f3fa99efb264fa8bbc73b76e2f89ed10315efa0b8bbd9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671937524, "uuid": "ee38e484-2b6c-4e44-ab12-1a9c0a149460", "value": "T1E0C32905E8918767C2E2177AB79A425D33332B6893CB33255938AFF81BC1B9D1E79131", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671937524, "uuid": "ff2aaa07-dc08-4124-8810-4122daa9f0f0", "value": "3072:KdB2qwap6KVXPi4jv8x+nMDkmDhZmTQOIsXAqE:aRwap6Kt6+nMDHZmTQOICAqE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671937524, "uuid": "cbbd4aba-7d2f-402e-86aa-585f92dcc18f", "value": 127529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671937524, "uuid": "08e81c04-89dd-40e4-a4b9-ae97c39554f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671937524, "uuid": "1e79fe94-5cdd-4747-9d1e-514f219ba4f0", "value": "2701c4b49342b725bdec6932bb8fd327", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2024472-8449-11ed-9db1-42010a9c0080", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1671968730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968730, "uuid": "0437f680-bee0-42a7-8c9b-2be4346eb139", "comment": "Malware payload (RaccoonStealer)", "value": "4ee7ef1486aafd932ff7efc0272c8d4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968730, "uuid": "d2e0c3c4-5bc3-430f-8a9e-376ae1547016", "comment": "Malware payload (RaccoonStealer)", "value": "fd629242766b2745c070cab64c4d47f073d8d22ac937ef2269a46b5f4f1152f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968730, "uuid": "96080d93-8a26-4a7a-95ce-9a9fa5392ea4", "comment": "Malware payload (RaccoonStealer)", "value": "a116cd0773f298177b9178b0b22365438a5d884f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671968730, "uuid": "75fc9704-3e55-46c1-855a-3d5b0cc399ac", "comment": "Malware payload (RaccoonStealer)", "value": "38443c0a41ce5326e6549c54e3054301b0caa3eb25fb96e91a865fa95ae856a7713ad11c9568d388eb3389d67f7fafcb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968730, "uuid": "59d0ccf8-444e-4fdf-81ae-2985a33ea9df", "value": "T12F66336213942289C4DBCC368B3FFDE471B6123E8F82A87A59D965C235170F1E716E87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968730, "uuid": "c5b988a1-f2a8-4109-a303-d1c752ae394e", "value": "ce26abf4781cac630107d46b9c76d477", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968730, "uuid": "00db64d1-2aa6-4174-b8c2-cd9b332ed8ed", "value": "196608:O2d9gFhryx+z8Fo3SJw6jITVtzQrZrMu79qAYav:dgh3z8FYSJw6jIT3y1Mupqxav", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671968730, "uuid": "99e1b5e8-f466-4d13-bb3e-d153884f54fc", "value": 6752768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671968730, "uuid": "f4db1095-adea-43b4-aa72-735151fbd114", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671968730, "uuid": "349fc0df-b848-40b7-8bd7-158ef8bfcc9d", "value": "4ee7ef1486aafd932ff7efc0272c8d4d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05335869-847e-11ed-9db1-42010a9c0080", "comment": "Malware payload (Amadey)", "timestamp": 1671991230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671991230, "uuid": "d1cd0d1f-6cfb-4e9a-b089-70d871383eb1", "comment": "Malware payload (Amadey)", "value": "c0ff3312259ea0350beb0a6868f98ccc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671991230, "uuid": "27f3acee-1734-4847-bc6a-a14ce156a623", "comment": "Malware payload (Amadey)", "value": "ff09f62185400dcbcf74f808a082e4712008995ad5c39ae5c1107a8cd66f7a54", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671991230, "uuid": "d0b6b402-9537-4d27-b669-de10760a8c80", "comment": "Malware payload (Amadey)", "value": "8f055d4fb3498f500feb5237be444caefa6f859a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671991230, "uuid": "bf830ab0-8abd-40db-8c69-f6d7b47389a0", "comment": "Malware payload (Amadey)", "value": "09d43f5c490dc6748851a2776ea36799dd98d21e132cae1367d674b975167a82a7772a4dab968cf10ff1913128fa0f7b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671991230, "uuid": "39cac960-eba4-4026-8a1a-2d196b83966e", "value": "T1CE34BF01B2A2E0B1C56308315C29DBD56B2ABC61AE64DE3FFB44FA5F2EF015094E5397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671991230, "uuid": "2779403e-294d-482f-bdc4-3f36b42f668e", "value": "997a79bbc9b29ccf624aa79059ded875", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671991230, "uuid": "6d582da6-84bc-46b2-9a7a-9da9fcb0297a", "value": "3072:H3J26LiesnND58VL59HpXmHTDqfwlJFhjJQb7llS1g/tK81Nru0otLrcSb54VIcK:86LiesnNOHpW6fwlG/tK81wbIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671991230, "uuid": "dffae0dd-d26f-4d64-815f-446cce314d9b", "value": 237056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671991230, "uuid": "1c9e5c40-257f-4553-ab61-a74ceb62e7aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671991230, "uuid": "cb4adbff-dc71-410a-abf5-ee2214e4e075", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }