{ "Event": { "published": true, "date": "2021-12-29", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-12-29", "timestamp": 1640822581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "23008859-1429-42d5-9eb0-4188de6a5398", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61264c81-68a5-11ec-9275-42010a9c0029", "comment": "Malware payload (TrickBot)", "timestamp": 1640782005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640782005, "uuid": "59631884-f182-4b8a-a90c-3c4cc10ca584", "comment": "Malware payload (TrickBot)", "value": "1e19cdc980488fb82c9245fde3ba28f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "top166", "colour": "#4BDA1F", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640782005, "uuid": "583b19fb-78ff-44e1-88d1-4a74a48430a6", "comment": "Malware payload (TrickBot)", "value": "01c69d0acc8734993ba9cbfe9b0da4616bb05041e103afdb487759995b93ee5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "top166", "colour": "#4BDA1F", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640782005, "uuid": "72c0b56a-154a-499b-a103-29d44051a414", "comment": "Malware payload (TrickBot)", "value": "6010fb83b30adfeba34ac6f302c2c8e865cdc705", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "top166", "colour": "#4BDA1F", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640782005, "uuid": "0f236041-fa4d-4ff3-a46b-0b9d93a53c46", "comment": "Malware payload (TrickBot)", "value": "a3612c1deff78976343e226fbcde7e7f70a396380ab1f04d6e1da383f0789bff7ba9e569546bcb7d688876ef012f7624", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "top166", "colour": "#4BDA1F", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640782005, "uuid": "007d12f8-ee24-4eab-bc3d-67d4ed0eef7e", "value": "T15C94F120B3E5C071D18721718A62CBB24FBA7C722591BD8F6FD656794F38A90972831F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640782005, "uuid": "587cbab5-1251-4760-a32f-8c366b935fa0", "value": "297ed3de0a49d4831344ce5a84729097", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640782005, "uuid": "a42d63b7-9fc5-452e-ae0f-f6d734635b73", "value": "6144:YFn61kciCuRBb15sZwkst8K5YHJHJ4wX4wp16SiVyaE6Clb4p:YF61k9CuRhaNK5Ypp4wo8OVlE7R4p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640782005, "uuid": "078994b7-8781-45bb-8fca-1d33aaf602f8", "value": 422912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640782005, "uuid": "8cbde2fc-d4fe-4ae1-adf9-c6a8d34c20e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640782005, "uuid": "7346ea61-9320-4a07-82de-1a0fb6b281cb", "value": "1e19cdc980488fb82c9245fde3ba28f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ed271f2-68f3-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1640815528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640815528, "uuid": "fbe54405-439f-44bb-abe2-ad03268c7f38", "comment": "Malware payload (RaccoonStealer)", "value": "8cbf006774f09f7dfa5f37aeb7ede7a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640815528, "uuid": "c930e6d0-c2ba-4514-bdcb-7bcc4bfc38fe", "comment": "Malware payload (RaccoonStealer)", "value": "034e8e297165eeb14372eea7a7e68756e561df39b84c5be924e542a36dee7418", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640815528, "uuid": "31ed8202-d971-4274-8587-ed80e9e911fd", "comment": "Malware payload (RaccoonStealer)", "value": "7264da559e9d8ea5e2078a82303ac45ee0a86df8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640815528, "uuid": "2dcc57a5-16ec-45c3-ac8f-a6f14ba6429e", "comment": "Malware payload (RaccoonStealer)", "value": "c088731c3cefdb1ba3db62e6d69a8b45349c5b2e781ca93f0b49750a64cc9e8cba35408fb925d5c445d2308c8d85ef8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640815528, "uuid": "301a5e26-3952-4ab5-86fb-325ffb26e884", "value": "T116B5B002BBD89B6BD06E4776D037082503F2DC6662B3EB0F6A54FA6A1D737C18C11667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640815528, "uuid": "4e723698-99ce-4c78-bf65-2fddab6e67b1", "value": "b985816070bef8efebdfdcd91627363a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640815528, "uuid": "8341950a-9f65-4b41-8670-71f37b4a3a88", "value": "49152:oSzTTnFM6MNqBSzTTRSzTT1eFl3h/3SzTT:oSzTTnFkNqBSzTTRSzTT1G3h/SzTT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640815528, "uuid": "931db5fc-7bd4-4baa-835e-036148f8515e", "value": 2278400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640815528, "uuid": "d8af571f-3d64-4b6e-abe1-8f78ce3a344a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640815528, "uuid": "7460863c-580f-4d3b-a718-bf2c3b090ee1", "value": "034E8E297165EEB14372EEA7A7E68756E561DF39B84C5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3592939-687c-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1640764614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640764614, "uuid": "4932232d-beb1-4f51-8135-5dff15e92658", "comment": "Malware payload (AveMariaRAT)", "value": "80dd3d05581fe20a2841016d2823cf9d", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VALVE ACTUATION LTD", "colour": "#2CAE7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640764614, "uuid": "5c6584e7-e150-4f07-8119-612b3409cd3b", "comment": "Malware payload (AveMariaRAT)", "value": "051400edf4aae2a1041743c1b12740a9e03cf51b6f9491e7e08138640dcd0db6", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VALVE ACTUATION LTD", "colour": "#2CAE7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640764614, "uuid": "30d59094-a924-44b2-a98d-f4250123356d", "comment": "Malware payload (AveMariaRAT)", "value": "cb7c6839b7350b989f4ecc06834fbca99d0fdb00", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VALVE ACTUATION LTD", "colour": "#2CAE7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640764614, "uuid": "f0f8f2f1-710f-49ab-b6aa-993cd69c9988", "comment": "Malware payload (AveMariaRAT)", "value": "d75a3ad95d924727b49c67dc4e5be5741e91d49653538a6eb05443f0cc6626653a71cdd2774334a7503e3a57895d4ab1", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VALVE ACTUATION LTD", "colour": "#2CAE7E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640764614, "uuid": "e47d32fd-6bc7-42d8-9ecc-da4be7b8076e", "value": "T1BC05AF23B2D04837C1B72E789D5B97A4983ABE103E28584B6FE43D4C5F396A139352D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640764614, "uuid": "7362e18b-9c40-4c4b-85ff-215df8e3f2eb", "value": "e145b55a33c2b3451d71d2d800c997c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640764614, "uuid": "fb1fcbac-0ff4-4979-a397-5c3616b3a20e", "value": "24576:XhXCYZNjSPZ8wMRbZhKK0CH/+LKF9Dbc8a:XhP3jxVdH/P/DbW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640764614, "uuid": "ade488fb-2135-4926-a8ab-727d15593929", "value": 851784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640764614, "uuid": "5eee0598-7d6d-4a90-906f-e78bb07a42d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640764614, "uuid": "3401dabf-56d3-4746-8772-dc4534a0a42b", "value": "360selive.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85f3633f-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640740835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740835, "uuid": "8af709f4-e128-4877-aa5f-222ae30be81e", "comment": "Malware payload", "value": "7a0d88fdf9ad006f58aacba0397ce51d", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740835, "uuid": "fb483b64-7179-4db3-a7ac-4a4dc984c96b", "comment": "Malware payload", "value": "056c112c04df690a01bfb3d747184bc7aff493a1234a6f18f8ae465d7ef5bffb", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740835, "uuid": "d66003d2-deee-4ecc-946b-8de4145553d1", "comment": "Malware payload", "value": "b1d078cc7ad74200f60b99254ec2ac201e63b2fb", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740835, "uuid": "0f2f1c37-0600-4649-9426-857a924abbf8", "comment": "Malware payload", "value": "dba654847a78ea5b0503a930219505a70c10444dad74463014fdf92242f3b8bbbef1746a5fdee2b9674273c2ed2e6ea3", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740835, "uuid": "4de01b55-adde-4cf8-96ad-b8178c6dc8b1", "value": "T15D64AE58FE9404F4DABBD63549972D6A727335720BD2DE9E135CA3E21F27360AF06A00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740835, "uuid": "7a62d801-43c8-456a-9f88-d81e87a2b48f", "value": "6144:iGpARjhjJh9gd+ZBLKEgOBo9UnQ7cPWa:iGGhdWmLuO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640740835, "uuid": "6b8c2f68-27f1-4f48-8797-b91cb000b2bf", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640740835, "uuid": "c2325d1b-35ca-41bd-97b1-93a43a5c2eed", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740835, "uuid": "e740acf3-36d6-499b-a1a5-677b64d9a66b", "value": "attacments_1034.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91cef027-687e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640765336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640765336, "uuid": "adf09bc9-0217-445e-a808-d2032aa2ed22", "comment": "Malware payload", "value": "3ae4c6261afc64a9f47f1948787c095a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen Tongbu Networks Ltd.", "colour": "#0A3476", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640765336, "uuid": "9e8c4244-844d-4547-ac7e-b3471a7425b0", "comment": "Malware payload", "value": "06139d63dd6245a7ddc44c5d812a80da0b23b984c42fde376465238cb4430064", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen Tongbu Networks Ltd.", "colour": "#0A3476", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640765336, "uuid": "bf3a2b54-ceec-4e8e-89f7-f60c41fefbb9", "comment": "Malware payload", "value": "944a8636ba0864f3a145015443204f4818233948", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen Tongbu Networks Ltd.", "colour": "#0A3476", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640765336, "uuid": "715f73e4-b1b8-4dd2-aa2b-39d7d741bb7b", "comment": "Malware payload", "value": "93479f0312a922b8ef1724bc24f9e2a360e2489ca45da988520ed83c60006e7995dcc6fed5f7fb31b786722c7eb2e5ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen Tongbu Networks Ltd.", "colour": "#0A3476", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640765336, "uuid": "92964e37-7174-49f4-89f5-5293b72a41bd", "value": "T174C533D594304DAAEDB42978FA6CE7338CBCD12567988EDB2B564D420B533C13A7CB81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640765336, "uuid": "7294099a-72e5-4e70-a481-73ea5626185d", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640765336, "uuid": "57ab4376-3f53-4949-b6c5-bba38155f677", "value": "49152:HllTI4jBs6oYy3Pw8yI0cpTRn61r3VTHw5quirM6u4jPhXcH+rq6Ljm:HHCL/PyI06R61TVTQ5qLM6u4zWH+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640765336, "uuid": "9b210d77-cdad-4489-b10b-bf4dd8f09984", "value": 2725176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640765336, "uuid": "acf6eeed-195f-4f70-87ab-744684f8febd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640765336, "uuid": "c0f99e97-b8e2-485a-8536-937046ee0c95", "value": "06139d63dd6245a7ddc44c5d812a80da0b23b984c42fde376465238cb4430064", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c996bcb-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640740819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740819, "uuid": "2dafb7d9-3693-4a7c-982e-d8bc302e3fd5", "comment": "Malware payload", "value": "0299256159f0111364ab332302a211ba", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740819, "uuid": "7257b48e-891d-4662-b460-6903472a7f3c", "comment": "Malware payload", "value": "0701a1de604a20a5bed1b5875467a40d0411bdbf156db5d93814288b26511a48", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740819, "uuid": "e9967b68-cbd5-4740-b32e-3207910e311d", "comment": "Malware payload", "value": "e803c7d95f84690c60e35fb4de2b6e09574fee81", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740819, "uuid": "92fd7520-b411-4ff6-a4e9-2280b778e3b6", "comment": "Malware payload", "value": "cf3027759c8d81502a5c5007641fe536c514051042952533feaf3c9f9078eea51e785b79a7297b0fdde941f27423869e", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740819, "uuid": "520bc8ce-a549-408e-8f97-332e03dd4625", "value": "T123649E58BE9414F4DABBD63549972D6A727335720BD3DE9E035CA3E21F27360AF06A00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740819, "uuid": "09c4c388-922d-43ec-b01a-e58406667600", "value": "6144:KsH09SPoUE8jJh9gd+ZBLwEgOBo9UnQ7cPWa:Lw8dWmLwO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640740819, "uuid": "4af39849-1b63-4b79-b587-a376ea030d75", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640740819, "uuid": "6a624f76-f130-4606-894f-e27e9efbcf7f", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740819, "uuid": "540da74c-c6fe-4a94-bac2-185a5c72e26f", "value": "Attachments-2049.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9de0e1db-68bd-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1640792414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640792414, "uuid": "5a9c0230-40fb-49a1-b805-01c899835122", "comment": "Malware payload (AgentTesla)", "value": "3a31865558c905cb08b09356d353bf71", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640792414, "uuid": "3bc33ed4-49fb-49bd-a965-777420dfc193", "comment": "Malware payload (AgentTesla)", "value": "073e537df1a31ebe720a81a20f86f46f4eb24ee911e317a10a9849a3aeb46c0d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640792414, "uuid": "1640a02e-ad6c-4884-b732-e6cc4fce9222", "comment": "Malware payload (AgentTesla)", "value": "2c1ec3fd8734bb1395f97b8e93a3000061cc609a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640792414, "uuid": "a9fa2cdc-dfc9-4b40-90f4-cbd7599fd9b4", "comment": "Malware payload (AgentTesla)", "value": "79f264745fcd83266d80522ad909fc995c5c2ecf0629b29c16f324d9898f32f3cca9bb6a92342dee761780f23c9a5c0c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640792414, "uuid": "60f99561-5c46-4f7d-a814-61fa14f17d81", "value": "T1DE941205A7652735DA79ABF3221275320BF6B161BCBEF7484C8550E26237F540CA2FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640792414, "uuid": "153d88a9-1b52-4388-9c57-0a96d5b4b3e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640792414, "uuid": "ccc97da0-092d-4368-911b-0543239b59d5", "value": "6144:VOf2z6xK4O3ec7p0XFlQjrjnHWwlRKM+436Zj0yLacO4cECqQghcwo9iSUB3Ektv:Nzz4IBiFiflxJiGoK7UAc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640792414, "uuid": "26f77e0f-0dd6-4e2d-91b0-99b45d8acc75", "value": 423424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640792414, "uuid": "c7c663a6-2049-4524-9de4-882cccc6a1ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640792414, "uuid": "4c14c843-5b1c-4a3f-a6cc-15abd287753c", "value": "T\u00fcrkiye Is Bankasi \u00f6deme dekontu swift TL4589020211229.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c90ab31b-6862-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1640753403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640753403, "uuid": "c3e76f2e-daf8-423e-b154-0e49abe454eb", "comment": "Malware payload (Gafgyt)", "value": "373917eeed31f5455e5336fa2aa89752", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640753403, "uuid": "81853a22-1b99-4f02-b4e0-f4cd945de165", "comment": "Malware payload (Gafgyt)", "value": "0aac3c73d66175bfab91ca0c9c223b90f8dafc39d2dfd09447c99332cf514759", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640753403, "uuid": "0434c0d7-01e7-4986-96d1-e33401fdc296", "comment": "Malware payload (Gafgyt)", "value": "3c054239809a5ff8cb0fad2017feb1054b4656cd", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640753403, "uuid": "9cbf7a1d-b75e-4d75-8812-31d2c5507838", "comment": "Malware payload (Gafgyt)", "value": "f474b446d2fb5968db7647c28c5db19fd0865fdce900f28c7bd4f9ebf67960337074567e753b1db31b5d9e38fe7f24e6", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640753403, "uuid": "6b378b94-796a-4fac-bd0a-ee53cc5ef4ce", "value": "T1022301C9ABDFA163FD11427256DFBCE0888FA5A7000B582B71D8CDFB3159245A316C9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640753403, "uuid": "73a1b13b-bfac-4008-8441-77307ca6f559", "value": "768:DIaAngwuC1JSHp5YYDt4gynHp+C2aDbAmTOV1cWEeEgA1a++tWamrf5:XMg3hpSYxEnHp+CFb3cf81YWa4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640753403, "uuid": "dea31d90-7208-4294-872a-8071ca53a21f", "value": 46260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640753403, "uuid": "d1044132-ba8c-408e-8244-37639fdab532", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640753403, "uuid": "c1f3aacb-b11b-44a1-894d-8742ab8f2ca2", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf56251c-68cd-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1640799342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640799342, "uuid": "a08410eb-ccab-40f4-9f49-c8ca48d2d38b", "comment": "Malware payload (NanoCore)", "value": "15209e5cdce6ee73b8f09aaa5e52ed6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640799342, "uuid": "73791e99-9591-487b-8753-adcb0a7286b7", "comment": "Malware payload (NanoCore)", "value": "0b1396805e736275f16550f3ecc5361cfcccc468094b4ea910ded8eaf430a5b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640799342, "uuid": "b6376e60-aad7-4d89-a033-ec566ef56c48", "comment": "Malware payload (NanoCore)", "value": "ef021f32d56ffd264975afad47ef1e9fbd3321c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640799342, "uuid": "cc895c08-c45b-4063-a30f-14e64c86e469", "comment": "Malware payload (NanoCore)", "value": "9d4618aec2d22065c669f32b656f9edb4dcd1b88945a90aa381fb93e696cd0f19ad65374996decf26bdf6f5d7dded527", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640799342, "uuid": "a79cf71a-75e2-4d60-afdb-af02fe522744", "value": "T1ADE4D56DBA870A72EDCDD0708D630A54FB6F0F0322C4E9A253DBD5CAA74F4696D44C98", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640799342, "uuid": "a7ec30f3-c0b3-42c8-9bcb-dfb3770f50d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640799342, "uuid": "6296f9c1-4694-41b6-a7a8-224e366b4bf8", "value": "12288:3+XB5B5hLN1rYvRh7N8RSAWRvpBUtbyyLjRJ0h0:I75lov+Rwv7ozVt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640799342, "uuid": "6422aa70-677a-4510-a9db-8ad7313319e6", "value": 682496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640799342, "uuid": "0bde8999-c1a0-41a8-aaaf-3bef08a443c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640799342, "uuid": "ee96a28e-6dea-4210-ba74-cc58042cb574", "value": "15209e5cdce6ee73b8f09aaa5e52ed6b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1e724c2-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640740908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740908, "uuid": "b95f4b49-10a7-4ecf-9fc9-f231efa6e699", "comment": "Malware payload", "value": "c5ae60d04ef4fbfebb7766247742df89", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740908, "uuid": "73bfea14-39cf-44a7-b01e-9399b8ed525b", "comment": "Malware payload", "value": "0bd8380e56e19545074c84015be214800a4c31ef46679682dcc890cf82e65ff2", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740908, "uuid": "d27ccea4-c3ca-4014-845e-f5cc4dcde733", "comment": "Malware payload", "value": "1114ca70509b588d51e37f3c6e40c47e65e747bd", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740908, "uuid": "16c6af7f-b094-45e2-9572-812e64d859f7", "comment": "Malware payload", "value": "a7c98663a68e84cfc5834a8a15fee4fed2fd4cd095f987088000931e0397cc3e72ff07837c092b3deb96135e5225b511", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740908, "uuid": "8a2c0059-ec39-4373-9652-1621a374c204", "value": "T18864AE58BE9814F4DABBD63549972D6A727334720BD3DE9E135CA3E21F27360AF06900", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740908, "uuid": "cbe054be-0f97-4962-b2d9-e8b8d68ea507", "value": "6144:JPb7Ax1Ra6jJh9gd+ZBLiAEgOBo9UnQ7cPWa:JT7Ao6dWmLBO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640740908, "uuid": "3b2c7fe8-8832-4cd3-b0a0-4a893c6f4c4e", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640740908, "uuid": "af17f9e1-3f08-4936-96c2-faee24f84763", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740908, "uuid": "73457508-83e5-4e36-8658-c83591c6c377", "value": "attachments_1005.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c200115-68c9-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1640797351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640797351, "uuid": "a4dbce08-14c3-4430-9420-592c8e0784e4", "comment": "Malware payload (RedLineStealer)", "value": "3a52006a5fb72eab985ea7751c0c7e8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640797351, "uuid": "1ff24f6c-4e80-4adc-842e-214c3d3cde4c", "comment": "Malware payload (RedLineStealer)", "value": "0bf31eb13d89118aa095226e54d5d6fb554e16ab2d8b9effe3e995c3f35bed05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640797351, "uuid": "2947e39d-8e26-4263-b0c3-987489d45b21", "comment": "Malware payload (RedLineStealer)", "value": "a9170fdd92a4e9a794ec1e6ab51642787f4d9e95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640797351, "uuid": "6fbc05fa-aec7-4a8f-8739-52330559020e", "comment": "Malware payload (RedLineStealer)", "value": "326fc4a470f6115a57fc5df7f580640e5e36c292bafe5d90e64d99a6cf6bead6a7b2537e03e4be95f76b5839ab8c1a3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640797351, "uuid": "230c966e-6046-4ac9-9125-fe9a914e7bbe", "value": "T11E35D7DD51D19849DDEE27F00DFBA89CAD7095CA938773EAA32C95F0AB423C2254D4E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640797351, "uuid": "389b4362-ea7d-47b3-8d13-f1099dc9099c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640797351, "uuid": "a0de1eed-b064-4d86-b90d-efc2d40cba7e", "value": "12288:0+G/FkXN5TVkr6GnzZbDxiotXcnw2Vx0UJ+z9nRPyBQBgKT9ZZzKr:0jlHJtXcnw2V6UQnRnT9HW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640797351, "uuid": "436b4095-e4d8-4b45-ad66-c6036d858ba5", "value": 1068936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640797351, "uuid": "839d8f8a-0cf9-4d61-b88a-1ea77b82bc91", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640797351, "uuid": "618b361b-e6df-4e95-b286-3a537aa455ff", "value": "3a52006a5fb72eab985ea7751c0c7e8c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "913872f6-6870-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640759322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640759322, "uuid": "0225e248-0b48-4eb9-9e9e-7f2998e7a207", "comment": "Malware payload (Mirai)", "value": "0ab325e68de1517093de955689332eab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640759322, "uuid": "f080d111-9ab1-4c99-86d0-a0435976e568", "comment": "Malware payload (Mirai)", "value": "0c58ca89e60ae88ad6635fc92613f0432301543cd132d4159d3b45d7a6d31163", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640759322, "uuid": "e6dd1b48-4c81-4723-9d28-b8b1b5b8c48c", "comment": "Malware payload (Mirai)", "value": "be139523e78fe47c9c03fb4452815fd0a15c859c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640759322, "uuid": "046bce49-8cd0-49f2-99f1-4e77adc4867d", "comment": "Malware payload (Mirai)", "value": "082a6af4c8e1f8860bab411b81c5e4c7cf9ba7f3827d66a615517add3a1281f2db829697126e68e2dd3c4821d80238d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640759322, "uuid": "86b4d54a-b008-45e2-884c-f01115536341", "value": "T126634DD5F8029D3EFC5FE6BA84124A09F53123505B530F2BABABFCD36D220A55E16D81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640759322, "uuid": "ead5c135-c552-459e-b48e-5f134e7b7907", "value": "768:QjUeDLO2MLfS4Fs1r0DBPC1uBj9T0SslujPy3pVmpeKotSYcSz8m4:RYILfSj0PHjF0SskTy+peKGSbU8L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640759322, "uuid": "e358b93d-e5dc-48ee-8f2c-2f00fb6dba66", "value": 71400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640759322, "uuid": "564c767a-7d43-4359-8e6b-2fdd8ee41ec2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640759322, "uuid": "0df38d49-fbb8-42fc-8c56-b74131fdd871", "value": "0ab325e68de1517093de955689332eab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ec1853e-687e-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1640765331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640765331, "uuid": "8911bd2f-b0ed-4699-aeed-b6bb73c572b9", "comment": "Malware payload (AveMariaRAT)", "value": "87adfc2b7ff82bc72899a578f6cb2cba", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen Tongbu Networks Ltd.", "colour": "#0A3476", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640765331, "uuid": "14d0520e-968a-430d-8ff6-a1933dbb6aa6", "comment": "Malware payload (AveMariaRAT)", "value": "0cb7f05cc5d9f8ddd206af78f98965b2b1966d61ea6711f722019036b5e2e602", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen Tongbu Networks Ltd.", "colour": "#0A3476", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640765331, "uuid": "3f07db96-aaf6-4b20-8cc1-b0a873ba4f8e", "comment": "Malware payload (AveMariaRAT)", "value": "43beaa1e42facc63543b55498db18bf8dee8ebf4", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen Tongbu Networks Ltd.", "colour": "#0A3476", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640765331, "uuid": "40b2d9ba-49d0-4024-bcfc-146ab669fb8b", "comment": "Malware payload (AveMariaRAT)", "value": "e9bfd61bf4eee78075d2f1b8c1641566d5bc3d7c3d8f02916051269013dd426bb3f8c3b420cacf681d07d0d5ab1a092b", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen Tongbu Networks Ltd.", "colour": "#0A3476", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640765331, "uuid": "fb46d26c-7d10-4e69-a6c9-741fefdbb19d", "value": "T14045C023E2C1443BC1732E789D5B97A59826BE103E78694E2BE43D4C9F353A139392D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640765331, "uuid": "591e13fe-261f-4986-9d5f-671bfacaaf83", "value": "e145b55a33c2b3451d71d2d800c997c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640765331, "uuid": "8e06ec62-e108-46d8-8191-dc5c6067d774", "value": "24576:XhXCYZNjSPZ8wMRbZhKK0CHTXrP3I2IvrrP3bfvFYlLj:XhP3jxFdH7r422rTml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640765331, "uuid": "50100b71-84eb-4183-8699-5c091e03be24", "value": 1264424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640765331, "uuid": "ad20f6db-d3d8-434a-ac1c-3ff5539c0dc1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640765331, "uuid": "c169a3c0-bb2b-4f94-bf63-3724c27ee5f5", "value": "0cb7f05cc5d9f8ddd206af78f98965b2b1966d61ea6711f722019036b5e2e602", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b61add85-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640740915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740915, "uuid": "9a061f77-5edc-4b39-88b0-c51fdedf0ca0", "comment": "Malware payload", "value": "01c6d55f20701de9d4f3d06a5d67f7d3", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740915, "uuid": "7bda0379-7afc-497a-b39e-a340f0cc699b", "comment": "Malware payload", "value": "0d228f16939f341ec41c413868bf7639740d387afe24b771c7a8c9847bcefd3e", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740915, "uuid": "4e785199-779a-46f7-8896-869bef97ad8a", "comment": "Malware payload", "value": "b40e1b6cee29932d4f782a71aa8f8abcef2cfbeb", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740915, "uuid": "a4b5f226-1a38-4ba8-99aa-e4f3f3175a8d", "comment": "Malware payload", "value": "b0950a5527c829fb439a6a0a08f06c3b128575a8b82bbeb0ba98c74c4baa9359326bfa6b36cd245f2ac730dc01b82488", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740915, "uuid": "9ced17ef-7e3c-4329-8267-1cedfc08153e", "value": "T102649E58BE9414F4DABBD63549972D6A727334320BD2DE9E035CB3E61F27360AF06A00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740915, "uuid": "1174037d-f51f-461e-8199-d22500b2eacb", "value": "6144:hrcs5NDkGjJh9gd+ZBLREgOBo9UnQ7cPWa:hrcAhdWmLJO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640740915, "uuid": "1f798b4e-d302-469a-aea8-a35456f14d40", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640740915, "uuid": "c728034b-6999-45e7-92ab-5c9a4313e9da", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740915, "uuid": "9300f136-22bb-4a16-b117-8e6d727db5bc", "value": "Attachments-2048.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98613843-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640740866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740866, "uuid": "6d40921f-47d2-4fb7-870f-46eb46f15fbd", "comment": "Malware payload", "value": "def3ed51af4e6d1ce4f270b991f5c41c", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740866, "uuid": "7416f42a-3e2b-4771-934a-ce27e11881c5", "comment": "Malware payload", "value": "0e27170c3951db44cee49817d99f52c6c1f4cdf728200e1564c3e1cda9bc34fc", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740866, "uuid": "431235b3-70b8-45d3-93e0-1e8631fd06d7", "comment": "Malware payload", "value": "afad12d6fa081372632d18fe0724ad85b1fda281", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740866, "uuid": "25a21ccf-82be-4457-abb4-0bfd560af9bd", "comment": "Malware payload", "value": "e2b6a2b2051137dee061c43b8f3645764c309dcb560c3aacfd641d373f88f3b5bcf90771cba5a43e2ce7dab447d74969", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740866, "uuid": "d6166262-b4da-4f08-95a0-4787bba950c5", "value": "T1F4649E58BE9414F4DABBD63549972D6A727335720BD2DE9E035CB3E21F27360AF06A00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740866, "uuid": "ee146e2c-0558-481e-84a5-8c29001ccc73", "value": "6144:GGxHd5qzjJh9gd+ZBLOPhEgOBo9UnQ7cPWa:P+zdWmL8ZO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640740866, "uuid": "df9a500e-f87d-402c-9a89-cf94245e1750", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640740866, "uuid": "39385593-b677-4ee7-963d-ae9efddda561", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740866, "uuid": "e776f6d6-d388-41f6-957c-38740e312e2a", "value": "Attachments-2033.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f85d9daf-6900-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640821342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640821342, "uuid": "1c2b86b6-2504-4eb9-909c-361d7a1f8f2b", "comment": "Malware payload (Mirai)", "value": "77399b648a88b30cbac16ad8b5c1a880", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640821342, "uuid": "22273e19-d1a2-492a-a6d9-d09821c6e2cf", "comment": "Malware payload (Mirai)", "value": "10a5fabf1847feb44437827b040f707b432b3cc93167720fe9879ca33477d5c1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640821342, "uuid": "2a12e2b3-9474-483c-ba64-853e373456f7", "comment": "Malware payload (Mirai)", "value": "38bc36458253c2dda9905f8481d6dea4496e2d4c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640821342, "uuid": "63d68a5d-2068-4cf1-bf9f-a85b22259669", "comment": "Malware payload (Mirai)", "value": "4cee885640aeafcd792b662de3424dfb2acdb11bf0286b74730b311606260d7d3d6e2b48017723a45a443afbded8cbdc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640821342, "uuid": "7deb981a-012c-47cf-83b2-5d7154d5810e", "value": "T16EC3740E2E259F3CFFA9423987B78F25964833D636D1D585D15CFA022EB024E341BB99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640821342, "uuid": "362762a4-952d-4db3-8df7-f5719d2a5747", "value": "1536:lB8hJDwfMjYbfRbjIy0IpvuIqTHR+Xk5+RnQ548pHta3msG4sEReansw6ZI8ATF6:kUkICy0Ipv9nRQ55Swcsansw78ATFHQp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640821342, "uuid": "028b4771-f32e-4790-b0f7-0b629fd5db06", "value": 121016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640821342, "uuid": "119de97e-3d56-4154-8d9c-45dfacd37fc6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640821342, "uuid": "b53479c1-d939-4d6a-8f90-acfd38d5d35e", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "021a7547-68a1-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1640780127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640780127, "uuid": "ae53f5ef-94b2-4599-9814-53adbcedcdb2", "comment": "Malware payload (SnakeKeylogger)", "value": "53594cb4719b42a1b2cf290fb1b2a42c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640780127, "uuid": "92877006-ad25-4399-a7b0-94c9c8ca41fc", "comment": "Malware payload (SnakeKeylogger)", "value": "1539f0233510cf0257cd5677405a09c9ab1fec1a959aa93e6e35ae87b66460fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640780127, "uuid": "57ec48b0-cc45-46bb-a781-38182cbf0c12", "comment": "Malware payload (SnakeKeylogger)", "value": "97ab987f3ab85bc6ea89219cc8807b6d4915d882", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640780127, "uuid": "93686a14-9e5a-439b-89fa-19bf83775e1d", "comment": "Malware payload (SnakeKeylogger)", "value": "c7320ca930b3b24e51a967df26433123ba8510bdc5842c4f525d635a93c2012e475bc693c6e66f4f4ea0ca1baa43f140", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640780127, "uuid": "3613e724-00ad-4c34-b9ee-f1baab5fb79d", "value": "T1EFA46CAC72507ADFC857CD768A982C64AA50747B830BD213A01716EDAE0DADBCF145F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640780127, "uuid": "c9a91952-9d45-43ba-93eb-2cd59a85396d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640780127, "uuid": "39573384-bba6-4dde-a0a3-a125081dabb1", "value": "12288:+5QH791uDmY8FIMwJ9CoTRHTAcqlpUaqt/ZswlkAYjaT:+5QTuDmYgvw9xtAc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640780127, "uuid": "519d6470-8377-42fe-8347-87e70fb17f79", "value": 452096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640780127, "uuid": "de38a910-eef5-4deb-b078-724439e45fa9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640780127, "uuid": "2147b58b-4020-410b-9b16-2f7ce6873f92", "value": "LPO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "084a8f1e-6846-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640741053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741053, "uuid": "868666c6-ab78-4ee8-bcb0-b088a255592f", "comment": "Malware payload", "value": "d1379effa7d499c56cc12d1e624913ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741053, "uuid": "1a9e01b4-97a1-4656-8c0c-6dc2889c4cf1", "comment": "Malware payload", "value": "154e33683352ae24e7c63502f15e4b70452d5e2a2b349b9705853401bc7c5903", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741053, "uuid": "d522a722-ec1e-4672-abc1-1983b4c752b5", "comment": "Malware payload", "value": "66f219f1ed5506e86288652b150594821f5e1ca7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741053, "uuid": "995540db-b809-40f7-a966-cb25eb87798d", "comment": "Malware payload", "value": "45809ea491ca12dcdc075ac23433ac833bd8c29144086624e9348ec4fefa8dde14cc332c9450108c9d0e29b513bd6d05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741053, "uuid": "7ae2246a-aed5-440d-8313-8d5d9c875309", "value": "T15644AE58BE9414F4DABBD73589972D6A727335724BC2DE9E0358B3E21F27361AF06800", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741053, "uuid": "75ee93b8-3fcc-41aa-b037-314a46e6514c", "value": "d4755b9a9aec93c05c955ca11140bdc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741053, "uuid": "e57e575b-8d99-4f0f-9043-b3b76ea9af7a", "value": "6144:sDfe555DkjJh9gd+ZBLOEgOBo9UnQ7cPWa:DFkdWmLaO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640741053, "uuid": "484b505d-b2d2-4b40-8402-119c2652b22c", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640741053, "uuid": "fc867577-4366-453d-9ec8-7568cba55f78", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741053, "uuid": "8c7b91d9-3b95-4e73-b6dd-fdf0b1fd541a", "value": "macosx.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1b0676b-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640740989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740989, "uuid": "58a9642e-a4a3-4750-8d89-6df9cddc15bb", "comment": "Malware payload", "value": "544e91226fcee026be69c0d0bdd545fa", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740989, "uuid": "beabaffc-d1f3-4ebd-86d1-a21181802b20", "comment": "Malware payload", "value": "15a186aecef8159c9e4ef41f007c8010c096c7fad74550ad92cef7015e54f996", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740989, "uuid": "7587909e-4f08-4a55-a8c2-24c0a69369ee", "comment": "Malware payload", "value": "825edb8a173f3b53080ec753f30e827ba875a172", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740989, "uuid": "4eb5d9e5-732d-4f44-b0e2-7b07087b45f7", "comment": "Malware payload", "value": "0fa9c9ba74da828df42368e4e6e9a00c140ad240d824be45d673714335440a4f3a33c204535c3bf818e722e79cc5750e", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740989, "uuid": "0b46c653-79f4-4335-9e21-ba6a29ad0709", "value": "T18464AE58BE9414F4DABBD63549972D6A727335720B92DE8E135CB3F21F27360AF06A00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740989, "uuid": "2f2332e5-8187-44f8-a85e-67d4b87faa8b", "value": "6144:s9CSwAs0kjJh9gd+ZBLbEgOBo9UnQ7cPWa:sCSzkdWmLnO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640740989, "uuid": "8b6645eb-9a35-4f50-bed8-84bead35322a", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640740989, "uuid": "fffe25b3-b947-4ef5-aed3-f6b88ce75740", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740989, "uuid": "93625106-571d-4cb6-b0a7-14ee603e0f83", "value": "attacments_1019.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccb788bc-6882-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640767153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640767153, "uuid": "f498cd27-19fd-4c38-93a7-b5cd087bec86", "comment": "Malware payload (Mirai)", "value": "027a49dbf309063077af1010a90d5a9b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640767153, "uuid": "df40d79d-2ed8-43a1-ae84-06ce175e63d5", "comment": "Malware payload (Mirai)", "value": "16d0611456b997fea5d9e630921f2a07ad0564e11d7aa7371a71c84a30782baa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640767153, "uuid": "f95afeed-92d6-4e92-8de1-de767d5f9b6b", "comment": "Malware payload (Mirai)", "value": "50702809cd19ba1e64a95dd0f85591c1bd98e376", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640767153, "uuid": "11a49cee-e8d7-4a3c-8d96-cb33ca36d479", "comment": "Malware payload (Mirai)", "value": "900f2167993f0938b94e9a1e252947e876373719f7337ac240474a083afd516111e9406061ec00d062947e7f5a7035c3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640767153, "uuid": "d25faab6-6ea3-498a-9555-085a3125fbc3", "value": "T12A93B30ABF740FF7EC6BDD3749A92B09158C550A22E97B357930D818F64B26F19E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640767153, "uuid": "ee402a9a-f7e8-4ad1-ba62-47de8b0b8b13", "value": "1536:zahaNVXMDW/JdBjzYQL3qI3Lk/0B/BXsZiaBLTe:zahGVQWbB/zu2TXs/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640767153, "uuid": "fa87d611-3352-4732-9c15-34205c263ee7", "value": 92444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640767153, "uuid": "fd491691-5358-421f-ba14-b2d96ac4317e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640767153, "uuid": "019b881b-fdfb-4ef9-b184-dc68d1dbb940", "value": "027a49dbf309063077af1010a90d5a9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f21c256e-6884-11ec-9275-42010a9c0029", "comment": "Malware payload (Kutaki)", "timestamp": 1640768074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640768074, "uuid": "5150adcb-4e52-4f18-ab28-607148ea1723", "comment": "Malware payload (Kutaki)", "value": "30ae864bbb52f134f172124ee1e229bb", "object_relation": "md5", "Tag": [ { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640768074, "uuid": "3c419d8e-8adc-45f5-bc26-00b3a2519b90", "comment": "Malware payload (Kutaki)", "value": "1810e76a7f52cbb783412b2aeb93298fd31e3fd59e66cca317e16bd1079e9c71", "object_relation": "sha256", "Tag": [ { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640768074, "uuid": "1d9a7e11-82df-464a-9956-c35c5cd432ab", "comment": "Malware payload (Kutaki)", "value": "51a6900cc21b599759d42ab6b506bba0c729655d", "object_relation": "sha1", "Tag": [ { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640768074, "uuid": "746a2feb-7e51-4d5a-bb7b-470a03c8bd67", "comment": "Malware payload (Kutaki)", "value": "3cb07a2602cd88c032d518d01eae62ecf91af886a373e1f43b4ace9cf0c2b7880fb9a64861dc4a1ffa4b10ae155adfa5", "object_relation": "sha3-384", "Tag": [ { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640768074, "uuid": "5b8eabae-4c2b-4142-be63-7856408efd7f", "value": "T1B194239C66861F1BDAE864FD4F22A91206644CFB076D72006EDE31FBD095742B1AF70E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640768074, "uuid": "0df8b275-3cf0-4859-982c-d8bd7f25224b", "value": "12288:m0rEQYyoDAPH4SA9j8D/2hAFcMSU8GknR5YRwX:mLQYyoUPY38D/83MSU8GknzbX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640768074, "uuid": "c9d8e79a-19cf-4faa-acaf-580fcf81e483", "value": 420734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640768074, "uuid": "8fd1aa53-3637-4a23-a313-80b5ca9f50cd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640768074, "uuid": "25d11615-8594-47f3-a815-e0496b45ae71", "value": "30ae864bbb52f134f172124ee1e229bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f34c05a-68d0-11ec-9275-42010a9c0029", "comment": "Malware payload (CryptBot)", "timestamp": 1640800389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640800389, "uuid": "2c2720b5-00ce-46b6-ac4c-e6700ef1bfa0", "comment": "Malware payload (CryptBot)", "value": "9176db54f9eec97d7900bb5e5aa97d62", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640800389, "uuid": "ff9cd315-80c1-4532-a603-3cb065280f41", "comment": "Malware payload (CryptBot)", "value": "192ea5280a05d8d5fb39c4834befe628a396e4cd5a898ebb3967466b4295774f", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640800389, "uuid": "08d2e304-985f-44ed-a39d-6392e1e0a74b", "comment": "Malware payload (CryptBot)", "value": "d58d81ee1e2eb302f8c059e3f02a2c1b3a880889", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640800389, "uuid": "5b82982e-cc68-4487-bc98-f2c809041636", "comment": "Malware payload (CryptBot)", "value": "d9408f47a784fc6428fbd8786787afe9889ace236a253c99d7ecc49510052007c7cd91739563b5aa23e523600c86506c", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640800389, "uuid": "92fdfb00-ba04-4006-a013-dc21b6d4e522", "value": "T1B2C533135E436A5CCE9823FFA400C132D9D27F31E287A3695A2E0F7447731687E6969E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640800389, "uuid": "d6aface5-76f8-4b47-aebe-8502e080807c", "value": "076fd3bc44050b5480459bd4d8e1a2d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640800389, "uuid": "35f7bcb1-ca5f-46a5-8097-e0a15f894fd0", "value": "49152:EmihgB2NL+z64lLV/wDKXbIgieGq8EPjLQlFLWMnASLkyD6F6dKCx0:agB2NoJn8q0gieGqHjLIUSLYU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640800389, "uuid": "d1b68855-0a53-461a-8411-fe591d1daf60", "value": 2587136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640800389, "uuid": "fdb0f6d4-efbc-4df8-880a-b422876c9ba9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640800389, "uuid": "76be43e4-38f4-4f74-8818-a4b6642a7b2d", "value": "SecuriteInfo.com.Variant.Zusy.398819.656.20146", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1df036c9-6846-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640741090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741090, "uuid": "6709a752-d35b-495d-a184-2da7ec80c49d", "comment": "Malware payload", "value": "2108ae8c5ed3180be353400177c812c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741090, "uuid": "56333055-0628-4a32-a82a-792dea45554e", "comment": "Malware payload", "value": "195571cdddb8bb97e07427f36f3cd5e79e21c38a70e0477959e242a9fe0e2259", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741090, "uuid": "7e52f285-39ee-453b-9182-0bf96d2cdf57", "comment": "Malware payload", "value": "d1ade54e02ba0ba4501588ba5adff3e92698ab6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741090, "uuid": "6cf95904-3524-417a-a7f5-0d3374e7d581", "comment": "Malware payload", "value": "bacf86b7de3720a5114378676f7968b592b8a490a0caa13947e38d2703b4fc3bc0e087678dc5464e6c3deea90b52d6d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741090, "uuid": "50d80e58-1e8e-405c-b54a-9b9a9e2846bf", "value": "T1F2449E58BE9414F5DABBD73589972D6A727335720B82DE9E0358B3F21F27361AF06800", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741090, "uuid": "482a9c8b-e82b-47ca-af0c-4038c6056a21", "value": "d4755b9a9aec93c05c955ca11140bdc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741090, "uuid": "167d32c8-c15b-4a8e-b382-e4e60defe091", "value": "6144:F6c2Hd5qzjJh9gd+ZBLO7hEgOBo9UnQ7cPWa:Fy+zdWmLkZO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640741090, "uuid": "c661298a-ff01-4941-abc3-ac0f7734f05c", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640741090, "uuid": "1b4c97ac-935f-4291-af20-030b0432a560", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741090, "uuid": "51149839-b4af-4987-b7a8-1f183da93d59", "value": "macosx.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f6980ba-68e4-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1640808953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640808953, "uuid": "2a80740c-557c-4c63-bb55-c7470eb6beee", "comment": "Malware payload (DCRat)", "value": "4ed7fa930b105e4a07ba9014253bb781", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640808953, "uuid": "af16f2b6-e42e-465f-bf34-1f0f50045a6f", "comment": "Malware payload (DCRat)", "value": "1978a133fc8bcbba7fac230cfff5c2fc6ac2681e9f84df4231bfc056bf2cd91f", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640808953, "uuid": "e76c3e1c-6436-4368-b72a-c9d45aa7b2e1", "comment": "Malware payload (DCRat)", "value": "066bb9de3a55f5571efa7b5b83a9f8355239c284", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640808953, "uuid": "810ab71f-19e7-4368-9983-69da352b2cc1", "comment": "Malware payload (DCRat)", "value": "fe76c20cee078d6f06401d6e85a57faedca0e14d3cf6931d4d9492424517372de74e81632afac59673a9f06746e1bd35", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640808953, "uuid": "8fdea31a-46c5-4919-b443-95fd101558ea", "value": "T112555B227A49DD03E16A173BC5EF406447ACAD417A62CB1A7EAF339D65113A70E0E1CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640808953, "uuid": "7189458a-8df5-4285-91ef-511c1b33e670", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640808953, "uuid": "ed299cbf-0e6b-498d-a701-901487633cf9", "value": "24576:JTr2wsQaqPsFjO9dl6W7DSIE3fF6i91H2R7a+4:dkQLaOvHk91Hi7N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640808953, "uuid": "cdd0e0da-2ef8-4c40-a813-693fc5c8d388", "value": 1288704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640808953, "uuid": "47700e41-8d5e-4760-a72f-ecf0541e06d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640808953, "uuid": "2e0cca26-7a1e-45d4-9541-a213ff7a8d03", "value": "1978A133FC8BCBBA7FAC230CFFF5C2FC6AC2681E9F84D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18a54786-6846-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640741081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741081, "uuid": "46319bae-02ea-4b1c-a09e-b77ded6f775e", "comment": "Malware payload", "value": "da80808ac7de067c88fe9c0c147a08a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741081, "uuid": "87f5d798-0f4e-4860-8f94-0d3b66f6fd36", "comment": "Malware payload", "value": "1a4e3fb78f71ea58343007b666cf0d6a804fa4e2ec02bdf729cba5747a48ecec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741081, "uuid": "4861ff9d-b717-4e71-bd1b-19f028bb1e82", "comment": "Malware payload", "value": "9d859a6e7dda09ca3f73ba2246c5bfc99b933de3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741081, "uuid": "eb8f857f-6baa-4515-a84a-e3cceed10ed8", "comment": "Malware payload", "value": "b86290dc7141a6647861acc33ed5f21866b6a3d2ca5e8c632372d12265eb527ce1bd2760ec5b1e2bd079758a898c064c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741081, "uuid": "0e1c53d2-f649-4d63-bc6f-f5ad6473ff53", "value": "T1A044AE58FE9414F4DABBD73589972D6A727335720B82DE9E0358B3E61F27361AF06800", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741081, "uuid": "03ebe41d-3c7e-44db-af8b-2948e49537f5", "value": "d4755b9a9aec93c05c955ca11140bdc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741081, "uuid": "dac06153-72e2-435f-a9e9-74e6362b809c", "value": "6144:I6pARjhjJh9gd+ZBLMEgOBo9UnQ7cPWa:t2hdWmL0O0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640741081, "uuid": "a4839e47-ba05-4851-93c5-d400b477fdb1", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640741081, "uuid": "28240318-248b-4d29-91af-72c1580d1446", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741081, "uuid": "bb3ba70d-3ed9-4822-801c-32387637df7d", "value": "macosx.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "006b824e-6846-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640741040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741040, "uuid": "47259acf-59db-4ceb-be3a-ce8e92916bee", "comment": "Malware payload", "value": "bdbf83d2c73c5cfb07f9adf7c6edcf33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741040, "uuid": "5445d060-3943-47a6-ac7c-40b267bdee9b", "comment": "Malware payload", "value": "1b8bfd3e4115e4e0621217012dc678ca2fa2b002fc0154cdbefc537b5863dc17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741040, "uuid": "c4e393e7-8da2-49f0-b7e8-4caf2b282221", "comment": "Malware payload", "value": "21fd8acf25499e84d33d389063e20d4f7a442afc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741040, "uuid": "ee5df0b7-a22f-4080-963c-ed89271a2659", "comment": "Malware payload", "value": "4aba39d93bb32d633027a297db2d65ddccee48e5d3ecf12750f6d0f06127582e27dff5d1d25a202915cfe19aef9ec679", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741040, "uuid": "1df2bfd2-a124-4f1f-8471-438f83f230ef", "value": "T12944AE58BE9414F4DABBD67589972D6A727335720B83DEDE0358B3E61F27360AF06800", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741040, "uuid": "e0869ee1-495a-437f-b57d-62082f5edd93", "value": "d4755b9a9aec93c05c955ca11140bdc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741040, "uuid": "2700be77-f33d-4bea-a618-018ad8032df8", "value": "6144:2ooRvkhhg5D5jJh9gd+ZBLDEgOBo9UnQ7cPWa:2bGh+5dWmLvO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640741040, "uuid": "6a54b76b-991e-453a-96df-99b8e6fe66d9", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640741040, "uuid": "0a8088e3-9636-4ae2-a3cb-dcc8f37b36db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741040, "uuid": "1d4ed3d7-5008-4e13-ad75-30433a15eaec", "value": "macosx.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e1103c9-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640740848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740848, "uuid": "b544686d-8082-4690-8767-7811f27b3987", "comment": "Malware payload", "value": "a5d77693077b2e74c84cd3e29bc7fd90", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740848, "uuid": "d15afd57-0ca7-45f5-a63b-2537448f5023", "comment": "Malware payload", "value": "1d0f2228c45c300ead052e79b2d3a40a16a7be0f23aa79874e35a0049b27fa4d", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740848, "uuid": "baa9eb14-e8d9-4102-a028-54b8dc33086d", "comment": "Malware payload", "value": "52881df0faa26514e74998320e476ac5fb8f7e1f", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740848, "uuid": "68ceb788-201a-4eda-bf50-faeb1f8230f7", "comment": "Malware payload", "value": "f9b24e88efefff464278913437ba3bd93ec4c174f674e539f5acd17bd454974bc7d9fc4a802c8a427fa262eccb726e88", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740848, "uuid": "7f4eb43a-4a23-432f-b7dd-f5952185893e", "value": "T17B64AE58BE9414F4DABBD63589972D6A727334320BD2DE9E135CB3E21F27361AF06900", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740848, "uuid": "a0f2aff4-d48f-48fd-8fef-0a0b5afe325d", "value": "6144:licvrbR+qjJh9gd+ZBLOEgOBo9UnQ7cPWa:liWoqdWmLaO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640740848, "uuid": "6ad60c50-935d-4440-9b1d-90ab9a7d872b", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640740848, "uuid": "5eac40af-dac5-4476-bf09-5b79ec0599ae", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740848, "uuid": "c2c64d31-0847-4b73-9972-51a6654c8b07", "value": "attachments_1010.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9b49022-6900-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640821345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640821345, "uuid": "6ec776bc-42f0-4eb6-878b-c92159da1f6d", "comment": "Malware payload (Mirai)", "value": "df740e51a648b2eeb5a6c402a84d9771", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640821345, "uuid": "7199e226-4923-4846-94d2-570757b20326", "comment": "Malware payload (Mirai)", "value": "1d6e0ba4ff93254d9b547d690c03aac976969760a9c244afffd177bd30b96c19", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640821345, "uuid": "5e894ae7-57be-4bff-8292-53cf81d44762", "comment": "Malware payload (Mirai)", "value": "55fd24f4ab51939e8503ff81baf38e90d08c3d2e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640821345, "uuid": "a0a49165-f80f-49ce-9615-453aca930c82", "comment": "Malware payload (Mirai)", "value": "cf7c547ef1d7bd52d93fbb267e4c8ad6134fad9536b03b1c0864c48d906cd1f65e9e5e19e567f787fb7613e180c1de14", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640821345, "uuid": "c8b4c726-0873-487d-a623-5b9f9f03c186", "value": "T1EF833BC5B953E9F4DC1209322077FF369E76E1BE2214DE83D3A85673AD52A03E10269D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640821345, "uuid": "445113a9-493d-4f26-b7a6-9bfe6dc6ec34", "value": "1536:hNw7TjznqVg1WeAvqwjP1Zr7uuInqYtHsnYkf01h9kq/rnVzWX9yX/miwVEH:fw7vzdrAvhjP1Zr7/InqYtHsnw1nkErK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640821345, "uuid": "2fe01b81-38db-4055-be94-b67741bd15e0", "value": 86800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640821345, "uuid": "d9cc5ee1-6a68-45d1-8541-d26e4b754dfc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640821345, "uuid": "3579bfcf-55b2-4428-8f1e-793fe044eaae", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce43978e-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640740956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740956, "uuid": "99c9ab44-91b2-40c8-b9cc-2a5187498700", "comment": "Malware payload", "value": "52f5cb981ab408cd45bf03487cafbcf4", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740956, "uuid": "69ab4ae2-1373-435f-b97f-91e7c432bf2a", "comment": "Malware payload", "value": "1e82525900f633e0f31c977f339819bc55d90ebd57f0ee2da32a1fbcab86fc16", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740956, "uuid": "8b90732e-cbf2-4f7c-bd0a-2694b3e0980e", "comment": "Malware payload", "value": "287da0af9564abcbbfd4d453d79a34e889bcc695", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740956, "uuid": "24d50d00-ff3f-4b1f-ba46-bfa031596db8", "comment": "Malware payload", "value": "8f26e71230b7e2b62c3b2bc4aa10278b6c15fb435bf103beeb3865126aa42cf3e32396ba3c6a620ec0a051cabfc65a05", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740956, "uuid": "dd3ffb16-a0dd-486c-8806-1e9d36af9ca9", "value": "T16D64AE58BE9414F4DABBD63549972D6A727335720B93DE9E035CB3E21F27360AF06A00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740956, "uuid": "12b81721-eccc-411c-8a2d-d90b9cbfbdab", "value": "6144:kS1XiJtZqyjJh9gd+ZBLiLEgOBo9UnQ7cPWa:kEigydWmLOO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640740956, "uuid": "cf8a83a4-be06-46d4-b426-cd8558f25f65", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640740956, "uuid": "dbc326ab-c6d8-471b-839d-91b51093f73d", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740956, "uuid": "4531309a-e07c-4e25-9335-a2aa5b6120e0", "value": "Attachments-2001.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "538b8c9d-68c8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640797014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640797014, "uuid": "5c06d2d6-516e-45bd-b515-da5a001f5515", "comment": "Malware payload", "value": "c9240798810d1e69b8ed4bf21b95ed89", "object_relation": "md5", "Tag": [ { "name": "Github-hosted-payload", "colour": "#9A7AC2", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640797014, "uuid": "f1cb1377-eb37-44c2-a233-44f14a15cad6", "comment": "Malware payload", "value": "20aa2a67af405894c69adf05c5d8ac10be044203702eb11c58b5f0dfd9abe66d", "object_relation": "sha256", "Tag": [ { "name": "Github-hosted-payload", "colour": "#9A7AC2", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640797014, "uuid": "0ba1ddde-949d-44e3-b6e9-deee6132a754", "comment": "Malware payload", "value": "640927904a1d0a04c68c98b32eb38294afef31b5", "object_relation": "sha1", "Tag": [ { "name": "Github-hosted-payload", "colour": "#9A7AC2", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640797014, "uuid": "398a92a9-8335-48ea-a1ad-64842d37e2b2", "comment": "Malware payload", "value": "b3ab4502089be272b80b543918be3058b3473a167bf9b631ec6dde19172c4cc515f700098aa355b6e20c2d716ae35d55", "object_relation": "sha3-384", "Tag": [ { "name": "Github-hosted-payload", "colour": "#9A7AC2", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640797014, "uuid": "470c49d3-686a-4701-89e6-7017daf95960", "value": "T18DB36C1BA649CA87E13C4370AEE74F9E3B13BD159E8722D331097B5E3FB5140891E12A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640797014, "uuid": "58ce8c71-af8a-47a6-8021-afc332f75ef0", "value": "3072:SOKpbdrHYrMue8q7QPX+5xtekEdi8/dgxhjvH6f9+H5uUyLtC70:pKpbdrHYrMue8q7QPX+5xtFEdi8/dgxG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640797014, "uuid": "3e030ce9-5ab8-4700-96ac-15d213c854ef", "value": 108037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640797014, "uuid": "e2f407c4-a04e-4830-861e-582880816257", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640797014, "uuid": "5f2103ff-9192-49f7-a255-c465fab88aa6", "value": "recip_conf_13232.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc141979-687b-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1640764172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640764172, "uuid": "71d47d8d-ade9-4e99-ac6a-de1bae0b0385", "comment": "Malware payload (RedLineStealer)", "value": "7de3896baf12500f3e1cd311e2340806", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640764172, "uuid": "4e647da8-3639-4091-8760-fd5f772c4b29", "comment": "Malware payload (RedLineStealer)", "value": "213fce24e326925749adebaff2d85e23bba2b616c872e2089b23fa231f18756e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640764172, "uuid": "b42f2b2a-d211-483a-a5bb-0fc55f0cc929", "comment": "Malware payload (RedLineStealer)", "value": "500b906981aaa4810848643f1d8c17efa87bad20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640764172, "uuid": "233909d0-69e6-4937-a298-c15a14940aeb", "comment": "Malware payload (RedLineStealer)", "value": "1447d523b1df60e06f48072e262e8a8e2eefd3b4d18bb19e673e0eb29ebd5e428163346641bbcd74c55a13db38e8d73c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640764172, "uuid": "bcb1a123-d7dd-4125-97a9-a64df53444b7", "value": "T1D416330859E5ACD6C4ED32F89E5DEBBC513426F4BEED083B1012EDD0999E127075E0AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640764172, "uuid": "6b64da35-332f-4160-887a-f0eab2540498", "value": "9a4258c5d218cf6e5c500e8415d5f5ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640764172, "uuid": "4e73c04c-b070-4861-8dbb-9bf535a4a0e1", "value": "98304:xmAM03cGX50EXFEACRwiGbJ3hjOQxsaS3XnLUBzEydzEI:xBM03c+0ACRZGNBdONXe5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640764172, "uuid": "652e989a-1e42-4f4f-a466-7b8005f6d6f0", "value": 4397056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640764172, "uuid": "368c81ca-f00f-40a2-bab5-79b1425591fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640764172, "uuid": "69081b14-a92f-432f-9c41-a4a1f860b07f", "value": "OfficialKiddionsModMenuV0.8.7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f9931e5-6846-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640741119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741119, "uuid": "a873bd08-daf6-4f6d-92d4-2b764442ee1d", "comment": "Malware payload", "value": "5068e031ebf82cf8a7517db4130e8392", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741119, "uuid": "25365b83-82eb-4f2c-914e-8c09dbf1aa64", "comment": "Malware payload", "value": "214a74a6df6269aca1279a2a0e59ac4f2d3355ed0aa7de8ffa502f2502df608b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741119, "uuid": "6d795ee8-4229-4e30-bff6-c5e4847c8648", "comment": "Malware payload", "value": "8d1f71bc67fcc5c6730ad7311a2434a349d496ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741119, "uuid": "84616876-a0ff-4e55-a4d5-8aee2e35415d", "comment": "Malware payload", "value": "09608cc2ca8f9a5cb5b475fe4ad6503286c397b8853c092587a765e7d1186dfd0a5f7cce2150aef57c95e0586fd034f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741119, "uuid": "cc945279-d6e4-4a93-9140-caa43f51cf95", "value": "T13244AE58FE9414F4DABBD63589972D6A727335720B82DEDE0358B3E61F27360AF06900", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741119, "uuid": "a445b857-a67c-4e2f-9b30-afddc331f672", "value": "d4755b9a9aec93c05c955ca11140bdc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741119, "uuid": "5300d623-4c1b-4987-9a06-f0424a73cb0b", "value": "6144:1x4NSdQ55eHrjJh9gd+ZBLYEzEgOBo9UnQ7cPWa:HRGOHrdWmL3O0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640741119, "uuid": "f90992f4-23f1-4bb9-8356-75fa2f4509a0", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640741119, "uuid": "17c8fc7a-05c9-407a-b7d8-f13384939d3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741119, "uuid": "64f9407c-2719-4d60-807e-bc34b51447be", "value": "macosx.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c14e9f6-6846-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640741060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741060, "uuid": "14d882e3-7ff7-45bc-ade7-39ae077ad6d2", "comment": "Malware payload", "value": "080957c5f4beb80e64b1fff1b5a88ed0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741060, "uuid": "3190f009-4495-4457-bd5c-da362b61af3b", "comment": "Malware payload", "value": "2156afe749d115f61c86177a8aa74580bd2e73c23aa398fc3b7b88d472f771a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741060, "uuid": "77858a7c-5250-4f42-a7e0-d4d1c8d1274a", "comment": "Malware payload", "value": "02852901d356f341a29468c7ead22392b6044d8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741060, "uuid": "58e7a4f2-866d-4519-b9ea-b7a662d9d2d0", "comment": "Malware payload", "value": "24f1dffe220aea5a25d28e971d1652cc6099ea17821d87e198f6f9f8adee9472f8529e79b2d0466b53d8910d0756f2c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741060, "uuid": "73c8a3b7-1d24-4268-b09e-66a701d5ceeb", "value": "T17B44AE58FE9414F4DABBD63589972D6A727335720B83DE9E0358B3E21F27361AF06900", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741060, "uuid": "5f925cca-dffa-45e4-8c2d-a83e9600ba4a", "value": "d4755b9a9aec93c05c955ca11140bdc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741060, "uuid": "572f77ce-644e-4da0-86f3-c1f732c8eb61", "value": "6144:eJlpVRjBjJh9gd+ZBLMEgOBo9UnQ7cPWa:KlJBdWmL0O0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640741060, "uuid": "c9f9de54-54be-4152-b1f1-40f8044063be", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640741060, "uuid": "78083d6e-52de-421a-8d5a-fcd9afba1dcc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741060, "uuid": "711c675e-bfd2-48ee-98a1-898ef398b9aa", "value": "macosx.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d79c71f4-68c2-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1640794659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640794659, "uuid": "8f66d703-4373-4fc0-9390-edd3ff9d1777", "comment": "Malware payload (AsyncRAT)", "value": "b1bb23ee86ed2d0f47765a868779d083", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640794659, "uuid": "1191dbfb-bfc0-47f8-af3a-b642ffe24904", "comment": "Malware payload (AsyncRAT)", "value": "21caa48efbe81da3c1c58b69610c43a0d913eb95d0892f24e7477d6ab446f36c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640794659, "uuid": "24ee3dc7-9b71-48ab-a550-88798677325a", "comment": "Malware payload (AsyncRAT)", "value": "8a6ed9e01be08484f2bbf3e7e267ea0298330836", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640794659, "uuid": "05b9fb6e-0476-492c-9d28-3c2a62a0d293", "comment": "Malware payload (AsyncRAT)", "value": "47c3ab47ba74d94b3cb07f76f83136d90b7332b2cfa1138cb7aac40bb9450b2b4bd54beab8dd5b8316bd3584e39a8506", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640794659, "uuid": "01249645-7951-4f51-afd0-35e75899cda4", "value": "T14683D051E78A47B1EAF407F274CB8A7262F41F62712BE0AF10993FDA34433594A4AB45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640794659, "uuid": "74e93073-a636-44c1-a945-0e75fbe8a2a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640794659, "uuid": "f3d7c1e3-9817-43a5-b7d1-c19627e4c5e7", "value": "1536:LBdTEgBbN+xP9cPppv3s54ldQxM/TsLi+vQrpazPcXofYsxzR17TtJeqZx:LBxEgBbNR68d4kX6YsxzRB5JeqZx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640794659, "uuid": "7811a6b4-4277-4384-8b0a-ee288f16a5e7", "value": 88064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640794659, "uuid": "3bae248e-8e69-4e1e-9370-76422432a5cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640794659, "uuid": "b39c362b-5e54-4a16-9535-d11fd425bc3f", "value": "Invoice ATC20211230.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b458694-68c2-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1640794531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640794531, "uuid": "41988c28-7d2c-4860-81f8-fbb515d33ed9", "comment": "Malware payload (RedLineStealer)", "value": "bf40595412bd8e70a813586e7ebb8bca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640794531, "uuid": "eabc5f32-e199-48af-b8d9-16332a93b270", "comment": "Malware payload (RedLineStealer)", "value": "2606610e3f49105fbbd6c091ad3d7cf6481f4609eb2c249fb4801e99b73fc4e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640794531, "uuid": "88edcb9c-0b6e-4570-bf41-2a0f0a98d741", "comment": "Malware payload (RedLineStealer)", "value": "3b59913cc537e979b69b370873da7f99c2cde3a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640794531, "uuid": "75d4812f-d47f-4a76-b87c-a7566e2a32d8", "comment": "Malware payload (RedLineStealer)", "value": "dfa37fa041603db8045595bf75f958cef39810a360741a89d861bfc4ecb6aa8bfaff6e435ea0d7540b157cdf6a955337", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640794531, "uuid": "79c03e73-acbf-441a-890c-e4d7258c9986", "value": "T10B05025D79881E63FC1FB8704A426E8A4B514E92675249D22B64E0FDE3CF055EE03FB8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640794531, "uuid": "9e1f61bd-4ca0-42a1-b89f-ccc44481c87d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640794531, "uuid": "69398caf-e22e-4f09-a98d-73a60d5d5b52", "value": "6144:Xpo5BCQDONcqOU+a0VKSrIxPE/2m4PB7wv02XARD1T62n46F/IgOr4ihCmSo6tKM:qWQDPg+a4KZE+lBL2XAy6FBihjop", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640794531, "uuid": "99ab33dd-b674-4809-a0e0-e18f8bc5c712", "value": 801672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640794531, "uuid": "b5a4325b-76c9-493e-a584-59738b183da1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640794531, "uuid": "602cc348-4906-4b88-81f9-0fbf9b8aa794", "value": "bf40595412bd8e70a813586e7ebb8bca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d677fe13-6882-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640767169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640767169, "uuid": "ce67c6cb-f90d-4547-b1b7-c5e6b9f7f843", "comment": "Malware payload (Mirai)", "value": "357047c8c1cbc5f4cd4a17f8fdeb411a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640767169, "uuid": "86d69691-ca4d-4f05-a0df-ef3332359d81", "comment": "Malware payload (Mirai)", "value": "26e1a50b4f296604735dfc82a28ce1c702b5d8b9721c9c9e68b9656a93ec0d05", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640767169, "uuid": "661a4988-1ed6-43a2-9240-ae06ae4ef0a1", "comment": "Malware payload (Mirai)", "value": "74ca709dcf5c152eefbe48b34475e3ecf68a044c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640767169, "uuid": "c69c09a1-b4ef-40a9-bdf2-b88d416d10a8", "comment": "Malware payload (Mirai)", "value": "5c65708ef630f0b61ee3198f3007480389b57cb6f677e16c3bec4add3df61a06f2a2395bac5553025cecee37ab28aa93", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640767169, "uuid": "d6109b7e-5bc1-4552-bf8f-85fffe3f70da", "value": "T1BC93A61E3E258FBCF79D863547B78E229648338A26E1C545E15CEA011EB034E741FBAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640767169, "uuid": "516037e9-16e1-4aad-baf2-ce5da3f40351", "value": "1536:bK/QR35eT0Ata648QFfy0OVT2ZYHGS9XSWYkhoh9w:ke3sTPiBK0OVyZrS9XSWXhaq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640767169, "uuid": "eeaec0b9-7bd7-40a9-aecc-6bf2dcba9619", "value": 89628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640767169, "uuid": "cc2b0179-a1d5-4a00-b911-589d5dd28af0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640767169, "uuid": "b567c7ec-ff58-4b1e-baa2-d0dd4231d333", "value": "357047c8c1cbc5f4cd4a17f8fdeb411a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb8f8ff6-6862-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1640753407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640753407, "uuid": "25f46f23-928a-44ac-9b32-f2c37d60c70f", "comment": "Malware payload (Gafgyt)", "value": "b765031fe92e43655799ed4926aa35eb", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640753407, "uuid": "a65e3c28-88ef-495f-b1af-242afc15484a", "comment": "Malware payload (Gafgyt)", "value": "2836718b461f52ab6af89a432eb9fa58fd761414e4919d0de475e7c60fd14539", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640753407, "uuid": "bc00a590-714e-4e7e-83ac-515efd08b966", "comment": "Malware payload (Gafgyt)", "value": "fd4099053179f4eb4affcfbc1f5454b3ccc01f45", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640753407, "uuid": "11730b33-cc90-4736-8efa-947189b8de1b", "comment": "Malware payload (Gafgyt)", "value": "8da6f893f552aac844037416fc64b603daafcc335aaf2c787bf49b233499d1b6b1c6d3f78869d538b83932509eed3bf3", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640753407, "uuid": "9f27a717-239e-4b12-a91f-6e2ac4969606", "value": "T19523F1712286DCE2D3307439A2BAC381B39706D4A1FFB0F474724589B3E2E5615EB24B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640753407, "uuid": "700177c0-53cc-4c46-a0cc-6edc44768a50", "value": "768:wWf7bykCtQ5wvJzWcOi3FTH3WJdvF+TWEr2krs3UozsNbJuCXCj8j06GFZf0gvmw:b3dMvJzWc35H3kf+0BzsDG206YMgOU3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640753407, "uuid": "a0dcbaa1-5840-4e06-b192-bb990a02c65f", "value": 46996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640753407, "uuid": "1e5defe5-f347-48ed-8ff1-027bd566f24a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640753407, "uuid": "a01c0323-4ddd-4a82-b9e3-e7f3c1047755", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24e0d666-6846-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640741101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741101, "uuid": "3908e02c-5902-4961-9a5c-faf6b2483318", "comment": "Malware payload", "value": "9f084813d567dcfa373c0fc89c904838", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741101, "uuid": "05d7dad7-a82d-4624-80a7-40549568d40c", "comment": "Malware payload", "value": "29924aa4f4b2c959f131f178506e379f117e040fa5ff1760b2aa92674b2309c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741101, "uuid": "cf15c60c-53ab-408c-a270-7980cf4f1697", "comment": "Malware payload", "value": "2ff7b12db2d5ead3d97955387c14a191715785b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741101, "uuid": "2731951f-bc93-4d16-bdd0-fd7348649444", "comment": "Malware payload", "value": "ad6995c077480513474eb3f65d40ec4f3a65bdc6cc4cf8f40859e6ce8b6246f2669a251f60981b9d9d85ed9ef2c99006", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741101, "uuid": "fd624612-4eaa-4741-9aae-57a6935cb03f", "value": "T15344AE58BE9414F4DABBD77589972D6A727335720B82DE9E0358B3F21F27360AF06900", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741101, "uuid": "780d5245-c6ea-4125-a4dc-415404b3ab7b", "value": "d4755b9a9aec93c05c955ca11140bdc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741101, "uuid": "9214b4f5-e79f-432e-abab-fc0d59bd1f2f", "value": "6144:DZYnFzVRF4jJh9gd+ZBLZOEgOBo9UnQ7cPWa:enr4dWmLAO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640741101, "uuid": "68b459c1-a54c-49a3-b8a7-751163eec603", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640741101, "uuid": "f8facf25-8988-46c0-9921-9e07f292a35f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741101, "uuid": "e7de1edd-f634-417e-a89a-3432d415eb42", "value": "macosx.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ca426e5-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640740873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740873, "uuid": "276aa007-285a-4185-b9aa-af6a14bc7992", "comment": "Malware payload", "value": "0be2d05abd07eb241518086c9a542e32", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740873, "uuid": "5cc9b5ac-5711-47c7-b7bd-60f6b7c34a59", "comment": "Malware payload", "value": "2aa26ee3328873650199782ade3da2e8f23e2e338137099badc554521e012e4a", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740873, "uuid": "dbb1e7a6-0583-4e63-acfa-e16d17664afb", "comment": "Malware payload", "value": "79c46e65dae89caa25e421364341e9d009bfb441", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740873, "uuid": "580538c0-217f-4379-be52-bdd277ded4d6", "comment": "Malware payload", "value": "6310ee0ab3244e9b8469bfa893186c76aa63087f369db68ea9acc01b6386590749372340af0175ecfbaa33cc971b6e48", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740873, "uuid": "ae42ff70-bee2-48a3-912c-7f2798ac12a6", "value": "T1BE64AE58BE9414F4DABBD63589972D6A727335720BD2DE8E135CB3E21F27360AF06900", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740873, "uuid": "e06e6c53-dedd-46d6-8b66-3548a6854c59", "value": "6144:o3XxVRaKjJh9gd+ZBLi8EgOBo9UnQ7cPWa:oH4KdWmL1O0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640740873, "uuid": "49dedb63-2662-4033-9cc5-9a33d00fc9f1", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640740873, "uuid": "2c44f96f-6210-49eb-ab9d-f0724fab78c1", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740873, "uuid": "57601d62-283a-4bd9-ab68-d6e8213b711a", "value": "attacments_1017.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05a43e0e-68a1-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1640780133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640780133, "uuid": "0f018562-50e1-4532-be15-b71e3f6e05e2", "comment": "Malware payload (AgentTesla)", "value": "24b278ba3af768022928d579bca68329", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640780133, "uuid": "f26d3816-8960-45db-829c-ac11e7510837", "comment": "Malware payload (AgentTesla)", "value": "2ba5487668103c62614cfb4288d1c26a8d5172352b3b34363618c8c91c810818", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640780133, "uuid": "57bf09de-11b8-41a7-ae1e-7e530911cfcb", "comment": "Malware payload (AgentTesla)", "value": "5d94eda6ec2a54b8013416cad6e7f738af82925f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640780133, "uuid": "ad9bc4ad-8408-4f33-8913-6b375d0a9908", "comment": "Malware payload (AgentTesla)", "value": "c1586f86dffc2a254cd8db9029d0dca0fc6f086b8a27c3c1f49fedd40ce4ffafea12ceff641d6811359f6c510b8a01d2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640780133, "uuid": "6a44f104-17ed-4dd8-8829-c171629085b7", "value": "T11764FAAA694F44B2C608AC1D6540708C5D38FEAE74C106B763AEC5B9CF55EFA7EC8053", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640780133, "uuid": "d2f0a885-6f06-46b2-8795-46959d61dcdc", "value": "1536:iML/fhKEFHa6gBGu6oOoWDERAeyN39VSP7hKfedzFz76mAg5eeVhMDw5wfLk:iQIxJxdzFtr5RDAw5wfg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640780133, "uuid": "ff832a51-d47b-4b64-8f67-7cfc75c190d9", "value": 315949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640780133, "uuid": "6d47e48f-a38f-4368-9b1d-28abc2d590ce", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640780133, "uuid": "76860204-0fdb-44a2-8a2f-39df6eda533c", "value": "Fund Released Details.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa2076cf-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640741030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741030, "uuid": "995c2b59-f288-4666-b7f1-583b9e83c9f7", "comment": "Malware payload", "value": "be9f50b7f10634edba339218f0042c8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741030, "uuid": "6ea42194-59d1-49a9-962f-e30ba7e4e52e", "comment": "Malware payload", "value": "2c90702f65e2d91f76a5760e342c97304bec7a3cd6124ab514c36b189c3c6bcc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741030, "uuid": "d604009d-225d-4a3f-b6e7-0ad34d1b4649", "comment": "Malware payload", "value": "b3a420eed6c738eef9528852f8414ac35220211d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741030, "uuid": "91badb8b-e8c8-4f67-86d8-6f73c1ca1112", "comment": "Malware payload", "value": "3c00cba39c8ae8ddb2eb1f4c81753897c94fba7cbe82bfdf7d6ddd6f657d9231bdc5eb177a5856b9f86855e282f0665b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741030, "uuid": "19a8222c-9da4-4f1e-9a51-399fa400af3f", "value": "T14244AE58FE9414F4DABBD63589972D6A727335720B83DE9E0358B3E21F27361AF06900", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741030, "uuid": "b5670d17-0219-415b-998a-09489a0c49dc", "value": "d4755b9a9aec93c05c955ca11140bdc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741030, "uuid": "cd5b7ee1-af45-45c6-9a3b-3bb9ac18c630", "value": "6144:+Bti99SVZVwjJh9gd+ZBLZlEgOBo9UnQ7cPWa:ctiywdWmLHO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640741030, "uuid": "0ed860d9-4bb9-4dee-bfab-636ddbf59b07", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640741030, "uuid": "0bcad233-7a60-4c00-83a2-44b6e30fcd16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741030, "uuid": "ef30d875-d20b-4284-999e-afa5a56f34f3", "value": "macosx.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8460a98c-687c-11ec-9275-42010a9c0029", "comment": "Malware payload (CryptBot)", "timestamp": 1640764454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640764454, "uuid": "a84d864e-17d7-4055-ac4d-96ef27e82c54", "comment": "Malware payload (CryptBot)", "value": "8b2242c04e274c84a8dc25bcab75158f", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640764454, "uuid": "fcb8716b-eb2e-40d8-ad3f-bfa51700c8ba", "comment": "Malware payload (CryptBot)", "value": "2dfc078c3658a63016fd846cc735c0d5c359b6639cb89ae08ccc9a19fb3e5df3", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640764454, "uuid": "9f1fc638-1cc4-40d3-acf0-a23a83940b7f", "comment": "Malware payload (CryptBot)", "value": "33d4c61dca4ab2392f23b18ac3188491db586f0f", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640764454, "uuid": "f4ddfd95-89e5-4fe0-9b7b-e8713d5f543d", "comment": "Malware payload (CryptBot)", "value": "9629e65f63e0ad84b64ba6c90045dde05a74c5944391277b23795dd5b0a8d513aa20a048ce7b1f87707a1f3216d705d8", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640764454, "uuid": "4b273310-1f85-4085-b0bf-b4d62c6f388a", "value": "T179D53317BE354986E60E83F3563DC1FB5395DB4486AA10693338A4F346A8C8F47E2E71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640764454, "uuid": "8b024e11-5b73-4828-91ac-80f4b59dd02e", "value": "076fd3bc44050b5480459bd4d8e1a2d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640764454, "uuid": "0bc341e2-8254-49c5-8946-627ad2aff39d", "value": "49152:slFzazSpSSj2zjc7gjSHxpNqcX3Z5U75f7CB21QrLiaLEHkFa/BFJCqLRf6:suoj2zo7aSdqcX3Xo7u2CrLiaLva/BF2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640764454, "uuid": "b3b3dff2-7fdb-4b9d-85cb-aaefd7425782", "value": 2760704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640764454, "uuid": "a84f2877-1e65-4cbe-9a23-0e4046b691ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640764454, "uuid": "40f68642-2a84-4ae6-95d2-fc96b3e93c99", "value": "8b2242c04e274c84a8dc25bcab75158f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb7ecc22-6900-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640821348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640821348, "uuid": "43685796-f867-42c0-8599-f56630eb61f6", "comment": "Malware payload (Mirai)", "value": "a4fe28d58f50f1bb64af23d79cc366d0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640821348, "uuid": "e4a7668c-57bd-48ed-a7d7-d97e7fcb0afe", "comment": "Malware payload (Mirai)", "value": "2e2682fda1f277e419d673fc15e808723312318e9dcf71b6d17b013e18e3f3a5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640821348, "uuid": "b3388f18-8b15-40d9-ac8e-643a46f7117a", "comment": "Malware payload (Mirai)", "value": "f176a778b81446361c6af4a163fc0dc48436b963", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640821348, "uuid": "61b9bcd6-246c-4c9b-978d-7086f689a37c", "comment": "Malware payload (Mirai)", "value": "008399a0606c4ecbc9d767a22005c1081a78e0dc787814c5e9b923bb5d9580438d585da5f780fc5f83ee4e60c1fd4334", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640821348, "uuid": "2f0d8bc6-1961-4475-be85-7d57ef23d672", "value": "T1B6F35D46EA818A13C4C6137AB9AF018E3332A7D4E3DB73078D185FB43F8665E0E63945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640821348, "uuid": "380aa6d5-5672-46f9-9d0c-eceadb453998", "value": "3072:d2nHsiNDOkYol8Gs6cGQ+9tn0zOXb5D2fFStkhM/9DIk:dIHsiZCol3vV7tn0zOXdDmStuM/9DIk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640821348, "uuid": "3f40b146-3beb-4c4f-a8a9-f3d6a09765ce", "value": 167894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640821348, "uuid": "c156e907-f236-4d4a-bbd5-3116868abe03", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640821348, "uuid": "1da57c75-5fe9-4cdb-b2e4-3cbffb73615e", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35d57bb0-6846-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640741130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741130, "uuid": "fb4acf67-b22d-4bbf-b714-d7c39368be5d", "comment": "Malware payload", "value": "153e8efa362bf77075778a8a1708702e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741130, "uuid": "ed4751f9-b8ef-4073-a32d-35e910d66ab0", "comment": "Malware payload", "value": "2e30e80613b34e4e0f206f0197db7f23f9d3a1da73efee6a6ff98081a56316fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741130, "uuid": "0f09918d-85fe-41c9-94d9-7c0583568ecc", "comment": "Malware payload", "value": "4c393a1a937c7950f0039824b784d007d33234ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741130, "uuid": "1b721714-e729-4d44-aebd-467b0251b920", "comment": "Malware payload", "value": "3584a77063ce9f50394d1599fd797771d09629258573c0b2151a781d7dc32c6ff7b4b09c424bffa86485c3eca49e5188", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741130, "uuid": "cf9041a2-de84-4e2e-91b7-0e2771f2ba50", "value": "T17444AE58FE9414F4DABBD63589972D6A727335320B83DE9E0358B3E21F27361AF06900", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741130, "uuid": "d33c238a-00ef-4fac-bd63-ba350a2bf101", "value": "d4755b9a9aec93c05c955ca11140bdc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741130, "uuid": "1da0af8c-c9d2-4101-a75a-253bcfb707de", "value": "6144:SPQrboziZ5U7VjJh9gd+ZBL4CEgOBo9UnQ7cPWa:SY/MiZYVdWmL4GO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640741130, "uuid": "f7562696-ec8f-4d9b-a565-34d48c0a6ba5", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640741130, "uuid": "dea1639e-7ce3-4347-a405-64b42baa37bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741130, "uuid": "f51d63f5-ae88-4469-b6a3-fdde51e8d0c2", "value": "macosx.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ca860d5-687c-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1640764468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640764468, "uuid": "1f35b0d5-ec9b-4481-bf9d-adbf90e4ef11", "comment": "Malware payload (ArkeiStealer)", "value": "2862d4ee0774840cfa01204a5410781a", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640764468, "uuid": "4b2c2124-e3c2-41fb-ac4e-29e31414a8be", "comment": "Malware payload (ArkeiStealer)", "value": "2ff10148112933987a694ab813725a70ab580d7288acf3f58e4ce70ebaf5cc91", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640764468, "uuid": "626456b2-d943-49e1-b0b9-d98eb159abe7", "comment": "Malware payload (ArkeiStealer)", "value": "8857832da8e1bb347c5f684e4e98aa66342f22c1", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640764468, "uuid": "e85346fc-d90e-4a68-a20e-02a7bd056938", "comment": "Malware payload (ArkeiStealer)", "value": "76a4882a739dfaa612f63fa3bcf4d8a607d674f89b94a610a3ad525b2a9fa7389aa8a563f6a542c233416f9beebe88d6", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640764468, "uuid": "35a89828-d76f-40ef-92c2-ff495ee225b5", "value": "T17975239403AF25B7D405867EBA86D259A2D3620298CF47C501CF7AEC9BCA6874CDDF07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640764468, "uuid": "c34c957e-d830-470a-8a19-b7108e4aad29", "value": "ac689922c86295c0dd120b0fd683a8c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640764468, "uuid": "8556ae36-df42-401a-b242-a46233f53f40", "value": "24576:3dOf3Pyl++cBSM9sMKWH1L6zSIOg9FobuTUdHpUOR5Tw1BfeQawDF1HnB3:38f3KleKWH1L6zSzsFoqg4q5s1BLF1Hx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640764468, "uuid": "092252a0-b10c-4ffa-982b-94ae63496666", "value": 1552904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640764468, "uuid": "94f116a6-7c5d-4cdd-8e4c-3c8e5d304d2e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640764468, "uuid": "231fcb0d-8ed8-4c85-b6ca-a80b9bb7420a", "value": "2862d4ee0774840cfa01204a5410781a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01c02e58-6846-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640741042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741042, "uuid": "c187a4e1-3be0-4b6c-bdf8-00628dd5c17b", "comment": "Malware payload", "value": "b1f0928cb7e1c4a82e0a95d0271b52d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741042, "uuid": "2aa39d96-e486-47ec-b7eb-554207c3b6e7", "comment": "Malware payload", "value": "30563db8ca9c18385c8456b063987716997b98515441d5218779044adf811d6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741042, "uuid": "ad2a4a8f-849c-4013-a807-b76d928212c4", "comment": "Malware payload", "value": "7c2a996da47ac9ffd365c674d758086dc3854a0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741042, "uuid": "9f1b1229-c9e4-4d9d-807c-8429bde8ffb6", "comment": "Malware payload", "value": "7bb9513e23358d2f9cae7d01c22267e4d8a051ed51c625aeeab21a4838865d10ffbdbf5f9056e62dc5587fd219032ff8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741042, "uuid": "dab728de-0cc8-45ba-b63b-9e03a2fd88a5", "value": "T11D44AE58BE9414F4DABBD63589972D6A727335720B83DE9F0358B3E61F27360AF06900", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741042, "uuid": "8e3abfbd-efcf-424c-861e-25dc27198802", "value": "d4755b9a9aec93c05c955ca11140bdc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741042, "uuid": "043cdcc6-338d-478a-97b3-6b465185a10e", "value": "6144:jG0VbSdQ55eHrjJh9gd+ZBLEmzEgOBo9UnQ7cPWa:PuGOHrdWmLZO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640741042, "uuid": "3a78e1ad-8a5d-41dc-a95f-32ffb67bbef0", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640741042, "uuid": "7f93467b-16db-43ef-9c33-f416c49cff46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741042, "uuid": "0abc887e-140f-4826-a173-79a4c3324210", "value": "macosx.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cb09783-6846-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640741087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741087, "uuid": "9f1ff4a1-9003-4bef-b85e-55525841367a", "comment": "Malware payload", "value": "e29be38b79554cd7d9826f4903723c09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741087, "uuid": "21d0af9c-176f-44f8-a6a1-8ed2e01fbc47", "comment": "Malware payload", "value": "30f68d167e174241a0ba25c4ee1aa1dd46dc4758915b67f2568eb6a61ba5a3d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741087, "uuid": "cb3ac2d1-3d11-47ba-8234-bbda26ea7ae4", "comment": "Malware payload", "value": "ab32487a899d3a82a5e7547408ebd666913336a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741087, "uuid": "f69d803a-4fd8-497b-8735-48cc354b3824", "comment": "Malware payload", "value": "f00d797669ba16ce5ece33c2165ff1c444c26ca1dce08babac401c39585770515708986cb29c392cd989602e601dac58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741087, "uuid": "0dbf3c25-8e49-4699-87de-8e3978ec8602", "value": "T1BC44AE58FE9414F4DABBD63589972D6A737335720B82DE9E0358B3E61F27361AF06800", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741087, "uuid": "a01c1746-399d-433a-ad73-c47b2aedc019", "value": "d4755b9a9aec93c05c955ca11140bdc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741087, "uuid": "8e04301e-027d-4083-ad26-576fba024be1", "value": "6144:elHc5qTjJh9gd+ZBLOHhEgOBo9UnQ7cPWa:CRTdWmLIZO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640741087, "uuid": "c3682468-5520-4f6d-829f-88ea993809ee", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640741087, "uuid": "68e5c900-e4e5-40f6-9d31-bea7ba3421ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741087, "uuid": "f9a50b18-e147-44a9-a9b5-9acb96fa5e0e", "value": "macosx.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "052701cc-6846-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640741048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741048, "uuid": "3385ec3d-fbc9-4e13-bfc1-0cdeea432218", "comment": "Malware payload", "value": "8d58a11545c8d7c110457aaa73a2b95a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741048, "uuid": "64d5821b-0aca-4ef5-ac49-d392f45dc4fc", "comment": "Malware payload", "value": "338e6c40866dfc1665cca6aea604bc7fc24c8087410c1d4d1b9360059cb8c68e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741048, "uuid": "08e90515-760b-467a-9bcf-71bfbc092f38", "comment": "Malware payload", "value": "4cdc2e3caa0b94f9a0ab26f541be7dfc24a4dfd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741048, "uuid": "7bdc2ed6-345d-4aea-b42f-0619bc02fbfe", "comment": "Malware payload", "value": "7c6115e24deea8d66a89ef7e5f1210d32b83ccd513491bf24915511fbb50a6b8833ae2fafc111295ee1395616e893105", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741048, "uuid": "14c7aa69-11fe-4b30-bcdd-d95d24675a42", "value": "T140449E58FE9414F4DABBD63589972D6A727335720B83DE9E0358B3E61F27360AF06900", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741048, "uuid": "1651f71e-9545-45a3-8e3e-b09105a718a2", "value": "d4755b9a9aec93c05c955ca11140bdc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741048, "uuid": "d6d37052-3ebe-41f5-8bea-4b877c7821bc", "value": "6144:fl0QFozCZ5U71jJh9gd+ZBLLCEgOBo9UnQ7cPWa:faQFMCZY1dWmLLGO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640741048, "uuid": "58f6f19e-d7d8-44cb-9be7-6af9f6f692b9", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640741048, "uuid": "8aa6d110-384e-4842-ba9e-6fd1c4731813", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741048, "uuid": "ada49bbc-1a13-42e4-b114-ab86daff6842", "value": "macosx.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15221da1-68cb-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1640798198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640798198, "uuid": "be90315a-57af-4ae5-a861-f907bcab8d76", "comment": "Malware payload (AgentTesla)", "value": "ddf9de06c6a613532c458050705b6b3f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640798198, "uuid": "095b2f35-d8ac-44e7-b446-de7e84e78626", "comment": "Malware payload (AgentTesla)", "value": "3400fb69c6d46a8f3171110b48b7e443a0828b3a45054a63536b3689b5d2bad0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640798198, "uuid": "7ceef552-2e4a-4d5f-befe-bce034930382", "comment": "Malware payload (AgentTesla)", "value": "93f238922442d016b78e23468cb826744ce3359c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640798198, "uuid": "12be0bd5-09be-4d79-9230-26540cd3afe2", "comment": "Malware payload (AgentTesla)", "value": "4a9750606ed6854ea65d54e2c9addab1c03742858db8153bd3eca5c2c61a3f0dd50c4682d6770d886653d692d9f3d9b6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640798198, "uuid": "8b828ca4-8d77-4501-9db7-aacb10229955", "value": "T12B94221466A25332D5FB0BF9263133310B79B0357E26D2CCADD610DAA473F568922F9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640798198, "uuid": "3e9900cf-7df9-431e-9b10-0fb2f7e39cb4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640798198, "uuid": "1c67d17b-37a0-4820-b761-5b7773e0c78c", "value": "12288:AKqiJ8ETvNG3Lgo58P8rXZ+5WC7zjXbcKI1tbzc:/8ETFOLgoeP3Ffg1tbzc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640798198, "uuid": "061175b7-6f5e-47b8-9ecc-5ddc7369739a", "value": 431104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640798198, "uuid": "fa8e018c-0c48-4f15-ba48-a15a9388df72", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640798198, "uuid": "2d1ccd70-c239-4d4f-94fb-95f97cc19933", "value": "DHL Shipment WaybillDoc_TransportLabel_PRG211001715606.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6fb9016-68b4-11ec-9275-42010a9c0029", "comment": "Malware payload (CryptBot)", "timestamp": 1640788698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640788698, "uuid": "57bc7177-617f-4620-bd7d-2ced7e7d6ab9", "comment": "Malware payload (CryptBot)", "value": "18c556920d3c2e5a0037ee549896e670", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake-crack", "colour": "#673A20", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640788698, "uuid": "adc6351a-fa8a-4430-81d0-5f641a949fd1", "comment": "Malware payload (CryptBot)", "value": "364b659737adfdb115137df44a5ba08b9e2f89a645095c335c396bba4a924b82", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake-crack", "colour": "#673A20", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640788698, "uuid": "245a6f33-8592-4946-94b1-035489e3f692", "comment": "Malware payload (CryptBot)", "value": "298d33f873eba5afa9a75fbec65800d97a5eedee", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake-crack", "colour": "#673A20", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640788698, "uuid": "76ea3b47-9df2-40bf-be8a-ee5922bdb421", "comment": "Malware payload (CryptBot)", "value": "c71f7c1b2c17452fb25809d3e9f7184a07795448d899cb69cf5315c3ea380a382436f7bd59977a8cde53f3d940ad11ed", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake-crack", "colour": "#673A20", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640788698, "uuid": "c53c072c-20dd-42ea-93ac-cf8de0d1b0b8", "value": "T189D53306D44D84EFDAC9EAF20D7C8DA8BA54CB675150C4A62E6F1F1BEE1544AB7C03C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640788698, "uuid": "c8803eb0-c18d-4290-a893-9e031f4c0f4e", "value": "076fd3bc44050b5480459bd4d8e1a2d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640788698, "uuid": "0f5f26e7-ceed-4467-b880-3af29fe2fd0e", "value": "49152:w7FNaZTcuqroq7KgilL1zqrkEhL46kX+lIcr3B/FEjD+E7CTpTh79bLxQJ:wvaicq2gaVq3L46kKnB/qD+EG9Tbx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640788698, "uuid": "a2d2499d-6e1c-4e13-ad00-5130fbfc37b1", "value": 2750976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640788698, "uuid": "e38eee4e-a24c-45e1-a9c4-71ca3b492d57", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640788698, "uuid": "3f60a7ce-75e1-4c0d-a2c1-d8803f2522e2", "value": "activate-it.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09d0db74-68cb-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1640798179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640798179, "uuid": "0aa3b19f-f14d-4f4f-aa21-d16fe6dd1d68", "comment": "Malware payload (AgentTesla)", "value": "a0bde31e3c8b3e5f3f5b75ac95cf9cf1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640798179, "uuid": "a548853f-3c0f-420b-b418-434fda9f109c", "comment": "Malware payload (AgentTesla)", "value": "374b7a9c56aeeaeff144362d834accd1d02b8ec8922b1b6561693f4e83146597", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640798179, "uuid": "5c741fc1-5a37-4481-a919-38f2195c02da", "comment": "Malware payload (AgentTesla)", "value": "617a18017bae353f5c6b1308a377b405ca3d9cc3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640798179, "uuid": "87727bd1-30f4-4336-932a-3cc599ca50b2", "comment": "Malware payload (AgentTesla)", "value": "13865480fe312ceae00b2aa6def5e8f103454c655fdca55850e9f07850a6b7c434ab6f01729be074c9af5f580ffb453f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640798179, "uuid": "bb9a8013-34d0-4b5a-a155-4b2a56de0e6b", "value": "T18694127057491737D27E9FBAB6263A14537079223836E30E5CC1B0EC0662F9A8A71F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640798179, "uuid": "d166414d-595b-4347-b47f-fe472a0a872c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640798179, "uuid": "5526a260-e7dd-4e29-ab9e-c4d440d2fd31", "value": "12288:c3XCZeoc0KVYlk196Vvj54dmqFhjd/HaNe4oc:aT5YMQjDqFhtatoc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640798179, "uuid": "d16a4284-208a-494f-9864-fd394c054394", "value": 433152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640798179, "uuid": "b2b4bbbe-d33d-4334-8632-a2660c3f6793", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640798179, "uuid": "0e37f548-1af5-4449-9a77-e700496b82aa", "value": "DHL Shipment WaybillDoc_TransportLabel_PRG211001715606.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f60e8f7b-6884-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640768081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640768081, "uuid": "9e64bd25-3f99-4e1e-9c57-25b0cf9e0e57", "comment": "Malware payload (Mirai)", "value": "affc42ccceae8c3fefcbe46d1436b780", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640768081, "uuid": "0a350647-5e44-4b94-bfcc-1f3a1b941000", "comment": "Malware payload (Mirai)", "value": "39f9c9282d33b2670b8341409cf35df8b79beeffd7af6d31b21e6450cddbd571", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640768081, "uuid": "17bd7369-be19-4b7d-aa07-93f945fc4fba", "comment": "Malware payload (Mirai)", "value": "241354299be1d7062e5eeb6990d596332501a84f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640768081, "uuid": "c123811f-7f1e-45e5-801a-dc38edb590d8", "comment": "Malware payload (Mirai)", "value": "4fc2d72b38e277adad94bacc1641a9c5f7cc6f69ddaa7c3da935e5c4e4c46253840f93c05d4efa715b7a32641d09aeb1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640768081, "uuid": "07e83e55-11cc-41a1-8d21-80fc29246cdf", "value": "T1D163189678D19A12C6E423BBF96E01CD332563A8D2DF320B9D212F5477CA82F0D77652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640768081, "uuid": "ff1e00bb-53ce-46a7-b136-4fb85991a33b", "value": "1536:06VUvv15Ku1W7+9IV55fWfh9ympRTQjhKcahWMUiN4g5P9/e35ykzt:06Qh9hRghKvhT8gy3Dz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640768081, "uuid": "100ecb22-4146-45d0-983f-796a79e034a4", "value": 72184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640768081, "uuid": "59cb5703-fd06-4a8b-8b48-c580ecf1189c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640768081, "uuid": "365db1d5-9ffd-471d-994f-7dd6c73f83f4", "value": "affc42ccceae8c3fefcbe46d1436b780", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bb78d4c-686b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640757004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640757004, "uuid": "6cc89177-ea3d-4fae-9a8d-e785999312c2", "comment": "Malware payload (Mirai)", "value": "c13ad795663abf2d6190e5dae48e2f20", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640757004, "uuid": "e014ddd0-1c17-4445-95f6-88d0ce64e6e0", "comment": "Malware payload (Mirai)", "value": "3a13730df683eb95b83978cab84e9f3e6805168a9d4367ba36bec7630464dc9d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640757004, "uuid": "226aadc6-5418-4a74-ae06-65001ae3a42c", "comment": "Malware payload (Mirai)", "value": "5b04fe4af88303479f353614ab7b0176b48adb7e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640757004, "uuid": "02b8a146-c894-4353-82ec-6985415c3ff7", "comment": "Malware payload (Mirai)", "value": "be98f7b2941e15212612e0db1571df17c395616d91b113781d461d28749626665cd20977a08fe1e1ce6718dafe6628a5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640757004, "uuid": "dcac5b12-2e2f-4749-b3e4-ba24161d6cad", "value": "T1E8E34C56EA418B03C4D5277ABAAF02493322A764E3DB73069D185FB43F87B5F0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640757004, "uuid": "27301226-2f9a-42f9-8b4f-e0552e878e91", "value": "3072:ZI3FOKPJdmXfwS0Jetag12GX9TdhdjBVxpffWzJipM/99Sn2Ej:a3FOiJdmXfwx8IgkGX9TdhhBVWzJEM/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640757004, "uuid": "77f1e5c7-3ead-4d7b-ae60-aaafd533df1e", "value": 146387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640757004, "uuid": "3c3836ac-d507-47f7-9012-bfd177c5bdbe", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640757004, "uuid": "487c8052-7136-4245-b689-f265e745485e", "value": "apep.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e2afb2e-6846-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640741117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741117, "uuid": "9643dee8-bb2b-433b-8352-7e3c35393b18", "comment": "Malware payload", "value": "02dba156dfcbc6ce131aee4268aa0a5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741117, "uuid": "64523490-3bfa-47f2-b8f7-85cf153fabac", "comment": "Malware payload", "value": "3a9a78e13f4fb377d65f9e0bfd6e244f2dd9c96f501ad4c7ab71a4b3f66d36b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741117, "uuid": "923a9801-f77d-4b51-89fc-ecccd3556004", "comment": "Malware payload", "value": "d1ceb9cba6ea3c8403ebf1ac24985975917c028a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741117, "uuid": "174e5980-6ce9-4e03-a12d-6be61ce00d2c", "comment": "Malware payload", "value": "23e388ccacc7f712e119eca30dd61d32b0a922e46448faa9cd065b59d3242bed9e1e6a960167e41550c4f017739ef22b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741117, "uuid": "5fbd7007-de12-40f8-8f24-fa2802376fe7", "value": "T17E44AE58BEA414F4DABBD73549972D6A727335720BC2DE9E0358B3E21F27361AF06900", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741117, "uuid": "0d6f0407-2254-4b49-9697-f76e6dd63622", "value": "d4755b9a9aec93c05c955ca11140bdc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741117, "uuid": "7035133c-7835-4549-a7b1-590e5e039de1", "value": "6144:OZcVKNWOjJh9gd+ZBLJEgOBo9UnQ7cPWa:GqOdWmLBO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640741117, "uuid": "8abc4d61-5109-472e-b59a-c38e7b6165c5", "value": 270336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640741117, "uuid": "3f7f9904-944b-43ea-9344-d8021b39739c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741117, "uuid": "1dc01b1b-934d-4448-b469-31cb6be225de", "value": "macosx.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b08e476-686b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640757003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640757003, "uuid": "bae7557f-e40f-4b13-bafc-8026bc25ba7a", "comment": "Malware payload (Mirai)", "value": "19e4a0dc1d10e2f1b71c082beab5e15c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640757003, "uuid": "985f910a-125b-491e-83c7-ba1193172cda", "comment": "Malware payload (Mirai)", "value": "3b5ff37270f5a5929ac1508906cbce75be29b8a606076d895400b2f79672d7fa", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640757003, "uuid": "40099ec3-7fae-414a-8e65-1634417295fd", "comment": "Malware payload (Mirai)", "value": "d2ac4439ab2e46cc5944d2220523604287e35e97", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640757003, "uuid": "b2e882ee-d83d-48af-8158-834ae5c505d7", "comment": "Malware payload (Mirai)", "value": "287624a0372b0b4afd54e1519ab371239303cf3dfc586787c5ff1edc714d412a9301181a7528c5cf5492aa12aa7b9b2d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640757003, "uuid": "d0ada3a9-2dd2-46e0-b574-94df64c20b84", "value": "T1705349C5A583DDF5EC110A71217BEF328B77F13A111AEE9BD398A6239D42A01E10739D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640757003, "uuid": "ec475faa-40d3-43ff-9b63-cfa182caa537", "value": "1536:cyjg1uYGT4BZhfTbaJ4QBweBpBIxtoRaZwj+yP5t5DiztCuK5N8bQ:c2euYc4BZRTbEBwebmtoRaZwjxRt5juS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640757003, "uuid": "33c39a09-67e7-40e5-9a1d-3b7a26d9a5e3", "value": 62492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640757003, "uuid": "eccffc9c-a278-4413-a83b-6740eca88b80", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640757003, "uuid": "ea255506-b31d-4f00-b285-c9a74b7f754d", "value": "apep.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0122c42d-68cb-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1640798164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640798164, "uuid": "40796edb-343e-4ed3-9a9d-77f706bab74a", "comment": "Malware payload (AgentTesla)", "value": "0626e43f89763df42f0651cbe3313f27", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640798164, "uuid": "2f597eee-c898-4fab-b60e-27f9332fab76", "comment": "Malware payload (AgentTesla)", "value": "3f8017225d77b79c3d6b9cdd505012cb00cef8e2b11ee0207f54d2355b8880f7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640798164, "uuid": "3192ae99-014f-424e-aba4-a8926b454962", "comment": "Malware payload (AgentTesla)", "value": "3c0bf1de37a529e4fbfdfecf25ae99163545a09f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640798164, "uuid": "eb83b873-5e6a-47d4-902a-76cec71aaa8b", "comment": "Malware payload (AgentTesla)", "value": "a59ef45a70c7cd1e50dd3c3d9da97fb1ac646e139bcfcb05276b2a2a5b913106136f98330fdd0d8c3e5c0df0e745c529", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640798164, "uuid": "7969f72a-7c8e-4abc-8a32-93c608b704e9", "value": "T1BF4401893BABED34C1288BB20C2993D64275D30DBE9397457DAA103DADE57CF23642C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640798164, "uuid": "b43bd862-88d0-4166-ac10-8617787cb403", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640798164, "uuid": "3139b2ac-1431-4fe3-8f0a-0dd562b4d96d", "value": "6144:80j4Cj10wU20r6prCvYmyZLF27bHrkS0hYmuQ4pf:L4DwU2UOyH0YvQ4pf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640798164, "uuid": "7295b49b-584b-4fe3-940b-1a685c4e8c6f", "value": 273408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640798164, "uuid": "f49df97e-3903-4759-bb83-963c0b5ffec0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640798164, "uuid": "f9e2860a-075d-46e9-952f-bfc4b33e7006", "value": "DHL Delivery Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8be7fe0c-68e4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640809135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640809135, "uuid": "8080541a-f3c0-487c-9de2-63a9ea0d960d", "comment": "Malware payload", "value": "36c087cb423663c91959f045aa116c22", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640809135, "uuid": "2c6fa52c-bd4c-4bed-b09f-c840f9921b3e", "comment": "Malware payload", "value": "402410a6afb5e119cbabd9f69bbc5e22ed0f2777a459fc81e02feb737f45e706", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640809135, "uuid": "89e9f1ff-fe7f-4fcd-bb30-83d152f68da0", "comment": "Malware payload", "value": "221b6c970218dfd28a39030cd087a4f796f43ab0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640809135, "uuid": "bf21246b-bd10-4f19-b750-794e3694f475", "comment": "Malware payload", "value": "d18fb243a6b8455ee351d5dd3d00f98c0044f739f8ed84139dbcbde56e9f592e20dccebc528c0038c9a7c73ad695990d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640809135, "uuid": "0cb4f2a9-43bd-4aec-bcf4-5e2117c99791", "value": "T1B50412A60815DCF8FBD65D780712BD3A3169EA30EF89F0824AD0D6D59DD51231F3B44A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640809135, "uuid": "9f301237-b92c-450b-a309-b6d13c34c9a9", "value": "88f775776887c3897bf5575da16525a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640809135, "uuid": "8a9e8dd6-0143-4f6b-a381-da0aaa34811e", "value": "3072:ybVcCJGB0z9goLCg9yd7HhSqCNJ+KntK2g33dfEwIjYKlSMpPEpTptc:ybiCJK0+oWg9yd70NJPntiewIUKkMqI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640809135, "uuid": "730da28f-6cf4-45c8-8ef2-e6bef2d2b224", "value": 186862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640809135, "uuid": "0d0d1f6f-4483-4982-ba17-b51b8e61d199", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640809135, "uuid": "b8f60c43-f5b6-47a8-95f4-c18744b3c29c", "value": "36c087cb423663c91959f045aa116c22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "860a3cb4-687c-11ec-9275-42010a9c0029", "comment": "Malware payload (CryptBot)", "timestamp": 1640764457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640764457, "uuid": "3fcba647-4bf0-4f13-9a15-27e4e7ca71e5", "comment": "Malware payload (CryptBot)", "value": "06a6da8543ba7767c8728a2de532d224", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640764457, "uuid": "6bc97b66-3762-4fcc-9de9-31ee4bcc9f72", "comment": "Malware payload (CryptBot)", "value": "41df984882b7cb539f1bcc03433f60e2bd7a0313b1e05bda78338d9176d6996b", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640764457, "uuid": "7fdb38c4-a36b-4eb5-bb0b-1d3f401f79e1", "comment": "Malware payload (CryptBot)", "value": "94772a4b0bd3230ee749d160366c41751e71f1a0", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640764457, "uuid": "9073c6bd-19fd-473d-a524-58b576e7d27a", "comment": "Malware payload (CryptBot)", "value": "51999ac634a673a9c9d998bd44a07c564b18d0db593caf8107f76617d9f2f1b21c39253456325570f82f204f4101d6b1", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640764457, "uuid": "3c26d9ce-7845-4303-8f56-f0545c4a3bda", "value": "T149D5331429931C4CC11C64F3E57A5A6E360D339800987399BD2F7AFB316EEDFC69A891", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640764457, "uuid": "8a38edb1-9ea4-42b1-b1bb-2e274e4be530", "value": "076fd3bc44050b5480459bd4d8e1a2d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640764457, "uuid": "0fced196-e2a8-4f63-9bd0-8bd8c0e2caaa", "value": "49152:5AZ7tvf8sW9ZVptIMjG/DfXPVFfF+8y9NSevvSbEIu/2Z96JE2y2Q:5AZBHG9B6Mj4zXPVNF+8y9JvSbEb49lB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640764457, "uuid": "8a6c8e47-6135-4c3e-9769-3c85ceb56f67", "value": 2755584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640764457, "uuid": "39c1f109-b3ca-4328-9798-990875fddeda", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640764457, "uuid": "32671f5d-ff35-46ce-8bef-c648aeafca4f", "value": "06a6da8543ba7767c8728a2de532d224.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8557dc2b-68c9-11ec-9275-42010a9c0029", "comment": "Malware payload (QuasarRAT)", "timestamp": 1640797527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640797527, "uuid": "410c2461-6000-44a5-817d-243885fdfed2", "comment": "Malware payload (QuasarRAT)", "value": "23cde0022c4f71e4a90e27cfe229a257", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640797527, "uuid": "6d80fbf0-ae77-448d-bd7a-6e4ed419b01e", "comment": "Malware payload (QuasarRAT)", "value": "47014593d97368b6ed063234c8a3df28e7d89ad4abf5a7d5c176d64bf2e66967", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640797527, "uuid": "5bb8f1f3-0f85-42b4-80a6-aa79858062e0", "comment": "Malware payload (QuasarRAT)", "value": "0c6c3cde893904ea1093883d06917d9b73f2ae68", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640797527, "uuid": "6aebbc05-b207-435a-be9d-3c2acb7043e3", "comment": "Malware payload (QuasarRAT)", "value": "5870014ad52794d93976cd7219bf955539cd7fc16c415abaaae179aebebd0c6678d1129ac243288e83082d6bec218139", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640797527, "uuid": "57d17f32-043a-4076-855c-038792cc8d09", "value": "T100D3AD617A41C816D98547710CE2DAE87B3BFC926EB707033695F72E2EB36D0D91360A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640797527, "uuid": "a26bfbbb-31f4-41f2-b4ca-11028c898843", "value": "3072:prxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAK/h3gRqCCwtnvTZmcCZUeRaqwZUdEAW:lxEtjPOtioVjDGUU1qfDlavx+W2QnAcG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640797527, "uuid": "74902acd-6891-4261-ba8b-41e6900984f8", "value": 138240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640797527, "uuid": "5cb0cbfa-c566-4f12-9539-11b9f0ca884f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640797527, "uuid": "12f702ff-31eb-455a-9202-decff4626807", "value": "Comprobante.de.Pago.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5d2d41c-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640740888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740888, "uuid": "bbc2c52b-78df-4a8a-a03f-a40ea1a31f97", "comment": "Malware payload", "value": "425af4546d5b9332bec3fc17c28ca895", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740888, "uuid": "c62be908-2ac7-49c1-90f1-d9b38f443d5b", "comment": "Malware payload", "value": "483ef20b151035051e3aa40d17d8eaba4c26e688407d8df971fef701c126c2c1", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740888, "uuid": "c9c75ebd-94cb-4259-a9c0-14eb03751a99", "comment": "Malware payload", "value": "f4606d3b766a0afc7d21f82fbebf5a9562f9c3ba", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740888, "uuid": "b0c57927-f5ce-498f-8346-18b780d16609", "comment": "Malware payload", "value": "f6b7b0ffc7533b88d1fedeaa71b77245a36d79090e7eb1fc8ab054ffc6506e860db7c421e9e5b744f5a0e82a9ccac01f", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740888, "uuid": "e04efe09-0cb1-4c2c-82b7-998a8d863312", "value": "T16F64AE58BA9414F4DABBD63589972D6A727335720BD3DE9E035CB3E21F27360AF06900", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740888, "uuid": "3e01f94d-b101-4112-b884-5ed249cdc2f6", "value": "6144:mr2Xa2Zp6jJh9gd+ZBLrAEgOBo9UnQ7cPWa:D16dWmLEO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640740888, "uuid": "4a536272-4c57-4f7e-b0cd-71704c935987", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640740888, "uuid": "d8f03c87-a47f-49d1-91ce-fefe4303c71d", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740888, "uuid": "490e950f-dd89-4af8-a48e-c021628ab45c", "value": "Attachments-2013.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffbc1688-6900-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640821355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640821355, "uuid": "0fbe2b73-6d77-4ad8-9d10-d2df10aefc29", "comment": "Malware payload (Mirai)", "value": "3e992e2caf2aee0683ef7e23bc86c1f5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640821355, "uuid": "7fde258a-2596-4c25-b387-4b239fa8bedc", "comment": "Malware payload (Mirai)", "value": "497de709280e24d4477f3c303404dab7433f1b815101cee60a58b0fc96ab9ea3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640821355, "uuid": "6286e22f-e31d-45fa-82ca-bad005cd3328", "comment": "Malware payload (Mirai)", "value": "1451e814d42887cd7780da95e5663b50dbe6605d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640821355, "uuid": "d309c731-bd30-4647-acd3-bc674976062a", "comment": "Malware payload (Mirai)", "value": "29aae129be9809ccf77cd7bc084b6a91d7ffbce39a054abdb8f696f3e42d57e7480a2de81b737d86a50966bccaf7d5e3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640821355, "uuid": "f64747ab-0103-4681-8125-8569310604dd", "value": "T1CC832895BCD29A5AC6D4237AF97E11DE332073E8C2DB7127CC200B587ADA51F0D63A91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640821355, "uuid": "58e04f6d-66de-40d5-8283-8a8436319923", "value": "1536:jVbT6BwFG7df4yNtjnOfpD8c36pk979lB2lfMaYVD1pSTtwfQEHmkkkkkkkkkkk0:jVbGB+GZf4yNYRJjpgmykkkkkkkkkkk0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640821355, "uuid": "1e2812fc-a279-4ccc-8346-1739238e5c33", "value": 85392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640821355, "uuid": "8f49a604-07ee-40b5-ba8f-cb7e9cc50555", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640821355, "uuid": "3db42027-5a28-4063-8fdf-c9511ad52c30", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0179fb49-6901-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640821358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640821358, "uuid": "e6441ebc-58b9-4196-890f-495e8f6485df", "comment": "Malware payload (Mirai)", "value": "ea48c89a131aef264a410bdcbc9e1447", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640821358, "uuid": "2700a256-ee74-47fa-b818-85e87ec1ed2e", "comment": "Malware payload (Mirai)", "value": "4a6d2a48595bffbd47eb11b86b759ab8f32fdaee25845c5d03491602d6e94f63", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640821358, "uuid": "5919a838-d80d-4806-ae30-b6d68c5582d9", "comment": "Malware payload (Mirai)", "value": "55d52afecba51e542bc84e499ec258d615428e27", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640821358, "uuid": "f6c8cbfd-55b9-447a-8f48-fa80d14ffeb2", "comment": "Malware payload (Mirai)", "value": "283d343033ef22cb6ecc3928f4e8abcbb3fcac9a59a5f2ad4ca59915e014c9c6c748fe789fb9a8e784fba05ecaa924d1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640821358, "uuid": "585751a1-3858-4338-ba17-2fd3d5de26cb", "value": "T1BA930785BCC19A12CAE8237AF56E01CE371563E8D2DE7217DD201F6437CA82F0D67A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640821358, "uuid": "701b2b8c-c758-45dc-8de0-2302a46d0eda", "value": "1536:UWNtOzGhXfH75A6i/cQb4Uzy+SR6VSmR7a5XEUJAqrVD1pSFKt1ipQ9QW5QEH:UWazYXfHtAP/18UzGrRp/riC9Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640821358, "uuid": "4631b398-e187-4c06-bf62-7e80feb62743", "value": 95228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640821358, "uuid": "de2bfd05-1b4e-4c48-9f9d-fa4323466ef3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640821358, "uuid": "7cf1901c-be97-4f10-83c5-343390ebae4f", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edb754c4-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640741009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741009, "uuid": "96c6d8fa-cf4d-43a6-9189-defe21af4dfb", "comment": "Malware payload", "value": "2e9d0db221c8694f27255f970d3a253e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741009, "uuid": "fad95e8c-8b1d-43d5-b7d9-8f6169c76de5", "comment": "Malware payload", "value": "4b9196b05f54062cfbc147c86daa4b5eba77db3c7fcd6396b0de8b0d144a0ac1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741009, "uuid": "7d2ffa23-c7a5-4dfa-8e86-8263708e2eb4", "comment": "Malware payload", "value": "527bf586bab8d40e43a231bc9bec9350962702f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741009, "uuid": "e62882ad-dfd9-4e40-8494-01893caa9406", "comment": "Malware payload", "value": "71623dbc5de40030a2cd435ae58f585d8725a18e448f09358453fdbf0dd1e1acdc35b92e88be32c8bf7dbb50a72f3263", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741009, "uuid": "46fc8283-a0fa-46f6-9feb-d226e1c66ce9", "value": "T124449E58FE9414F5DABBD63589972D6A727335720BC2DE9E0358B3E21F27360AF06900", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741009, "uuid": "be35e6b2-63fc-444a-b5e9-526ded4da489", "value": "d4755b9a9aec93c05c955ca11140bdc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741009, "uuid": "4e302d7f-a1e1-468d-8ae3-ceec00163206", "value": "6144:pzrqHSdf55eHDjJh9gd+ZBLC1zEgOBo9UnQ7cPWa:1rrlOHDdWmLwO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640741009, "uuid": "5359d20f-863e-4171-9f39-dc53bb2351a1", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640741009, "uuid": "488daf36-f164-4e30-8478-a910cecbfcea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741009, "uuid": "7d76e7bf-68c9-4fa2-b7cd-9eecea38a55a", "value": "macosx.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d664d82d-687a-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1640763733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640763733, "uuid": "a673b967-f108-4598-922b-2eb89bd169a6", "comment": "Malware payload (SnakeKeylogger)", "value": "77f9cd1e0ffcaaeae90e5cc0b3d19b3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640763733, "uuid": "f24eb700-ff28-4c5c-b1e0-dd6aefb0c729", "comment": "Malware payload (SnakeKeylogger)", "value": "4ca89d4e22bfbafdc3eb23c3be0d6e80c9d2ab9763fde20c484cb9735426dadf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640763733, "uuid": "c70b972a-45f8-4fec-9a47-725c721074c4", "comment": "Malware payload (SnakeKeylogger)", "value": "04e34c4eeb8dc74144d4bd45cb8f2edae749fb99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640763733, "uuid": "bf48c8ac-0624-4b37-b682-7ca0d92d4439", "comment": "Malware payload (SnakeKeylogger)", "value": "b7e70b79097c6693599050a1be9399f9aec627308825175b79c06d77867379811a62df886b563083d3201cb783cd3207", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640763733, "uuid": "85fc343b-beac-4af2-9e08-ed86328cc0bd", "value": "T1D1A4D0F865D642C7C6A3A4336DADF32CB09C4FDA2A77804FB3253A2C7731E925A16541", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640763733, "uuid": "140fab7f-bdb8-44bf-a0ac-aa480d474c71", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640763733, "uuid": "97892087-5d99-4c0f-9e0f-65729c83d6ea", "value": "12288:GMw8wUaIA4wVuHQn51pFbEnUuvQgGAWCg+9Y:GMw8wUaIANVuHQn5BAnUgG9Oa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640763733, "uuid": "0a87c922-b803-4455-8ce4-41ba9cb31b06", "value": 488126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640763733, "uuid": "3d45a76b-fbb4-495a-be87-5bc06a1db0cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640763733, "uuid": "81045b31-78aa-4e47-b9f2-a95f5d63a33e", "value": "77f9cd1e0ffcaaeae90e5cc0b3d19b3a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d95765bd-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640740975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740975, "uuid": "208256e3-b50f-4c28-bf26-faf28948bf03", "comment": "Malware payload", "value": "89354716794a4fb38e48e597f03d270f", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740975, "uuid": "d6556b97-82fe-4cf1-a591-98db02363368", "comment": "Malware payload", "value": "4ce077d6c423fca1b947376d28cc20e4006fa89e53eab658094fd28790bd5c91", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740975, "uuid": "c8de573e-98d4-48f6-bce5-ecea75faebb1", "comment": "Malware payload", "value": "c7e621b7325920ea305aae216102bb518a82aed3", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740975, "uuid": "731f7da0-0ddd-43c2-8dda-dc9e982eed3e", "comment": "Malware payload", "value": "f77e94057eb086c0c92bc88eca8d063f52397f9da2d4f1e4ff77694f85517e98ef197d6bd31f884177f836893dddfbc0", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740975, "uuid": "5b6978c3-52a5-42a1-a16b-fc9a39ced524", "value": "T187649D58FE9414F4DABBD63549972D6A727335620BD2DE9E035CB3E21F27360AF06A00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740975, "uuid": "309a5f56-e8e1-454a-be76-75c91c4b343c", "value": "6144:QM6xiys4NDkmjJh9gd+ZBLFEgOBo9UnQ7cPWa:x8iyPRdWmLFO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640740975, "uuid": "0bc90ec8-c3b8-460a-90f8-8c69509723e1", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640740975, "uuid": "831e2872-1b6a-444a-92ce-d2ce38d65aa6", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740975, "uuid": "ccb3f29f-a8fe-4b4d-b847-76dee5826b46", "value": "Attachments-2046.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3ffd9ba-6845-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1640740966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740966, "uuid": "e364626e-e484-43a8-945f-0515b90e4c44", "comment": "Malware payload (NanoCore)", "value": "f29ba9f179fb2eed153f8f2a746e830f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740966, "uuid": "a8391516-6d24-440b-aa21-31452a1f7102", "comment": "Malware payload (NanoCore)", "value": "4f7da7d6fb331a8098d4ce354690ffc64d8f0225307b406e722548109e669d4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740966, "uuid": "1d488c81-1e6a-495d-a8f3-c9c18b7759c0", "comment": "Malware payload (NanoCore)", "value": "dd6b68aa68999db37c8d8d97d057fbefc761c26f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740966, "uuid": "b0820842-8731-46f5-b823-ee57271d9484", "comment": "Malware payload (NanoCore)", "value": "2dc27101e28c87a68354c45f25c8a0910cea271b368a77fb740eb2bd3c66e825c217d6cf3e5d498394292567cde1c18e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740966, "uuid": "811a1685-84da-4618-8463-6ef32344ca9f", "value": "T128B4F15856C493F7D13A35B41043702CADF5A8A1E361D1C4FF8BE2A8C63BF916B2B645", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740966, "uuid": "38b1f226-2e03-4fd7-8d7b-32be580b0c64", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740966, "uuid": "12a6c745-97bc-4d71-9c73-53ec8247d58f", "value": "6144:r8Ofs6bK5ra4/QviaRIGBw3BFTbplRRyA/Caqk1mYP+EXz7n9IIo+6Kb73bQcnGA:oO06G5OHvHRHBezFjk8P+55mXGp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640740966, "uuid": "c3d25510-4fb5-49f0-96c0-6455936b21d4", "value": 522752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640740966, "uuid": "f27557ad-5933-405a-a489-91bba1375288", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740966, "uuid": "43ddde0c-ba8f-490f-ad2c-e9b1a873c55d", "value": "EqSsNFlnik2KxfG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f06b44b9-687a-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1640763777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640763777, "uuid": "39776e11-486a-43d8-8463-bf92fe32194e", "comment": "Malware payload (Smoke Loader)", "value": "6f0958a4ccd48b7656a1126aef7bfc71", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640763777, "uuid": "eddf9bc7-fdc2-4f49-9abc-6a30c87532bb", "comment": "Malware payload (Smoke Loader)", "value": "4f80fa70b7fb1792e737bc3ab64798e57cdeddeedc030a671663e6257a49020f", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640763777, "uuid": "66a6c066-2d2a-4536-a04f-2c7fe90e8397", "comment": "Malware payload (Smoke Loader)", "value": "14f5f4cebc38dce75d9a83fba0bf2a11bca53a23", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640763777, "uuid": "8ee76b12-b220-4701-accd-e2121ef1e841", "comment": "Malware payload (Smoke Loader)", "value": "f1997ef21699c4ff4773a25fb522ccb5e1f4e3b50b6c35eff932cbebd8ca2b5965ed7ef58223e1f7737394628ab7ae85", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640763777, "uuid": "b6368104-9c54-4829-a1e8-80c320392cdc", "value": "T1B344BED176A2C872C49278718839FF959BBF7C32D6B0404B3778266E5FF06C19A26316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640763777, "uuid": "51cfd184-43cb-4793-a313-c9a267af6e13", "value": "89fd3724ee6753e08cc5a51df8f9b6a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640763777, "uuid": "cea21e11-3717-43b3-af91-bf6df2f69520", "value": "3072:4XLx7c12FXuEvWWc2oJ8VRB0zOLKFVggjcGkNIVqI:aLq12BXvWWpo4R2Ou7ITsq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640763777, "uuid": "3b2c3960-a944-4242-adfc-38eea79a17cb", "value": 263680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640763777, "uuid": "e8278c03-36b1-4090-a84e-a50843ce81ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640763777, "uuid": "20ef178d-1873-473d-a093-578deb54c4cb", "value": "6f0958a4ccd48b7656a1126aef7bfc71.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "096dd6c2-6846-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640741055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741055, "uuid": "5afa48b7-8cc5-4fdc-aeb3-31ee97f5c8a6", "comment": "Malware payload", "value": "375f94852f815cf9de666b94f8eb0ae3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741055, "uuid": "4e4d879e-70b5-487e-ae37-34dea3b83988", "comment": "Malware payload", "value": "4f9443050501f6fe2ca8483e102c08a0bf7581dc511a54d01a038e4f7b3406e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741055, "uuid": "df7d6913-cf54-49c5-9cdb-71bbe388fa83", "comment": "Malware payload", "value": "fb344f76069e81998cf1fda21565cfcc876f2343", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741055, "uuid": "9082dfb3-c36b-4a5e-9f7a-b8b38146f514", "comment": "Malware payload", "value": "c867ba184d1b07c054c9bf32c5ab11a99a20a16d50388b1e77ee3d55893e8504f222f5f20eb294343987d0eba37831d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741055, "uuid": "fc7e3279-8dea-43c5-a572-c5017c85cb88", "value": "T17B44AE58FE9414F4DABBD63589972D6A727335720B83DE9E0358B3E21F27361AF06900", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741055, "uuid": "06fd42ff-cdba-4027-8a0f-657d7437ce72", "value": "d4755b9a9aec93c05c955ca11140bdc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741055, "uuid": "611e6d56-b6d0-47d5-8ae3-cc59d9dc2c37", "value": "6144:7sH09SPoUE8jJh9gd+ZBLwEgOBo9UnQ7cPWa:0w8dWmLwO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640741055, "uuid": "d0baf37f-a24d-4385-9b2c-4f40487690b5", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640741055, "uuid": "4448b7e4-3f04-4ad3-a30e-d98866efa7c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741055, "uuid": "27bdb58f-fdc6-4364-bc2a-a1ff8bf33975", "value": "macosx.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc785852-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640741033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741033, "uuid": "516407e6-05e4-4127-b0dc-840fd1193589", "comment": "Malware payload", "value": "a08ff1a0f34d4253c4aad65aeaf0c50a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741033, "uuid": "373f7cc0-6db3-4671-8d40-b066c5d92a2f", "comment": "Malware payload", "value": "512b414ee08648ac8421782df61b42170adea8eb150c5e4c93daa046c497f90b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741033, "uuid": "094ff0fb-a032-4d2d-9452-388f0be7a03e", "comment": "Malware payload", "value": "bf22ae70500d3802e4ca97231a6c7f9d29181085", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741033, "uuid": "c134d617-63cc-46ac-b1e9-72110bcd248b", "comment": "Malware payload", "value": "fa2bfcd7940eb9333b781fb26410ac34f26421084c2613df15a1978b28193635525956369aa35481bba4543413628841", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741033, "uuid": "ed0643ef-bbec-403a-841d-eadc7e0d6265", "value": "T18844AE58FE9414F4DABBD63589972D6A727335720BC2DE9E0358B3E61F27360AF06900", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741033, "uuid": "1205634e-dddd-47e5-8b30-342a9cb9104c", "value": "d4755b9a9aec93c05c955ca11140bdc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741033, "uuid": "7da6c283-f839-4eee-975b-2b7c7de89e01", "value": "6144:77shlPSdn55eHrjJh9gd+ZBL8xzEgOBo9UnQ7cPWa:32o9OHrdWmL6O0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640741033, "uuid": "ca48005b-901e-4472-aa9d-60d4cce03caf", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640741033, "uuid": "341ff888-c36c-4c2f-ae8f-a17f5713eb1e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741033, "uuid": "dec0bec4-f786-450f-b7a5-6b22982ae0dc", "value": "macosx.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca3f2de2-6862-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1640753405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640753405, "uuid": "29758c65-3e43-4ff8-af72-9bd6ba3458fa", "comment": "Malware payload (Gafgyt)", "value": "d3213d6b62328d88cd2ba6851e03659f", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640753405, "uuid": "7ba38488-644c-4182-85c9-82cc5fd2698e", "comment": "Malware payload (Gafgyt)", "value": "5297917f493f66cc56b5f957b9426aed14f5ced1f0426fcc1bf271a3196f4e60", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640753405, "uuid": "b208862f-7f97-4bc5-a10b-274e4a8f57e5", "comment": "Malware payload (Gafgyt)", "value": "4e834fb91469ccab16c8e52f93f52c7e14dee94e", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640753405, "uuid": "ee1e5bd7-3d7c-43c2-aef0-9790cdc2983f", "comment": "Malware payload (Gafgyt)", "value": "63c6be43a51ffa1551b406d9823bb2303742e0a48b7ca6dd7a6482a92bf4f10ee08f26a9101829c30edcfe8651cba42e", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640753405, "uuid": "5cfad4bb-a9a4-418b-adc3-777001dc3247", "value": "T1DB630234264EACE694F20DB7BDCC0589C50E27E585B9C9130533E33BEF4226FA696067", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640753405, "uuid": "7c3a3479-2b46-4ec2-9fa6-f4d28a9460be", "value": "1536:VTNoJJ1Y6hF3Tax4e5TuI5W7lcZLK6O7WEmtlQiywWc6:NNoJnF3T0QsW7QLK6O7WTlPywV6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640753405, "uuid": "8b8d9f68-5a10-4ef2-a7bc-1d2a8529c0f2", "value": 67180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640753405, "uuid": "e4b553ea-6f50-4e7f-ab38-dc69162e1d30", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640753405, "uuid": "76d0457d-1d24-4dd9-9d52-e4d31132cc1e", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab4c8a6b-689c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640778263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640778263, "uuid": "e20cf263-d1b0-4760-9fe3-94433ada9e52", "comment": "Malware payload", "value": "1c1a85a103065b97eb0ad88a29df8651", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640778263, "uuid": "e6a4db6c-5bb7-4846-82e4-fe7cc1722e46", "comment": "Malware payload", "value": "52dbf093eaa8db9a0535ae5eded2b30d2986a8cc95674f24634f25eb6eead137", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640778263, "uuid": "8b445055-21de-46f8-8f3d-57a35324e09e", "comment": "Malware payload", "value": "85bf196925fe057b29040539bffe82ac5311a3c8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640778263, "uuid": "d9b78627-af7e-4f3a-a19f-5877d395bf35", "comment": "Malware payload", "value": "f6a149fbca90938a20469b7f3dbdc7b733bdbe11d5fea697577e99ad1410f51f9c398e1f5221f7d36465ae891d7018db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640778263, "uuid": "c891d70a-ef2f-4a68-815f-48b276071fa9", "value": "T13E21C07AFBBB9617C85090760EB323143660CC4800159A696F51679D9C126517F962F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640778263, "uuid": "218ba2db-999b-46f8-90a2-1772ca95c6d5", "value": "24:3L3Dq3N0yTKaM9kdu8MDXQZP/hCrjSkvEXkBJ9l7NTawq98:3WVTCEu8MDS0Dvf9RNu38", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640778263, "uuid": "34a36b62-8c48-486f-bcd4-7a5ca944e2d6", "value": 1264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640778263, "uuid": "5d4332f5-7e1f-4277-aef8-d5f9e3d3195d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640778263, "uuid": "ec2d8957-eeaf-4155-b90d-aff87d9bed38", "value": "1c1a85a103065b97eb0ad88a29df8651", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e559578b-68fd-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640820022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640820022, "uuid": "4562e967-d58f-4e0a-90e9-7b79bba71514", "comment": "Malware payload", "value": "6ecafd711fc7a4b442c3bc42fd1989b6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640820022, "uuid": "a787f9bf-0294-42c9-9873-e65c20f2c959", "comment": "Malware payload", "value": "532a9a1caf0c15ecfd37605f561a9b6ac732b107c5cf7e9accae86b50c33a980", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640820022, "uuid": "f2d920b6-9151-4690-9d47-b88d4dcea5e3", "comment": "Malware payload", "value": "847d7ff9b4c2ba67244d02991a328d7fe3e7d316", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640820022, "uuid": "92e1e0a4-e56d-46ba-8834-596dd3220b23", "comment": "Malware payload", "value": "9b90b4986badd5027aca69ccfb24759d1605f93e4377add26e3c0bb5d912075018afdce24d6feaa14fd4da22acd9e179", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640820022, "uuid": "b8035829-2258-4057-bdba-097a982bae23", "value": "T124B4E152B6845CEED8A755F64827C99013225E7EC092E34D08B7FE77B9B33930923987", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640820022, "uuid": "4ef8fe6b-9050-4434-b3a9-7176ce3b9b85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640820022, "uuid": "2eea574f-c609-43c9-b20e-80a64b1af99b", "value": "12288:XIoNfqNy2Wuvxa3vEg9N1rCkOA2J0cdY:pNtwvUf9rrCU2J0c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640820022, "uuid": "3e1b3baa-d02b-44fc-9634-ea06ca675b33", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640820022, "uuid": "5005a1f5-f646-43b9-b7fc-354168e55653", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640820022, "uuid": "3d1cb876-e50b-4bea-8054-d36636ca0f54", "value": "Proposal listing.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25950163-68c1-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1640793931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640793931, "uuid": "886b4326-0015-4f84-8c70-ee92161a780a", "comment": "Malware payload (RaccoonStealer)", "value": "bdf583da337e0c5f6b2243f8053a3c05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640793931, "uuid": "92d8a27a-d7b0-436d-9872-44415007f243", "comment": "Malware payload (RaccoonStealer)", "value": "5676e0a540f1996d4866fe92847a70f40b43a8d7a2e4622053126f4b19e318ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640793931, "uuid": "60e14aa4-de4a-40cb-a1be-f7619c756b30", "comment": "Malware payload (RaccoonStealer)", "value": "2499ec077708dc91eeb5fa1df21952835e3fa05e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640793931, "uuid": "35d88615-1061-4f54-9e79-772154c4a6dc", "comment": "Malware payload (RaccoonStealer)", "value": "1e1eb1fb09091d4769e1bfbb41eba3691cd00757fdde17b3713468f8b9b3160ae6d3306a49113dab617ead7239642bca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640793931, "uuid": "5d0c7f46-24cd-4759-8f96-0a068d93ccf1", "value": "T18EF4F110BBA0D035F5F722F84579A679B63E7AA0AB3490CB62D517E94774AE0EC30347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640793931, "uuid": "b0ed21a1-555e-4c54-8022-5d718d5a4039", "value": "bbdc5cea7d9bbd6ae9c6a36e9d9fb769", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640793931, "uuid": "98e52699-344c-4696-8740-ab3d655cacaa", "value": "12288:A1l8N9umSUU9DqRBWYnX5YWyMf7fc0YBqcfiC4FdquAbTTIez5Z:ZNK9DqnhnX5Nt7fcDqxnqjd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640793931, "uuid": "29de1da0-3a16-4e20-a6de-ecd1a0d9b2f4", "value": 733696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640793931, "uuid": "d327ee23-fc4d-4ac4-ac84-f3768a0e39ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640793931, "uuid": "40c6f6c6-79f1-4be2-99bc-9500ba41d0ad", "value": "bdf583da337e0c5f6b2243f8053a3c05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4ab3ea0-68bf-11ec-9275-42010a9c0029", "comment": "Malware payload (BillGates)", "timestamp": 1640793312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640793312, "uuid": "44ab8f00-15ca-4cd8-85f3-090a75fd8995", "comment": "Malware payload (BillGates)", "value": "0b585110e4306fabf26976193455af63", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640793312, "uuid": "f24221d8-3074-4e68-b26b-f973b7b6ff70", "comment": "Malware payload (BillGates)", "value": "56c7871b6146949726be915da62d65ece9586d02365b3d20ff5f8042f96b234c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640793312, "uuid": "44b27dcb-4ca0-4514-b63a-6a586f32a69a", "comment": "Malware payload (BillGates)", "value": "8011c58a56eb1317e9b0753d8742adb542879cd4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640793312, "uuid": "0631eb76-fff0-4a50-bb4c-4f33b94bf8f4", "comment": "Malware payload (BillGates)", "value": "18f6d89df79c491f0a892ca7e7f7780b974a1136fac91cfcc0f7ec6e8a78c8f594a24e7e0b17234d348a428f19cafdb2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640793312, "uuid": "e1369524-5aaa-473e-b8e4-a401d29935b1", "value": "T100456B12FBD0CCB1D84616F5100FDA35D5229677A01BCA4FEA5DCD38BB29181AB1A37E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640793312, "uuid": "a70d7ae6-a281-4f6b-a8a4-2207e66910aa", "value": "24576:e845rGHu6gVJKG75oFpA0VWeX4j2y1q2rJp0:745vRVJKGtSA0VWeoCu9p0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640793312, "uuid": "5f54ba2c-7cd6-49f8-9cd2-97b9b0d9e65e", "value": 1223123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640793312, "uuid": "d662ae62-6d87-4d14-8496-e18f8c9c60a7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640793312, "uuid": "e87c1395-0f00-4cfa-b206-ae8a2fa39b1b", "value": "0b585110e4306fabf26976193455af63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c90c04ec-6862-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640753403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640753403, "uuid": "f191b194-dcd6-40bd-9faa-c36e1487be4c", "comment": "Malware payload", "value": "aeaed6eb3ce5d5f7dce5c337777287aa", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640753403, "uuid": "75573cb7-5d88-4717-adec-ad15ffa18e5e", "comment": "Malware payload", "value": "56cfa9406dc47a380d748bc2c732abff17a87d96704ff5b4929cdf04f9378ee7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640753403, "uuid": "cee50412-cfb5-4b51-9095-88ec5eab5626", "comment": "Malware payload", "value": "4ad3d5ed293026d395041b5a951a38f65bdd02c3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640753403, "uuid": "1528a070-8fea-4561-aaee-96d82e51be1a", "comment": "Malware payload", "value": "a0bb53d7c7fe8cba19bbb166df6591238d3b3590f2ebf9ca22685ff06000e85811480ca22a2efb9ea4d39e31da54f9dd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640753403, "uuid": "63613538-2b05-45bb-bccb-cb79995a036c", "value": "T1CD23F1DD260A675ECC25C1B522F0077088281F96F9C2C8AF4CE3A58B8DDD9453877EE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640753403, "uuid": "3258560f-4cc0-4a64-a816-072bca170a3d", "value": "768:c4MpKMSWPgmSeSY4VahUKb3zp/UYt9iMil4SU2XuJgGlzDpbuR1J4dSpmBICs6BO:1Ck+SeQKbDpse9Mu2KVJu6sKICxTi1R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640753403, "uuid": "29ba351c-bd22-4278-bfaa-8184037f945b", "value": 47256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640753403, "uuid": "f2baebe6-e7c2-48e9-9932-f2b41adff294", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640753403, "uuid": "8251ade2-47bf-4451-8d95-5b48008732a0", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efdf486d-68b3-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1640788257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640788257, "uuid": "fd27c9db-63a4-4fd3-9193-6066ef22a472", "comment": "Malware payload (AsyncRAT)", "value": "b9946891a673e422f94b3eeb5468b94a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640788257, "uuid": "c2459bc5-271e-4430-bc16-5968f1692480", "comment": "Malware payload (AsyncRAT)", "value": "582d1342ddffbbf3eae83ee7c229bc9e45bb07f73744ee518fbcac8590fad63e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640788257, "uuid": "816d77c0-bbcb-4712-bfaf-aacdfe64ab70", "comment": "Malware payload (AsyncRAT)", "value": "633b92e524174d292fd413114511841c96d61765", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640788257, "uuid": "1414a3dd-7389-42dc-83fe-673d3abbf09d", "comment": "Malware payload (AsyncRAT)", "value": "31ee0e08233bcf85de154a1e91e86a2001d16d11ab0dbc77d5dcc75867046930387b0596e9e1c0c1933bc1cedcc634ea", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640788257, "uuid": "b12487c9-2eb5-4f5b-a824-f88881ebf71b", "value": "T18A232C003BE8C22BF2BE4F789DF26145467AF2636603D5492CC451DB5613FC69A426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640788257, "uuid": "d38deba7-452e-4ba1-ae8d-311e3dd5bb0c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640788257, "uuid": "56356269-2ce3-4dda-9959-f1c9c7198a16", "value": "768:vuwCfTg46YbWUn8jjmo2qrDKjGKG6PIyzjbFgX3iPivLZ8O+BDZSx:vuwCfTgp/2OKYDy3bCXSPSSvdSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640788257, "uuid": "f958e92d-a187-481c-85fa-5beb195a817a", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640788257, "uuid": "a8569626-516c-43d0-b962-f89f197feef1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640788257, "uuid": "2fbabcd9-eb0c-4b75-9870-6a86fd0cfab9", "value": "b9946891a673e422f94b3eeb5468b94a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3469e8dc-6846-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640741127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741127, "uuid": "b6668967-363a-4e78-850e-132b2c3ae741", "comment": "Malware payload", "value": "229906bb7d8d3a4883f3eca34ceda26b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741127, "uuid": "0afa639f-5d14-4c77-b684-01168058a646", "comment": "Malware payload", "value": "584e4d7e27f8ed6b7c9a0123b824e9dd73f0b0dba49d58709aefc2d1a2871087", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741127, "uuid": "f4fd0644-6cb3-4189-8995-19d0fb114a15", "comment": "Malware payload", "value": "70a26386a11fd00a2b354855128a587e3a75dfb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741127, "uuid": "ab240e78-7b05-4eb4-b6a4-5035e4cc131b", "comment": "Malware payload", "value": "4d00f75b62eada6f8470f2ed16f8c3d2dc5d5ea5b0c162d55f9fa0d2a8aed7b2df8f7748ff88c0eec168a0c094793494", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741127, "uuid": "029609ea-98ac-4fc7-8592-0ace197be689", "value": "T13A449E58FEA414F4DABBD63549972D6A727335720B82DEDE0358B3E21F27360AF06900", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741127, "uuid": "a9c6efee-8d57-4358-b028-fad25112651e", "value": "d4755b9a9aec93c05c955ca11140bdc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741127, "uuid": "3e3f6424-c140-4d04-8a7f-5f74668c5ce7", "value": "6144:rh+irB6lmJjJh9gd+ZBL7EgOBo9UnQ7cPWa:QiNJdWmLHO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640741127, "uuid": "a14f5813-a0c6-4122-97de-e52668ecaffc", "value": 270336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640741127, "uuid": "4a2a7fb2-0cca-43c1-ba0e-2cd18d6e65d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741127, "uuid": "c7ebe578-bc78-4693-8ff5-8c0eddc168bc", "value": "macosx.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f1994c0-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640740877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740877, "uuid": "c12c6784-86de-48e6-9852-a370b7744a91", "comment": "Malware payload", "value": "f4790279abe315d691aac7e45419a706", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740877, "uuid": "fb8d3ffb-9ec9-4bd8-a823-366e5a648314", "comment": "Malware payload", "value": "5894532abb661e1d8126cfe9762aed5b658d9d5988ae1db96bb7a7152647a062", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740877, "uuid": "0240cb41-ce9c-4b87-9bfc-a4036bb5acfe", "comment": "Malware payload", "value": "488fd88d1064dd423c1bf3e68eb54e93ae24bcbe", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740877, "uuid": "b734dbe1-26ef-4999-975d-2f00210ee9a3", "comment": "Malware payload", "value": "2a03f893188237014eae726c10803b1f664d9f8b8405f0cf55f532fd6afb4573d8773d78e71addb9149b542f38ed8d42", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740877, "uuid": "3d453fb4-a50f-4199-8642-80c2b42cb76c", "value": "T1E1649E58BE9414F4DABBD63549972D6A727334720BD2DE9E135CB3E21F27360AF06A00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740877, "uuid": "3a2dc9f8-43eb-445c-a0d9-268560e8c871", "value": "6144:4MZAzomr0Vzl2ZjJh9gd+ZBLmEgOBo9UnQ7cPWa:JoFZdWmLyO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640740877, "uuid": "bb9f182f-d278-4112-a69a-a936385aa22b", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640740877, "uuid": "61b2f4a8-85cb-49a0-bc78-99d7369ce992", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740877, "uuid": "fa884db3-1eec-4ddd-93aa-c83a0a23626a", "value": "attacments_1013.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c773fa08-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640740944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740944, "uuid": "960ac47a-6d7f-4c4b-8955-4b571e586509", "comment": "Malware payload", "value": "e7f7792879bbee9197a68e60339cda4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740944, "uuid": "272bd7ee-e4fb-46c0-b134-fca060596e87", "comment": "Malware payload", "value": "599db9e0ebfd171e5a1ae8b4b4f5b2710008e1a7f71655ded73778c295e9bbcc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740944, "uuid": "7e0c966c-ca14-443d-b64c-7e21a7359bad", "comment": "Malware payload", "value": "482d7e32a9e896f7196646055c9a051cce632527", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740944, "uuid": "b87aa7e0-b66a-4c21-b4d3-41eb430b9fd2", "comment": "Malware payload", "value": "95ba89c8e17d44760250326472c83a3c6d8ab8cf27bd75648841e93cbc92b46f1f390cb0809ed18cfcf962ebe2a9e8e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740944, "uuid": "75619465-db08-4150-a256-ccd5f38acca2", "value": "T1E0449E58FE9414F4DABBD63589972D6A727335720B87DE9E0358B3E21F27360AF06900", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740944, "uuid": "ed31de71-8f1e-49bb-ac7d-c5f36ece7ae2", "value": "d4755b9a9aec93c05c955ca11140bdc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740944, "uuid": "14f1b29b-a502-45eb-9d33-e99551bd7bad", "value": "6144:l9Vi8sbajJh9gd+ZBLGzwEgOBo9UnQ7cPWa:NWadWmLOwO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640740944, "uuid": "a536f9b1-f632-4407-bc3b-2c1613db6516", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640740944, "uuid": "8b7af569-76e2-4dc0-85c4-3fd4e9f5a02d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740944, "uuid": "e46ed83b-5c44-4c13-b5bd-bcd929116f20", "value": "macosx.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e155bc31-68b4-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1640788662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640788662, "uuid": "40affad0-31e7-46e5-933f-aecfe7e7f4c5", "comment": "Malware payload (AgentTesla)", "value": "51be817b8361874cc9d36c8a971064e0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640788662, "uuid": "06b1855e-834a-42f3-9a30-36249881b2c0", "comment": "Malware payload (AgentTesla)", "value": "5b8c260a34b8c013822404843943a456144cdd55a2274597ba71beca6c8f330b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640788662, "uuid": "32f89702-2648-49c1-add3-ae180cd3f11e", "comment": "Malware payload (AgentTesla)", "value": "9c0f84d5f5a7a159649ad6c55646d64b9e9b46b6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640788662, "uuid": "018b4edb-4759-4cb6-9672-6fb6c3b22bfb", "comment": "Malware payload (AgentTesla)", "value": "027a63fe7dd15ffbcdcf7f8b6f77c4a0b62236228e57006f3d73e3ae6c7714e61d9d87fcbf1f6a48677750416f7f4516", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640788662, "uuid": "fce3541a-f79f-4e2b-a779-a435e54e0c74", "value": "T18294126527A80791E97A9FF96A40367127B1A52B7422D71D9CC260FF0533B00DBC2BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640788662, "uuid": "48838d92-ca27-4e20-9b7a-30589a82dfdc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640788662, "uuid": "94510ee7-dba1-43e0-a417-246db7de5a81", "value": "12288:1bh/CftUJSGGxSg6OuDptU7eXdjc9H6BKc:Pw0SGGog6O4Z+hc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640788662, "uuid": "f3999a9f-6365-4db2-9967-fce82418fb81", "value": 431104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640788662, "uuid": "3422a6a4-faa4-4c55-bed3-bad2beb2b076", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640788662, "uuid": "b17ce358-8dd4-4ee9-91fc-3dfb7e36b245", "value": "JANUARY INQUIRY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "332f7412-6846-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640741125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741125, "uuid": "21a61fd2-7e7b-47d7-9bb5-896a5df14a92", "comment": "Malware payload", "value": "ddf935ca0dd705fcb0ee912168b7382f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741125, "uuid": "19000745-1f47-4a19-a4d8-beefd314224c", "comment": "Malware payload", "value": "5ba3f8918bfce95b7343f3bd8669d60e9f8915b963c761917a5054d8d7ee540c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741125, "uuid": "8987708b-2b9b-4f22-9037-7e2a05a8d7a5", "comment": "Malware payload", "value": "bb7185c64dbff3c76959c0a376e25afd82a60bc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741125, "uuid": "541833d8-3e85-4cf4-a342-60e6a2195562", "comment": "Malware payload", "value": "ad5fa79fd46d7fdef47c4f07f33e4bdf228b10405ad9a1bbf2499c3848f1fd7b50cb9b9f25909af9f1c0a72dd200f80e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741125, "uuid": "0a31f46c-63b4-467d-8cb3-36f07bd1a4fe", "value": "T161449E58FE9414F4DABBD73589972D6A727335720B82DE9E0358B3E21F27361AF06900", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741125, "uuid": "9f064bcc-74c4-4cf1-b026-64e3b2d4ce6c", "value": "d4755b9a9aec93c05c955ca11140bdc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741125, "uuid": "cea4995b-0a8b-4812-82f0-5525e19e3e34", "value": "6144:jAdxVRaKjJh9gd+ZBLi+EgOBo9UnQ7cPWa:y4KdWmLLO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640741125, "uuid": "4e9ee5a9-69ce-44bf-a229-de2be0956249", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640741125, "uuid": "a9291019-40e7-49a8-9aa1-ee06f43eeb6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741125, "uuid": "63f19d5d-a86b-4a0b-88a6-70273e722f62", "value": "macosx.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1b76e87-6847-11ec-9275-42010a9c0029", "comment": "Malware payload (TrickBot)", "timestamp": 1640741794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741794, "uuid": "eb85ebe8-d15e-4516-a7b2-5404aa1828b0", "comment": "Malware payload (TrickBot)", "value": "e9d4ef1a8d0371d5760cd8a815cf1acd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741794, "uuid": "da719b30-6d4e-4974-9192-7cd36ba5d01b", "comment": "Malware payload (TrickBot)", "value": "5c032f85c0a9a4a551f6c0057ecc78aec6b625df77fcbf6e76c685e362613a92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741794, "uuid": "0c6f4f6f-8b62-4f20-816c-cc40527e0548", "comment": "Malware payload (TrickBot)", "value": "0cb109a1a37622d8147d11b1b5ffbe858388707b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741794, "uuid": "bd1effaf-2e76-493e-9ee6-fd54ad22b75f", "comment": "Malware payload (TrickBot)", "value": "53576688e522d84b6e976c933eab2d7eb74a0930666d40aa07e43e60c8901358e1cd87dfc5960c9d28ef0795ba00a05b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741794, "uuid": "8c961ad3-5909-4899-a069-1dccfc9f5850", "value": "T18C94F11172D4C031E19721348A76CBB10FBABC7675A2AACF2FD5067A4F34AA1D32471E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741794, "uuid": "225b99d1-9b56-4592-a0d0-88c2a70772fb", "value": "297ed3de0a49d4831344ce5a84729097", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741794, "uuid": "17ca6e7f-368c-463b-8970-96e6687be1e7", "value": "12288:5F61k9CuREuCBifx5ABMQ2f6OArPtMZotp:fCuOlQxDni9rV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640741794, "uuid": "7be722e9-ef49-4f8b-8aa8-4a6515ed318b", "value": 422400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640741794, "uuid": "3023ea96-6a3e-431c-a9de-81b3b9172950", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741794, "uuid": "5565e5fa-45e8-48a9-82fc-e6c7763dd3b1", "value": "SecuriteInfo.com.W32.AIDetect.malware1.29332.22610", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c84cfe32-6882-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640767145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640767145, "uuid": "0736af81-07d5-4515-8e94-d1848b8b41e2", "comment": "Malware payload (Mirai)", "value": "bc744d41b2f58cb6a662feead806d018", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640767145, "uuid": "c5b32b39-a041-4286-86c5-d6eb7553029a", "comment": "Malware payload (Mirai)", "value": "5d2eaac7c23519388df6279d4ce79342e443c972778d96af2134aeb4ba21bf7c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640767145, "uuid": "8c1317f3-8144-4ed4-ae55-203e79c16e13", "comment": "Malware payload (Mirai)", "value": "a3ab49d8c679a6a395265ceba153c185e7f8a795", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640767145, "uuid": "5abd557c-1921-4ff7-8df8-8038f75652cb", "comment": "Malware payload (Mirai)", "value": "ac04ad726859fcd4f19a074f339ddd6f943b1e10d8c52122b5c22345e4e1c4dad9572ae5d4aa9ccd93cd5c3440c19ce8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640767145, "uuid": "8233053e-6c86-4dda-ba55-4536266bf93d", "value": "T1F2634BC9E8029E3CF95BD6BE90174B08B931635456930F2BD6ABFCD73CA206C9E46D41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640767145, "uuid": "9c1d3b13-7659-49af-8ac4-4ac7b80374f7", "value": "1536:J3gL/1nt8F+qsgEnLQor69xcnZ62QsIk8Rm:+L/b4gZj+rYQTK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640767145, "uuid": "39d69799-e721-4da8-a97a-c3a8488d0486", "value": 69592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640767145, "uuid": "8ba93bf7-9526-4124-b054-b4e1b55fb917", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640767145, "uuid": "3be34984-7be6-4a2f-a181-be8e140e81ee", "value": "bc744d41b2f58cb6a662feead806d018", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e671fe77-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640740996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740996, "uuid": "865c8f50-7a81-40c9-b715-4516275b8b50", "comment": "Malware payload", "value": "cc3b9203994c4d21ccc425806d4ab95d", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740996, "uuid": "fa60b68b-1ca2-429f-859d-05fd0a3448d4", "comment": "Malware payload", "value": "5efef4dccf8614ac45ea199e4f90a367ae6af246234bc1102733f4654960713b", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740996, "uuid": "e39e430c-c19e-478f-a7fd-cc2b90f56b99", "comment": "Malware payload", "value": "0283d6d1230bf52283b52bfdb0f043fcca90b1aa", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740996, "uuid": "c71da824-8b1f-4c90-9e47-72f4913e6f21", "comment": "Malware payload", "value": "2cb06a798ccf2701a43913c39530c5c449e1fde2141e9988945912a84d7a5ee02f1aa04e4979cdb47bea629718edfcc0", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740996, "uuid": "8a70e1c9-a5ee-42ed-9654-36c1c6973175", "value": "T1A8649D58BE9414F4DAABD63549972D6A727334720BD3DE9E035CB3E61F27360AF06A00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740996, "uuid": "297dc027-47a7-43e9-bdfa-d772092f317a", "value": "6144:QG0VbSdQ55eHrjJh9gd+ZBLEmzEgOBo9UnQ7cPWa:yuGOHrdWmLZO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640740996, "uuid": "4a941ece-802a-47d7-af0e-fe21bdb6dc8d", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640740996, "uuid": "f570bbe1-ddf2-447a-91ee-ace9f2b31222", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740996, "uuid": "ad6f784b-7988-457a-8daa-567e6d554cea", "value": "Attachments-2016.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c419feb-686b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640757005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640757005, "uuid": "9afe7c16-0a58-447a-9665-bf5cedfdbc5a", "comment": "Malware payload (Mirai)", "value": "65f43d20b2f99c5217df860d2592c295", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640757005, "uuid": "8f174fd0-ac55-488f-88d6-f05dc30b5d21", "comment": "Malware payload (Mirai)", "value": "5f8ffa28cdf40d07925d385ac1890138941b9944078696c27b8c4824955fac5f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640757005, "uuid": "ee1f2e93-b3a2-4eb5-a349-34f52c8eb028", "comment": "Malware payload (Mirai)", "value": "132fcf03306f532620aafe89e7d4441f14ed8042", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640757005, "uuid": "e418d4a1-c90d-4e89-99f8-e71d26a2cc15", "comment": "Malware payload (Mirai)", "value": "096916561b3b6c5deb187ec624f13800b1542d7fcf32ce9b45de10ed62ac7bd9ccbad0263652e286e7a91c7bcbda999c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640757005, "uuid": "8e7174c0-d624-4b8f-8ea7-fd0b5de21cdc", "value": "T1A9732A52B8829A13CAD4237BFA6E018C332563E8D2DF32079D216F5177C682F0DB7695", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640757005, "uuid": "94e73be9-0532-4603-a391-b2286010605b", "value": "1536:tprklX/yrWv584cr8Po6j/Mcv1rkdfVWMc:tps674/59g5Hc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640757005, "uuid": "60cb3ee0-84e2-4a5e-b575-23cde3b59409", "value": 74924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640757005, "uuid": "3f78686b-5a5a-485d-9f56-78f5bd2c68c4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640757005, "uuid": "b3284641-e813-467a-86aa-35a6551214c6", "value": "apep.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb9a4749-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640741005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741005, "uuid": "3de1ce4b-c61d-4226-80de-d4e27fe6b269", "comment": "Malware payload", "value": "920653e0c9c2297bab409bf7f6806b5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741005, "uuid": "2fcd7abf-a446-4f19-9016-969ce0382a02", "comment": "Malware payload", "value": "5fbae7252c1f7abb7bce898a06d71b2e4552867be17f328ef4eb929b64fd7af3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741005, "uuid": "cc1cf383-ce71-4db6-85ef-8ec65abf423c", "comment": "Malware payload", "value": "08f4954ca6600ac0920b669a6d11d17922c1ec7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741005, "uuid": "52dfc975-ecaa-47e5-87a7-e7b0868d1133", "comment": "Malware payload", "value": "93ff64dc1c8723693bc59a9b7e02ac3ca4ea194fd6bcdabdce32f52af2e8e498cb5e1f99235d5f9aff09d242516ff026", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741005, "uuid": "65fa1556-0a99-4f9e-9d6a-90b475319be6", "value": "T1CE44AE58FE9414F4DABBD63589972D6A727335720B82DE9E0358B3F21F27361AF06900", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741005, "uuid": "31057211-7b3e-4974-b286-b7cab7f3eaa4", "value": "d4755b9a9aec93c05c955ca11140bdc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741005, "uuid": "8eab069b-331f-436a-b368-1f526349f2c6", "value": "6144:73XxVRaKjJh9gd+ZBLi8EgOBo9UnQ7cPWa:7H4KdWmL1O0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640741005, "uuid": "b9884d09-4b03-4c40-a08a-be2111e0c7b5", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640741005, "uuid": "8ee3013b-2716-47c0-aeb0-5b643538a32e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741005, "uuid": "add1dcbd-c3ca-4e4e-aa8a-94ec4ffa0b96", "value": "macosx.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df51772b-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640740985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740985, "uuid": "c4401302-3470-4ad9-a443-c348ecfad1ef", "comment": "Malware payload", "value": "bc36f980e56e382bbb0ea33bec312e34", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740985, "uuid": "db7a20da-ec62-46ed-9fca-29bc291ed518", "comment": "Malware payload", "value": "62875cdda9150cce79f79f97cc00bd3612d1cfc2e4270c3218f6676bbea0f5f4", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740985, "uuid": "eebe85a8-6681-494a-86e9-577194a3b4cd", "comment": "Malware payload", "value": "ef09d9e7baf13202277e37c66292ec769cefef26", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740985, "uuid": "1c422358-64e8-4dcc-b9a8-4bc2c33c89ff", "comment": "Malware payload", "value": "6d78ecdf59945ec87472d8003325d28ca9c1cdcb5ba9a78a7cf503d95fd5fc3e93c5064f047e3ef483b76ddb273e903f", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740985, "uuid": "203613a3-b49d-4c91-905a-1aada01629cc", "value": "T13564AE58BE9404F4DABBD63549A72D6A727335720BD2DE9E135CB3E21F27360AF06900", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740985, "uuid": "5cff160a-3b4b-445d-abe3-307b78273046", "value": "6144:r6pARjhjJh9gd+ZBLMEgOBo9UnQ7cPWa:22hdWmL0O0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640740985, "uuid": "6ec85252-17c0-444b-aabb-56ed3d38b002", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640740985, "uuid": "2fafaa91-dbd4-4697-b010-37a53b081202", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740985, "uuid": "00392a30-4313-4a67-a37c-b1b54b831e48", "value": "attachments_1008.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76210f28-6901-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1640821553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640821553, "uuid": "84e0d016-520c-4f4b-b661-b1c0e076ec5d", "comment": "Malware payload (njrat)", "value": "a28656f539450e71284c372b4d8cb1de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640821553, "uuid": "ff3e87ee-5f54-4472-bb85-10b9bcde4073", "comment": "Malware payload (njrat)", "value": "63dec7fa46a8b31f38ec74c9518847f54e570b62b1664f191a596727bf75f22b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640821553, "uuid": "72b8671c-e0a4-4ded-b54f-20e3e9a31438", "comment": "Malware payload (njrat)", "value": "c7fe2e2399212cff176b732640a08471f8771dba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640821553, "uuid": "52b994f1-634c-4efd-9d8a-609d59192552", "comment": "Malware payload (njrat)", "value": "d7e4d77c3f4ef1ddf70bec5ad7c0d79981c648f4548ecad303866a4dff259644e5eb47e81949c202b2d70daadd215a58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640821553, "uuid": "55b77c0f-fc9c-4c5f-8e50-3a5a79ca6f83", "value": "T1E727124547924EE8E5F88DBC14F51AC816AC6E223C70ECD59C7F3063DA7276720B792A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640821553, "uuid": "c97eba4f-9ca9-4387-b5ff-fa9f9175f376", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640821553, "uuid": "0ca7dd3b-373d-422e-aab6-8c2c3625540c", "value": "49152:BQPB/J4hsDbew3G2uL6ubfpMHRfLqRKdaBXvxWFT5GQmfSSm98M0EEXRKGYdfy0a:+/pbs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640821553, "uuid": "a5e11239-d93f-4268-b1a0-ba9a21091308", "value": 21166336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640821553, "uuid": "9a702a14-ca9e-4e1a-9972-176388f4b081", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640821553, "uuid": "bfac0da2-f98c-4ef4-a7ed-08cce52ec4f6", "value": "a28656f539450e71284c372b4d8cb1de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98a52359-6857-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640748597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640748597, "uuid": "2b50d433-a4f7-4686-a485-57108491adac", "comment": "Malware payload", "value": "84d5469bcfa4fa684c1e9ee94e0d3584", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640748597, "uuid": "78399f5a-1dc8-4633-93cc-64c81154c343", "comment": "Malware payload", "value": "651d7c6201d1ae3bd43152d499f0fda0a99ab919fdea6c4291863cf9edc3f5c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640748597, "uuid": "1d0f01ad-3b6a-4ef4-a3d0-d6eceb1ad288", "comment": "Malware payload", "value": "fa7f78ca4441054c9388c91763a4b93db948c9cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640748597, "uuid": "e174f05b-56fa-491e-b9dd-bab3ac01d260", "comment": "Malware payload", "value": "8444959f0b7f85f5e83849a6d404864838d01514c8c1fd2adb24392cd3b847f46d916200d4f724daedefa13e538d9446", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640748597, "uuid": "73f53ad2-4e51-4c27-b49d-25d23cb601e7", "value": "T1D0567C43F85561ADE5EAD230CA7582927A317888173033D32F61F6BA2B63FD46E78351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640748597, "uuid": "3c366780-4485-4b67-92bd-7b06f67340f6", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640748597, "uuid": "5b1a01f0-22eb-4666-bae6-393e0b58c133", "value": "98304:XHm3Z1YiV3dVkOD7E3NwBXa5EXhoF8Htyo/F4Slykc0Rl85:eQikOUw7RZyod4Slykc0P8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640748597, "uuid": "f29fa2d1-7d67-43e1-b9b7-1eb48d776edd", "value": 6422016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640748597, "uuid": "d337f355-c05c-4cc1-8f8a-6211d389ab9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640748597, "uuid": "eabc664b-e0c1-4a6f-a743-a679b7aeeff6", "value": "84d5469bcfa4fa684c1e9ee94e0d3584", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7290cfe-683a-11ec-9275-42010a9c0029", "comment": "Malware payload (HelloXD)", "timestamp": 1640736300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640736300, "uuid": "b41c83cf-ca28-45c2-ab8d-0013f962e459", "comment": "Malware payload (HelloXD)", "value": "93cb0fa81ed42d4c44fac49dd0354d0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hello", "colour": "#2EBF57", "exportable": true, "hide_tag": false }, { "name": "HelloXD", "colour": "#6FB78D", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640736300, "uuid": "b92ca739-558b-41a2-be49-3ed8c704f788", "comment": "Malware payload (HelloXD)", "value": "65ccbd63fbe96ea8830396c575926af476c06352bb88f9c22f90de7bb85366a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hello", "colour": "#2EBF57", "exportable": true, "hide_tag": false }, { "name": "HelloXD", "colour": "#6FB78D", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640736300, "uuid": "07c75af1-dd09-485c-93e5-53b99a8f8c56", "comment": "Malware payload (HelloXD)", "value": "9785231ebf3d00216aa979f8c705e2513568802e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hello", "colour": "#2EBF57", "exportable": true, "hide_tag": false }, { "name": "HelloXD", "colour": "#6FB78D", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640736300, "uuid": "93991aca-9725-4f5b-bb45-268e1370114a", "comment": "Malware payload (HelloXD)", "value": "4c3ecdd97d3d821f701606271cd5faea409688b08cb8f06e12ca505a0b78906caf2e81d93b09fb8d5c5c7a9a4ff6617d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hello", "colour": "#2EBF57", "exportable": true, "hide_tag": false }, { "name": "HelloXD", "colour": "#6FB78D", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640736300, "uuid": "7413a7c9-2f2b-4208-94e7-20deb822788d", "value": "T104E30185751948B6C45B11309A6BD88A2A34FE246FC1A82E349FF77E3A31777DD3CA10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640736300, "uuid": "cfa6fe4d-de99-4451-95cf-a13d15259ca8", "value": "b244bf9042a5dc34867b521d46e2f128", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640736300, "uuid": "46994390-86db-420c-b85b-016f5a3d67ee", "value": "3072:/uMGy1F1ld/zcQihU1xgG4zMtm3ffkxdViDbhS/DIyhN9HzJ7EC7bEFqHD:/6y1Pbc92gG1Kf2dwUIcnzJ7EqbEFq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640736300, "uuid": "2c2fd49a-1e22-4db4-a1f9-26e69ac70935", "value": 156672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640736300, "uuid": "4ddf5c0f-e2ab-4b9e-b06b-cc6e9e4a583e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640736300, "uuid": "0accad72-fc20-4ddb-a3dd-0d83da933e39", "value": "65ccbd63fbe96ea8830396c575926af476c06352bb88f9c22f90de7bb85366a3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcae2ec1-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640740926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740926, "uuid": "dfc25985-d172-4219-a297-88d3cafe2054", "comment": "Malware payload", "value": "e1ccfa62036e29a411e2104652e32bdd", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740926, "uuid": "5cc771f8-2058-41eb-8a4f-ca8f33d8d8cd", "comment": "Malware payload", "value": "679024c39d9df761788d6046b15bf4e677fd27a245aaa3203a813dcaf42ea337", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740926, "uuid": "08c709fe-3cbf-495b-aae6-b51248198a46", "comment": "Malware payload", "value": "16cb67316d95571f3481e82d11d835fff823ea7c", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740926, "uuid": "782404db-6cbb-4eb3-80a9-48b8cf1f3527", "comment": "Malware payload", "value": "db914584ead3d1131fc7c93d85f66418f06ae8a061928a7fdcc81cced3bf82102db3a36920233ba29de95f6314be9fba", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740926, "uuid": "3c5810fa-497d-48a7-8f6b-5b442d191bda", "value": "T13D64AE58BE9414F4DABBD63549A72D6A727334720BD2DE9E135CB3E21F27360AF06900", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740926, "uuid": "cd9b9df6-8af8-4649-8351-21b0140b2817", "value": "6144:aAdxVRaKjJh9gd+ZBLi+EgOBo9UnQ7cPWa:x4KdWmLLO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640740926, "uuid": "f78ffc3f-4310-4965-a93c-a29d32508b66", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640740926, "uuid": "637526b2-7055-4b1c-943f-08e2fa5fc14e", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740926, "uuid": "1c6881d6-b39f-4562-b33d-70f5d2b542b3", "value": "attacments_1024.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddfa52ec-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640740982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740982, "uuid": "d94c1bb3-b5f5-4cdc-9ef7-ef5127a6e243", "comment": "Malware payload", "value": "ce742c7144f1dd33d05971bb73be6373", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740982, "uuid": "b6bbe6c9-95d1-4c41-b832-cf05742f28ff", "comment": "Malware payload", "value": "68140fdf1563b5854fe87fc752ea80acdc5489d76a0df95ac8659c8bbc4b3cf5", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740982, "uuid": "a96a72d2-01c8-4c27-be77-cff30b525c76", "comment": "Malware payload", "value": "7000b6706b25652affce11cce7d24c1757cf3bdd", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740982, "uuid": "fabb699f-13aa-431d-a60f-b9b3e76e533f", "comment": "Malware payload", "value": "02f509656f11cc74d3d37af127ffc53d720f2a1dcbb8429bfd00cb52877a4e9e937324d0bfdad4c1fbf021a2290bdaf5", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740982, "uuid": "a54dc618-9347-4775-8647-348f8124fec7", "value": "T11A457B2132C79B32D493127155AEA3610A3EEC704B718287729C7B9E2FB67C0673579B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740982, "uuid": "0746326c-e90c-4b74-a0e9-779fcd120185", "value": "24576:Blgq+3Nn7BjlpOu3LBCvAq23Nn7BjlpOu3dAll8:BlgJ3Nn7BxwubBCvAF3Nn7BxwutAs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640740982, "uuid": "96c14b55-9b62-499b-8ed8-54c2ed728382", "value": 1169379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640740982, "uuid": "3f214bb7-28b0-4571-b57a-d559215d67cb", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740982, "uuid": "bc070c85-b334-4e6b-ad93-4ae135e3d98f", "value": "Delivery_Info.jar.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e830eab4-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640740999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740999, "uuid": "656de5b8-bb75-4ba7-91ef-108a05cbc7be", "comment": "Malware payload", "value": "1e4771fbf29504ba1fef14fbf92c18e8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740999, "uuid": "5ac733ae-dd03-4a45-91bc-31ba19de772d", "comment": "Malware payload", "value": "69f8df331575def99afc490e307ad3eff43d018b661ae738b90c8c7ee518de70", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740999, "uuid": "53458a00-20c1-4957-9ae3-9607fac9650e", "comment": "Malware payload", "value": "0e48379bd46b24629e62bf257ebf799c4e6c23a1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740999, "uuid": "b60825d3-9f13-4040-90dd-75e0585bb4af", "comment": "Malware payload", "value": "133a1ee6aeb41d2b7a610c065098cfc55c4c3d3928859ce61ca5657c164294ed8e1e244091d71d78cbcc56a3adcb74f5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740999, "uuid": "048ce8ed-08b6-4db9-95c8-05b510bbcee1", "value": "T17BB09B50B9856874B2114D8049160D9F5631F86513198C305D8449D5D400D456D57A82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740999, "uuid": "135002aa-1e17-41ee-9aac-51b2c9d18369", "value": "3:mKDDOGKVBFSvKWdO05VaCRBJbR9eOD6L4AcfjzBJYOZ5vBRn:haRMNdt5Vj7Pe06kjfP4+xnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640740999, "uuid": "bb4aa063-8052-41df-8fea-dcc74f3539cb", "value": 121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640740999, "uuid": "bb6dd406-4e4e-46cb-a564-58aad81874f8", "value": "text/x-msdos-batch", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740999, "uuid": "0ded2534-134e-4aff-b9fc-916ec58f0508", "value": "start.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a367b44a-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640740884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740884, "uuid": "80664026-2bcc-4157-a6e9-d0b932aed54d", "comment": "Malware payload", "value": "b2ee9d435f5888aeaf3b5001b9644ada", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740884, "uuid": "3ded8c55-0a3b-4be3-a206-9cb2f0a0f50c", "comment": "Malware payload", "value": "6c2812501b56986c292c33f714c2cb2376793278bdeca257e72a83b61af5d0b3", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740884, "uuid": "ad62f513-9491-4642-bebd-615d9dd8afc9", "comment": "Malware payload", "value": "7041f4283536f375e3fd320800544192d834d388", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740884, "uuid": "8864bf3c-b2d3-49f1-bc6b-3799ef0195a4", "comment": "Malware payload", "value": "e846443d3f2da248a99b671e8395d4838c2c89020ffe46ae82cd1f8354550ced9d2b39c65ba28f998ee205919055e3aa", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740884, "uuid": "6354784c-cb99-4845-ba6c-4e0bef8ece74", "value": "T17F64AE58BE9414F4DABBD63589972D6A727334720BD2DE9E135CB3E21F27360AF06900", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740884, "uuid": "5ccaaee2-73d6-4ae5-8df3-9efab9cf59ea", "value": "6144:MZH8FzVRF4jJh9gd+ZBLZMEgOBo9UnQ7cPWa:Zr4dWmLSO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640740884, "uuid": "03f51973-2fda-4ee9-8d68-eae48fdac228", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640740884, "uuid": "3b3259a8-4013-4ceb-8f88-79d3687d53e9", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740884, "uuid": "0fe052cc-4f26-4687-867b-4b2f76c9882d", "value": "attacments_1032.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a7d038d-68c9-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1640797348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640797348, "uuid": "3bc81f9e-67fb-49f9-a441-3ba191a5438a", "comment": "Malware payload (RedLineStealer)", "value": "c7ed4705cf8b9ad8c2c0148f662e3c55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640797348, "uuid": "676c877e-682e-470a-9139-276cfb6bf4ed", "comment": "Malware payload (RedLineStealer)", "value": "6d86e35937b4681bf381232833c194fa5e30d392c2828deff4c0f391d77a3483", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640797348, "uuid": "8d1ceea8-d926-48c9-aa71-66997c8766bb", "comment": "Malware payload (RedLineStealer)", "value": "ac55d8e1a854b732431e9f4a18758b800d3d62e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640797348, "uuid": "3318a38b-ea4f-4be0-a5e6-4ecaba026f70", "comment": "Malware payload (RedLineStealer)", "value": "f00f9206ed8cd073173964a778b572c9c8bd2b6e9e173df255ea037d335c7f00c0b35ab54d76db9421a942144cab9dca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640797348, "uuid": "5395e064-6f04-4dad-a430-cbda9f938f00", "value": "T158A4D0F1B692D471C0A5353848659F915F7FEC61CA20468737B83B9E6FB22C10A6631F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640797348, "uuid": "9d52cca4-0f62-4a9c-888e-02a9d0bd3f0c", "value": "686f40ae776d9638a830c9a812897676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640797348, "uuid": "4f91c264-e3c8-486d-9e21-a8685487f941", "value": "6144:+GXLSKMYDuLLfr6wDdIkxVxuS/Df1Y0GJr7ITsq0:+GXeKRcDr6wuknT7f8N77", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640797348, "uuid": "60bb797f-d5c2-4b4b-bca7-a87a7168dc34", "value": 454656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640797348, "uuid": "afff006e-bee9-44f7-93e3-c8d3edfac5e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640797348, "uuid": "8a46c3e1-6496-43bc-bc56-7cd351993866", "value": "c7ed4705cf8b9ad8c2c0148f662e3c55.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb805c87-6862-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1640753407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640753407, "uuid": "57804825-9813-4e7a-af63-0589119d24f5", "comment": "Malware payload (Gafgyt)", "value": "71e81cb505675f1d2cfcd6adb632b1b9", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640753407, "uuid": "fd14944f-9624-4821-9a24-9277dbe32868", "comment": "Malware payload (Gafgyt)", "value": "6ef4744dfb8d626a09117d0176689616c729d99b90a303714af1ef818127616c", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640753407, "uuid": "d47473dd-86d2-4396-951a-c8d85792beb6", "comment": "Malware payload (Gafgyt)", "value": "84c3e5c328cb354d0e9f997b05c4fd2fc4fc511a", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640753407, "uuid": "246c1ac6-1bc7-4822-b9e3-facfc75e8a3e", "comment": "Malware payload (Gafgyt)", "value": "db200cea2a47a5c0aad6429e671178d7b8278a4332fb32625a363cad78decfebf5eed9bdc1fd19610727149a8d721a2d", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640753407, "uuid": "bbaf70b2-3dd3-49d5-a910-88e6b21a05e6", "value": "T1A013F1D08DAB3D89A7F09D30CD7949DB2539DBBA21AE74CF2624C7250AC324265F9217", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640753407, "uuid": "5484e20d-f799-4db8-a8f2-bccc634f9294", "value": "768:Nknn7W6Wivi0Rm8plvnCqCmrYdst2WMdN6Qs3UozMDpNuCho/NCEUlcvhc:QIi3R9LvCkrYp8FzMuCheDUlGc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640753407, "uuid": "dd35a91e-e490-4ade-b86e-58c1b9620162", "value": 44720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640753407, "uuid": "fe5d1f67-ebb7-4d76-80b1-e5ba6e5e1236", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640753407, "uuid": "08149251-21ca-4e7e-9f41-486f35e043d6", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6504a71f-68a1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640780293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640780293, "uuid": "dd5b93c5-2721-4969-bb46-be32af6d5aa5", "comment": "Malware payload", "value": "f97b1a042edff1161977dc022f028e6f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640780293, "uuid": "c1cb48bc-62cc-40e9-9739-d6f8cd8f1eb6", "comment": "Malware payload", "value": "6f8b7d8fa7d6c9121e6510b03c1490d4ff61b1e2e9660fe8f1c7ee7886221a47", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640780293, "uuid": "59ad402a-f076-42ff-b3b5-832ae680726c", "comment": "Malware payload", "value": "b29a7cd10801b2c1017bbcbc42aca85b057ccacc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640780293, "uuid": "c48b2f55-cc55-4cec-b9d0-ce6db64b4d8a", "comment": "Malware payload", "value": "d048652c5367520d6d1284ffef8b48a7327f99137528814fde8f35189c7bf3e16380c83e94d099ea87bef1991c1f4e01", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640780293, "uuid": "d9c12530-c3be-4ca2-a6cc-9eb3b726bd2d", "value": "T14724238DF89D4B31D375CCFB211DBA2396F8CFBE841D5A0D1559BB49053E4A38A90198", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640780293, "uuid": "0b592570-9193-4cb4-8c59-0d1098efda23", "value": "6144:Z5EbrHg5R//2vEzDgqJzMQsuU2VlKgmrcvR:nE/Hg5x2vE/TMeU2mCv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640780293, "uuid": "8c07b48f-90d4-49cf-862e-b0ca014a8ae0", "value": 221696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640780293, "uuid": "9735099b-45b7-4ce3-8a33-0d55ff56f232", "value": "application/CDFV2", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640780293, "uuid": "424a2e8c-3cc4-4c21-85c1-180033f20342", "value": "SecuriteInfo.com.Trojan.GenericKD.35778482.23227.23835", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd33d0db-6887-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640769328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640769328, "uuid": "59381a36-fe6f-49ef-9007-042a33f5efbe", "comment": "Malware payload", "value": "ad5122a5ef7ecdd89d936cb8cc4e2bd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640769328, "uuid": "e5975a76-3cc9-4401-b43e-b53efb18af69", "comment": "Malware payload", "value": "709b7e8edb6cc65189739921078b54f0646d38358f9a8993c343b97f3493a4d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640769328, "uuid": "44581da3-a9e3-418c-858d-c6a80d026a65", "comment": "Malware payload", "value": "1758a8db8485f7e70432c07a9e3d5c0bb5743889", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640769328, "uuid": "4042ab36-6b04-4030-9e41-34deeb443124", "comment": "Malware payload", "value": "13dd98f6ac9917354f67f35e659ce71137f58546034dc44f2bc92b7ee319ac05e8ede0c51a4e701e1cc371f502147cd5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640769328, "uuid": "daa04b81-c7bc-46f4-8ee8-f03b37bebafc", "value": "T12673E1A674C48085C2D604B05B87D3062639FEBA4C208A1F356FFB7C377D976B986AD0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640769328, "uuid": "286f519c-fd73-4317-a5b4-7bdbb31967df", "value": "a46ea633057f9600559d5c6b328bf83d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640769328, "uuid": "07983520-4965-46a6-9a84-2567c015419f", "value": "1536:MZHISwR/XIU6bRHoRMv06bdKQ4ShnkmNtaJQOf+xFqTRT:MmSY36bl5QekeEf+xFqTRT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640769328, "uuid": "ffa5aee9-deb0-4fee-9ad2-215451fa4836", "value": 76288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640769328, "uuid": "02069eaf-a69d-4290-b44e-89e66b42c823", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640769328, "uuid": "48813c0e-6c68-4718-80d7-ae7a54736a88", "value": "ad5122a5ef7ecdd89d936cb8cc4e2bd5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31f045b4-6846-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640741123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741123, "uuid": "fd11dad4-fa3e-4e5c-aa1e-2a5ba2dbda71", "comment": "Malware payload", "value": "457ef7f0531492392c78e4adcd8919a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741123, "uuid": "df77517b-0577-483a-b23b-de924e9284c8", "comment": "Malware payload", "value": "72e92aa56e269c795a008e4e132548e8ed9c05ee9359d5bbc948ad13ea5a8ce2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741123, "uuid": "fed4b8d9-2438-4b5a-885d-5331bb091e09", "comment": "Malware payload", "value": "6211332b3aa030fa3515fb5fb9d12b28bf91c275", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741123, "uuid": "7fb412ed-e0a7-443f-8849-cf3adc282d1f", "comment": "Malware payload", "value": "30449decd39aa3ae82e4bddaba44fffd0d35deacf8fb8d54d01be2e2d92167af2b653c290c700b25bf290b49bfb5cbfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741123, "uuid": "d48da276-3e41-4c33-8259-52ad41837584", "value": "T17144AE58FE9414F4DAABD73589972D6A727335720B83DE9E0358B3E21F27361AF06900", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741123, "uuid": "29996280-2092-4bb3-8f02-307320902ddd", "value": "d4755b9a9aec93c05c955ca11140bdc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741123, "uuid": "cd04b43a-6707-4be2-8451-9d4023b9996d", "value": "6144:2AiO2f6RQYjJh9gd+ZBLi3EgOBo9UnQ7cPWa:2CoYdWmL+O0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640741123, "uuid": "a58d179d-30f4-4ce3-ab28-05ab2d4a8b68", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640741123, "uuid": "5310079f-585c-49e8-8220-f73b02ae5462", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741123, "uuid": "06f8d101-a88d-4c09-be56-1d0468e912ad", "value": "macosx.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aac45457-683f-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1640738319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640738319, "uuid": "80b3df37-2d1e-482e-a36d-a48a73b7cf1d", "comment": "Malware payload (RedLineStealer)", "value": "cb5fb610cfa0eb1bc585b4a86fc8a46a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640738319, "uuid": "f2b49718-d47d-484a-a360-78e179749e3c", "comment": "Malware payload (RedLineStealer)", "value": "7387dda5e2f645e2bdb9c2b366b4917a52a0535800580deb50f28e6790418ec9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640738319, "uuid": "5f836794-1b89-4429-a7c1-76724652623d", "comment": "Malware payload (RedLineStealer)", "value": "1d92fead157639cfd3c9790d8212da578135e020", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640738319, "uuid": "4d54db50-1f06-4d08-994e-d0ca5628be8c", "comment": "Malware payload (RedLineStealer)", "value": "cf1cba9a63c171e6e050f80791c656639d2bf310654fd5729211ba3cc8de111cb03ee0583c78ea506b2751581d8a6d7d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640738319, "uuid": "cd27fd11-4dcd-475c-b9fb-37b88d6282c4", "value": "T169963320EC01DCF1DE6969355534EA5081BF7CA02E18998F238DB0994AF3BD11BF5F9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640738319, "uuid": "effc646d-2ac9-4485-8b5a-1a19c563c97c", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640738319, "uuid": "206b7537-da48-4bb5-abf4-6513c6431d75", "value": "196608:YUL3oMR1CrKDGOVQ+18NnyE9e1oNGeR8ot7gcgjjADtVwXv:hL3oMzdGOVQ+unyELT8ou3Cqv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640738319, "uuid": "802181d4-072d-4bdb-8733-4ed9490cc076", "value": 9359415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640738319, "uuid": "752f0663-9713-4df6-a00f-99e9091f1451", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640738319, "uuid": "bd29a4c6-144c-4715-9662-b2692b796b20", "value": "cb5fb610cfa0eb1bc585b4a86fc8a46a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9f30b87-68e2-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1640808353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640808353, "uuid": "ae482d15-0c1d-4d8e-86d5-0481794101af", "comment": "Malware payload (RedLineStealer)", "value": "5066fa073fb45009657b28d0ab85c8bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640808353, "uuid": "ce8bb09b-3480-4375-a802-1a550ae72d33", "comment": "Malware payload (RedLineStealer)", "value": "7458424fa52646e28eb350b6694a6a437c7a16a8dd7e8f8a11e5f46d4dc0be39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640808353, "uuid": "78fe81cc-41eb-4757-b358-0e9aa61de0b2", "comment": "Malware payload (RedLineStealer)", "value": "da8fd0e1067b3d866f13103177564d1f28eabd58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640808353, "uuid": "904932f8-e624-4554-af79-98cd061d5f53", "comment": "Malware payload (RedLineStealer)", "value": "10efdd4db384f04e3b6ad96f97b6b1fa74d0c3e45488ce9d6aadfbcc3d6061927683572fc4d81398879537f311b98402", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640808353, "uuid": "610dfa1a-e105-4566-b706-2910f2600e8b", "value": "T1E1C4012637D8072BE3F5FB7845E100259B35F943B536C70ABFF97066582278C4EA426A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640808353, "uuid": "d0fc742b-7864-4cbb-a5f9-71896a9ded8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640808353, "uuid": "2aa2f435-e9fd-4a49-b8bd-2dc9d56d842e", "value": "12288:T0GSAJGXRTxrOEA8IDZSSqToDxsM8H7A1kT7l:ZPwX9FmDATsxh8H01kT7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640808353, "uuid": "25909228-28da-4316-a6d3-21606cf227d8", "value": 548848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640808353, "uuid": "9699ef18-38b7-4d95-a7ff-368404fa848b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640808353, "uuid": "1215e71a-0332-4100-8fe7-681f3ef425fc", "value": "7458424FA52646E28EB350B6694A6A437C7A16A8DD7E8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c90aa8a1-6862-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1640753403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640753403, "uuid": "6e616d46-019b-4ae6-b1a7-97d46d4c6d60", "comment": "Malware payload (Gafgyt)", "value": "169abd80b7e5c19954bcc8b8fbf4726a", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640753403, "uuid": "94c488d0-08ca-4a38-94c7-8e91d3672515", "comment": "Malware payload (Gafgyt)", "value": "77318d8306ef6856ed333833622ed55f4560fb0e945432d64dd8bf3a8d05d4b5", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640753403, "uuid": "2593384e-e93b-4900-a7e7-a2aaaf8b37f0", "comment": "Malware payload (Gafgyt)", "value": "7e1f6a296b7e21de970b4d96e6ed84255de3688e", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640753403, "uuid": "3da3c721-0633-4665-8ee1-18550fdcfe0b", "comment": "Malware payload (Gafgyt)", "value": "f5d9c88f7797180eb2b97cfc50b488290ddab69b6c71117d78d55930e3352f69fe8cd0b6b503631e85e49e89ea4d5ce4", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640753403, "uuid": "8e507a85-1ec8-4cfd-987d-444d3d0c1816", "value": "T11813F20AF1F88F94AA8D20704A79BB2EEC955FB9DC4440E86DC4705698ADF50F23B781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640753403, "uuid": "d9925a0b-7245-415d-af69-6e68f3e3b419", "value": "768:ptc03MgWfgiq6Ot99orimrh/KHFx5Z1b5FnbcuyD7UHQRj2auHawkGLevmHvIJXM:LzcgP1mV/ox533nouy8HyH6aw4gAJM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640753403, "uuid": "760b930f-530c-44a9-96de-91b71b927b30", "value": 44288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640753403, "uuid": "bdbcab0f-e4cc-4efa-8db0-636dd4bd2f6d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640753403, "uuid": "8e4383d0-2b8f-4b4b-ab92-9090288061f4", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93dd1124-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640740858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740858, "uuid": "c8021dce-00c9-4ec1-ae25-5bd6c43ddd7d", "comment": "Malware payload", "value": "d817785289b5b687ae8f393050ee9f3b", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740858, "uuid": "4086e394-47b6-4b22-94ec-625a256cbb2a", "comment": "Malware payload", "value": "7919d732d3accac2c0903515b1043470f89a5da9fb8fe1dded5037ccb61859ea", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740858, "uuid": "38d3d337-11d3-4bf9-8083-6d9058842fd6", "comment": "Malware payload", "value": "2ae74d99cc399383fe390f41ab30fe39fd5c4ab9", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740858, "uuid": "e05e2a98-8f4a-4224-9cc9-53db523bb1c4", "comment": "Malware payload", "value": "783423465822eb5e4b9ca0c3bc9a9f36858f85db947bd2d95e5c1554782e60f21d9a057145cae454c3bb8eda3fc181e5", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740858, "uuid": "a940b876-485f-4fc9-844e-9ff334743ec5", "value": "T165649E58BE9404F4DAABD63549972D6A727335720BD3DE9E035CB3E61F27360AF06A00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740858, "uuid": "9d4646cc-eb7c-43b3-8dd3-d1705018791b", "value": "6144:il0QFozCZ5U71jJh9gd+ZBLLCEgOBo9UnQ7cPWa:iaQFMCZY1dWmLLGO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640740858, "uuid": "5465929d-ac22-49c1-882d-f65acba6a16b", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640740858, "uuid": "d84f4db7-64e4-448e-bcc8-6d78cea31e0b", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740858, "uuid": "345c9b5b-33fc-4080-946a-527f0ae122f9", "value": "Attachments-2045.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2334c627-6846-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640741098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741098, "uuid": "20eb6645-1bc3-4ebe-99ae-7c04dc0edb63", "comment": "Malware payload", "value": "ec22b0d56efbe77253d3ce45307af2d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741098, "uuid": "ee484337-595a-4375-90e6-f2244d9cb5a6", "comment": "Malware payload", "value": "79591b44955812c9f6c9f6d168a927c7af1bea5928d22c1d210eddbbcd93578e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741098, "uuid": "5b56246a-f1bc-4a2a-b4b3-9459c3d9834e", "comment": "Malware payload", "value": "3195e7edd9d16060080a60c186e5d3582e2150b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741098, "uuid": "66bee8fd-06e9-4edc-9651-2f69c0ec72ec", "comment": "Malware payload", "value": "be95a05e0cd722044a09b973b2fe43af0d8a6bdc333bd0c4c0d00b3cbfbc70b1b6a0c191d64ca32a55000eddc8ece7fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741098, "uuid": "5fe984f8-0092-4d76-a436-d92406ae1ef4", "value": "T1CC449E58FE9414F4DABBD63589972D6A727335720BC2DE9E0358B3E61F27360AF06900", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741098, "uuid": "697f8af6-c39b-4764-9efd-ea7ce2bbf112", "value": "d4755b9a9aec93c05c955ca11140bdc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741098, "uuid": "5abc6bfa-282e-4a62-945a-f3a87acbee6b", "value": "6144:LGpARjhjJh9gd+ZBLKEgOBo9UnQ7cPWa:LGGhdWmLuO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640741098, "uuid": "11ceaf04-da43-4e63-8873-8ae9cc04636c", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640741098, "uuid": "5721fbaf-6de6-40bd-9647-a50a5bfa22a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741098, "uuid": "0d144c76-6d15-4d9e-b362-d65fb911bd56", "value": "macosx.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90b5b8e0-68e5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640809572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640809572, "uuid": "d42fa45b-b71f-43e5-b71b-8e56189dc602", "comment": "Malware payload", "value": "99b6ee52d0dc5a07bff09373a8dda2fe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640809572, "uuid": "2ebe7f3f-3fed-422a-b268-4ec1cc18f6ee", "comment": "Malware payload", "value": "7b3296a5492a8b01ab3bb33164a1bb269630b396d6dd8234accce8e4c4d84067", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640809572, "uuid": "ca8c970d-535f-4145-8fc0-4e9bbf02216c", "comment": "Malware payload", "value": "616c52af96614c86623829b604b0eda3cf29af28", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640809572, "uuid": "e27c7c48-a4d5-482e-8498-96a7dfe3cf91", "comment": "Malware payload", "value": "05e6fcd5916448f383fc3b467e79a7010cd6dd53f9b939837e6c386ef83f5402347c9bee3ed47ba5c7c428edb44ad760", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640809572, "uuid": "801a0bc4-d143-4e99-a949-84cc29463fd3", "value": "T1D8D533E3B5821836CC52297DCD0ED569862E97E874B8928D2FDC7E50D740BCE0F76A24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640809572, "uuid": "f8d5ee98-d4a9-4092-84ed-35e8dbadffed", "value": "076fd3bc44050b5480459bd4d8e1a2d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640809572, "uuid": "9f203799-c17b-4a43-8ebc-a29329c09446", "value": "49152:DPPskqauipv1QRGYYHZRuhIR3AGb9UCJ0MaLQW2QWCQqc412Rx0dxgJ13:jfRpOUYuGVGJQPUjqcfRx1J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640809572, "uuid": "131c2544-d4cb-4a76-9ce6-23ea0c1f5beb", "value": 2797568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640809572, "uuid": "1c4670b5-b3b2-4327-9f4f-8da319af59dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640809572, "uuid": "95deae25-fb48-482b-9481-6daf0a955bd6", "value": "99b6ee52d0dc5a07bff09373a8dda2fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8f5515f-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640741028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741028, "uuid": "dd77d71f-5bca-431d-96d8-e9377f3e2c15", "comment": "Malware payload", "value": "7968fb6ee54e1d55b7a172e934980b74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741028, "uuid": "bc6616af-3c1a-4796-96ca-9456a15ddf89", "comment": "Malware payload", "value": "7c6db95b335f15e54df4a83ac12fae5fc39bedea1d0aedffa96393e04fb737af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741028, "uuid": "fd3b8cb8-0e1c-43c0-8a7c-4863440f63c1", "comment": "Malware payload", "value": "700cedb2ba3380e20881b9de8580766c0e530fbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741028, "uuid": "68d3f34a-0f7b-410e-96a1-5e4d963aa442", "comment": "Malware payload", "value": "bb33f8160c9961ea5abf12481a73c319db5608de5a1d03ceb39eac6077b636652043749fdc8c34854f4d5032f2944a1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741028, "uuid": "ee525b22-fa41-4895-8a2a-52055bc64233", "value": "T16F44AE58BE9414F4DABBD63589972D6A727335720B83DE9E0358B3F21F27361AF06900", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741028, "uuid": "960459d3-0f03-4266-b343-30c79f79c860", "value": "d4755b9a9aec93c05c955ca11140bdc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741028, "uuid": "291ff82e-9521-4388-ae5e-a11241ef919c", "value": "6144:X9CSwAs0kjJh9gd+ZBLbEgOBo9UnQ7cPWa:NCSzkdWmLnO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640741028, "uuid": "2ae0b777-a18c-4e49-bcd7-fc4c020a1a5b", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640741028, "uuid": "d22eb888-9631-4136-8e09-9055ce6431c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741028, "uuid": "f3d1cb5f-8cb7-4650-8bd8-ff5c2afb3bc4", "value": "macosx.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d568fc89-68b4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640788642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640788642, "uuid": "8d52f5ea-d8cb-4768-885c-0ac91c912acb", "comment": "Malware payload", "value": "6ab69d3f6b8a4864ce992d6a9f181de5", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640788642, "uuid": "959ce30b-c27a-4a2d-9605-0d4031b4090d", "comment": "Malware payload", "value": "7dbbb75970df18a597d9412b79c0982611579eb7fc72d99849be432d8b39e7f4", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640788642, "uuid": "49408efd-1e4d-45f1-a914-bea40133a735", "comment": "Malware payload", "value": "3bfc59321c331faa9bba3e46067ddced099ccc95", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640788642, "uuid": "48709ff4-dd16-46f1-978d-2a3a0a2845e5", "comment": "Malware payload", "value": "02d4e0495a49c984a6ddb005495160910f8163602b422b5d641f4de9128f09891c1cc713b944c18cf3942360e4adc5c8", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640788642, "uuid": "cf43d0a0-85bb-4d74-9c03-69910aff7dbd", "value": "T149457B2132C79B32D493127155AEA3611A3EEC704B718287729C7B9E2FB27C0673579B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640788642, "uuid": "6ff65f94-ec0a-43a6-89ef-ffd4a3f7dc51", "value": "24576:Blgq+3Nn7BjlpOu3LBCvAq23Nn7BjlpOu3dA1FC:BlgJ3Nn7BxwubBCvAF3Nn7BxwutAy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640788642, "uuid": "ea80125a-c5a3-4092-98b4-030ead1cc1c1", "value": 1169379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640788642, "uuid": "b0699483-85cf-4512-a79e-2e2f6e47d533", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640788642, "uuid": "ce90ca33-809c-41fb-b0c5-a904552be1f4", "value": "Delivery_info.jar.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3c5e55a-6882-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640767191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640767191, "uuid": "588eddae-4281-41c0-a39a-bc5c5a5c0c99", "comment": "Malware payload (Mirai)", "value": "c1c64eb04863ef40a12a02e54a8aa83d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640767191, "uuid": "1963a7a5-76b7-49ea-90da-c4ebd2b9d2b4", "comment": "Malware payload (Mirai)", "value": "7dcf43e0982735d71f2ed9636d038e48cc4c4b096ab2ef9186faad7e93885d53", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640767191, "uuid": "25c07e07-3fa5-4797-9ed6-2cbc3da48a02", "comment": "Malware payload (Mirai)", "value": "536e45a32d7016143b81bbf564bcbb432520a792", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640767191, "uuid": "3cafc980-dd58-4677-9b20-8b730c396660", "comment": "Malware payload (Mirai)", "value": "f08668ad0523265525123008f82dc6c6ebf400d262ce4f11dacbf892de5bc0a445cbc9867a880fb4248c4abc71defaaa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640767191, "uuid": "09e1303b-b4cb-4f77-88f6-f1ab5eff4d3e", "value": "T173633C4272280F47E5A249B4253F1BE093FFED5024F4BA88694FDB5A4639E761086FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640767191, "uuid": "38253e6d-7efb-41c1-a936-07f6459ae4e0", "value": "768:HtbRcTIqx+TV7Rn0/qPhTS1qBeaqPfH3MZfD93whOm7SG769aLxHNR+h2lMBS62Z:Eg7q0TS1qBp2PMeOrAB36sZI5SL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640767191, "uuid": "a4d39b81-dd8b-48ab-8d66-e81fa4f04085", "value": 66808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640767191, "uuid": "9d7af076-15b1-4e56-8129-3e51eee80acd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640767191, "uuid": "fdcf808f-3bbe-489f-96ac-b8bb5dd1cc3f", "value": "c1c64eb04863ef40a12a02e54a8aa83d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f632c80e-68be-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640792992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640792992, "uuid": "627e6e60-9134-47c7-a4d9-4f0600d19cfc", "comment": "Malware payload", "value": "3004a7663d8b6347f0adaf580986a056", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640792992, "uuid": "cdb29859-fa55-4aab-be63-f3563cf7a63c", "comment": "Malware payload", "value": "7fd6beb2fba112b677de31a8614322c197b2c89c85f696096c5d5df2d52482fb", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640792992, "uuid": "da427d52-aaf9-4e90-b561-7c9edb54a4e3", "comment": "Malware payload", "value": "f3db94bee338b29c844e0c98783cf2e14ab439b4", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640792992, "uuid": "219f4425-64a1-47b2-b40b-c8b4063e5dd9", "comment": "Malware payload", "value": "825cff1566e678fa796ce9c636cada15ed89c7f2eee476d396e889429abc3d8420a74c9b39176cf26e17f20848907e0a", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640792992, "uuid": "6fedf499-3739-4678-8bd1-87640cfcd675", "value": "T155B36C1BA649CA87E13C4770AEE74F9E3B13BD159E8722D331097B5E3FB5140891E12A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640792992, "uuid": "d89d8583-2d1d-4e2b-b405-adb412a703ea", "value": "3072:SOKpbdrHYrMue8q7QPX+5xtekEdi8/dgxhjvH6f9+H5uUyLtC7A:pKpbdrHYrMue8q7QPX+5xtFEdi8/dgxO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640792992, "uuid": "f8928555-9b0c-44f2-b62f-8f41cac9af04", "value": 108037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640792992, "uuid": "0b1ebb35-8c13-4835-b000-70dbdb7ed3e0", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640792992, "uuid": "d48ad86e-b4f1-4bc0-9b71-45a96af85098", "value": "recip_conf_1561.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8cad1b1-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640740947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740947, "uuid": "294bdd31-5df1-44be-9f44-a72bc149991d", "comment": "Malware payload", "value": "4e227abe719b2a8a50d328c41f7ffb7b", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740947, "uuid": "77332da3-771c-46e9-87fd-0cf9bf4cbad2", "comment": "Malware payload", "value": "7fdb725a0a99b1c93f23ba4bf351f1940b51538da00fbfe355b662cbd670deb2", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740947, "uuid": "9083a6b0-03d9-4082-81f9-fbb623cff716", "comment": "Malware payload", "value": "321fe5721866f74fd89efe4b4bff47598336e261", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740947, "uuid": "5a4688dc-a23d-44d1-a64b-1ce268e84a39", "comment": "Malware payload", "value": "f5795de6a07643223f4d3c0cedc5c055708d5b55c79b8eea41336057ea4d27f6f3e01f246a506d22416d29b4ffe6dfcd", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740947, "uuid": "f211c758-4ffc-4394-85c2-e00776698d25", "value": "T11C64AE58BE9414F4DABBD63549972D6A727334720BD2DE9E035CB3E61F27360AF06A00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740947, "uuid": "0913a808-623f-457b-8b07-9d109e74d6e1", "value": "6144:szrqHSdf55eHDjJh9gd+ZBLC1zEgOBo9UnQ7cPWa:errlOHDdWmLwO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640740947, "uuid": "db74f81d-a7a0-49e6-a835-db35356769f8", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640740947, "uuid": "0a682bc4-4578-4657-a8ef-045195d75108", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740947, "uuid": "d7556c19-b5da-40b5-9e9b-81ab0bebadb5", "value": "Attachments-2040.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12650910-6846-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640741070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741070, "uuid": "8fd9ddec-9d5c-4313-8eed-2c9a8030ff72", "comment": "Malware payload", "value": "31e7d8130d7762cf3753edea2ab932d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741070, "uuid": "3a6c015e-a286-436a-a80a-986fcf155700", "comment": "Malware payload", "value": "825c24bf213910d4cab0ac2ce9f7875a27eecba0864299d4774ab3f4394a562e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741070, "uuid": "f3258298-2abe-4654-aca4-41d670a6f23d", "comment": "Malware payload", "value": "5f1beadfbb603a3f9e88eda61e7295b73c46c89c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741070, "uuid": "5cb8f2e6-7e26-4c45-a38d-e418a2ec4bfd", "comment": "Malware payload", "value": "10ffee070f30302914c876e3fb82b4ccf3c41dd0fefb4f76b3078d2ba9d045eec42c9ea5028736bb08afa3ef644f070e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741070, "uuid": "7cc50715-a8d4-42d9-ab97-7cc3005d3a28", "value": "T176449E58FE9814F4DABBD63549972D6A727335324B82DEDE0358B3E21F27361AF06900", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741070, "uuid": "d28e366a-7823-4402-925f-6a13cfc3a5a2", "value": "d4755b9a9aec93c05c955ca11140bdc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741070, "uuid": "f5c4d2bd-652c-4048-af29-f90fdf86dfe4", "value": "6144:sj3JDuCtGRjJh9gd+ZBLAEgOBo9UnQ7cPWa:0J2RdWmLAO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640741070, "uuid": "7d88381f-ab90-4d73-b919-6bef2fb43926", "value": 270336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640741070, "uuid": "60298a30-368e-4186-b720-cac539fc4bde", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741070, "uuid": "f10cb24b-cf24-4327-8a63-77a15c04ed91", "value": "macosx.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42ef088e-6856-11ec-9275-42010a9c0029", "comment": "Malware payload (Stop)", "timestamp": 1640748024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640748024, "uuid": "7e9ee45a-4c6c-4d75-9e63-ec816e959bcd", "comment": "Malware payload (Stop)", "value": "c15f4817cacb70c2d5be5c54b1fa2855", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640748024, "uuid": "587b57b8-630b-4ce3-91b6-d88438944e87", "comment": "Malware payload (Stop)", "value": "8292948dc01246cbe55ab7c75f6a70da2fd0ebf065960e9249b48160f0363b7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640748024, "uuid": "8b1c6468-af24-4cf5-9f40-372893a7deed", "comment": "Malware payload (Stop)", "value": "2b3deb38584b3d2176c33924f83d8dd7831e20f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640748024, "uuid": "fbc53ee4-5b5b-4536-ae91-a2085c4271dd", "comment": "Malware payload (Stop)", "value": "0b1db5402e086a362d70ca4ea720a095ce13f9869ee95aca2505493e3507f0716ff0a6fd17e28ced3b987edcdb232129", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640748024, "uuid": "a7d5767d-2f33-4769-a7e1-d7399976afc1", "value": "T10605231C3FA1D03AC88B0AF219E6CB956D2F76117D33C74BAF5C2B9B7E61194495A302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640748024, "uuid": "82bc7b3f-85b3-4ac9-b5cf-058f2a07bc0e", "value": "95d45e77143988fbcae4ec8ca9a8169e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640748024, "uuid": "3405bd0c-8a1f-47e8-a0f4-dc29b7401658", "value": "12288:+QDvUlJbboUv8FuNfVBD9RKT2eHFw1rfQgcg70L:iJnoqMUdBGT2eWVTcAw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640748024, "uuid": "b4aaccbb-9ea1-474f-be3f-10f9341f732d", "value": 872960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640748024, "uuid": "02d87721-8549-4116-bccb-dc0397b7bd59", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640748024, "uuid": "74d441be-ba86-4116-9c29-d1af22f46b65", "value": "c15f4817cacb70c2d5be5c54b1fa2855.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1816611-68b3-11ec-9275-42010a9c0029", "comment": "Malware payload (CryptBot)", "timestamp": 1640788233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640788233, "uuid": "c3d488b0-583a-4de4-a30d-5c58302509ec", "comment": "Malware payload (CryptBot)", "value": "c8a6f0cdf70bcd2db55bd61927778d12", "object_relation": "md5", "Tag": [ { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640788233, "uuid": "eb8a652a-b752-47a6-9299-e4132eb346de", "comment": "Malware payload (CryptBot)", "value": "84d93b2fd2597da5d611165cbad0b252569a837c56a94a42849f2bedc8af033a", "object_relation": "sha256", "Tag": [ { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640788233, "uuid": "18b5e6bb-cad4-43c3-96f4-f395aa0998ac", "comment": "Malware payload (CryptBot)", "value": "a574cd6daea71a503c2c0e97bb8656be3967a2c9", "object_relation": "sha1", "Tag": [ { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640788233, "uuid": "44f190db-940c-45ca-8fdf-6ab93f61527f", "comment": "Malware payload (CryptBot)", "value": "38efbc18bb2b6ebeb5657c818d7f4a35ba20648f52fc27a950e06f8339ad2186b72e6856832c7470d738f3b77b73be74", "object_relation": "sha3-384", "Tag": [ { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640788233, "uuid": "497b3bf6-1ede-4fcf-a4a3-0819d2d4e6e7", "value": "T192C533B6020F885DD32B095DB8F19E3CDD36D30414862F3E559D88A59A33FD68C3AAA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640788233, "uuid": "3855bf75-c362-47e9-9acb-eb1c6ab84ef6", "value": "49152:4zsgRFN1iOPgU2w7ZmbVqgtJxUASqv7s8B4PM7ySjKdIfHayeKwkD6p7ZI+q2AcA:kzLLidSgVjvvxv7s+78IfHJeKl6p7ZIh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640788233, "uuid": "52bf699d-b519-4b9d-b11d-daa10b6e8ae6", "value": 2740590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640788233, "uuid": "680fee72-1992-4bc2-b567-84ff98a89451", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640788233, "uuid": "4e7e87e5-500c-4996-a96c-1b681abd3e08", "value": "file-password___2345(2).rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f79b92d2-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640741025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741025, "uuid": "dbcd7caf-92a8-4e44-adeb-e0a391ca0549", "comment": "Malware payload", "value": "2e8f587f18a377984fb01953c9de01c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741025, "uuid": "52eb0968-1872-4c22-9cdd-136dbef97012", "comment": "Malware payload", "value": "865f22622f2a7bfdb85ac4d2c7c4fb73f63c2e76d3c7445c525240800d79c6ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741025, "uuid": "e76659fe-7470-480a-b49f-a22b6a60de22", "comment": "Malware payload", "value": "150d88fe5d36427ba59c1f0e146abefe9b5e76df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741025, "uuid": "df899367-4042-4515-bf6a-bb49689f0277", "comment": "Malware payload", "value": "c4041cb8e32a592738181b58de2faebaecd21b0901e87ce5311285d9908a7f73503e201ae102c56c384d41fe253e286b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741025, "uuid": "25b83983-072f-46f7-9550-20d16bee2638", "value": "T1FA44AE58FE9414F4DABBD63589972D6A727335720B82DE9E0358B3E61F27361AF06800", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741025, "uuid": "c37ea344-1b3c-47c6-9833-02c19ac62581", "value": "d4755b9a9aec93c05c955ca11140bdc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741025, "uuid": "d2d8ee3a-f79f-406b-9b36-a2e2a24ffab7", "value": "6144:UicvrbR+qjJh9gd+ZBLOEgOBo9UnQ7cPWa:UiWoqdWmLaO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640741025, "uuid": "6b509d29-aece-4772-8995-0beb4a8796b6", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640741025, "uuid": "a9630660-8289-4598-a6d5-14220be79933", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741025, "uuid": "0944d221-871f-4990-9263-54b5466e6189", "value": "macosx.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7298b88-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640740917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740917, "uuid": "503bcc5a-3c56-4f07-9312-3d79275f0433", "comment": "Malware payload", "value": "2858972d6123d13faab6dfc8411639b6", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740917, "uuid": "7bcd7241-619f-4126-8cbe-935d078cdd15", "comment": "Malware payload", "value": "875e28e1de3bbf9fde6b72dee05f2fbf345292cf258c920e2d87cce5408f37f8", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740917, "uuid": "77a50633-7f82-4a8e-aef8-4db0bd676db9", "comment": "Malware payload", "value": "84bc6f6eb8cd4111c8591c02d9f68ac7266b660f", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740917, "uuid": "86dd996e-3f86-41d5-b655-f46945c315fc", "comment": "Malware payload", "value": "217abd0917dd92676101723cf084b089bbc161b3d168ac1e62be4c0568bea8ee2600d9c7259083f0f24efe3e29bb9b95", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740917, "uuid": "d334232c-571e-4273-85e7-4023c14bb8f5", "value": "T1FE64AE58BE9414F4DABBD63549972D6A727335324BD2DE9E035CB3E21F27360AF06A00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740917, "uuid": "c2599e7e-1dc8-4950-b179-dbe7896cb332", "value": "6144:QheneAt5FjJh9gd+ZBL7EgOBo9UnQ7cPWa:XnTFdWmLHO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640740917, "uuid": "38e093c0-cd45-4983-9441-5f5de591b0ec", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640740917, "uuid": "6b5da9d7-a890-491a-9886-2f8b59a7a50c", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740917, "uuid": "9a85698d-0917-4d49-9efc-93493b7f791a", "value": "Attachments-2021.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcc7823d-68c7-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1640796869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640796869, "uuid": "2e37b5e6-ba71-4894-b539-0721e5152f54", "comment": "Malware payload (AgentTesla)", "value": "0ee2fb6c8db47864652b0d7757f387b5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640796869, "uuid": "a3bf0f91-46d9-4814-9f8b-8612a5e37ad8", "comment": "Malware payload (AgentTesla)", "value": "883d702af603ae021218da994040382660c48ecd76bac4be1a8e670881b17082", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640796869, "uuid": "260eaa8b-ac8c-4d61-bab0-5c23d0192527", "comment": "Malware payload (AgentTesla)", "value": "17a6ddd577beeb753ab1e05f3440a3bd69cb819c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640796869, "uuid": "5dc800e3-027c-4a2a-9e19-235fe20670bc", "comment": "Malware payload (AgentTesla)", "value": "1d027bfb3a2971d09095261f8e1011625fbcd8432dd5321dcbd94015203de72b0162b08e1fbb7fe3a3345f4b9c280f58", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640796869, "uuid": "2a2e9222-3c57-4f48-bcd3-abc2efa3ea4e", "value": "T1F5A423B93879BFA9DC9636E91157DFE503E009A3236E199A8318978DE5C107F732D0C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640796869, "uuid": "fa34e22a-d3fc-4232-ac74-345971c0670c", "value": "12288:+PRpRG1BB820oS+KTYjIqG6UgnlhaKMu/bRDHjp7x1LJqBUG:8i7G5TUpxUgn/aKMuzRDHVlAUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640796869, "uuid": "734826be-3bda-4189-bc81-afd80465415e", "value": 458166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640796869, "uuid": "0a6764b2-58e0-4a6b-bdfe-dc763a131bc9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640796869, "uuid": "67663dec-e8fb-4199-977b-ba21e99ad131", "value": "SHIPPING ADVICE 4081791001.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d54871cd-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640740968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740968, "uuid": "d64166cd-4cbf-4c89-8c99-86ad025952e0", "comment": "Malware payload", "value": "ae3d8531047cef092e4518f460861a99", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740968, "uuid": "b9fabab0-42df-40d4-b491-b636f57a3cb2", "comment": "Malware payload", "value": "887503d167687bebdbdcbe9eba239e04951300464040feb02e29e4d9407f3597", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740968, "uuid": "f79f5536-5079-4e89-98e9-a95f5c20188b", "comment": "Malware payload", "value": "094eb0c5ca6b157fad8a16039170b8ee23ed8f52", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740968, "uuid": "f8bd0bac-798d-4737-9590-c72cd2b81039", "comment": "Malware payload", "value": "656d759e4cc57e8c9fde60c52ba2660997da8f3131bbb14a3b030ed88427a00b2d23017806ce56b70c5274177dd3f4d7", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740968, "uuid": "842294c1-907f-49bc-bdb8-c604e7c65a6b", "value": "T13364AE58BE9414F4DABBD63549972D6A727334720BD2DE9E135CB3E21F27360AF06A00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740968, "uuid": "718eeda0-ffdf-4895-9ca1-98af18006684", "value": "6144:LkwAs0kjJh9gd+ZBLfEgOBo9UnQ7cPWa:IzkdWmLDO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640740968, "uuid": "64681062-cdb4-489d-bcd7-f42910e13edc", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640740968, "uuid": "41d9a8dd-693c-4443-88db-06730344d862", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740968, "uuid": "f2d75515-b77c-4801-a9da-c707527e3b4c", "value": "attacments_1046.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef0c6b00-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640741011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741011, "uuid": "82ce99be-146b-4191-8e10-1ab98ab7d36a", "comment": "Malware payload", "value": "82cf545f849679c4bcae5d17220f3f55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741011, "uuid": "f883cfd2-ceb1-4cb7-bc86-2c699279289e", "comment": "Malware payload", "value": "88e57e7e089e6bd4d927fc805af4a54eb8e5e64ba3e658620021d90a59f57b3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741011, "uuid": "b3932633-56a8-4cd6-8363-4000eb1a7e6f", "comment": "Malware payload", "value": "3ce2fbc210c7e3991993cde54e1e480a8dbc0eae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741011, "uuid": "d972be3d-559d-4024-af35-0ccfce57c889", "comment": "Malware payload", "value": "de0c1ad6096cd2decf1e50c88259b570fb162bd5ce40beeb6663267c9d6e1c1badfa8e48bbdac9d2971d1a8248ef44aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741011, "uuid": "a203507a-9996-4802-b072-18bb6b70164e", "value": "T12244AE58FE9414F4DABBD67589972D6A727335720BC2DE9E0358B3E21F27361AF06800", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741011, "uuid": "a8a371b3-7270-4794-b701-2808f307a16e", "value": "d4755b9a9aec93c05c955ca11140bdc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741011, "uuid": "f2670d6f-2ee9-4354-993c-0c1c71df21e2", "value": "6144:ZAE99SVZVwjJh9gd+ZBLZbEgOBo9UnQ7cPWa:BywdWmLVO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640741011, "uuid": "9bf58dfb-0e47-43b8-a9dc-2df77bdcfab0", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640741011, "uuid": "b8fd633a-0a91-4469-8833-31bbdfd6c9be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741011, "uuid": "112d2800-70e4-4e15-9011-e7ebcce00e63", "value": "macosx.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c65a3294-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640740943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740943, "uuid": "e0ab331b-9a58-4214-aad2-7d43d0e2f408", "comment": "Malware payload", "value": "10a6316b03496ab998b106fb9e20a695", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740943, "uuid": "83fba997-300d-476b-a689-98da3d95029e", "comment": "Malware payload", "value": "891e8582eaafb67a84c53805bd250408a07683b89dfcf3bb578ae827ecb18a10", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740943, "uuid": "82672c31-65e5-43c8-bfc2-f8cb649c91cb", "comment": "Malware payload", "value": "a7fd7e76a88884e4b28afa5eb874e0b3f48bcd21", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740943, "uuid": "3cbf1f95-9a41-49e3-86cb-fa6eea3357a7", "comment": "Malware payload", "value": "4e6e02de6a3355ecb07e231c83e537257a616e63139da9a2d2f5169f0e3f1b71a01b68957bcad7fec69a5194b3e0161b", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740943, "uuid": "3d909692-19a1-4d1e-b779-a23f68f5b605", "value": "T19B649E58BE9414F4DABBD63549972D6A727335720BD2DE9E035CB3E21F27360AF06A00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740943, "uuid": "a39ff3e2-b7f1-47a5-9c87-032ebb7e7351", "value": "6144:TZcVKNWOjJh9gd+ZBLJEgOBo9UnQ7cPWa:FqOdWmLBO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640740943, "uuid": "ea37b34b-4c2e-414a-9f9e-9ba5946a7316", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640740943, "uuid": "f21cc266-c66d-4122-8673-32ce0c5c5be5", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740943, "uuid": "d6180262-eb68-43b8-9211-2c37cce6bedc", "value": "Attachments-2024.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25cc824a-68ab-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1640784482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640784482, "uuid": "c31807f2-8ea7-482a-b6bf-361fcca25c41", "comment": "Malware payload (AgentTesla)", "value": "968ac47d70b190bea0e364666030f557", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640784482, "uuid": "8d60133f-4bf8-4c8e-b0b0-9fcf12574b1d", "comment": "Malware payload (AgentTesla)", "value": "8ecbf01a5689e13256d949cc0665f62c5f5be9a86be97fbaaf9a43b3432cbf50", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640784482, "uuid": "c8c03198-81f8-4d34-b404-6c68067c01d9", "comment": "Malware payload (AgentTesla)", "value": "7bc686ef6860e95e148d16f7a2a195bfc9f06bd5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640784482, "uuid": "288af40b-db71-4893-b943-567639772e74", "comment": "Malware payload (AgentTesla)", "value": "deed3030b32ca20fe6807066446f5115190f2e14267b415089278b25a0296bbd2e2a5be955df3dad911ae78ae2c83ba1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640784482, "uuid": "aeb1088b-232c-4f80-8b87-1bd8fc93e97f", "value": "T1FCD4DF59315C651BDAEC76B84F62DA7407B85CC66812E3BA6CE03D8732FE7DB00506B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640784482, "uuid": "affcb937-d1b4-4fd0-960e-f345a93900a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640784482, "uuid": "d265c122-059f-41cc-a241-940137ddf0c0", "value": "6144://Y+A9aUtPmX0kUxVcCYNBz8da8v95i27Y/jNmdwON+pbcWpr5iWWEIi5qI87ANC:/noPmXsOMMcR6bcmQWWEILpyJc4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640784482, "uuid": "b4002298-1a67-43b8-87e9-e2ae4896746d", "value": 615936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640784482, "uuid": "d9d6c78c-9443-464e-a045-a43ca153ceba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640784482, "uuid": "a825d30f-1691-4955-9903-8526c901b6e4", "value": "nt8rRiY7rRZ36Ml.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06b690fc-68db-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1640805046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640805046, "uuid": "f5b6b1c3-ffe4-4842-a5ab-6a3ef44a89f7", "comment": "Malware payload (njrat)", "value": "3d882526b381e7b346837e515ed7817e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640805046, "uuid": "4d91b55d-7988-4ccf-8561-e276e944303e", "comment": "Malware payload (njrat)", "value": "8fc6e869d0bb32f11f19ff4628bfd3e8c7c0616f01becb93f4c828955e28465b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640805046, "uuid": "781406c9-5248-4a7d-9747-03a3a625b48b", "comment": "Malware payload (njrat)", "value": "13b0ad476f89697708910d80152b56224ee8cfe1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640805046, "uuid": "262a945a-34ab-43f1-846d-eb822bf8d1a1", "comment": "Malware payload (njrat)", "value": "16d6371087825ab34f2042fa413609213c8791af1cc1c784de0f5395eba84b8ee6f9ffb9211c11234272df690a7843c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640805046, "uuid": "8f523016-c702-494c-8807-3575d6dd46b2", "value": "T17A67D1A3392C93BDD1146E310587DA27A2BAB5261F4F7B55EF826261D8F4DC0DFC0252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640805046, "uuid": "03c1e96c-a779-44ff-b021-779d6986415b", "value": "0331ca1875ee1266bf09953125b712b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640805046, "uuid": "15575e52-fb2d-431c-9c40-d5652e577a8f", "value": "768:nhuuCHTZbVuNsyAo3OMQHkUqpcBc9zAccuy28We:nhMTZJ9yLO9FQzAGy2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640805046, "uuid": "ab2ab1dd-63d7-4c8f-a8ff-1ede198ee847", "value": 30720000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640805046, "uuid": "d1913719-9b08-40c4-805c-d39234bb9b2a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640805046, "uuid": "2443b548-35a4-4a41-8fc7-0e2b6ae78659", "value": "3D882526B381E7B346837E515ED7817E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe4cc108-6900-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640821352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640821352, "uuid": "e9dcc6f4-f52d-4e1a-8878-b28b56e56b91", "comment": "Malware payload (Mirai)", "value": "7703756f7f3c52dfb1e24d5f785bf7e8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640821352, "uuid": "44fb98c2-0d02-4d58-a279-10c46d788b29", "comment": "Malware payload (Mirai)", "value": "92a5a26f5739b8fd8188d1558afe77520e3c9073ea8f57e3357a431028ee521f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640821352, "uuid": "63d1e9f4-f57b-4269-b5da-706a5f0cf989", "comment": "Malware payload (Mirai)", "value": "0f89075f19659a96d8e6f5b748e2014eb22d9493", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640821352, "uuid": "d13eeb04-b972-4911-b8fa-e55e79277ae1", "comment": "Malware payload (Mirai)", "value": "acf12ab1aece020a809b2fbf67494ea12b8c6eee9364be40cfa95f6906fd936b352520392465da5c97dea1700938db93", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640821352, "uuid": "bb2c5373-8ad2-494b-9939-6b61c5dcf0d9", "value": "T153A32A4AFC818A11C4C9237AB92D118E331267E8E2DFB263DD141F6477CA92F0E77956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640821352, "uuid": "c2f6a509-866f-4740-b463-f62c55bd0033", "value": "1536:wtnvysW8jqrHdr6du5i4JC+25LxET9AoZxQzqsVx6Y+Qw5tn9M4iiiHqhQBW1EH:CysWLrHhJCd29yqsVxXqiHqhQB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640821352, "uuid": "c9d07222-573e-45d2-a15d-f0bcde6b99e0", "value": 103728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640821352, "uuid": "12eae23d-87e4-4d19-871e-8596239e3772", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640821352, "uuid": "1c86a008-dd86-4076-a23d-3d5284c958c2", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86f847a4-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640740836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740836, "uuid": "603f065d-2e8f-496c-9c66-961960caff15", "comment": "Malware payload", "value": "97082b5d339a1e41e43a3237273ef932", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740836, "uuid": "8e6a82cb-8c4d-4cf8-9dd9-6dce554ce226", "comment": "Malware payload", "value": "9455fd82320a6ae843d557e5f6cae844f22be828fb06c95ce2d756727a448c5a", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740836, "uuid": "d2a86071-be5c-4619-8056-d129a1139f6c", "comment": "Malware payload", "value": "ad41683376964692f582940ae528cc21d6dbc456", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740836, "uuid": "acbd1a77-487c-4be3-88a3-601c444241eb", "comment": "Malware payload", "value": "76bae6c8bcd7f0a25f1c12dd2465ec009696c0d4b50bded37d4abf1be9e5bc8a4830238219fad4ff89ad98f50d05ab40", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740836, "uuid": "47c47505-93b9-48bb-b1d0-36041c9a2f9e", "value": "T1A164AE58BE9414F4DABBD73549972D6A727334720B92DE9E135CB3E21F27360AF06A00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740836, "uuid": "aa38cc36-4cd1-4c0a-96be-f0fad1c77118", "value": "6144:KZYnFzVRF4jJh9gd+ZBLZOEgOBo9UnQ7cPWa:Znr4dWmLAO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640740836, "uuid": "27febe7e-f2ba-46fa-a16a-174e05d050e8", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640740836, "uuid": "3089868b-da54-48a8-b81a-d8e903f5d043", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740836, "uuid": "2778f806-e17e-462e-970f-997e6f3cf078", "value": "attacments_1027.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fbbc6fe-6846-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640741066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741066, "uuid": "d8a108a7-295e-421e-a414-ff89cb2eec5f", "comment": "Malware payload", "value": "ea89e0887bda8669fc61ed1c0dc2873f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741066, "uuid": "f81054bf-40fe-4098-8e8f-68f046e50c26", "comment": "Malware payload", "value": "950ae733089e9761c22fcd9b1f5c1a45357fb744667298070da464afaa560905", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741066, "uuid": "4b52db0b-304e-4337-a623-1936aead8acb", "comment": "Malware payload", "value": "96289e977a975ee9413598eac308bc5d4251d741", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741066, "uuid": "795fc450-81e9-4def-ba7d-bcb819608565", "comment": "Malware payload", "value": "58100816a22ffbd5ceee74af304a470dab50afd2633a77aeb86ffbde60cd8e320fa91edb18c515a0753ea113cc54da16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741066, "uuid": "1e229e5b-8eae-453a-819b-0a961f7ea2b2", "value": "T16E449E68FE9414F4DABBD63549972D6A727335720B86DE9E0358B3F21F27360AF06900", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741066, "uuid": "e4f3b47c-029d-41a3-951d-836a6125eaaa", "value": "d4755b9a9aec93c05c955ca11140bdc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741066, "uuid": "35380841-01e4-463d-910a-0b9cfe6e33cf", "value": "6144:BM6xiys4NDkmjJh9gd+ZBLFEgOBo9UnQ7cPWa:y8iyPRdWmLFO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640741066, "uuid": "68e6ad53-ad2b-4650-badd-1fa09454b984", "value": 270336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640741066, "uuid": "c6e75e13-3aae-457e-b2ea-1f8ed20fd343", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741066, "uuid": "030660ea-7f55-43b5-bbf2-3673a623faef", "value": "macosx.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfe4cf2e-6882-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640767185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640767185, "uuid": "f8132870-fdf5-40d2-93e2-f7fcabcfebcd", "comment": "Malware payload (Mirai)", "value": "09833cb6bf0596d295300d230cfa1bee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640767185, "uuid": "1b67a405-9128-4982-9549-2bdf1f8e82d0", "comment": "Malware payload (Mirai)", "value": "959cad4e781515233a2990db7df15438b89ab8061a95e2d4b05258ccfb4e34eb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640767185, "uuid": "adbbb36c-ddeb-47bf-8216-46bb2c469613", "comment": "Malware payload (Mirai)", "value": "9d23e99a917a2bed53a07bd3c8e2a72f75ffe3ba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640767185, "uuid": "111bb145-58e4-476d-a263-75999893d611", "comment": "Malware payload (Mirai)", "value": "6905e2022d814fff6a019436ce08c72127a6e7aab0a95ec9a864aa4f380887d86ac41de891ada74daac212b28c36dc8e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640767185, "uuid": "15693fe3-f955-4b16-9c70-639b16721f85", "value": "T1E25339C1A983DCF6DD1146B83177FF328636F436212AE9E7D7D9A923AC81E40910729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640767185, "uuid": "61e0932c-ade2-41ce-8bd2-77fde2ba8537", "value": "1536:VMzVhePhrkmetvEuckIzN/hkfgiu5BWWcEAct5CjUoBiAepTLE:VMzVhePlkmetvBcxJhyu5BlActYRoAOf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640767185, "uuid": "b996560b-a6db-4ab3-b7fb-3e624c517a1d", "value": 62224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640767185, "uuid": "142bd578-48ce-44e7-91ef-44bbe0c2478c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640767185, "uuid": "3eebcd61-39e0-49b0-b9e1-2d12cc5b4d52", "value": "09833cb6bf0596d295300d230cfa1bee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0abb3823-6846-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640741057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741057, "uuid": "03bc9cca-96c7-4eff-a890-c501fca3f5c2", "comment": "Malware payload", "value": "efeb9e54e43a6885c84c492ac4f85e57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741057, "uuid": "b6a594a8-67d0-42b3-a2e7-b23092195ce9", "comment": "Malware payload", "value": "9684a4f10eae5f9a982172a7210114546fda5bb7a05158b4a20ae8a38562b6a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741057, "uuid": "6c581238-e52b-40d5-8a13-fc2967543ca7", "comment": "Malware payload", "value": "4526806eb67392be9fc272279964a296ceef45c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741057, "uuid": "7dacc79b-91ad-4a40-98b3-cf30416073aa", "comment": "Malware payload", "value": "91a683442d3ecb7a8cc937769ac07a655d384a8894d88b9f8bde325cb73e1eab46a4878db1b3c72be18b1ca17ea2263b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741057, "uuid": "48895f50-6b99-4f3f-a6b6-2264a84d3746", "value": "T1C644AE58BE9414F4DABBD63589972D6A727335720BC2DE9E0358B3F61F27360AF06900", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741057, "uuid": "458a8a4b-0b2a-4926-b17b-3d73e10f09a6", "value": "d4755b9a9aec93c05c955ca11140bdc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741057, "uuid": "c987dc38-6798-4744-b0f5-016e5c278c44", "value": "6144:2kwAs0kjJh9gd+ZBLfEgOBo9UnQ7cPWa:vzkdWmLDO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640741057, "uuid": "419c3f20-dc89-4a71-8be0-01b065aaa3c9", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640741057, "uuid": "9c34457e-5b61-4030-a1bd-09958608d2d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741057, "uuid": "69ca9d6c-7328-4834-840c-9e466c759686", "value": "macosx.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f34d9c85-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640741018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741018, "uuid": "f887cdd2-3b15-4ebc-a5c8-9eb36cbe703f", "comment": "Malware payload", "value": "ff85041d2a1979e14cb0ac45852977bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741018, "uuid": "cdbf02af-3136-444c-ab31-55a05dfea69c", "comment": "Malware payload", "value": "96c5641c15ab21b833c1dd5448d81af5b89f87b8eecc25526cf2d063400c4c38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741018, "uuid": "314621dc-2f63-4f12-8a92-7581d8ed17dd", "comment": "Malware payload", "value": "106e8e05b10d55af817eabb310c9d5f16fcb1200", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741018, "uuid": "e8350b9e-bdad-4394-b83c-90f4d40ef76b", "comment": "Malware payload", "value": "eec156d18ed0800ba4d377a9382a9ba115fa027121f091a09a934b8b49c43875625aa10f8d1f9fae746f40d27a3b50f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741018, "uuid": "b24c2e59-ca09-4270-a83b-92455e81d2bb", "value": "T15F449E58FE9414F4DABBD63589972D6A727335720B82DE9E0358B3F61F27360AF06900", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741018, "uuid": "777cc215-3643-4545-9f40-2c0598914d27", "value": "d4755b9a9aec93c05c955ca11140bdc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741018, "uuid": "87f5b8b8-f23f-4544-be13-454391899ab0", "value": "6144:ircs5NDkGjJh9gd+ZBLREgOBo9UnQ7cPWa:ircAhdWmLJO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640741018, "uuid": "fe0d2977-f681-4f91-8195-8a356949b72d", "value": 270336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640741018, "uuid": "ddfbbe98-af92-4f97-b6fe-ba6aa24b5b60", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741018, "uuid": "819c698a-c393-45d5-8748-6255549522ac", "value": "macosx.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93b126c0-687e-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1640765339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640765339, "uuid": "20cfa6a5-1e28-492f-9d09-1a1c6c32d71f", "comment": "Malware payload (AveMariaRAT)", "value": "e6eaf5c3db155b6a2f47e68cffa49ab0", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen Tongbu Networks Ltd.", "colour": "#0A3476", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640765339, "uuid": "608738b7-b136-4e4b-89c6-65c8832ac497", "comment": "Malware payload (AveMariaRAT)", "value": "9dcf1501177b898785315d1f3024cd8371da1c77401c0075aa2421bd5b056740", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen Tongbu Networks Ltd.", "colour": "#0A3476", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640765339, "uuid": "6d1863cd-c1b4-4177-80e8-6452a4fb6439", "comment": "Malware payload (AveMariaRAT)", "value": "0d48d17fe8a3ddb7c06f4724ae8fe8901beeff3a", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen Tongbu Networks Ltd.", "colour": "#0A3476", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640765339, "uuid": "739e7493-bd90-4190-af52-d0054fa4a3c5", "comment": "Malware payload (AveMariaRAT)", "value": "97857568567f4688f8cc9f36364286affc2fbf24aa4d475ae5200bfb8118e197f95ebb3a28e26ab4408cff2612710731", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen Tongbu Networks Ltd.", "colour": "#0A3476", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640765339, "uuid": "6704c8bf-f9c0-4d1d-9a43-3271cf2fab56", "value": "T10745C023E2C14477C1732E789D9B97A49826BE103E38694E2BE43D4C9F357A139392D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640765339, "uuid": "f779b3a4-c175-4b2f-a6ec-779c957f79b8", "value": "e145b55a33c2b3451d71d2d800c997c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640765339, "uuid": "c5f2c6d0-0e82-49ae-9252-ae0c42acc92b", "value": "24576:qhXCYZNjSPZ8wMRbZOKK0CHTXrP3I2IvrrP3bfvFYlLEs2l:qhP3jxSdH7r422rTmesm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640765339, "uuid": "f0b7b810-f0f7-4d6c-86e5-a3b0962aa9e7", "value": 1261864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640765339, "uuid": "13351148-85c9-48f8-b743-8d5eafbc5b45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640765339, "uuid": "a4b35b11-5ae3-400c-b17b-f5c6099fc80d", "value": "9dcf1501177b898785315d1f3024cd8371da1c77401c0075aa2421bd5b056740", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "154d4ffb-6846-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640741075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741075, "uuid": "80b3ac0f-df68-4b8d-839e-56fdb4c17e51", "comment": "Malware payload", "value": "a18616c093295d038bb8b9762be3d682", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741075, "uuid": "046b08ed-eb17-4610-9beb-35b5fd2a55a0", "comment": "Malware payload", "value": "a06010d09b93b8cf46c397a30a15e7f4a163fddd7eaa18dc0eeb202b9f2560a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741075, "uuid": "7365a1de-e671-43dc-8101-661d3f355b89", "comment": "Malware payload", "value": "6911e8335613498dc10f7cc209c544882d17ff90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741075, "uuid": "ad0c77b8-2316-47ce-92af-2f3a85d79fa8", "comment": "Malware payload", "value": "4d08ded818e9d33538b8394507fb439ebc7b461a7cf15db750cb0e0939377f50a03442277276a4be16ba14e5ca05aaa9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741075, "uuid": "cc23c85b-c8d8-462b-a1e2-6fdd485150ad", "value": "T109449E58FE9414F4DABBD63589972D6A727334720B82DEDE0358B3E61F27360AF06900", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741075, "uuid": "d9587a4a-542b-4489-b601-06c86d304c25", "value": "d4755b9a9aec93c05c955ca11140bdc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741075, "uuid": "1a0c20ea-a4a9-446f-ac1f-fac80bd8cbb9", "value": "6144:HMZAzomr0Vzl2ZjJh9gd+ZBLmEgOBo9UnQ7cPWa:QoFZdWmLyO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640741075, "uuid": "ebc61dda-954d-401e-89f9-2c2b77c82091", "value": 270336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640741075, "uuid": "3d04172a-2455-4b30-96e0-9528aba1b4a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741075, "uuid": "e4ad319a-67fd-4178-b80b-bd0c79673cff", "value": "macosx.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ea3f49d-686f-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1640758727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640758727, "uuid": "417ca4f4-57c5-43fe-a7ad-539f963a7440", "comment": "Malware payload (AgentTesla)", "value": "35c5cae9565e83502ad6ea2fa587efcc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640758727, "uuid": "d7c6ecee-1903-4584-9541-f2ec4ddd49e4", "comment": "Malware payload (AgentTesla)", "value": "a17ae871afd094a1aa47e2bf0634b33918b5013097bc429e9571daaad5038b57", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640758727, "uuid": "3edb4a26-1b08-49bb-95f5-e85232ec4dfa", "comment": "Malware payload (AgentTesla)", "value": "cb66355172b962c72b270c04d46d2bbc56b176ba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640758727, "uuid": "335c96e5-5b40-49da-9a7b-e3a5757fed17", "comment": "Malware payload (AgentTesla)", "value": "be9853cce1194dd80c1a56e3981519204c7d8275cde7b9a4fe458e623f9de28e17dcd6a9d344a787fb82e1080d49d447", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640758727, "uuid": "d7b4a465-bab7-4b05-bb5a-bb81b65e6f89", "value": "T10CE5626C24C34CC2005C5DBCD4F51A69227736010F49DB0BA3AFAC9ED552AC9F56EEAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640758727, "uuid": "8726dcf6-19cf-49fc-912d-686aafe5d13d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640758727, "uuid": "3af77002-c984-463b-910b-256c60f5d110", "value": "12288:c96wXKHFoCCx5nvN2fM6aUTgQXhOuRqKsbd24w/34mpBXhdg0L39j/i+FLMtBagK:lp7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640758727, "uuid": "6ec037cd-f2ce-49e8-8b28-a9b8c9b8dc80", "value": 3286016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640758727, "uuid": "c5086fb7-1dbc-41b8-aadb-d56fbd65e059", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640758727, "uuid": "ccc3f2fa-0e7e-443b-bf7b-294d47ea682c", "value": "Product Inquiry Catalogue.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b874ea59-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640740919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740919, "uuid": "990c9305-4899-42b1-bb00-a4ba6fc7f1c5", "comment": "Malware payload", "value": "d904361f401607382cc92a2940f085a1", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740919, "uuid": "ab51cf40-7d8b-4b14-bfea-88b6a2bb3cae", "comment": "Malware payload", "value": "a1a77f06b2fab3695501abc85094ee50a8b503d886df1fffd839497b2f1553c6", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740919, "uuid": "96d8ea77-726e-49ab-8f27-ccf438062833", "comment": "Malware payload", "value": "4fc8f38962216bfa3da29d4dbe1768cbfe48de1a", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740919, "uuid": "d435a0b5-ea9a-4485-8a60-902e8e595f5f", "comment": "Malware payload", "value": "24976b42e5f6878934682e554344c9c439d98546e63f96eb7c74f4ec86d0914eaf654adc4153846d930af1a122dcabc8", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740919, "uuid": "a864a832-2f89-4be2-a190-563ca2e46ece", "value": "T1E0649E58BE9414F4DABBD63549972D6A727335720BD2DE9E035CB3E21F27360AF06A00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740919, "uuid": "80313aa4-3c33-4dde-b925-81809f4afa5e", "value": "6144:Q6c2Hd5qzjJh9gd+ZBLO7hEgOBo9UnQ7cPWa:Qy+zdWmLkZO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640740919, "uuid": "c7ee1397-81b9-48c1-9a53-698e7f5fcd37", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640740919, "uuid": "0aae993b-0096-450e-a006-541e687f9dfe", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740919, "uuid": "9c49c2c8-b8e5-4d9e-ae35-61894c50d42f", "value": "Attachments-2007.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3886dba8-6846-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640741134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741134, "uuid": "10ca6754-9798-49bb-bf75-51462d01a53b", "comment": "Malware payload", "value": "1047133aaff557f833901638ffe3f209", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741134, "uuid": "20834a00-17c1-47a0-a6c6-1d5c6e02e796", "comment": "Malware payload", "value": "a283cdf067e49d74651238f5ea1f8d9a54fe3f79e579f3c532c5df88e3b04e59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741134, "uuid": "0c0a5da5-18d1-4ea8-a378-68c97f3925c0", "comment": "Malware payload", "value": "94b50d161b43871ac090e22d367331a7c320b071", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741134, "uuid": "5d16ee8c-0678-407f-a4f1-1497eacee7ce", "comment": "Malware payload", "value": "36e54701e46e7fb2145477c0433ceba6ce7e4b0c2bb78d51ce3aaa80b50be28654ec179e94f5e9b76f3f7c5c8fc07fa7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741134, "uuid": "b808a224-9a41-4d1a-a43d-04d311ca11af", "value": "T19544AE58BE9414F4DABBD73549972D6A727335720BC2EE9E0358B3E21F27361AF06900", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741134, "uuid": "c5eaf8ec-4700-499c-96a6-b5a522f92924", "value": "d4755b9a9aec93c05c955ca11140bdc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741134, "uuid": "dd12569c-f216-45a0-b308-d6832fcde483", "value": "6144:3heneAt5FjJh9gd+ZBL7EgOBo9UnQ7cPWa:onTFdWmLHO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640741134, "uuid": "2de2456f-6f4d-4dbf-a51c-c9bc12182abf", "value": 270336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640741134, "uuid": "a345368b-f070-4e61-81b7-885e728e69c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741134, "uuid": "0996a9a1-f018-480e-a0c8-3431d7dc4886", "value": "macosx.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a402308a-688a-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1640770520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640770520, "uuid": "af573980-78c9-4cd9-bf24-e860fd5d87d4", "comment": "Malware payload (RedLineStealer)", "value": "03817805450fd55be0025f31ae69399e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640770520, "uuid": "86da9dc1-a585-4af0-b5ca-b2977b283e9b", "comment": "Malware payload (RedLineStealer)", "value": "a9eb984c9de2d2d061babaaec8c15a04895af2cc0653d044f7092ba73013da5b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640770520, "uuid": "0d4cfe99-1b26-4fad-9e7e-d5985067998c", "comment": "Malware payload (RedLineStealer)", "value": "77e96bd58ec428cc14b1dc051f8a0195d4aec44b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640770520, "uuid": "2310318b-309d-4010-aa64-da9c65a4665f", "comment": "Malware payload (RedLineStealer)", "value": "690872b560f540917c33783c0fb4e46352d5d733316bd7af00ae2dab5694ddf560ae5606e47caebda3b2f9e0723f3c91", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640770520, "uuid": "ee996a71-47e2-48ab-97a9-1a7ffdf12618", "value": "T10F1633DC0119A599C91C36B9AB10430221B651BD92CE6B4CDFCCAB15ADDF233A67F0DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640770520, "uuid": "a3ab4e1c-32b2-4ca2-bfc2-51989af5d884", "value": "9a4258c5d218cf6e5c500e8415d5f5ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640770520, "uuid": "91593c35-b3a1-4497-ba79-802ba6fe4163", "value": "98304:/O26bBUvDp9tKUFS5KhLWulXwQ7WYxtKIER:3vl9HS5ELWU/7wI8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640770520, "uuid": "1afa0979-95ca-4d6f-880c-2d3f5db25e66", "value": 4385792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640770520, "uuid": "c8b322fd-4590-4bcf-9de1-a23ea7cc42f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640770520, "uuid": "4f332bf1-b68e-46ed-8f27-c49c67d21384", "value": "03817805450fd55be0025f31ae69399e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3499198-689c-11ec-9275-42010a9c0029", "comment": "Malware payload (BillGates)", "timestamp": 1640778250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640778250, "uuid": "37cc8b98-3dff-4fd8-b1e2-7f2d5cf10ab7", "comment": "Malware payload (BillGates)", "value": "66003fc2cfd270acf3745b613c558d1c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640778250, "uuid": "43a9976c-82e9-4bf8-a8f2-107a7ab4329b", "comment": "Malware payload (BillGates)", "value": "aa7807e6f0b7a0a5bb859b302b9eb2604040f5f4a84414ea1baa93b377b42ca8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640778250, "uuid": "1764f64b-a98c-49f1-810b-6b0079e062be", "comment": "Malware payload (BillGates)", "value": "40d4f4f457907b7a887bec47c519c54a1fadc06d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640778250, "uuid": "8f8a31c2-cf70-438f-818b-3bd0de3a4932", "comment": "Malware payload (BillGates)", "value": "d3584b5685445b6295945304408e4eea2030f97ae733c0f2fa647d58d6b49add0d2679209606e8c6fde3a33e91c88a9a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640778250, "uuid": "dcd5a00f-90fc-4b8f-ab7e-00b2bfbfe5d9", "value": "T114456B12FBD0CCB1D84616F5100FDA35D5229677A01BCA4FEA5DCD38BB29181AB1A37E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640778250, "uuid": "e94fb074-bc3c-49e7-9875-43486d387f38", "value": "24576:e845rGHu6gVJKG75oFpA0VWeX4N2y1q2rJp0:745vRVJKGtSA0VWeoEu9p0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640778250, "uuid": "bd25d10c-b8d5-44ed-8652-36b444cd216c", "value": 1223123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640778250, "uuid": "c2dabe3e-397b-47ca-812d-a4ee172e702a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640778250, "uuid": "7fad403a-d41b-4130-9528-c2b4185fea0e", "value": "66003fc2cfd270acf3745b613c558d1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95a99b74-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640740861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740861, "uuid": "bba829aa-ac39-4762-8260-61a1465a4d3a", "comment": "Malware payload", "value": "ac100df6f40d7a92aec70a5d9c3aca08", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740861, "uuid": "0863f42a-abd0-46d7-aeed-e1310701093d", "comment": "Malware payload", "value": "ab57668bf754c5e449aed5e4f3fc1a4c62f823e30d84d4e53f57834bdba5cee0", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740861, "uuid": "d0ef0a6d-cdd5-436c-8005-6f85eaeb79b5", "comment": "Malware payload", "value": "b3644c86f8b63581b53bb5e9ee367b9c2859f35f", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740861, "uuid": "eade0255-0126-4d7b-80e3-d963b483ada8", "comment": "Malware payload", "value": "aa07ee3593adae18b43e27fa71ee323083fc0b5b426e4a9945ffed740131e73db4e5e2cc4f897efdd619a166115ae276", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740861, "uuid": "c05158ad-fd98-4042-a168-b321aa5eb0da", "value": "T108457B2132C79B32D493127155AEA3610A3EEC704B718287729C7B9E6FB27C0673579B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740861, "uuid": "9b4a229a-ed08-4d1e-9cb9-8142952a9f64", "value": "24576:Blgq+3Nn7BjlpOu3LBCvAq23Nn7BjlpOu3dAjND:BlgJ3Nn7BxwubBCvAF3Nn7BxwutAp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640740861, "uuid": "057358a5-d10c-4151-92b5-e6e320bad770", "value": 1169379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640740861, "uuid": "21ae5e63-7c90-4b86-b3dc-fd230a03f886", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740861, "uuid": "bcfc18c2-5bd7-4665-b046-7e8685c19373", "value": "shipmentdelivery.update.jar.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a05b6b54-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640740879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740879, "uuid": "327624dd-5706-4272-9004-f692fc379ff9", "comment": "Malware payload", "value": "bb02d3ed9182924a18e65b04420773a0", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740879, "uuid": "2c907cc9-d4e5-4385-9c58-ac8c1bda2f27", "comment": "Malware payload", "value": "ac247def81dad72d9d56516f6919c24cf3f874f0464834496db2bd7d03670ece", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740879, "uuid": "ddcfee92-cb2e-4710-9138-3bfbcc13bb7d", "comment": "Malware payload", "value": "13a9efee4db0796f1a9453a8b8f7c1d98e2b1fe8", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740879, "uuid": "eece31c1-cbf7-4ce1-b1e2-2e56eea6c6d5", "comment": "Malware payload", "value": "4f687b2b368c12523f0effbb4cae0c3b9445185999fb19240cfab4c0f5adcf629e2395d22a17d564c624744fb326c170", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740879, "uuid": "974b5ebd-6fb0-46cb-8b3d-a0df360c6826", "value": "T1DB649E58BE9414F4DABBD63549972D6A727335320BD2DE9E035CB3E21F27360AF06A00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740879, "uuid": "2f010fc3-0336-4369-b15f-e586df66ab46", "value": "6144:dj3JDuCtGRjJh9gd+ZBLAEgOBo9UnQ7cPWa:NJ2RdWmLAO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640740879, "uuid": "75b42046-13e6-4eb8-bb4b-fada84eedffd", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640740879, "uuid": "55f641cb-aea0-4a62-aadf-dd3a588d2a3a", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740879, "uuid": "ea16ac22-ac3b-4c9e-8fe0-ab755ceb033f", "value": "Attachments-2031.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f078ba6-6846-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640741091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741091, "uuid": "35359497-490f-4e42-b70d-299c75d6df31", "comment": "Malware payload", "value": "5d5b07bbc6e426cf23d94f8e22f662ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741091, "uuid": "62eb3439-9e8d-40ac-bc1e-da6071360b51", "comment": "Malware payload", "value": "ac64301a43403c83264c5c32676a99521304e842fec99a66941a3313520f4e07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741091, "uuid": "a481e010-37bb-46a3-a5ef-0c2a2b80e8c7", "comment": "Malware payload", "value": "3444d86e9507f5c5f816d009c47821319f7f538d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741091, "uuid": "d806c817-aa41-4a7f-8ecf-a0ca193474ab", "comment": "Malware payload", "value": "452d83dd36336c2c1bc894c7d3ecdfdb44f3cbe625f555e73286c03d251234b2793346edb408e0c5b95097d7965cc3b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741091, "uuid": "bdbc6452-3327-4d4a-bfe9-55be10e6d62e", "value": "T19D44AE58BE9414F5DABBD73589972D6A727335720B83DE9E0358B3E21F27360AF06900", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741091, "uuid": "ad0883c5-2478-4225-9b66-f889e469a952", "value": "d4755b9a9aec93c05c955ca11140bdc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741091, "uuid": "2dd91948-8259-44b3-b92b-48d70885aa25", "value": "6144:5S1XiJtZqyjJh9gd+ZBLiLEgOBo9UnQ7cPWa:5EigydWmLOO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640741091, "uuid": "8ab56f5d-6bc4-490f-8d4d-71ba45c9ab9d", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640741091, "uuid": "4418f68c-5f6d-4762-bbce-d6ee2e7401ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741091, "uuid": "851c14e8-c46e-4694-b311-a0a7591ef2b4", "value": "macosx.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbaa7421-687c-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1640764601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640764601, "uuid": "77b6ede3-e061-44ff-bbbb-32f11d3b70d2", "comment": "Malware payload (RedLineStealer)", "value": "40b665edf189e012f4350dbe045e17ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640764601, "uuid": "6d350f6c-2bcc-4f58-b565-a238eba5b59b", "comment": "Malware payload (RedLineStealer)", "value": "ac8bc27c6868bbb4b617b4280d8e400e6c9dda52c3ffda8a5603fe378374f69e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640764601, "uuid": "8c944d12-dc99-4bdc-a897-c3d2310e8202", "comment": "Malware payload (RedLineStealer)", "value": "972938468529ed4e0517dbb162559faf78ea8836", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640764601, "uuid": "5b29c5fa-e274-470c-9350-6870698179ad", "comment": "Malware payload (RedLineStealer)", "value": "5a46ccfe942f58c817575dc7de411c6adfc881905d623611a223d9556096575f43fc8e0dfcec52afd4f6900176e929cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640764601, "uuid": "68a2a8b0-3c5f-4bfe-a1d0-d39ae4d29f1c", "value": "T18225E9DD51D1D849DEEE27F00DFBA89CAD7094DA938763EAA31C95F0AB423C2254D4E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640764601, "uuid": "24951f28-1b28-44da-bf34-2548b789832c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640764601, "uuid": "3321e5cd-fb6a-4da2-b976-1cbc91fdbdb8", "value": "12288:2m5IusrjH49SXQDEdJ3jYlmsOwvDHAumDyne5sxrmMk+I8MRjaupauMZI:UFPiZcvwvUue0dMRj6E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640764601, "uuid": "6f55986c-e98b-48ed-a69b-6674f6d648d7", "value": 1009544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640764601, "uuid": "5d432f96-b869-496a-942f-47c79e40b43d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640764601, "uuid": "7a485f81-57b9-4272-8874-3b18b5b20b6e", "value": "OneWay Hack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85142381-6870-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640759301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640759301, "uuid": "a5adba84-d882-43be-a991-7d3de69f81ac", "comment": "Malware payload (Mirai)", "value": "c6819c314f954bbdddfff2e756b43c82", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640759301, "uuid": "9647fc3e-87df-462b-a77e-c63783ec9039", "comment": "Malware payload (Mirai)", "value": "aca0e0c3da9d589ab8232dc4409bcb23654c87b401638499e8dae3b32798e81e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640759301, "uuid": "3d395b3d-0170-423e-bb25-e10cea4180ab", "comment": "Malware payload (Mirai)", "value": "4df7d4359442845004cdda899b86dbd95412f36d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640759301, "uuid": "566d4290-58a2-43ce-98d0-b6a62bd57745", "comment": "Malware payload (Mirai)", "value": "5569d8f1989298799fd48bd5d5087ae58cf56d56308a62bcb63f8a2d0e0583c2d5ac570a2fd73528a3aebe70ebccc1b1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640759301, "uuid": "75aa6f89-20fe-4e56-9e73-84f247f389cb", "value": "T1EA93D80A3E26CF7CFB9D863587B78A21964C33D626E1C145D15CEA026E7034E741FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640759301, "uuid": "f42ae819-ab3a-43b4-bc42-35ad3efe8dd7", "value": "1536:Lt0tX+a6LO7/FH0KOHHale3dpWgPWnw/Iut0pDDIEeXwUlE93ydY:Lta+ar/9KHHvtpy1pDDIEeXwUlE9yS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640759301, "uuid": "046b999f-afe1-41e7-81b2-703156b61843", "value": 92596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640759301, "uuid": "89dc592b-2ec0-478a-b20d-c385651fae4f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640759301, "uuid": "6f8a344f-18e5-4907-bb7c-4402d8516822", "value": "c6819c314f954bbdddfff2e756b43c82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db29f28a-689e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640779203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640779203, "uuid": "c475f3a9-79f7-4d61-a185-187467ce8a46", "comment": "Malware payload", "value": "d43143a73075e0842c69650585d7de68", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640779203, "uuid": "8434ddf1-b933-436e-9db4-884feddf0d7c", "comment": "Malware payload", "value": "add21ac2d57bddd23879ea57608f29b92f55ff07a814749c3940990df7a74491", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640779203, "uuid": "2e0c4318-17f5-4523-95b9-23a0613ef647", "comment": "Malware payload", "value": "a196380c37a2691276a30107082bed1af994738a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640779203, "uuid": "0ca3674c-f2c1-41c6-948a-853acffc0ad3", "comment": "Malware payload", "value": "08ebef2969f5c20b709da7bc177cdd6b041196dfc276fc44749c05a7efce82481edbd33a222bde29b37dbac3317565fb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640779203, "uuid": "1a0a3771-26f7-47e4-b8db-64109100205f", "value": "T16BE2510909E34A4173B3F0B55BDDA8197B6B81C74B4DDE203D6C829ABF91074D2F9AC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640779203, "uuid": "20331fe3-1fd2-4f87-b7b6-094588967a4d", "value": "384:fDcMasJ0EM778JD4hl1siavkofd43+yZKB3lp:fD6sJ0j778J8yigRyEB3D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640779203, "uuid": "fbed626c-42ce-4535-9fb5-ca9cc905fe1e", "value": 32374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640779203, "uuid": "b3498166-0a15-43a3-af32-56c38ddb6066", "value": "text/x-perl", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640779203, "uuid": "1456d446-1063-4574-a289-6f8de75be468", "value": "add21ac2d57bddd23879ea57608f29b92f55ff07a814749c3940990df7a74491", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89b533c3-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640740841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740841, "uuid": "bdc765c8-54cc-4aca-9e8a-a326e678653d", "comment": "Malware payload", "value": "e4b305a074c4e652c1789398a84107ec", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740841, "uuid": "0b2ac901-f10c-427b-931f-c0be0b51ffbd", "comment": "Malware payload", "value": "afbf8268c5578986ea861bb1ac644005a11c3f375590ab38438755a0505a33e3", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740841, "uuid": "e05aa26c-8e30-4dab-8cd7-639bea154dff", "comment": "Malware payload", "value": "365667b661c8deb49740d0f583d790a9c88643c8", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740841, "uuid": "dd2a2031-0b6e-4d3d-ad73-3a458be5656f", "comment": "Malware payload", "value": "a4fdbe0033cda02e12c7eea82891dc80c4b0c5b42148a0967ef9f8ec02379de96fa5a4547d3fe42b0b7192c0a9e0aed8", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740841, "uuid": "0f92424b-2a0d-4f92-8228-0a5e7fb2853d", "value": "T15264AE58BE9414F4DABBD63549972D6A727335720B93DE8E135CB3E21F27360AF06A00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740841, "uuid": "109b390c-1677-4b23-9c3a-8bbedf24289e", "value": "6144:1JlpVRjBjJh9gd+ZBLMEgOBo9UnQ7cPWa:jlJBdWmL0O0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640740841, "uuid": "0e212165-ded4-4766-a30c-b66f5ca856c9", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640740841, "uuid": "1a849de4-eed6-4dfe-841b-6c68dda3d58e", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740841, "uuid": "281f1db8-5a6e-41d8-aadf-4d6310b568f2", "value": "attacments_1043.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "647679be-68fd-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640819806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640819806, "uuid": "f695e3df-f7a2-4280-b2bb-f18e53ee5c25", "comment": "Malware payload", "value": "76148c39e78cdddb881239bb458c36b9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640819806, "uuid": "0bebb78c-3f7d-4f77-9bf5-ba2d36c01b57", "comment": "Malware payload", "value": "b05304798ed228b2da35af7a3473599b937b62731176a7b706369a743467a104", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640819806, "uuid": "3dd3f2a5-db27-4841-aa00-a1f0787c56fc", "comment": "Malware payload", "value": "c63b0d4de4a05a81d8b23abc5b3d2fa05e879618", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640819806, "uuid": "d1445e7d-cf34-4d48-b3df-829f23068aa1", "comment": "Malware payload", "value": "c16834bf37378c789df17f93709928b21c149ed2242e7fcd11a276b5fd6c72793d84ff44a8e13d91d1326a19701b3cb5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640819806, "uuid": "3a9a8994-724f-48a5-bbd1-24f8bcafe5a9", "value": "T10D3529583141B1AEF8FBF2F98B681C589B917CE6C216815AD0373C5BB93D583DE104AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640819806, "uuid": "048b0847-f718-426f-b8a9-b9dc129d416e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640819806, "uuid": "eb05570c-1466-4aae-990e-1c2377f84b83", "value": "12288:0XIDvnP0uJq2yyhNP694vDqxoozJ7/Z+oUOOT1YVawvCi70QtokPmRzdf7uD:0XGnnY2yyhNi94G6S/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640819806, "uuid": "65a4cd3c-6441-41ab-ab10-b86887256016", "value": 1110528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640819806, "uuid": "86e7959a-8031-4190-a861-393633aebbdc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640819806, "uuid": "7432632a-a443-4d8f-b9b6-96fb61a884ab", "value": "Payment 20211229.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73045720-68cb-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640798355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640798355, "uuid": "fc27cae3-d601-453c-9b3c-13b6a9f097bc", "comment": "Malware payload", "value": "0c804a1b394da57edc191b7be213ba8e", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640798355, "uuid": "1bc10966-99b6-413f-8bbd-88a03f3b6487", "comment": "Malware payload", "value": "b162c3be00805d4282a9d4a9c008d58cc0526de8d4faf0e12500b80b9cd65d04", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640798355, "uuid": "ff36442b-c2e3-4f7e-b124-3d44761603ca", "comment": "Malware payload", "value": "15e66fbd002d83462e93b0d3fa17eaa87719311b", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640798355, "uuid": "eb759c34-c551-4c14-892e-c244c498c267", "comment": "Malware payload", "value": "6e17bd98177c7c3c454cb09ae7401492bffe8b58e5d0fafaf80a525d2a49d7eaa135445fc718ef2a61e3e35ea7e1ee9f", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640798355, "uuid": "a824b701-c366-41a8-ada2-98614554a288", "value": "T1A2E07D956E7C17C54BF61A5498B07616BD224E045CC2FC7D31D39F01940C1E45BFA586", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640798355, "uuid": "21f15b07-59fc-478e-b7c7-4931337e7ff2", "value": "6:SGIVEV75FJEQ7veamuRdf29Y5e4WfwcMeYdGfwrGpOSVy0wuHKW/rmUHcen:wEV75FekvJmediY5FjcfEGrgS40wuHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640798355, "uuid": "a192d6f6-3032-4c4a-b468-ba6ba3de8432", "value": 341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640798355, "uuid": "dc096f4c-eb82-4736-b7dd-59cfa52d5860", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640798355, "uuid": "18e2353f-c478-4d9d-92e3-48f1b2597e18", "value": "bad.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26c4f0f2-6846-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640741104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741104, "uuid": "4c35f1be-148a-48d2-b0ca-1780fdd0e5fc", "comment": "Malware payload", "value": "b94d762ee204fb2bb2e6dc23d94dee24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741104, "uuid": "2c7ad8dd-fcff-4db6-9168-2cb181929824", "comment": "Malware payload", "value": "b19a1e6986a971d2707963151bcf72677154483f163798d114782ece52778c6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741104, "uuid": "309b0841-d322-4798-8aff-394742d45f61", "comment": "Malware payload", "value": "21ed8848c11d824b8b237e88c76a405d9e3ede10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741104, "uuid": "6f6d37c0-a33a-45b9-9dd9-dc7d85ae0d74", "comment": "Malware payload", "value": "189fc3f8d97ca842e01355f8197d2ffc51b75073b1d6d45bc1162848d96d2f02088866fbfe0804238490467ac98438bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741104, "uuid": "b264573b-3743-4363-a29b-c09bf3ff82fd", "value": "T1DF44AE58BE9414F4DABBD73589972D6A727335720B82DEDE0358B3E61F27360AF06900", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741104, "uuid": "5bbf0f08-7fed-4914-a964-0a6d7a4f60a0", "value": "d4755b9a9aec93c05c955ca11140bdc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741104, "uuid": "9a027695-b063-4325-8b26-3043d9ed11d1", "value": "6144:3ZH8FzVRF4jJh9gd+ZBLZMEgOBo9UnQ7cPWa:Kr4dWmLSO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640741104, "uuid": "a95c9ad8-2a9a-4c73-9711-ced709b96d6d", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640741104, "uuid": "9487d8ae-5f25-444e-be89-064695a7d3cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741104, "uuid": "d6a65db8-05ef-4672-a4dd-29c2d41a02ea", "value": "macosx.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0860869-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640740987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740987, "uuid": "74928e66-d7c7-4760-b2b1-eb167c2a47e6", "comment": "Malware payload", "value": "dba417754508a73d04332fc967fb08e0", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740987, "uuid": "7740f20e-e50f-4401-b123-38a441dc98c7", "comment": "Malware payload", "value": "b41dff764dcab8b90b3500e2d86bf8826a85613e40e111f6e8dcb2461bf91572", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740987, "uuid": "0b5d162c-f3f4-4aa5-abb0-57da01bf2694", "comment": "Malware payload", "value": "dab99bf714063d79aca58c353929471470d7717b", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740987, "uuid": "d1c12ff8-3f1c-4acf-9f7a-572723c2f9ce", "comment": "Malware payload", "value": "a7e5215bbb7d6f0ef3edce7629733a06ff2e022e1181ca38144adeb3b1ae0dd0f66dee6646d287e0eca5e49f653b336f", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740987, "uuid": "b9518406-b1aa-4e17-bbd5-7fc96a36bd65", "value": "T1E164AE58BE9404F4DABBD63549972D6A727335720B93DE9E135CB3E21F27360AF06A00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740987, "uuid": "97c77714-cf01-43b3-be59-8ba7a79b4eea", "value": "6144:89Vi8sbajJh9gd+ZBLGzwEgOBo9UnQ7cPWa:SWadWmLOwO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640740987, "uuid": "ae0af25f-e5c0-40cd-bc78-e31449a0dbaa", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640740987, "uuid": "23d7ba9d-aff1-49a0-b430-bcce1b3fdd42", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740987, "uuid": "2839ff1f-333e-4f7d-93e0-bc45811108a6", "value": "attachments_1001.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c8284f5-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640740846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740846, "uuid": "ae3c4aea-49e6-4701-83ce-beb0c062d629", "comment": "Malware payload", "value": "62430ea2b7d63611944baf69822518bb", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740846, "uuid": "23dd74d4-9926-473a-9743-3bcb7f9478d9", "comment": "Malware payload", "value": "b4636798d2017bc6e33f3cabf5e43154c032fc540d165498db6b3fd02c509b1c", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740846, "uuid": "09492a25-5ced-4008-8f64-c91f16190b64", "comment": "Malware payload", "value": "ac99dd85285c3a1bedac2bd81b973f9d7b5659a1", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740846, "uuid": "92ba12c3-2017-4c4a-84ac-8b5fd24146ed", "comment": "Malware payload", "value": "37082d4f52282624307fd6c71f07bdc698544afaa69e9d8faea9bdba71b7374913f2fbee399e3c90fc1e0c46c53c64c2", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740846, "uuid": "282adf19-2de2-4378-b40f-3707ff27e977", "value": "T1B264AE58BE9414F4DABBD63549972D6A727335720BD2DE9E035CB3E21F27360AF06A00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740846, "uuid": "b19584eb-2bc9-4952-94a7-9ae945394a19", "value": "6144:uAE99SVZVwjJh9gd+ZBLZbEgOBo9UnQ7cPWa:uywdWmLVO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640740846, "uuid": "5676a3e9-7356-40f6-9fbb-c0d8181a8747", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640740846, "uuid": "b4c0761f-6093-4811-986b-1da83fabf03d", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740846, "uuid": "3c8a2bc4-634c-4e23-bee1-85f152ad15d2", "value": "Attachments-2029.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3f5dc3e-68c5-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1640795995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640795995, "uuid": "df76c440-6ad3-4113-ada5-7e6d2388987a", "comment": "Malware payload (RedLineStealer)", "value": "61307c1e5978f031f56572eafa5a8cc4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640795995, "uuid": "ba0671d2-cf0d-4330-8eeb-c8d5d9efa859", "comment": "Malware payload (RedLineStealer)", "value": "b56a7bb3b8602bc7dbae750ec0159b9c250a6fed188ed2fca56d1f52947fcad4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640795995, "uuid": "bc9072a3-6fba-4117-a7fc-bca61d61dcc9", "comment": "Malware payload (RedLineStealer)", "value": "4728243e35d0b7dfe704bbd3fa4b5ffd88a092bf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640795995, "uuid": "aeb01abb-4dac-4935-9091-ce8aec9b93df", "comment": "Malware payload (RedLineStealer)", "value": "526870020f8ed7689ffe846b0c6b4e68efd67baeb425abe514fd31f1d98aa1bc568df615907fd88e8fc62b7b8cb0e7e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640795995, "uuid": "403c0f1d-6bec-44e8-93ad-5a34e5a99bdb", "value": "T1EA94F1C1B6E3C4B2C296F5718828DF9549BFA831DAB0319F3374265E1FB03D05A6974A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640795995, "uuid": "655952bc-cc5a-43ba-bea9-7176914c0034", "value": "bdd8adae7e6277cccc5ebfa6ad074be5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640795995, "uuid": "f350375d-0508-48ba-a9c0-c188b9a784dd", "value": "6144:tsLh5nfKSYGLBie7vX9jYf8JOxuCAg4jx89JohiVtf7ITsq:tsd5nfZYG1lP9PJOxuCAgmEzV7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640795995, "uuid": "f732f2e8-5a82-429c-9195-3c0ab66bff05", "value": 408064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640795995, "uuid": "e8442349-327a-41f2-8e79-43b4be308fd5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640795995, "uuid": "97afe93b-c0ef-41a0-a81a-4beb0a108b4e", "value": "61307c1e5978f031f56572eafa5a8cc4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8825e408-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640740838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740838, "uuid": "05c0bb1f-225b-4e4a-b772-2341042e9a04", "comment": "Malware payload", "value": "18847d8033501125e9040f21e7e57ab9", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740838, "uuid": "ef1e0eae-0ca5-425a-8806-cde1ce3335e2", "comment": "Malware payload", "value": "b5a590dc9c6659d6e2d59ff4560a15faba856a00567afed7e662b6972d4ad796", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740838, "uuid": "c3431ce4-f6eb-44af-91c9-b9b9d4bc27ba", "comment": "Malware payload", "value": "73f1da36e80d4e42bde73799c63b8a517f1197fc", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740838, "uuid": "fa7ebff4-a8c7-48fc-912b-5d9e3bfd886c", "comment": "Malware payload", "value": "d2e22fb39fee8f04d9a0ccd4a8bf0b3c6f66bcabb1aeb0af696554af4d0a4d954b0d8c74df2e3ede23d6b6cc4d75126d", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740838, "uuid": "1ca10905-8876-47e3-959a-5e88623ddf55", "value": "T1C6649D58BE9414F4DABBD63549972D6A727335320B93DE9E035CB3E61F27360AF06A00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740838, "uuid": "ace0d279-e02e-43aa-bed9-723cc183dfc4", "value": "6144:5PQrboziZ5U7VjJh9gd+ZBL4CEgOBo9UnQ7cPWa:5Y/MiZYVdWmL4GO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640740838, "uuid": "475e8313-ee59-4253-84b9-6963f60588b3", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640740838, "uuid": "928ad80c-6f43-4dbe-baf4-d4fba434d4bb", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740838, "uuid": "3d0293f5-a673-4143-b4e6-350437a75d33", "value": "Attachments-2027.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b6e6605-6846-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640741112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741112, "uuid": "2dc7a4b7-35c1-4e9b-907c-c046c111a8fd", "comment": "Malware payload", "value": "55922c6593c45f82475ea814545e6a9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741112, "uuid": "e1206895-c5b8-4d77-b612-c490162e3a44", "comment": "Malware payload", "value": "b64b3219e447c13440ca2f800705d25b03f1ce27e214edad3cb240a34b36862b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741112, "uuid": "d4dec490-4bf4-4718-94e3-7725e3d7468a", "comment": "Malware payload", "value": "64c834f8f9ad3cb29d130cb7ecc4391b66564fab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741112, "uuid": "5a5faa9b-e3a6-47f6-b50e-770be06197af", "comment": "Malware payload", "value": "7e8260282d736a519a43a86fb04988f47b574644c2026be455487010b116e1e91a0532c99e25d9f472417ec3a1452377", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741112, "uuid": "fd01f6a6-e578-4c49-b9a6-09caf305da26", "value": "T18F44AE58FE9414F4DABBD67589972C6A727335720B82DE9E0358B3F21F27361AF06900", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741112, "uuid": "d38c98a4-a14c-4c2d-8e09-6ed55026c350", "value": "d4755b9a9aec93c05c955ca11140bdc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741112, "uuid": "7ff278fb-e008-446e-87bf-c90984327065", "value": "6144:qSSIj+ZeijJh9gd+ZBLxEgOBo9UnQ7cPWa:r3/idWmLpO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640741112, "uuid": "1d0e9a16-3960-49a9-862d-82e9c1b3888e", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640741112, "uuid": "6b1cb887-da48-4182-b0c9-5a40077bf62f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741112, "uuid": "73c17eff-1fc8-4f19-be86-aaf92d4213fc", "value": "macosx.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37435e12-6846-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640741132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741132, "uuid": "f4e3c428-69f8-4fd3-8d04-3ac57346804d", "comment": "Malware payload", "value": "a3644b79bb1ce2fe044fb4ad8dea13d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741132, "uuid": "ea4faa3c-bb9c-47d6-a3ff-263240ef7c08", "comment": "Malware payload", "value": "b75c337a0fb7eb49ec34d6d313a612e93dc4180a8bf25f99fd7b10ea1077e8e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741132, "uuid": "8bbfbe24-84c8-4e42-91b5-f238b09ca745", "comment": "Malware payload", "value": "1d460c0f5a69be50f76f0fbc022ffd2d24213deb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741132, "uuid": "a17f4984-25a3-4f7b-babf-95d4b105490a", "comment": "Malware payload", "value": "1750415f0b9a24f822ed9902415a817ad9c2b92790b727cb7819ba9e2c4ef944ac95fa6f1d517682d92d90cd6aed646e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741132, "uuid": "b312af74-1d4c-4c95-a3e2-216d994792cb", "value": "T18E449E58FE9414F4DABBD63589972D6A727335720B83DE9E0358B3E61F27361AF06800", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741132, "uuid": "c4b32a94-190d-4796-be0f-9fcf22044afe", "value": "d4755b9a9aec93c05c955ca11140bdc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741132, "uuid": "8e0ad96d-2ceb-47a9-9ac5-68a16f92405d", "value": "6144:dr2Xa2Zp6jJh9gd+ZBLrAEgOBo9UnQ7cPWa:k16dWmLEO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640741132, "uuid": "3a9a4342-d773-4ccb-ab05-6df433ddbbcf", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640741132, "uuid": "b398da6b-9705-44b5-bea2-c50190690541", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741132, "uuid": "831fab85-b0c2-42c5-a3c5-2edf9a86cc99", "value": "macosx.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51ae32ce-6888-11ec-9275-42010a9c0029", "comment": "Malware payload (Kutaki)", "timestamp": 1640769523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640769523, "uuid": "ce9b1135-5244-4a8d-a0cb-78d2c09f774f", "comment": "Malware payload (Kutaki)", "value": "0684d62dd44b077b6e537af5146b3481", "object_relation": "md5", "Tag": [ { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640769523, "uuid": "2941b651-6111-4dcb-8f43-ddd6c5f85d1e", "comment": "Malware payload (Kutaki)", "value": "b761256b5f20918c970f0d64b939e86d8304141b04e9024a809996da04d46c5e", "object_relation": "sha256", "Tag": [ { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640769523, "uuid": "94d9bd66-766e-45b8-a2a7-05c3756c131e", "comment": "Malware payload (Kutaki)", "value": "ceabfa1f86844feacb09fcf2f99df4fb181834a3", "object_relation": "sha1", "Tag": [ { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640769523, "uuid": "1577a643-3574-4f0e-9da7-7c646e4fea69", "comment": "Malware payload (Kutaki)", "value": "a89ce2b9b2f7423c65f011f94ceda41ed448719f922e37e76762e6305348167a158d2516cfcda8e5b7d54d770d44d675", "object_relation": "sha3-384", "Tag": [ { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640769523, "uuid": "901e0e71-625e-438b-ac43-3326b44e4e6a", "value": "T11F9423689A4A5F9F5EDC54A6CEA7F21607C05AF71344F8808D8A73B79015383FE4361B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640769523, "uuid": "604f503d-637d-4164-a562-a6a92994bb1d", "value": "12288:20poWbQAMzhqUq4CA9jAN/Ah+9KMSs8aknB1YRM:2iBMzhqEHAN/+PMSs8aknP3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640769523, "uuid": "d1cc0373-d6f1-4237-9fa6-1ba6d50e845e", "value": 420730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640769523, "uuid": "db3cd419-4dbb-49a7-b091-6f1f7406df84", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640769523, "uuid": "9efc5b73-e9e0-4600-a6d9-454ffcbd63b0", "value": "0684d62dd44b077b6e537af5146b3481", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbda534b-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640740952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740952, "uuid": "10231482-8627-4a93-82a7-5cbfe7718a76", "comment": "Malware payload", "value": "15b2cea83391573cac7d9758f2141472", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740952, "uuid": "7219e2a2-74a1-4d26-8198-3cf0be387f6f", "comment": "Malware payload", "value": "b778f23e45faaaac8abb9a8bcce53da9fe6a0ea470a91bba791d1d608423c30b", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740952, "uuid": "feb9d6db-59e1-466e-999c-8b0089ca71f6", "comment": "Malware payload", "value": "e9e8df5402834e80078e0892ec438e5fac8c0c5f", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740952, "uuid": "4377c467-d1c0-4acd-a529-bd0acec76e41", "comment": "Malware payload", "value": "6ce47e5df3ac5dd585ae90683c47e4ea19a257a169df822571304d2d52c985018a5fba8559809477899a1831925f11b8", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740952, "uuid": "1bb7da77-e10c-4428-90ad-8a83296c8c37", "value": "T14A64AE58BE9414F4DAABD63589972D6A727335320B93DE9E135CB3E21F27360AF06900", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740952, "uuid": "1af8998c-45ef-42fa-8f31-ec504202a917", "value": "6144:HAiO2f6RQYjJh9gd+ZBLi3EgOBo9UnQ7cPWa:HCoYdWmL+O0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640740952, "uuid": "2c493933-f0a1-49c2-9532-efd4c44478a0", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640740952, "uuid": "85996877-20e3-485b-9740-d37fb4c3ab17", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740952, "uuid": "2e694b61-bb34-442c-b88b-18965d117cf0", "value": "attachments_1002.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94dde54a-6870-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640759328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640759328, "uuid": "533ab6d8-0603-42af-9188-5b537da24d20", "comment": "Malware payload (Mirai)", "value": "003b57e7b1692e051430108037b4c1ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640759328, "uuid": "2300026f-a685-4a3c-8885-2f9d63c20be8", "comment": "Malware payload (Mirai)", "value": "b957e454e58b8b516bfb95540dbc99094c47c6b62182374ceac5371bbfd53cb9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640759328, "uuid": "5e6d9a14-3550-452a-83e6-c7f79f6f1625", "comment": "Malware payload (Mirai)", "value": "5788e74a234c92995ebbf99bae567e871ef262c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640759328, "uuid": "6a90e4da-0ae8-4ce6-90fd-2fc857aea843", "comment": "Malware payload (Mirai)", "value": "96439fd26afb5c9ba6f2e5adf8758030bd085ca14b9da4d9cf3beb02a16251ee3d0b805ccb3770b29298714c4283bc78", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640759328, "uuid": "f36cc141-8da8-4d20-96f5-cf1d47e8bdf8", "value": "T17C53AEB1C42EBD94C5584274B8718E781F53F504D2A62EFA9EC6C2628407EB8F66C3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640759328, "uuid": "00ebae10-2e88-47ea-affe-776b42865c98", "value": "1536:laTdpWvMXzwt8YpNzwICHNlDEXtSCvbU:l0avMXzmUHNlDEXYh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640759328, "uuid": "2fb163d2-be25-47ab-ae9e-f45c5bff6562", "value": 64064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640759328, "uuid": "ac895770-b963-4943-8979-2d1a23ecfa6d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640759328, "uuid": "a6ce499d-ee10-4f80-9370-c3ad572f266c", "value": "003b57e7b1692e051430108037b4c1ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14340cd2-6846-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640741073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741073, "uuid": "4732e140-57bb-4b02-a400-286acae2f24c", "comment": "Malware payload", "value": "b824e0663277b4917d3bcd0cb78d3ef8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741073, "uuid": "787ca8f7-1847-4dc2-ac91-fccd79020095", "comment": "Malware payload", "value": "b968be42546794effa6900666e9e6ad09c6e211d192571a1bed308c92222c227", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741073, "uuid": "3b75298c-6f9f-416c-b287-dfee771dd594", "comment": "Malware payload", "value": "c1c2c89a13166f47462b7e283f24ef355c71bd87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741073, "uuid": "4378e6f4-573a-4cf5-938c-916f55cdc87c", "comment": "Malware payload", "value": "e2c6f6d79d2cefee1b836f74a8c46cb4b8ad71d0a866d91d2c934e05521bcc95f33aa19f68b2c56c7f868501217410d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741073, "uuid": "d35e0052-32bf-4f71-8941-f7c8ab97f8e9", "value": "T1B9449E58FE9414F4DABBD63589972D6A727335720B83DE9E0358B3E61F27360AF06900", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741073, "uuid": "9cb10d27-9904-4480-a3e7-8027680dde3d", "value": "d4755b9a9aec93c05c955ca11140bdc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741073, "uuid": "ec269e5e-4c73-4269-9bfd-a9d784744718", "value": "6144:NqAhl5D5jJh9gd+ZBLoEgOBo9UnQ7cPWa:bx5dWmLoO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640741073, "uuid": "aa1654a6-72e2-4aa5-9fba-36e4ed356023", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640741073, "uuid": "44d36143-aeda-4051-ba53-56176eea9c2d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741073, "uuid": "9a4e4c48-a25c-4356-a49c-a6ecd0c1707a", "value": "macosx.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e6a3dc0-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640740822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740822, "uuid": "9dbdb60c-0aef-4660-9b99-55d73dceba43", "comment": "Malware payload", "value": "f9a805d720244440559af39d693fc895", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740822, "uuid": "e2e7da6d-8961-46f9-9b2b-7458d1673068", "comment": "Malware payload", "value": "ba5d32b0b63cdd120f06d043d1e13d5b5824a643581a7862ee69a3749cecbdd8", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740822, "uuid": "88577aee-9260-4dd2-b31a-530deb87e45e", "comment": "Malware payload", "value": "471f2d69862d65148b4dadd69217de79193a4c96", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740822, "uuid": "03695be4-479f-43a1-91a6-98301f1be45d", "comment": "Malware payload", "value": "5892ed7b12ec2fa3d2585b3912abe3868021d78a656ded10e0bbd53095cf9aa6dff0198a7f81dc7637066e2c55499ebf", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740822, "uuid": "599d8399-2bc5-4f5a-98dc-4029e1960554", "value": "T14E64AE58BE9814F4DABBD63549972D6A727335320BD2DE9E135CB3E21F27360AF06900", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740822, "uuid": "65e8d8f7-9025-46b1-9246-65e04ddccf66", "value": "6144:gh+irB6lmJjJh9gd+ZBL7EgOBo9UnQ7cPWa:liNJdWmLHO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640740822, "uuid": "6cd43996-527e-4844-b96f-cbb7fd0c52b1", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640740822, "uuid": "fcd16623-3fac-4384-8332-1244eeecc95c", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740822, "uuid": "7a72b330-5b43-4319-b49c-a1b7142c9477", "value": "attacments_1041.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0fb6d70-6882-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640767160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640767160, "uuid": "2fb674a7-ead5-450d-a402-665c2521f841", "comment": "Malware payload (Mirai)", "value": "73a85d6c446aec4939236108897cb088", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640767160, "uuid": "9ebaae6d-cf30-47c3-acb6-836de517107b", "comment": "Malware payload (Mirai)", "value": "bac509597a430526b0424b8358a6b95d77466422294ddfa54cd09c1e1142237a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640767160, "uuid": "855085a5-2465-4c41-b49f-5c6fa604b4b9", "comment": "Malware payload (Mirai)", "value": "6304605bc05576b50081d64223dab3718a1697c3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640767160, "uuid": "790e1f1b-982f-42a0-813d-a5831a2e4a2e", "comment": "Malware payload (Mirai)", "value": "3af8787d3dd0c7cb2cd9ecf4ac5f8c7870be3ff32a7bd051aa5820e90c56a6393445a9ddf52940379b376ecc778d0f39", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640767160, "uuid": "9473baee-e639-4ffd-95a6-107ea71b0e6d", "value": "T10E635B356D7A2E26C1C0A43E11F74764B2F1678E3AE8CA1E7D720E4EFF50A5060279B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640767160, "uuid": "7a16d1c3-61e3-4d1a-acb8-f1e3e58014f2", "value": "1536:oCB7VZfV63/UB5H1S5ZkCJBTP/KcT39zLGO:vbE5NH7h91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640767160, "uuid": "3aff1b21-a33d-4d53-b18e-94058dc7e280", "value": 72792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640767160, "uuid": "87984cd3-1a68-4a64-8281-b293ba96e447", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640767160, "uuid": "b4930f9a-4709-44ad-a538-15f174937a50", "value": "73a85d6c446aec4939236108897cb088", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5ca8ef9-687b-11ec-9275-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1640764161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640764161, "uuid": "192981a5-00ec-40b3-ba7d-bc7182285c93", "comment": "Malware payload (Vjw0rm)", "value": "e6860fcf7fd568970643d88ddc7d87cd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640764161, "uuid": "54f45269-ade8-4dc4-8145-f5fb847cf2ef", "comment": "Malware payload (Vjw0rm)", "value": "bae95e206861f753435369c3ca6b6c4bc655bd8a6f461c150785b1899766d55b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640764161, "uuid": "a19efb94-158c-4379-baa7-0537d705887b", "comment": "Malware payload (Vjw0rm)", "value": "fef07c35b5cb90b850f920b222b7cf005c03b199", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640764161, "uuid": "20c52048-b714-40e5-8ca6-989e72dfdab9", "comment": "Malware payload (Vjw0rm)", "value": "e89e73b9f71dcceb3cac378e567524eec6374a57086ecd3422d01f4f9e9c1c60e6c36c1b6e1ccacf799dd2848d500847", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640764161, "uuid": "c54e69ea-bf63-47f8-bc96-1fe9716b460b", "value": "T10A24F8CC7895F0EDE922A07536BA2CC913E4630BA40497CCB54DB7015FB2794C7DEAA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640764161, "uuid": "25224914-7785-4199-94bc-ea8a756f76ce", "value": "1536:eN9aEj6vR1VsDUkc3YYCMKvyT5uOsrBibF1iCex1B2zwybiLPqirbmuzL/2ybpzA:eN9aZqMt9umRvwZzfDUt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640764161, "uuid": "e46469be-0c9b-4878-b55e-a5766fa6292b", "value": 214263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640764161, "uuid": "ba9807ea-2ccb-4188-a65c-a8dec7d789c0", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640764161, "uuid": "8ad3fc89-8858-4473-aba5-a5ca57f1185f", "value": "image006.png.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bcd057b-68cb-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1640798209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640798209, "uuid": "aafefa0d-381d-4835-afc2-75d69e39f4d6", "comment": "Malware payload (AgentTesla)", "value": "6d3d934289514f11fd8dc82abe771172", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640798209, "uuid": "b62bb283-1ac8-4429-8164-dbfee5ef8040", "comment": "Malware payload (AgentTesla)", "value": "bc8fc1d6e4b1f2d54e06717a136ebd113d7cf50939958bcf85b9556083d5b00f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640798209, "uuid": "80926cc6-2aa9-4b3a-b901-1cf52185d682", "comment": "Malware payload (AgentTesla)", "value": "af632ed4379e580c47df1e056d59273163f19a59", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640798209, "uuid": "2299c5c1-6ba9-4beb-960e-608ea5f15324", "comment": "Malware payload (AgentTesla)", "value": "6bc6f468933368544fd320bced28e2ed695eb506cbaf947c03d4a853cd28b9a23d8d85897d2c17fc9ec84d8046965af2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640798209, "uuid": "521c3978-44d2-4be7-8a6f-55e2b86a552c", "value": "T1CE94235623E81362CFFE8FFA086223215F72B1276039E31D4C9098EA15B3F6169B5757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640798209, "uuid": "0c01dd1d-3ff0-4eb1-b88e-6bbbdc6ca56e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640798209, "uuid": "69ed1319-f607-4deb-bcff-3d6451a5cb95", "value": "6144:w9LlsXmESmQP71kY0d9cqLD1ZQgWgubbDOoeRVn5VKMABdd11+HfVnF4wy/baRXS:gLlsXmESmW1hSN9wdbnbeVnWPKKa5Fc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640798209, "uuid": "772a9bce-5ca7-4efa-a343-5a95e1ad91e1", "value": 422400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640798209, "uuid": "9d1cd440-d79f-4e33-851e-8de09e94f1dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640798209, "uuid": "b96f3fff-5593-4dd7-bd78-49f04be230c9", "value": "DHL Shipment WaybillDoc_TransportLabel_PRG211001715606.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11311134-6846-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640741068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741068, "uuid": "267213fa-2c87-43be-97c8-7fd717d58fc7", "comment": "Malware payload", "value": "75150b077a4d44f23cebaf8524a1ac3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741068, "uuid": "8a00eee1-f60c-48e5-849a-073cf39d48aa", "comment": "Malware payload", "value": "bd1292359d2b0df3b90019dc404151593f83ee48d38eb850fc2652d48c3c2b80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741068, "uuid": "580f04e3-3907-448d-be65-716469cb7dca", "comment": "Malware payload", "value": "860a1b9484abfa545776a2fe342b237d29782697", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741068, "uuid": "9f66554b-1aba-4b52-b168-6c33b724337c", "comment": "Malware payload", "value": "18f12b76400e35b0d3ea6e11d2a2de45757fc3af8125549cdf16337b5627537e3c92a2119bb60aa2e97e130d8a8cd4ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741068, "uuid": "a1ef31cf-97b0-4968-9060-2358f055b75e", "value": "T11744AE58BE9414F4DABBD77589972D6A727335720B82DEDE0358B3E21F27361AF06800", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741068, "uuid": "ae5c9183-5835-4de4-8adb-6c89fc6f647a", "value": "d4755b9a9aec93c05c955ca11140bdc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741068, "uuid": "a8250d4b-5582-4f2a-9cf2-6a18880fbb32", "value": "6144:zGxHd5qzjJh9gd+ZBLOPhEgOBo9UnQ7cPWa:c+zdWmL8ZO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640741068, "uuid": "325e369f-1f1a-45e3-a6c5-1d241b0c2f29", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640741068, "uuid": "7f2d8d76-b252-4805-9c01-5f399da8f302", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741068, "uuid": "14d379cf-c095-4a07-bec0-60db00750717", "value": "macosx.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c97cb920-6862-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640753403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640753403, "uuid": "5e9656e4-e03f-493c-945f-509e12ea9cc6", "comment": "Malware payload", "value": "d779363315850972a91e04e12139c377", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640753403, "uuid": "5064c970-614c-4653-b778-dd91f562ddf2", "comment": "Malware payload", "value": "bd14a7b07596583f4ec106184442dd97316c09d8672f4cbf19e45aa24f94f1fb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640753403, "uuid": "5bce033d-1b46-48dd-9dc5-9f8d9c8c09bf", "comment": "Malware payload", "value": "435e517d695ebdb99363ee3f787bff8863acc56a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640753403, "uuid": "5c5b01c6-05cf-4462-9cbd-fc7d3ef335ab", "comment": "Malware payload", "value": "f629bff11e79a38f72a9780d018e32bf05f4ed38e76ccacf589116465a95af27f6e31413bfc3d5e57717eb21bdafda36", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640753403, "uuid": "90016b36-2d39-4293-b79a-9621ad901faf", "value": "T1FC23028E70D86686CECD5E7376E943B508A671C063BE3F5CD20801863BB0D5D25CBDAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640753403, "uuid": "2759a075-f92e-45c5-86a5-4609acfbe0f9", "value": "768:61GgvW4977nBAb49xxKbCVc3ZQE2eWegIZas0V8elPaQKScIUBuBvbXp:NWWU7y49xsN3ZNgIZafV8elTKdIU8BTZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640753403, "uuid": "cfe03941-e555-42b9-80c2-faa42223d541", "value": 47940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640753403, "uuid": "b1b28b8e-6c2e-4047-a9e2-9d1b2762f30b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640753403, "uuid": "35e09fab-02c9-4abe-8525-ad0faf849247", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dcdf659-68b8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640790267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640790267, "uuid": "0d34b61c-5f8f-49f2-b139-48c852928b0f", "comment": "Malware payload", "value": "2b91ed6cdbbf2f11b0ef9e6ff979bb61", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640790267, "uuid": "113efb66-00ca-4cc3-a542-f738c94af574", "comment": "Malware payload", "value": "beb09377e0858f26268b0bc3c305330370c34600973d3a90ecdb4471f55a30be", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640790267, "uuid": "90c7bfd7-9afb-4f3a-bff2-c1e135713db0", "comment": "Malware payload", "value": "f6d04d995727df9ac23916f5a8b990f3621fd630", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640790267, "uuid": "a684899d-88cb-478c-a4bd-d8bc676c24e1", "comment": "Malware payload", "value": "69c651268e09bfa6a6fbc4e5ce9358e5ca6f7b13ad6f9ef8694562d31cc9cced07ae56ea066f54e0e5774e21e17f3656", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640790267, "uuid": "b8877fb7-dbe4-4512-904f-7f0ebaeb7679", "value": "T1ED513921B6A2DE4AE8509F364C92D3883732BC40AF16E6833685733F5D772C05A56571", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640790267, "uuid": "d43163a8-11f1-409c-a8b8-993f5dc79f98", "value": "6:j1bxc+CF2DqbXbEGR1/CX22qQfd/lrI//UA4G/2HnC1PmyG81Gj:pbaF2uLbEY/iLplrI/yG/2HnC1Pt1u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640790267, "uuid": "c2a54949-1a78-4893-b4d3-62d93ee2f1fd", "value": 2560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640790267, "uuid": "218e2c2c-a403-4353-9ac4-0c169dbea25d", "value": "application/CDFV2", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640790267, "uuid": "ec341996-e531-4b96-be3f-6d4a546dcaa8", "value": "SecuriteInfo.com.Exploit.RTF.Agent.NT.23720.18682", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8093eb18-687c-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1640764448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640764448, "uuid": "b820ea6d-7031-48bc-a60a-b6259994c938", "comment": "Malware payload (AsyncRAT)", "value": "5d0af73ef7455354badbeba368487bf4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640764448, "uuid": "e1088af4-fd7a-49bb-a9d2-29acb33df8ab", "comment": "Malware payload (AsyncRAT)", "value": "c061cc43c2ab0ad504a4b8507b6cbc1cf2520229338d7c128bf0244791e75a4c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640764448, "uuid": "422b265d-221f-41a4-8dc5-df4fa46ec42a", "comment": "Malware payload (AsyncRAT)", "value": "c6c196bd7b65bae0b4651c2dadaa51d38ce38f6e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640764448, "uuid": "aa625258-d775-4eab-86bb-94b74c367bcc", "comment": "Malware payload (AsyncRAT)", "value": "79ff11cd072006763ca65ae251e72d57c7383df9f3aeb813f1c2e154125922138feb8e703dd1a8c8f63547a80cd36b1a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640764448, "uuid": "8ec0d4ae-ea54-46e2-8fbf-2f6f38b3a77e", "value": "T1A4231B003BE8822BF27E4F78ADF26145867AF6673603D9491CC4419B5613FC69A426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640764448, "uuid": "df9ab542-4954-4cab-a655-e8087e895ea6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640764448, "uuid": "aac95820-d03e-410d-8fe5-aad2543fe68d", "value": "768:YuwCfTg46YbWUn8jjmo2qr1EsS+1KnPIwRjbOgX3iVEbxa8BDZex:YuwCfTgp/23sCAwBbxXSVgMadex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640764448, "uuid": "1a0be06f-8ae1-4108-9737-753ccfa005f2", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640764448, "uuid": "28cb367a-e733-4676-909e-479895cf75e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640764448, "uuid": "37800576-a753-4285-8bc8-15767b499bff", "value": "5d0af73ef7455354badbeba368487bf4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a97735e9-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640740894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740894, "uuid": "69d9ec81-091a-4461-b9f5-50187cfdd47d", "comment": "Malware payload", "value": "f63921c6091f8e02ee1219aa2d324b2e", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740894, "uuid": "b4e6af84-473c-4308-a110-1d8c3cf8145b", "comment": "Malware payload", "value": "c378c841654fcd7eb42e8a2e805fb0b9b97e016ae5ae23897b1674288a503284", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740894, "uuid": "42fed43d-bced-45d6-b87b-18213f1ebd56", "comment": "Malware payload", "value": "ee62698ee50a5136ae6b060b625964b8aafba53d", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740894, "uuid": "ae41b9b8-463a-487b-9eff-076b10a17737", "comment": "Malware payload", "value": "3ae06a6e1b2606a12724327baa944b41b6650836cee16defa8741eabfec47f588145131041fcdb259028ab6efa4113c9", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740894, "uuid": "2dbc3d43-db70-4a66-9f36-df03cf645d76", "value": "T1B564AE58BE9414F4DABBD73549972D6A727334720BD2DE9E135CA3E21F27360AF06A00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740894, "uuid": "4501e6b4-6be8-4a74-b219-349fc19fa302", "value": "6144:Ks3FCVRF4jJh9gd+ZBLZ5EgOBo9UnQ7cPWa:r3E4dWmLTO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640740894, "uuid": "7809b7e5-bf27-4738-970c-a867c3a2443e", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640740894, "uuid": "b9bfbf18-f2a8-40f5-aa94-68b732390086", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740894, "uuid": "fe944f3f-7b82-4e8d-bc41-579f449b5c81", "value": "attacments_1021.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03e1cdbc-6846-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640741046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741046, "uuid": "32588a1a-23b8-48fb-a634-fdb7431968ee", "comment": "Malware payload", "value": "707a40d29e70d856528ec027e2183262", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741046, "uuid": "caefd69b-14e7-41ce-9cd0-33250089d28d", "comment": "Malware payload", "value": "c3cd94c5daba0d292b40e783cf2b7813f5c71c6da490b587aed6dedcd48f3bc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741046, "uuid": "fd30013d-4711-462b-be7c-a39be1b05ef1", "comment": "Malware payload", "value": "3c42ebbb82c99be1c837f270b732aeca6b12e957", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741046, "uuid": "8487cb76-c2c0-4f13-8174-0866fe7f98a2", "comment": "Malware payload", "value": "097a48e66bc05b2b90e14b0fd94b38e30f930a5ef005f3295067e71075b2e4da7ffdb468bb1389c71747fb0ed84926a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741046, "uuid": "15241cc3-2c7a-4999-ab3b-fc1196b4ac09", "value": "T16744AE58BE9414F4DABBD77589972D6A727335720B83DE9E0358B3E21F27360AF06900", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741046, "uuid": "25dca501-60df-4abe-bcdd-9994adebdae7", "value": "d4755b9a9aec93c05c955ca11140bdc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741046, "uuid": "8d7ee622-9f30-45ed-a152-b17a093d319b", "value": "6144:Ns3FCVRF4jJh9gd+ZBLZ5EgOBo9UnQ7cPWa:u3E4dWmLTO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640741046, "uuid": "ddfdead7-8c2f-4010-9cdd-736934de6f7d", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640741046, "uuid": "7f1516a7-cec6-48d7-a6ad-04d3b4001e37", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741046, "uuid": "75038b19-6cfc-4aa6-a9d7-591db40f0534", "value": "macosx.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8a688eb-68a9-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1640783842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640783842, "uuid": "7cda1668-ceae-4443-b681-970c30016c05", "comment": "Malware payload (AgentTesla)", "value": "6eb995df72043d5640aedcc988b70b88", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640783842, "uuid": "8481946c-66ac-47b6-bb82-f23fb688c522", "comment": "Malware payload (AgentTesla)", "value": "c3d7e456737132d66363280933814835bc8b82c6f57a6ead7b0eb4f99ec199d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640783842, "uuid": "8e954e5e-10c1-406c-b2a6-3f0e0d1b1db9", "comment": "Malware payload (AgentTesla)", "value": "9c6e3a0ed76dffb36ac19ead5d32348670d93c4e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640783842, "uuid": "5de86199-beed-4446-9e3e-e4e70a9f4e5c", "comment": "Malware payload (AgentTesla)", "value": "d11a4b4624488120cf6a539eb3dfeec390bdc1d83a8b3a18799721a2e5a534569d87698111f5822b2574b2bb844f6f97", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640783842, "uuid": "3d1d6f52-c76f-4a41-96f5-0e27c5ca6810", "value": "T121558E7AF2899DD2E02693B8D8B7A80043277E59E56AD54E264F31DD1E333D324069CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640783842, "uuid": "46f477bd-ca50-43b9-b1a5-f127af8dc714", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640783842, "uuid": "e19997eb-6502-4498-a495-e851928717d4", "value": "24576:qe2H9ISIYn1+sYn1+MYn1+oieHZuvDSqXfL1zUqXRrb2gs9cy2:m9Ia1+n1+H1+obwvn9XRrbdy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640783842, "uuid": "47e10de4-3773-4e3f-9237-c1fb5ee5e27e", "value": 1372160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640783842, "uuid": "e2a7f6e3-98fa-4753-ad39-776a6a1ab30d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640783842, "uuid": "791de90c-422b-4b50-8601-efe2b57ca5ea", "value": "6eb995df72043d5640aedcc988b70b88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c98da6d7-6862-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1640753403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640753403, "uuid": "703be191-7d8b-406b-ab5e-8a2a5d25d52d", "comment": "Malware payload (Gafgyt)", "value": "bb8671bd8fe7bd3a8b118b4c353c5428", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640753403, "uuid": "4b202d9c-701d-4827-806c-95ee64d85898", "comment": "Malware payload (Gafgyt)", "value": "c5909be64f3d7bb5b40a871c197683b8e48254ec9a22366c66dcfa6547469583", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640753403, "uuid": "2d7dd2c2-574a-4137-80e3-08f6b07a1b65", "comment": "Malware payload (Gafgyt)", "value": "dd258d329134852679443f83d8f560f97f64dbac", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640753403, "uuid": "b02b9480-d3a6-4c22-be0e-01edf4a58ef2", "comment": "Malware payload (Gafgyt)", "value": "2447a1ee9cc703bc57f3a36b598701e68ade74a6eabd6a5af2cd8a41b0b699670368789f9d56e72fde0860eaa7af43d1", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640753403, "uuid": "374b53b0-3574-494b-8221-048f18fed2c2", "value": "T1DB23F13A537B81BEE0EAB4B3056767C0D8BD943ACB0E3387189DB1349A57315291C7C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640753403, "uuid": "5777fec9-cd9f-4366-b99f-218789c8e251", "value": "768:YxL/dzaxgfyoeov9RnPWu4I4b3qonFknmpCx0cDuKAyaadEDARqdA2y:YxLVzM6RZvv+uh4DqTmABydxaj2y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640753403, "uuid": "db6731e5-c86c-4ac3-9332-c9ac660b1429", "value": 47028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640753403, "uuid": "641c1e1e-7cbd-484b-a212-c87a1d450aa3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640753403, "uuid": "f7bc57cb-a92e-4c74-8332-6905fc3fc58a", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abb2b758-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640740898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740898, "uuid": "507df92e-7cb4-4faf-af02-c641c4d94551", "comment": "Malware payload", "value": "41ebca98f568b2d0423213d4e0d81e96", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740898, "uuid": "4f301ce8-d890-403d-8fa5-89a016c1770b", "comment": "Malware payload", "value": "c71b7f7d7fa7cfb542643c877ef30a8c9bdd1061f9f1c4e185b8d98ab3f10d1a", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740898, "uuid": "c8b0aebe-bb70-46a5-9c46-05e8fbca953a", "comment": "Malware payload", "value": "a5ed2cae054758677ec37d307f35f97cf2163609", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740898, "uuid": "64d2f9dd-15cc-4b3d-9c0c-822bad66b1f5", "comment": "Malware payload", "value": "b5dc5efc4a10c7766e4d0c118ef7c2cc65ad88729b10d2d90484627f9f10a336d9cf84a72d182d04c122a7d6e6de589b", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740898, "uuid": "5d47c3c3-9ce3-4d2e-8779-8c2e9c8cd082", "value": "T1FC64AF58BE9414F4DABBD63549972D6A727335720BD2DE9E035CB3E21F27360AF06A00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740898, "uuid": "758dfa4e-9097-40bc-80e3-4788cc087e28", "value": "6144:FSSIj+ZeijJh9gd+ZBLxEgOBo9UnQ7cPWa:I3/idWmLpO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640740898, "uuid": "17e3fab4-9390-46cb-9004-da222c9b8344", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640740898, "uuid": "dbcee8cb-4ec7-4ba1-8b30-831b1b05b8f2", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740898, "uuid": "0e34b71b-88bd-43f6-96d6-a3dfb2a2d609", "value": "Attachments-2022.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27fc5ad8-6846-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640741106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741106, "uuid": "423c8453-8463-4ebc-9a81-c80f0d7a9b40", "comment": "Malware payload", "value": "49c7cc20333951bb7520c6ecabef85de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741106, "uuid": "72dc5a3d-5719-41f2-ad37-205e8f4a9852", "comment": "Malware payload", "value": "c765e040e1facf4b651d4684a4fdb3fd04c0d01e506bfb0dce454104f2c43f8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741106, "uuid": "cafbee4f-4469-4544-a541-577f0731839e", "comment": "Malware payload", "value": "984d3443e5119ddf2e45001404694e59cb92f0df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741106, "uuid": "1a7bd838-8b24-41de-91b4-8d04e2c22289", "comment": "Malware payload", "value": "43c6eecb8d12dcdc57a6f857799deaa5da91b2dcfd3325758451d61a5e42b82068d5916d77a6e9368d0f1b5fb05be610", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741106, "uuid": "652347ee-3a40-43a1-88a8-5e5b9b920a09", "value": "T17E44AE58FE9414F4DABBD63589972D6A727335720B83DE9E0358B3E61F27360AF06900", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741106, "uuid": "368f57b0-a310-4b88-8aeb-4a299f0fd86f", "value": "d4755b9a9aec93c05c955ca11140bdc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741106, "uuid": "ad1c9e8b-c110-4b40-a79a-8354ee52f347", "value": "6144:mPb7Ax1Ra6jJh9gd+ZBLiAEgOBo9UnQ7cPWa:mT7Ao6dWmLBO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640741106, "uuid": "754c1fee-22f6-4d5b-b5cd-f91c893f4a1f", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640741106, "uuid": "dcdafe71-0161-4a0c-bbbd-c0eb5967b592", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741106, "uuid": "d3965775-c399-4ad0-b7aa-2c895d43257e", "value": "macosx.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db771297-6882-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640767177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640767177, "uuid": "2250d5bc-6167-421a-beef-dfe326422a56", "comment": "Malware payload (Mirai)", "value": "a687f80dc42d468e1595beb314345e09", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640767177, "uuid": "4091ce92-543c-421a-84f5-955b1afff063", "comment": "Malware payload (Mirai)", "value": "ca59630f80e328e0f56ef37780f95c56e0825194ed90a71cfd68f321a27b4624", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640767177, "uuid": "f32c1be5-1ed1-4986-bb97-4589538a3a35", "comment": "Malware payload (Mirai)", "value": "744a89265f8a55183e4987c02ccd8de46a8e3047", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640767177, "uuid": "fc6f761d-3b79-489f-ab12-819fdd15e365", "comment": "Malware payload (Mirai)", "value": "a5fcb43a30860fc9f49bde0ea22de07e1af8bf462cde1b0822b9d98256bfa8430de2dc91728df2d16a9ef4280fd17f8e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640767177, "uuid": "b93816c1-d4d5-4c53-ae80-a0f64435c087", "value": "T1D533E8527DC26A2AC2E0137AF9AE81CE332167E8D1DF7257CC211B0476DA55F0DA3B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640767177, "uuid": "6e35c26f-5033-4540-8cd1-414e84452b44", "value": "1536:hCqZI1iDUguHppKKOxgPg6osAvH3Y09WZoh+fgh8S:XZeAPD9WmhA3S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640767177, "uuid": "a58171d9-ba81-4aac-9481-e307309453d0", "value": 52144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640767177, "uuid": "9c1f7560-245b-4352-bdd1-a15508cf9791", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640767177, "uuid": "790e6c04-f7bf-446c-b6b0-7bba4a1fc961", "value": "a687f80dc42d468e1595beb314345e09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02076a18-68a1-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1640780127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640780127, "uuid": "25d7f02f-c45d-48d8-a0f8-aa475188758f", "comment": "Malware payload (RedLineStealer)", "value": "b7a2ad9b2fcf161a24b2b3f84f3606f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640780127, "uuid": "67e299bd-2bf2-4668-94eb-8c86f18fe523", "comment": "Malware payload (RedLineStealer)", "value": "cc5519639307c7bb166c2a370d4485f440c7ef0a7cb120e5b7d6a114c0f8973a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640780127, "uuid": "424ecf62-9bbc-4777-9553-17eaf406f720", "comment": "Malware payload (RedLineStealer)", "value": "d981795e773497c6798981c64abe15699bba74bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640780127, "uuid": "9274da5a-d719-4147-96c3-cf38895c2f43", "comment": "Malware payload (RedLineStealer)", "value": "43b24093c02a751a3b5246a158c1cb153040d4cda7fc469919f0d686d4b77ef8bdc60cd5314fbbf9c09178bb7a24ebcd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640780127, "uuid": "14882797-53f8-4b5f-b2bc-cb09631f3c94", "value": "T1F3F42390A769A642D5EB8674CAE1CB229937FD342231857720D7F32F6E237C0CD4162E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640780127, "uuid": "b2ce3115-467d-4a14-957e-11155b04cbfe", "value": "e6398d6344d6bdc32c905f9695ff28cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640780127, "uuid": "d76c4259-e608-474d-98e2-cc495acc6ed2", "value": "12288:9swX7FMfxh3AwSVu/SjsROL7LilRXh/kLjrUGJeMX5IfCTVbtSd4cwW+tP:9LZi3AVVCSZLifR/kLjrXeMXqmVbtSGH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640780127, "uuid": "72117777-02b4-475c-b1d4-1dcf7c5a5dad", "value": 782336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640780127, "uuid": "3a75170e-b6e4-4b5b-b67e-be3320c63957", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640780127, "uuid": "324eef51-70bf-450c-8478-307e2e8d0088", "value": "b7a2ad9b2fcf161a24b2b3f84f3606f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "312607dc-6876-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640761738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640761738, "uuid": "19f4da6a-82a4-4753-abb8-c7ee878c84b0", "comment": "Malware payload (Mirai)", "value": "896c34a03db540c51c3d7a408d64b2e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640761738, "uuid": "a97144a8-7147-4c73-8ea5-598c60db4e9f", "comment": "Malware payload (Mirai)", "value": "cc73dca263370bb88f7c176fc6659b39f2f3569b6649556d795a33fea1a3c09e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640761738, "uuid": "be70705c-0af1-46cb-9786-6e3e2024c7db", "comment": "Malware payload (Mirai)", "value": "09effe4aa190bac114fc0517526db5bf4361bdba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640761738, "uuid": "189f909b-4e3f-44d0-9a29-9d275f0a6607", "comment": "Malware payload (Mirai)", "value": "57254e3a4b8ee5b3c17912fc59a171e4fdeb34b3f3a9bc3717416d0fa31778ac127ddc1237c8570d7cb53706b8f9ad1f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640761738, "uuid": "102689d3-7366-4608-bd91-22a22f453652", "value": "T1DE735A36AD3A2E07C0E4B57A52F74364F2E1674E25A8CA1E7C720E4EFF6155060632F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640761738, "uuid": "8fc8cf30-71e5-424d-b01e-b4a5589b7188", "value": "1536:6dekM7z9RvfrLuSJl0bSWB3Ps0oq+/LzKK6au:qwCeWpPx+KK6au", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640761738, "uuid": "463fbd57-ac90-4d78-b86f-03cad370ade5", "value": 74940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640761738, "uuid": "82c1d7fe-1e10-4a71-b03e-164c33a16e86", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640761738, "uuid": "4ecd3699-da52-4ae7-a64a-a105b0c20b28", "value": "896c34a03db540c51c3d7a408d64b2e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c11831e1-6845-11ec-9275-42010a9c0029", "comment": "Malware payload (Kutaki)", "timestamp": 1640740934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740934, "uuid": "03590084-fa00-4453-9b6d-6dbd6768c29e", "comment": "Malware payload (Kutaki)", "value": "c43b7d74eef3fa1c025f08939e9d4be2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740934, "uuid": "0754ecff-11ac-481e-9464-65e6ea6e2265", "comment": "Malware payload (Kutaki)", "value": "d0fd86e3254a14f3b99d141b8512eae447cd716436ba8a192422596a2b0bb625", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740934, "uuid": "04bf1bfc-2dea-4a30-b049-44fcc0931c7c", "comment": "Malware payload (Kutaki)", "value": "0b41411bd1f52c115d77fc44815beed1b3cb749c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740934, "uuid": "2c30aa8d-c7bd-4ad5-b0e4-9994a3c9a208", "comment": "Malware payload (Kutaki)", "value": "ec8f0291213c581404f71e5b2863859e70c1df46d2fe2efcef16732a2a13c227d1252359bbf8688c241197a04ba9f089", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740934, "uuid": "5aa8ab8e-3f70-4fe3-b6fa-96f49275fd74", "value": "T177B4DF0572F21B4EE9BA6E322EE395F24273784FAF67414AFE04212E2571E504A15F1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740934, "uuid": "62efe3bb-1eea-41e1-b9fd-a02f7b778c9c", "value": "55ca440ed2816a8cce78866834895c34", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740934, "uuid": "81b45b4b-9af7-4602-b1ad-e4a1e86039bb", "value": "12288:3TW7+/MVdT4c46A9jmP/uhu/yMS08CkntxYRn:3qgMVdTqfmP/UDMS08Ckn3i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640740934, "uuid": "600c5749-bdf6-4e57-9c56-c5c183506621", "value": 528384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640740934, "uuid": "33832989-ddf9-41f4-bb63-202a8856e1ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740934, "uuid": "d1f7d94e-20d1-418d-b258-2ab62302dc33", "value": "image.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c50b798-68ca-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1640797834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640797834, "uuid": "1edc09a5-c780-4281-b33f-eed78c0ac5df", "comment": "Malware payload (AsyncRAT)", "value": "c3cdcbf86def50ab43b56c0dfa95eaae", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640797834, "uuid": "184d6a4d-5bc5-476e-a0ff-1826f8e7a782", "comment": "Malware payload (AsyncRAT)", "value": "d17d26fe698a00cf23683e5df58679d6d1bf18866de4b87edb62a2bc64cb22bc", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640797834, "uuid": "594eeed7-2ba4-475c-a6a0-423f948bbe33", "comment": "Malware payload (AsyncRAT)", "value": "58f0b8cd269df59b1a7386c67ac0b0818c53e748", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640797834, "uuid": "1cd994f6-b3f1-40eb-b2b8-16c0facf5d87", "comment": "Malware payload (AsyncRAT)", "value": "dd65a07a980bd2d118edf4762b75b662b7f7605c9c812f75e169bc2c24b395e8b02e08dbd93dddf80a567d6451d3dec3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640797834, "uuid": "be37e6f6-04ea-4698-8cd2-ed8d3189c9d5", "value": "T18A535B002B88C965E1AD4AB8ACF2454046B7D5772122DA5EBCCC04DB5B9FFC64A523FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640797834, "uuid": "40b04928-47a3-4a23-b242-0aefa55a2a56", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640797834, "uuid": "6c08abac-ba3c-4c99-8530-29cd6c480db6", "value": "1536:WhjExLDRwQuNMXbmaeWs1lheeiMl8GbbXwsmZGktVclN:WhjExLDRwQuNMXbreFlEeFmGbbXK/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640797834, "uuid": "6299120e-f7cc-4b58-a467-050bc39f4601", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640797834, "uuid": "621bbdf9-9c45-49fe-9fd6-0331dcd73cdf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640797834, "uuid": "4eb99e49-02af-495b-a783-15c78c2e6582", "value": "c3cdcbf86def50ab43b56c0dfa95eaae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca08b529-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640740949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740949, "uuid": "1ee58b3b-92af-42c9-b493-b82d5794513e", "comment": "Malware payload", "value": "47c6c84f635336e01714a18c96bcc82f", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740949, "uuid": "ae1cbd43-6cc8-4eb7-96c2-265521e7bba3", "comment": "Malware payload", "value": "d36a2314b8b42abd3c7a0a6fb6c57a9d783a4c60e30e716569c20edc6aebdc2f", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740949, "uuid": "3849c8db-0c49-4465-93ac-39a5fb9d27c4", "comment": "Malware payload", "value": "6885c66ddd19f25d36fa8dcacfe9bca9badd7560", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740949, "uuid": "8ccdad8a-211e-48cd-9e31-ad52c97e9947", "comment": "Malware payload", "value": "710388be68e154c936838dd740e76e1762ed2cf5f6e1143cab1d88eed9d92ad50cfd4d5b067177fc3ec37021909b50e8", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740949, "uuid": "34c98276-64f4-4fe3-8167-a6aeb651bb2f", "value": "T135649D58BE9414F4DABBD63549972D6A727335720BD3DE9E035CA3E21F27360AF06A00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740949, "uuid": "a595820e-d302-4994-9f55-0d2ccb18b557", "value": "6144:qqAhl5D5jJh9gd+ZBLoEgOBo9UnQ7cPWa:Qx5dWmLoO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640740949, "uuid": "9618dda8-decc-4710-bf56-3a5ec4945cb5", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640740949, "uuid": "efff9037-70a8-48d0-9d8c-fe5804ee24bd", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740949, "uuid": "d4914723-4fb3-4bda-b900-6b9709ec051b", "value": "Attachments-2032.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3f3962e-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640740992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740992, "uuid": "c380acf9-32a4-47bb-9e96-438780ae472d", "comment": "Malware payload", "value": "56d559791d3d46a73f828fbcb79678a0", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740992, "uuid": "a7edb137-3486-4448-849d-77567004d8f7", "comment": "Malware payload", "value": "d4a26a850e673cf35db7463aaff6024a76e79bf04ccfb64d3615746d4be38a44", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740992, "uuid": "98e4a880-e3c7-4aae-988c-01477db5f60c", "comment": "Malware payload", "value": "58305de0c5ab6a6e89a5fad897e3c38c64ad019f", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740992, "uuid": "f073a3b2-01ae-40bf-9989-1dbf909f37e4", "comment": "Malware payload", "value": "a06c393be04b953cc7b304cca93884ef4766522e63474325e2c18a94380957434f38fdb59b9ab54ef7fa9ceb40b097e2", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740992, "uuid": "c71169be-948d-446e-bb7b-4f5d5d719bc4", "value": "T18064AF58BE9414F4DABBD63549972D6A727335320BD2DE9E035CB3E61F27360AF06A00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740992, "uuid": "67d8619d-70b7-4fc1-bed1-9d825f8c9bc8", "value": "6144:8x4NSdQ55eHrjJh9gd+ZBLYEzEgOBo9UnQ7cPWa:QRGOHrdWmL3O0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640740992, "uuid": "617b7ac1-9ee2-41b4-902a-6684aa3108a4", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640740992, "uuid": "fd0a1e7d-d29d-4ee3-8d40-4ebb30ddc8a3", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740992, "uuid": "4d9c93c9-1506-4e4e-a267-2039c8623710", "value": "Attachments-2018.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8459ef24-6866-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1640755005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640755005, "uuid": "941b3aa5-b357-49cc-92da-69c594b4c01c", "comment": "Malware payload (AgentTesla)", "value": "50821d36a7eab0ffb260a657e3e4608b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640755005, "uuid": "8d59c25f-2344-4245-bd6e-fd6201fe94fd", "comment": "Malware payload (AgentTesla)", "value": "d571e2a38226799f56d9559ac9f964574bbf96a536fe786e1d71f6e7e375c4a9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640755005, "uuid": "26a8d97f-334b-486d-864e-36aac75ac857", "comment": "Malware payload (AgentTesla)", "value": "ec4adfba9a23a7fc5aed1734d0995006f24bb10c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640755005, "uuid": "3a78db0f-5ffe-4eee-a079-cdddc0b08131", "comment": "Malware payload (AgentTesla)", "value": "a613bb45e491722a40b2f152e9fb3044d35fac0e629d17c2bf6fcbf64a5361030634c4e8254468ca2bc14568e0c04c65", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640755005, "uuid": "648c0304-7458-4999-8471-4025bbc867c4", "value": "T153158D11219ADB55F8FEF7F80B28659003F5AED5E211E1A9EDB13C8B7471A43CE2092D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640755005, "uuid": "e86b1b80-cb03-4263-864c-eee9a52fed2e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640755005, "uuid": "0087bd0c-616a-48f5-be7f-898e6994cdff", "value": "12288:D+0zpxDvnPmuq6S+61YpIqG6UgllrCKMu7bRVHpp7xjLJwV:RzpZnhAT1QpxUglRCKMufRVH9lw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640755005, "uuid": "149aaa49-e947-4e9f-9b20-e57596223840", "value": 908800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640755005, "uuid": "5dc91783-6583-4611-9707-ac6e58c2aa29", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640755005, "uuid": "00725ba4-7226-4ddc-bb56-ed30e6e96924", "value": "SHIPPING ADVICE 4081791001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2922b162-688c-11ec-9275-42010a9c0029", "comment": "Malware payload (FickerStealer)", "timestamp": 1640771173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640771173, "uuid": "b0b1214b-9d30-4509-91f5-14d35867ff67", "comment": "Malware payload (FickerStealer)", "value": "5dac23376502cf57b537b51a3b3c2a44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640771173, "uuid": "50000293-9f6f-473f-b494-cfd66acb3d75", "comment": "Malware payload (FickerStealer)", "value": "d6a975b058cbdbf7f0511a2a6d77911bcb413cb622625f2742a8531889d1760b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640771173, "uuid": "ccdb8c45-f5bd-4e82-9eb4-7302d4774649", "comment": "Malware payload (FickerStealer)", "value": "47188fa2280b1cd3a6796145dd3f901e364f9ac2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640771173, "uuid": "548da5c0-8a66-46fd-9f84-a9e6266725fd", "comment": "Malware payload (FickerStealer)", "value": "253a7ceb03f1034add922f88011acec66470b065cf495dae42f7d2b5332cd5a5878ebe0c3c7fbfb571d5e8d564b72fbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640771173, "uuid": "99656601-e1f6-4538-93c4-29d0d8cf4971", "value": "T111C49EA064F82C35EE86327C489B9B569B3E7D50EA33CBD3163625F5CF532C2A564243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640771173, "uuid": "bea46c70-f27c-4d02-a8f2-c8623ecba9bf", "value": "004c40e6f1bae11582448a280c9deb25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640771173, "uuid": "24dd6a88-abbe-4c75-b92d-2f5150cc7d8f", "value": "6144:ODLYQxgtQaFkCLXBIA8VLJo5k4tt0hr7ITsq0L3kGW0rLCb56dpLN4XQKJ3:EsQxgtZFXBIAugH0177bkGW0ra3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640771173, "uuid": "527fd9db-3a24-46c5-8102-35d13562c5e8", "value": 579503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640771173, "uuid": "22a10eec-fa86-4a63-a942-e97e21cd8af9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640771173, "uuid": "63b4280e-c223-437d-8538-9e88dc95f1ac", "value": "mixshop_20211229-065147", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "097ed963-687e-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1640765107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640765107, "uuid": "98b3025f-a45d-4998-b359-45415282cd8a", "comment": "Malware payload (DCRat)", "value": "0d93421e4dc3c05d3ee3fe7c49a6b0bb", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640765107, "uuid": "41afe811-3d30-4f23-a235-d42b5c415eab", "comment": "Malware payload (DCRat)", "value": "d6c9dd48914bf40e5a1cb60e307924dc24974dfcfe5b79a40b9056a247ac39f0", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640765107, "uuid": "d6f68646-d054-43d5-bb3c-0d78fe0a33d0", "comment": "Malware payload (DCRat)", "value": "24c6b3e00070e34ee7e6651ae250ce13e0bf4afa", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640765107, "uuid": "4663c9ea-86d2-4948-b58d-22d3b6b8b0d3", "comment": "Malware payload (DCRat)", "value": "1c873df09c53919d44cde353c55657d45f0f96cab91d1e3cc8edbe01ac620301a160d2d480eab41c675085bd3a3ec4eb", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640765107, "uuid": "c1dced2a-880d-4afd-91aa-a11b431648a7", "value": "T18F75CFC2789C54B2CDEBDE3E141608466A676C7B4291F12E36D1BA04DB3B4125EFB437", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640765107, "uuid": "f7225364-8e27-4a3d-a434-ab019dccd606", "value": "49738ad0bee20b817dabab783acdf71c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640765107, "uuid": "c11523e1-b380-4ead-9127-08d2b6663305", "value": "49152:6KRz7ARCrEYhQrRPlBkGMEW3gWVup6aaIb7b7YEKtayr4dZ1YnvkMK83LhJokend:fC5GQr6EW3gWVup6aaIb7b7YEKtayr4D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640765107, "uuid": "73356c44-51ce-4398-bc2c-6637655cf4e9", "value": 1693696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640765107, "uuid": "a9cb3d6b-1d24-4193-9458-f7b85f9bec22", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640765107, "uuid": "e27c1d1d-795c-414a-a0b0-4f9d5543dc3a", "value": "Fortnite.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1f95977-6882-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640767135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640767135, "uuid": "24747083-8855-43f1-aee8-20f92d7b99bf", "comment": "Malware payload (Mirai)", "value": "56ad85e76b0065cd200c037d9b61a319", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640767135, "uuid": "3fe3f1ff-2091-41dc-8ca3-5f8311ec8cd2", "comment": "Malware payload (Mirai)", "value": "d8ea2fc3b36e10d690631a3a3746ed0abdd1fd8ca89ace910259fa0968ca15f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640767135, "uuid": "a6d6e6d9-dcfc-49db-98cf-e4f99acb585c", "comment": "Malware payload (Mirai)", "value": "51aa7116f50072393706179a8d998fc2f15e1dbc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640767135, "uuid": "4de0c699-8e09-4a0f-b388-5d06d030f4a5", "comment": "Malware payload (Mirai)", "value": "c5220bd8e7afcebafb64e569ec18b7da8bf1235ed36dcce3acd8b940fece42deed417e082e17884f508220ada8bcdd1c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640767135, "uuid": "07c5b14a-c9bf-47b1-b13d-1ac7591c7b6c", "value": "T1DE83E895B8C18E11C5D413BBF92E018D332267ACE2DFB2169D206F147BCA92F0E7B955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640767135, "uuid": "b65c6d49-af14-4a3d-a70b-e9f4a497c073", "value": "1536:2RnabgUZLKq/zB8dAm5UhNTzeRGq1SM2b/cc7JT4i6N1sGKNw5e5C995fZ4cuIHJ:9gYLp/t815YNPeUqoMS/ckJMpNaNC0+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640767135, "uuid": "7c1ef108-2094-44da-97c8-56e797985258", "value": 83244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640767135, "uuid": "8843f351-a009-4228-bf19-9e7cb5766a3d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640767135, "uuid": "46f79618-f736-4422-a272-91a26170055e", "value": "56ad85e76b0065cd200c037d9b61a319", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3683d7e-68ff-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640820824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640820824, "uuid": "c05e4ee0-e3b1-4c87-a7a3-6a376764f301", "comment": "Malware payload", "value": "05130a4344646a9a41e54173726ef8a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640820824, "uuid": "37ee54e6-95a2-457a-9c5c-4e215d1f1e67", "comment": "Malware payload", "value": "d9b6982e6ebb44f281207474f885164df5748889ee12d2f21ceaf13ce1315f52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640820824, "uuid": "bdd45e48-eed8-4f56-9bd9-97ce22743b9c", "comment": "Malware payload", "value": "0a6f681ab6b1e7fa5dae9fff2103d7f7c00c1e47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640820824, "uuid": "6e13707a-6f83-4be0-b2f7-44e085a5efd4", "comment": "Malware payload", "value": "fa8d3228698dd665fb36e074b6117d7c8a57e7585f4d0a85af6714f7d12409a428914ab5a08def0246d7d5a70a338cd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640820824, "uuid": "31d8b791-ad21-489e-831c-4cf1887cb52e", "value": "T11E05BEE0317D83D3E1B19DB10F89827075F275ACA8D0570D60F59B2E9BE27900C9DAEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640820824, "uuid": "d6680400-c893-4440-9271-d1ea698da451", "value": "6d0581cc6fb802a355a01b5710cdf497", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640820824, "uuid": "1721aa59-88ed-432e-a016-932e63f5104c", "value": "24576:Q6SM9ocz6I7BYGYghoUnBQtJV/nonfpLx:8M9oSnOZgnQbnofp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640820824, "uuid": "76cbca1c-0ff0-4d37-a348-6418ad2af987", "value": 834560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640820824, "uuid": "939d7b40-d631-4b27-91b6-6e508725c5d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640820824, "uuid": "b815d667-2e16-44cc-9605-e80e03a3860e", "value": "05130a4344646a9a41e54173726ef8a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "891a094a-6870-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640759308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640759308, "uuid": "c904997b-133b-4b3c-bb38-c8e3882bee97", "comment": "Malware payload (Mirai)", "value": "1574036e806b587494448c16a861c8fd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640759308, "uuid": "b5628aa6-5d88-4262-bee5-8e6210effb4a", "comment": "Malware payload (Mirai)", "value": "e2cf9e48ad460ae323a0d51adaca36a23b4dc10af2aa331d414ff435408a1d45", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640759308, "uuid": "22715df9-b238-4a59-a118-2d7808343f8a", "comment": "Malware payload (Mirai)", "value": "45a1a41b2e773cad634bd694318860c459fa4cd4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640759308, "uuid": "39e5dc8b-6171-451f-8b9b-88272358a67b", "comment": "Malware payload (Mirai)", "value": "46b8a45d9cad4d6d7dbef83588638c05bbd67f1af72a21d7e2c6f61440a2350942ae602115e45095cbb8df185dfc0c57", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640759308, "uuid": "d98ddfe0-d9c2-49aa-9a41-0bad292b40b8", "value": "T1B693D51ABF600FF7ECABDC3749A91B05288C650A22A93B757D34D918F65B24F15E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640759308, "uuid": "9e82beaf-0717-4d9b-bc90-2814bfb35d6b", "value": "1536:KaRYhUVUZ2yQAVNtHd7QrPUFW2BLnZ4yVQCZ2sGVWu:KaRYqKhQ0Ru83QCPu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640759308, "uuid": "3eb8591c-3995-4f74-ab90-226753e889d2", "value": 96692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640759308, "uuid": "7c546e1b-b3ce-426b-8be6-89f4596774e8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640759308, "uuid": "c2d4e361-750a-4b33-a421-7e6af2a551e0", "value": "1574036e806b587494448c16a861c8fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd0120b2-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640740954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740954, "uuid": "ce756446-d663-4854-85e5-8e74716842ce", "comment": "Malware payload", "value": "ee471a98c2d9d2ffec731aa255e2ac8b", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740954, "uuid": "b772f1d6-5bc9-4285-8d8a-e21f8f5775e6", "comment": "Malware payload", "value": "e409bf27ce5df273c0692655b911aa4adfde8f7ea2485284ed0e9be16b54e08d", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740954, "uuid": "8683c007-8993-4f88-bd0e-b868d6cc5f69", "comment": "Malware payload", "value": "9c9263a87f79579b1961a576cf59128692f9f9d4", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740954, "uuid": "49fcec21-6400-4b60-81a8-04552c9387fe", "comment": "Malware payload", "value": "151f30e575e816e5faba43bb686ffa1b92e2991f9d1f470ccc5f70f9ac9ef9c97813e5f73d08bf9b213465deebf264d1", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740954, "uuid": "17f4d74a-9444-474a-b109-dcbce4e7986a", "value": "T165649E58BE9414F4DABBD63549972D6A727334720BD2DE9E035CB3E61F27360AF06A00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740954, "uuid": "3b336928-04e4-4f28-b5d8-c31c3d4e75dc", "value": "6144:e7shlPSdn55eHrjJh9gd+ZBL8xzEgOBo9UnQ7cPWa:C2o9OHrdWmL6O0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640740954, "uuid": "8275d54b-4146-4e51-943f-9f48ac16b403", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640740954, "uuid": "9cb772ae-97c0-4769-9a43-6e3b12bc2cb5", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740954, "uuid": "34f0fa7a-51aa-4301-9e88-1d7e41307e79", "value": "Attachments-2025.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0c21e9b-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640740906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740906, "uuid": "cf9cfb4c-cb5a-4b71-93c9-9d89a53fc077", "comment": "Malware payload", "value": "5fa27d84a10da3790c15568d699c501d", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740906, "uuid": "1a890bc0-f214-4d18-bcb7-429af5e0ce89", "comment": "Malware payload", "value": "e5f983750273d759bf4a93397403249bb4a710781e7a013933fbc308cec622de", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740906, "uuid": "f66224c5-75a3-4a45-99f6-05a032ccc8fc", "comment": "Malware payload", "value": "721e459da829993b3435a9d26996213ae0a10ae1", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740906, "uuid": "e6a510e9-6af1-4d83-a95a-8d4651848425", "comment": "Malware payload", "value": "11ef39fa6171eedf3a0df023145d6cd4517666ad688c3661a47a2187553b9493cb69723a0bfb97c7eef5ef9d7f11677e", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740906, "uuid": "ce342dfd-4846-4ec7-9e10-60b7f00834e4", "value": "T1B964AE58BE9414F4DABBD63549972D6A727335720BD2DE9E035CB3E21F27360AF06A00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740906, "uuid": "ea7189f0-d336-4571-8338-292f2de4e20b", "value": "6144:zlHc5qTjJh9gd+ZBLOHhEgOBo9UnQ7cPWa:5RTdWmLIZO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640740906, "uuid": "848ff748-827a-4439-9275-2ad191d0d21e", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640740906, "uuid": "6510d498-a795-4a3f-a71e-5e03f3fb5fb3", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740906, "uuid": "b4d2c672-5877-427c-8431-acae1d9185a3", "value": "Attachments-2036.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a781c330-687f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640765802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640765802, "uuid": "520f5eec-0860-4c5e-b4ed-72efab911694", "comment": "Malware payload", "value": "8c188184d5100c29ed99dab5968a834c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen Tongbu Networks Ltd.", "colour": "#0A3476", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640765802, "uuid": "0a1f8705-574c-4283-9a7d-da4405fa7914", "comment": "Malware payload", "value": "e6042f28df9d2c4a7f7adae1ad8ce6f6f44982e19db58463badb3a49d516eab4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen Tongbu Networks Ltd.", "colour": "#0A3476", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640765802, "uuid": "0bbf6634-0553-45b7-aeb2-9858d1f28d77", "comment": "Malware payload", "value": "3d0bb0cedd7d29c019cbaf24d86f16d94b2034e9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen Tongbu Networks Ltd.", "colour": "#0A3476", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640765802, "uuid": "46fe8509-089e-45df-9a24-c6316cf03c7d", "comment": "Malware payload", "value": "608a3ba6056d9b329b79d091bc0793235d41c9ac0ff3873e5f3fa92813591aa9dccd3745f038c5146eb11902c26879a0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen Tongbu Networks Ltd.", "colour": "#0A3476", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640765802, "uuid": "12fab250-9b4a-47e6-ab2c-cb5584f73572", "value": "T1026623632328114AD5D3CC398A37BED0B5F7036F9B01B87565DBB8C638220E5A727A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640765802, "uuid": "8c68397a-4b40-4058-aed4-6512ce224f0d", "value": "9bbb032372ada3487fe837556f01277d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640765802, "uuid": "c3d04336-c8ed-4598-b0fd-7bec48d30b45", "value": "98304:onUZaDcfmMWI7+RnSF02t0bymZBveQRKTT81iq9YaVDju0jA6xXW3VCMJ9:oU0D7M/+U+bymZQnTToiq7xfxXW3VCu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640765802, "uuid": "75fe46d3-a91b-474a-84de-4a71e68d83af", "value": 6533920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640765802, "uuid": "f1f479c7-ba25-49be-afb9-b55b899ac790", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640765802, "uuid": "81275e3a-2f9d-4224-8105-e7b6bb885471", "value": "navlu.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4570caa1-68f4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640815888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640815888, "uuid": "ec0ca44f-c004-43c2-b37b-186cdec6977c", "comment": "Malware payload", "value": "dd76fb615518bfc30d3a16e382b786f9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640815888, "uuid": "75e331b4-33b6-4147-a0cf-3de9315cb2f2", "comment": "Malware payload", "value": "e6d4e1eb605c72fb6aa865b7c7a7d31b2e0f2e40a50c883354b7439f2c674df6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640815888, "uuid": "0deda1e4-5d04-4040-bf1e-de58426ca9be", "comment": "Malware payload", "value": "1f9e178acc1835aba78903225ab27f390d320af7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640815888, "uuid": "75ae05ce-e2b6-4c93-8661-1a35324d886a", "comment": "Malware payload", "value": "99537809097a594f866c8ebe9401c0ef70a0086cbf468ef8405d3aead3a8c0f97bee0aa4fbd07984edfdbf13338bbdde", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640815888, "uuid": "b91d6ff5-2a05-41ae-abe4-34842ccdf747", "value": "T13EF44B06E1A752F1F073C576CA7406AB72393C5813B0D4F7237536268BB31D0A66AB9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640815888, "uuid": "b58c980f-199a-41b8-9bb4-38b2268f3f1a", "value": "b042b71cedee84c48715395a9bb0daab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640815888, "uuid": "1c71f999-01fd-405d-966d-6c7145d7e1bd", "value": "12288:9L2dkQ8j8hNSkFf7erQXJCEIrani5QE1VCUGAPUC12Evm9G/uE0qkwhpKqnVw:97j8rSCf7elsCxvm9mBhpK+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640815888, "uuid": "a8da43f1-1371-48ba-80bc-aeec48fabb13", "value": 724568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640815888, "uuid": "d01a2cfb-9ec8-4f10-a8fe-89f59977399d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640815888, "uuid": "2e2110d1-3d71-490f-95e6-ec40ba87b294", "value": "e6d4e1eb605c72fb6aa865b7c7a7d31b2e0f2e40a50c883354b7439f2c674df6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91c582a0-686d-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640758034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640758034, "uuid": "39918a42-fb54-46ae-94b6-80be6c3326bc", "comment": "Malware payload (Mirai)", "value": "c8322099dd7ee469c42c6518d08ddc77", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640758034, "uuid": "5460299f-1433-423e-9b36-4e25f7717efa", "comment": "Malware payload (Mirai)", "value": "e83240378edda701d1c6d3ca368c3ac2f945502f7b84092b6c1146b28cd36eda", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640758034, "uuid": "04ce577c-0be9-450b-8733-8452ea677637", "comment": "Malware payload (Mirai)", "value": "f3b76d11ddec8720774b61d7bf246fa72cd1f5cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640758034, "uuid": "942463ee-5d88-4912-ac53-767f6687f75b", "comment": "Malware payload (Mirai)", "value": "055dd83dd2aaa70b9c885cf5edf1b18ebe00bfc18181461e7462de1b33686373f158cc5fe3f2c190f8819a1811429312", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640758034, "uuid": "8f97ea02-60c9-4e8a-a009-2c88d5971add", "value": "T11C634C42322C0E47D4A65DB4293F17E083BFED5024F4B6891A4FEB5A8636E771186F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640758034, "uuid": "bb21b11a-86be-4f4d-bca6-c825053127f2", "value": "1536:MMaNJEA8hE91Vr5jkOBGQpbh00gkxImca7:0JIhE0Qpb+kxIU7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640758034, "uuid": "e6bc5335-6a52-4045-b39b-79f387d23c9d", "value": 70928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640758034, "uuid": "1428d7d3-c406-4915-80e0-77bf5ee63c1b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640758034, "uuid": "1e5fb084-b23d-4d74-89c4-145d1e2305d2", "value": "c8322099dd7ee469c42c6518d08ddc77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a3b77a1-68a1-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1640780141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640780141, "uuid": "c7d9ad29-3e54-43b4-87c6-25f2d3948b2a", "comment": "Malware payload (RedLineStealer)", "value": "b1cdaad6af18382fefea5e554666eb1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640780141, "uuid": "cec190ca-73aa-42ec-b61b-c4bd262160d0", "comment": "Malware payload (RedLineStealer)", "value": "e833a4e60afdb1923d7ef837e8333218f82c08bb5de60a3e565c95e5f6c61f2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640780141, "uuid": "7e78eb5c-f37a-4315-8f1e-ea83a9bbb54f", "comment": "Malware payload (RedLineStealer)", "value": "28a5e765c223c582850d42a4a5222395a70033df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640780141, "uuid": "669bf614-212f-4777-9415-e3e78f6eef53", "comment": "Malware payload (RedLineStealer)", "value": "c1305a9abbc050c38005666065d41928a9133b246d9a944736e221fd2a053747c826b81d496995bec8f41d02d1fdaff2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640780141, "uuid": "17c66139-eaf9-4764-95c6-5aee55f78a62", "value": "T160F53351837D247DCE4B13B87A44AE006D4B432614CF84ABDA2FCE25FB7F46ACB69446", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640780141, "uuid": "b9e0ee18-771f-4a30-84c6-b9714c27bf7a", "value": "c284fa365c4442728ac859c0f9ed4dc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640780141, "uuid": "06dbbb73-9ca1-4301-9518-3aed7522ad62", "value": "98304:js/8KAzm5KUr+R8yyZnFtGWV4wY9yKK/sMn:jsHA9USuyyZnHGWaxPK/sa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640780141, "uuid": "2208f9c4-5a6d-45f2-b8e3-fa160885b02b", "value": 3582976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640780141, "uuid": "51bf1d30-ec4e-4e8b-be7f-408c2b43ed40", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640780141, "uuid": "6a3b3a40-4960-4866-ae6f-8f3d6ce92284", "value": "b1cdaad6af18382fefea5e554666eb1c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8cd481f-68ca-11ec-9275-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1640798070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640798070, "uuid": "aa54d966-48fa-4874-8a93-f7a69478b79b", "comment": "Malware payload (Vjw0rm)", "value": "07e92aeca1fc47c58589ba6ea8d0bbb8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640798070, "uuid": "ff1019ff-8a8b-48a1-b3f3-618737bc27df", "comment": "Malware payload (Vjw0rm)", "value": "e83d9228e3dbcc078c9b8ffc9dde4ae2d20c75500bb99262050ad5ac773986c1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640798070, "uuid": "de85c09f-2840-4afb-ba1c-200f849d9cfe", "comment": "Malware payload (Vjw0rm)", "value": "4f133e5a32a04d2b815bbca2eb27790cf5b1e167", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640798070, "uuid": "7f450abf-6c31-4877-b3bb-ed160b95c09f", "comment": "Malware payload (Vjw0rm)", "value": "f807b346d5aff40bae9200bf4c38d4d74dd8266f8f0b78c86154d1513e505d64c2b4aefaf3c39639d3bc3a9598515991", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640798070, "uuid": "f77b6821-bf96-418e-b9cf-c4fdd91d84a2", "value": "T1F024F69C6891E0EDE922A07136BA2CC923E4630FE44497CCB55DB3055FB6750C7DEAB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640798070, "uuid": "c64f5b05-0bb4-44fe-884b-5dde7cb9ef8d", "value": "1536:eN9aEjj8iHl3Zhe4eE0DvfUvsgoxn2i+eEiiSng5/713GvN2Hy0nhcN/7D9qliFI:eN9aCCe08sgpuC3pHA651", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640798070, "uuid": "f3d2e5a0-eec8-4a97-af4b-d6139d4dabbf", "value": 213932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640798070, "uuid": "8e7d59a1-d6d4-4f06-babf-c8eb9a5ab162", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640798070, "uuid": "2fd1d4c3-f888-45ec-9126-2734b45534fc", "value": "receipt_ups.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17524bbd-6846-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640741078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741078, "uuid": "d93c5d2b-e819-4d1d-a0b7-f467745f4c4a", "comment": "Malware payload", "value": "2e1c10dc5044e69f3eb734e5b46373cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741078, "uuid": "4adfcfd4-8077-4b10-96d4-e9d0ed396f2d", "comment": "Malware payload", "value": "eb924f1875af3aa40d136b55d2698cde7822fcb226b26b71e8eb1e781456f99b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741078, "uuid": "5daceb08-a381-445e-b590-8364de1fadec", "comment": "Malware payload", "value": "e739f7c56d4984b36dd43c73673eb2151816a276", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640741078, "uuid": "db4cbde1-e488-490e-baea-5a110ff807d8", "comment": "Malware payload", "value": "2530e0bb762deb62774d324c65bf19ec14c2cc399b303f7de56fe8e0b8163808a84adbc572c9b6c6d2fa785caa39ef06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741078, "uuid": "56f8adc2-e05f-41a1-b905-053e31e1700c", "value": "T1D444AE58FE9414F4DABBD63589972D6A727335724B83DE9E0358B3E21F27361AF06800", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741078, "uuid": "76fa9549-0e37-40f7-9ade-5b5d125e5af7", "value": "d4755b9a9aec93c05c955ca11140bdc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741078, "uuid": "93510d0e-8e1f-4aa9-bf6a-1b43df2efafe", "value": "6144:tj236RQojJh9gd+ZBLEEgOBo9UnQ7cPWa:VgodWmLMO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640741078, "uuid": "c80b2126-31f8-4a2e-b2c3-ca682c3dba3c", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640741078, "uuid": "937262e6-2f2f-4354-93fc-ec639d7ea235", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640741078, "uuid": "61096028-2299-450d-9967-d09dab373b2c", "value": "macosx.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "956db6a5-686d-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640758040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640758040, "uuid": "2b46740a-e3ae-4198-a90c-eddffb4b721d", "comment": "Malware payload (Mirai)", "value": "c9220724ca1a159435ef6151bc45988d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640758040, "uuid": "8cdcecdd-ee15-431e-9da2-07b709e4e126", "comment": "Malware payload (Mirai)", "value": "ed4864748b4e2cf71f56429476977e133d22f07a2854797dc35ee069263bfe36", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640758040, "uuid": "96bdac1b-3d98-41d6-ab2c-0ed79888949f", "comment": "Malware payload (Mirai)", "value": "2e73657c9860621b942bec6d65c7de8e1c0a544e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640758040, "uuid": "1f96f4ac-c309-4c5f-9c8a-07ebbdaebc4e", "comment": "Malware payload (Mirai)", "value": "f057df180c8d61a3cbcbc994fe798b71be676adf2255ca69eb2f9bb67a301ac5cff3b7a8e7565baf86425ed281a35cd4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640758040, "uuid": "8442c7e9-f99e-4f39-a23c-b9af31ea2f66", "value": "T195830896B8818E16C5D423BBFA2D018D331267B8E3DFB2179D106F242B8A92F0E77555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640758040, "uuid": "ddaf7245-27f8-4b4b-af4d-196fdc9d821f", "value": "1536:fonHbbllpoo6Dn5adcLMXvSSZVg8PDgLwHglUW99SZaRIgfEQcUIiiZ1TcoHGWX7:+blMo4n5u6vSZVzPTAEZoIb1QoHGWX7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640758040, "uuid": "6647098b-8088-41fa-8c19-8cdf626de19d", "value": 83424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640758040, "uuid": "c4ebb7a5-0aba-43a5-a565-b05419947246", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640758040, "uuid": "b9136e3f-1f16-4b06-be9e-293b158244f6", "value": "c9220724ca1a159435ef6151bc45988d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd1124a8-68c4-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1640795473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640795473, "uuid": "a7623bb9-dfaa-4196-a2d8-03a91f32f5d8", "comment": "Malware payload (RedLineStealer)", "value": "520e90300c99de08645a714f6bde9fcf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640795473, "uuid": "953966b2-e51a-4cef-8c6a-a2632338c0b0", "comment": "Malware payload (RedLineStealer)", "value": "ee23f4d44cf618e05d480cb1dc2c7db45a64e1d9bad45d98412b6981e576d661", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640795473, "uuid": "0473fde6-0e55-4622-a5fa-fb42448e5007", "comment": "Malware payload (RedLineStealer)", "value": "71bc9f1dda1481f9f769781050ec34d49c1631e0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640795473, "uuid": "ebdf10e0-0846-4f71-8c88-e7d47fb07c8d", "comment": "Malware payload (RedLineStealer)", "value": "71ff90f0ff7af74b7f5fcc2e32ee04d32cb03c13833379dd10c52d489b07f1b0f468fe0410d55210711d2dd8fd07bfcc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640795473, "uuid": "18497bbc-e02c-4a42-b29b-e7e9b23779de", "value": "T1D484F1DDB5F2F472C19634718825CB917A7BB822DA70609B337D276F5FB02C14A26316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640795473, "uuid": "96ef281a-699c-41aa-a2f1-df80e7c4da99", "value": "bdd8adae7e6277cccc5ebfa6ad074be5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640795473, "uuid": "40eb768a-8840-4af7-9f1a-682acae4262a", "value": "6144:ZpLl5oRwbXFY9IwfcTJHF0pFW/5fnOCixB/tJ2l7ITsq:Zpx5oRyX5wUNHF0iR6x/J2l7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640795473, "uuid": "271ee320-80e3-4d72-becc-f64a7a4e2db4", "value": 407552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640795473, "uuid": "d3be5eca-d7ba-4bb4-9092-5679b121630d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640795473, "uuid": "8f3860b1-8e76-4050-a414-c248a16632d9", "value": "520e90300c99de08645a714f6bde9fcf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92b57e8a-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640740856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740856, "uuid": "f9f7f1b2-048e-4ffe-99be-9a313d792e26", "comment": "Malware payload", "value": "c77d5dfff963185382a8a9fa41593252", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740856, "uuid": "626215fb-b523-4ee1-97aa-6efedf255568", "comment": "Malware payload", "value": "ef3f64f853d666c68956f33778990c208976db8ff9bcdec9bef1f0b8224ba106", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740856, "uuid": "4839523e-40ff-4223-b80f-9de4f66013cb", "comment": "Malware payload", "value": "a20f5c93ad2618477ce90cab7498b1d60c1a9b42", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740856, "uuid": "e5534eae-2df3-48ce-b7c0-cf587027cd0e", "comment": "Malware payload", "value": "ebf09c23586755f1381db445d1266a51e8b078edcd8beaad6b99941ba98d175f721af498a5556e3242bf952b8f447d72", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740856, "uuid": "503ad6a7-f00e-4c2d-97d4-6baa126b5e59", "value": "T1DE64AE58BE9414F4DABBD63549972D6A727335320BD3DE9E035CA3E61F27360AF06A00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740856, "uuid": "1f15711e-752e-4eca-a164-8fd89c0c7ebf", "value": "6144:7ooRvkhhg5D5jJh9gd+ZBLDEgOBo9UnQ7cPWa:7bGh+5dWmLvO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640740856, "uuid": "e33896e2-a035-4d7f-9bf0-7875af3bc127", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640740856, "uuid": "dc186d06-1a56-492c-b038-c4f7a4c6b700", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740856, "uuid": "7f712500-0f9a-4520-9765-846ebbf51675", "value": "Attachments-2006.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "124434eb-68cb-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1640798193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640798193, "uuid": "7cf621be-a092-48ca-bdf3-44e2faf42065", "comment": "Malware payload (AgentTesla)", "value": "c6b02dccf00243a1ae99b268e1dacafd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640798193, "uuid": "6b95e538-4093-4840-af09-731aae715e42", "comment": "Malware payload (AgentTesla)", "value": "f0ac815c0b23cbad93105a1b2dbd70bef5eab7af3a9e8a69e0d955860d145c35", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640798193, "uuid": "f9ff1cce-6853-4238-89c5-7425e886570b", "comment": "Malware payload (AgentTesla)", "value": "27893ec4a2d26ddb6f86dce549f42ba77c1192b6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640798193, "uuid": "2512f2ee-61ee-4a6f-a111-c0ff1e6513f8", "comment": "Malware payload (AgentTesla)", "value": "dfda62f804307e73d79e94756598f372db6537be70c2f9712540be0be316f4129ac9e00e46e6c3c755ea4b91d065e4f3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640798193, "uuid": "a0c89f8e-7eec-484e-9ba4-652bb2e5e5dc", "value": "T1CD9412097ED6572AC1FB1BF9782272345732322A5D21E38D5CD849FE2472F405A52FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640798193, "uuid": "59af0d30-4b5e-4814-ae7c-dde349d5afdb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640798193, "uuid": "06379536-ea87-4b73-908e-6f348270d16a", "value": "6144:xUVQLpxXs3NXc8LyjKLy8EegBYmbeGrz8qoFqSKe4pMSrGqEiUUiUc87Fvxo7kcc:a+pxe5yEy8EegBNrz8RqlJpMiUWp/Ic", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640798193, "uuid": "958903a0-4299-411e-842f-5edc9fb620b4", "value": 434176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640798193, "uuid": "84f97fad-5827-4190-b77d-06992bbefd1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640798193, "uuid": "9b0962f6-33a0-448e-8ef7-04e7f6febc50", "value": "DHL Shipment WaybillDoc_TransportLabel_PRG211001715606.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3aa2081-687b-11ec-9275-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1640764158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640764158, "uuid": "08e3a681-1ef0-4ae5-88eb-f35127442511", "comment": "Malware payload (Vjw0rm)", "value": "b73f3e184d87dbd7061d42ece00b0a56", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640764158, "uuid": "2d4bb144-8a0a-4143-a2d7-5bdee361f950", "comment": "Malware payload (Vjw0rm)", "value": "f1e3700b61aeaaffdb5d80c5a8d7bc0f2d19b55ab758f0cdcdc4d05388638960", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640764158, "uuid": "652ced92-f8dc-4be1-b37e-f163144288ab", "comment": "Malware payload (Vjw0rm)", "value": "bf9db43bbb8d4d56068d3955270c229b3e74047d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640764158, "uuid": "849b4cf3-d845-4ed3-806a-5dd8eb014e8d", "comment": "Malware payload (Vjw0rm)", "value": "0b8cbfdd98250536f505b9a6483cb0d3dc86e578b0bc3930ed0d5934fe33b783fdddd11000483a194aa79b9c2d3d3d23", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640764158, "uuid": "fa07fe6a-d5a1-4968-a9f2-59205358c949", "value": "T1D581109C2C5BC63C57D27B8A802ED148CDF548B47F28D2B5148CDAC5360E97987B29BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640764158, "uuid": "ecd23f1c-3971-4996-97d0-17795d22c83a", "value": "96:SABNo5DRk2c24ZRMHXE6/BIk+Ys+fJpWDdQqR7bJyKhHIOS4UK:zSa2c24ZRMlBIfYs+fJp0fRfNp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640764158, "uuid": "f2b44f4d-460f-4eb1-8d95-85ad305ea1e8", "value": 3884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640764158, "uuid": "ff4af253-dfbb-4fe1-978d-91a4fc5fbc39", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640764158, "uuid": "1f2686d9-b968-48e3-b4be-5c29dc0444c6", "value": "SCAAAA3099.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64dfa95d-68ba-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1640791030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640791030, "uuid": "991bc4a9-84b3-4bd8-9c78-74c5a0db1241", "comment": "Malware payload (Formbook)", "value": "857037f2a3a69697f6343c44ae4da41a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640791030, "uuid": "46dd0128-5e6a-46dd-bfd7-996c5ef0d2c6", "comment": "Malware payload (Formbook)", "value": "f306c809d900329d4f788b9ecf6c1771a6cdfdcaf549d257fc7187955a8a610c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640791030, "uuid": "03193dbe-ad57-4fe6-980f-78e8680518aa", "comment": "Malware payload (Formbook)", "value": "19b314073cd3759bd03fa55496c4edce608e0480", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640791030, "uuid": "5b25ed27-89d1-4a20-b475-be9b5048289f", "comment": "Malware payload (Formbook)", "value": "79104b526b23326783c77a819abb76016b797d5f59c8eae4e7291914d3196e1fe6aa72fafaeaed099601b311b5877a0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640791030, "uuid": "dd163b90-cec7-41b7-b0a2-627c26cdd51b", "value": "T1B4841340636E073BD4FF9BBA507632302731B23A6C2AE34E1DE665798277B504561FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640791030, "uuid": "f9118ad6-c3b9-4fef-a30e-43fbcceca262", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640791030, "uuid": "5cc49f15-fa78-40d4-bb44-6158270b3e56", "value": "6144:SbUiY999NmlLYXQlUC9UHLeXLu/PdkvGZS28C4fWBs2Z2/HYDmX7l++fPcfAhcF:ee9NhXQSCaHbcD28C4fW5Z2/WmV0fAhc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640791030, "uuid": "a92cc9ee-771d-4bcc-a999-ecfeacc943c4", "value": 387072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640791030, "uuid": "e76824e4-a802-40c5-8e9c-43ddf8404825", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640791030, "uuid": "23bcce8e-4534-428b-8863-d25b896007ba", "value": "Quote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a728a21-68c8-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1640796999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640796999, "uuid": "062cd6f9-c44a-421a-b353-40557ca91aab", "comment": "Malware payload (AgentTesla)", "value": "d0877ef4b5908823646e1a8b6bdb7f4c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640796999, "uuid": "3066d658-f64e-4974-87e2-30d316ea6047", "comment": "Malware payload (AgentTesla)", "value": "f3ae2154605617fcd422bcdbd1ddec14af0e90fb12d5dc113260e78bbfcdad4c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640796999, "uuid": "d4ddc21d-1f16-4d17-8736-f0c47f565757", "comment": "Malware payload (AgentTesla)", "value": "c9850ebddf0b3a15b6f0559522872a439d583c56", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640796999, "uuid": "db055cc2-d1a8-4528-a382-9c215e9ce8d5", "comment": "Malware payload (AgentTesla)", "value": "172f7934cd947dbaa7159939a748e98c296e2bdbfe45bb3fb219692e276d7786030a618702c1507bf3caf995dee1f78c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640796999, "uuid": "a0392017-5019-4734-a6b3-6e7af95036b9", "value": "T160C48DAC3250B9DFC857CD76C9685C64AA50387A831BD203A06326ED9E1DADBCF145F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640796999, "uuid": "be678aff-8f06-4842-a2ce-809cc7bd7f51", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640796999, "uuid": "2768e514-4390-43c5-bcf4-2117829945f0", "value": "12288:aIhLnymTp9N5wUH0RMADPvb0M+E4RhGl3cFO+YpRODY8dZSL:V/l9XwA0RMA8p83cF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640796999, "uuid": "f9d0ae86-557c-4044-a46e-e9e5582c603c", "value": 547328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640796999, "uuid": "02785510-f3e2-4602-a1fc-e299579272c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640796999, "uuid": "4f0cad66-ab0f-4317-a638-76595a52d51f", "value": "Purchase_order_scan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37f32495-6876-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1640761749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640761749, "uuid": "26debe46-56bc-4d9d-9825-dfa330eb0402", "comment": "Malware payload (RedLineStealer)", "value": "1a8620af98d68f9cadb5916341ad1e71", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640761749, "uuid": "fddcea90-bc99-4d69-b4f6-380fa43267d2", "comment": "Malware payload (RedLineStealer)", "value": "f593cd3e0a4ad34d16b48b9cdd344e486b42fbfc5bca0c25abb75b6cc03ac2d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640761749, "uuid": "bc11fe70-a19d-4d6d-adbf-d6c8f1137269", "comment": "Malware payload (RedLineStealer)", "value": "1a39e1f41e89d552bd1228f7dd79e553a8dbb22e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640761749, "uuid": "14cdf708-aede-4d3b-ac0a-8e6b23b55951", "comment": "Malware payload (RedLineStealer)", "value": "e64eca8d5e663a4b8a2bf2303d90e6279a87334e87fae0c70faa5fc402927f94ee65f4840ac6bb88879dafb80686e095", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640761749, "uuid": "d08d5f3c-44c3-414a-8504-e8f4c8d03eed", "value": "T1A1B31A6437D88604E5BE4BB5BCF1559843F0F1436601EB9F5EC560FD1EB1B80A922AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640761749, "uuid": "d58694a4-4b08-49c8-b208-71d308e596b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640761749, "uuid": "4efac7cb-f02b-463e-b25a-e1281620a996", "value": "1536:9UVr85RhYuBGHDp8j468w4d8WD7u7HXhbYpfwxBRFovsSw00IniD:9UVwfUHD2868tiW0JX5BFsiD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640761749, "uuid": "31f23e2f-e58e-4310-bcb0-7ea4db6b9ace", "value": 115712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640761749, "uuid": "5a15d08e-fb3f-4d4a-b161-b9ea148c2560", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640761749, "uuid": "622c2390-35ea-421e-a59a-5c63a188f567", "value": "1a8620af98d68f9cadb5916341ad1e71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "831bbd50-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640740830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740830, "uuid": "d1299f87-7ba4-416f-ae3e-aa2d7062d6c1", "comment": "Malware payload", "value": "a11e14ee657005c7d98d2987d187d1dc", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740830, "uuid": "35b19548-8f16-445f-9d9b-8fed39513298", "comment": "Malware payload", "value": "f5e9757fd9a12446cbb43a58ec8dc9749b43e7e43e4bb83408ea4855b8d2138d", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740830, "uuid": "88b6cb30-3631-4f1b-bb98-d5f36e6ebca1", "comment": "Malware payload", "value": "7c4bc2bbf8d90ee7c876b4ec0d082ed71048b20e", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740830, "uuid": "c1e5894c-6250-4228-8b75-dbf1f6d7f04d", "comment": "Malware payload", "value": "34ebecd95fbed629d9ea1e5ef1590684a7c69f14e558b31835ff53b69e65fcbcd4eaea0fd55bf3459b08a5f4c4f34fc0", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740830, "uuid": "2e3593f3-04f2-4dc7-8e0c-56424f2b2d4f", "value": "T196649E58BE9414F4DABBD63549972D6A727335720BD2DE9E035CB3E21F27360AF06A00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740830, "uuid": "faa067ec-43f6-4ebd-aa9a-e363eecefe9e", "value": "6144:JBti99SVZVwjJh9gd+ZBLZlEgOBo9UnQ7cPWa:ftiywdWmLHO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640740830, "uuid": "f05d109c-0fc8-4f8e-9695-84f98dfa66c6", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640740830, "uuid": "dd586473-f4cd-496f-b392-c8af126dec9a", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740830, "uuid": "5deb56b3-c46a-4457-ac4e-3dc6dd1a0257", "value": "Attachments-2041.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb2e2745-687d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640764976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640764976, "uuid": "d8eecc56-6036-4e22-9535-852e4f45dc29", "comment": "Malware payload", "value": "fefbf3a6998a24ce1d180ed9f4ba88ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen Tongbu Networks Ltd.", "colour": "#0A3476", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640764976, "uuid": "8a6ab745-0c4d-4dc0-9a20-533377938ec2", "comment": "Malware payload", "value": "f5ec089660ff7654e490f777f1474de95854b471cd7b5820c3325b4f611fc6dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen Tongbu Networks Ltd.", "colour": "#0A3476", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640764976, "uuid": "2444b810-d4e8-430d-af84-d34556084161", "comment": "Malware payload", "value": "bd0c5bdb67446ca6d927b6f34f71336a5edb1977", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen Tongbu Networks Ltd.", "colour": "#0A3476", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640764976, "uuid": "d5ae9c13-ba30-4547-b996-04e8cda58eeb", "comment": "Malware payload", "value": "3d5f9900fbfd3eb1aac521c9386cd4b24d88f4c816a780b1ff718a95eac3e789077c1ea11b17b122a5a19da1e2b6ba19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen Tongbu Networks Ltd.", "colour": "#0A3476", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640764976, "uuid": "9148503c-7099-4d48-aa10-541ba37aa1ec", "value": "T1B0762322E1508877C27327FCAD9793A568277D203F54984E9AF43D4C8F366A23D3619B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640764976, "uuid": "f121b192-fd7b-4692-a369-3e186243a2f8", "value": "e145b55a33c2b3451d71d2d800c997c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640764976, "uuid": "17a888e9-bf3f-433c-b804-1ed2e2310170", "value": "196608:bgrOn7FE6icOcKTQWwR9CtmwRgWn7v/IZ:bgt7c+twTnAgYS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640764976, "uuid": "cbf1df4a-a9da-4daa-9e75-43ab7aaa0e54", "value": 7502312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640764976, "uuid": "d8382125-607d-479b-a91f-1d524a1468ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640764976, "uuid": "98f96072-b731-43e1-a4bd-861edcc2a7e6", "value": "nex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec8872b0-6882-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640767206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640767206, "uuid": "7b557291-d321-4f16-aa91-ba6345108c4a", "comment": "Malware payload (Mirai)", "value": "1da2e24daa953659a4a70b88cd963ce9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640767206, "uuid": "aa039188-8925-400d-9fcd-77bf5d4f8faf", "comment": "Malware payload (Mirai)", "value": "f75df3aa8d37443cb0c2af04782fe8fab625e7615a938a2dc02f0f226203ec2d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640767206, "uuid": "bf3225a5-9d39-454f-8f24-c13efc261cda", "comment": "Malware payload (Mirai)", "value": "b642907f6ca505b0aba1ff72954bb25b4bae7836", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640767206, "uuid": "416f27f0-c1df-474f-8cbc-94150d493e78", "comment": "Malware payload (Mirai)", "value": "bde2288af61281cbc5584d3ef52d742f5747f5b667dfe02b724b74f0dd3ceb89a7417cf32d7b5e35079cf760a0406f8a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640767206, "uuid": "bc8c8f7e-b41e-4508-a012-2d0e9620b22b", "value": "T18EE34B46EA818F13C4D5177AB9AF02893332A75493DB730699186FB43FC6B6F0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640767206, "uuid": "c469fbfa-53a0-4c95-933d-4b2e78c28343", "value": "3072:KJg95AVjN/8cCy9G5ejG6Ln9gMTDhiMjNNmTtLXD50CzbSLOfM/9i8Lxh:KJg95AVjN/8cNG5eC6LBnJNmTtLXN0EY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640767206, "uuid": "21d420e3-2149-46c5-be6f-538f9f27ba0a", "value": 146275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640767206, "uuid": "ddf8391a-80e2-483d-8313-17e39f719644", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640767206, "uuid": "b2148742-1f76-4d7a-9819-3bbcb3e0c701", "value": "1da2e24daa953659a4a70b88cd963ce9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbc37115-68ca-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1640798155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640798155, "uuid": "6ddfa3ba-e372-4616-b91e-6707f49b6cae", "comment": "Malware payload (NanoCore)", "value": "615b715b4706bd3c3bbdb65d068ce828", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640798155, "uuid": "30ce7404-308c-4c07-a203-b21724c6dd48", "comment": "Malware payload (NanoCore)", "value": "f7a6f38018e13e40ce1c3ce3bc19b049d964919c4f883cc65c75643b209e8b99", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640798155, "uuid": "c6467102-8f19-4297-973d-b6a90db310b6", "comment": "Malware payload (NanoCore)", "value": "4d520042ce36bb0163cf00949227c5c0e31723cb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640798155, "uuid": "241204ff-4499-49e9-87d0-4d812f2193f6", "comment": "Malware payload (NanoCore)", "value": "2da7bd1ea88293034ac66861473a4cd798b9a02d644dfb22931944b0998f35cb9d62a57d44e53ca8d9abe13581210abd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640798155, "uuid": "03d4c775-fce3-47a2-8e8a-dce864d12b82", "value": "T13731CD42960D8F55962A72DD27D4F845D5E68F75351D3D1474CC0AC09355F6C12902A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640798155, "uuid": "55534f49-0c98-4f1b-9c60-403e5154a860", "value": "6:6bJ1CFKNTssgoTy3ia3/xii3wNBNuuyAX1rpX4gj/jGNVNBppX4+OTouvn:c1DssgoTy3iaPxn3wNBNP51igd+OTo4n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640798155, "uuid": "de162d0e-3d47-4957-9d66-5cec2d8ea195", "value": 1639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640798155, "uuid": "9709d842-4a15-4a22-9fce-649f2daac2d1", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640798155, "uuid": "93cf40da-1609-45c4-9566-93e4fbd4f6ac", "value": "Interac-copy.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "970deb46-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640740863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740863, "uuid": "a12e2135-23c6-4d43-b29e-fafb96cda010", "comment": "Malware payload", "value": "c522c6d57ea4523f11ca189a92d216c9", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740863, "uuid": "f229ef30-b7e5-4c98-82d0-80f2e1d51e89", "comment": "Malware payload", "value": "f87a87d940498c1e757773c74257f2b2c20fc195c1b207508fb8aa939742c680", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740863, "uuid": "8f475eb2-71fd-4e66-81b3-e3d12069778d", "comment": "Malware payload", "value": "2870ec956e3e8470aeafa722f5252dbbcbc4272c", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740863, "uuid": "91344b06-23bd-4f7d-88dd-36a6d45d7e05", "comment": "Malware payload", "value": "f7f56e18de6fb858620aefe775b5534574ce6144bcbb4d753523a1348b81951eab9daffe20e7f86b3e742c8b50288b76", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740863, "uuid": "0274eb2a-a8f0-4f90-b85c-991664edecb1", "value": "T19964AE58BE9414F4DABBD63549972D6A727334720BD2DE9E035CB3E21F27361AF06A00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740863, "uuid": "54aad5d9-6f15-4f30-9ff4-7a5c8d0be03a", "value": "6144:9Dfe555DkjJh9gd+ZBLOEgOBo9UnQ7cPWa:kFkdWmLaO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640740863, "uuid": "0accd01e-89ca-47e8-96fc-c87b84a8fa52", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640740863, "uuid": "be9f2bbf-ae6c-4f2a-9b75-50027c6d7b1a", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740863, "uuid": "923073c5-8847-45b6-9a4e-98a888b0fd90", "value": "Attachments-2005.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44815136-68c8-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1640796989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640796989, "uuid": "a732a0f5-9d1c-460d-8047-d4e9038c0d37", "comment": "Malware payload (AgentTesla)", "value": "d64b27ea87b056f7c4894f6c7a00b053", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640796989, "uuid": "65c0a36e-461b-4b23-87e2-a6b37cc566b2", "comment": "Malware payload (AgentTesla)", "value": "fa1102ea243ae971a32ef42c89fe217b5e4a06d2a1e6e518ba2c6ed7f2285df5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640796989, "uuid": "050afa95-ad02-4517-b3b1-6ab9c0d28775", "comment": "Malware payload (AgentTesla)", "value": "77808a1537bf1eba379cae00014d73c05a290049", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640796989, "uuid": "3c1fb738-2da3-4ef4-9da6-8a071aedfa1e", "comment": "Malware payload (AgentTesla)", "value": "e500c72b12625671ab951c6a641e2790ae9fbfb3f129a39df576676b5726ce069dd103874da5d7a161a4c5f5b73fc7ce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640796989, "uuid": "229afd20-48e9-42da-9996-02ea9f3dce4e", "value": "T1ABA4232C165A55E193639F4ED175C5DC53143FFCE8132022F6C241B42E82AE897BEBDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640796989, "uuid": "706b1abb-fb80-44c8-a9b7-e7465c781794", "value": "12288:fmW8ymTh9d5wyHkRMMDPv70M+M4RNGK2uP:1gF9Hw+kRMMcZx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640796989, "uuid": "dfb7b4bb-e0c8-42af-8919-713f672da124", "value": 459609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640796989, "uuid": "adf38599-c24f-4c91-ab42-89004e3bccb5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640796989, "uuid": "326f24da-0335-4465-97e7-cad630d0be5b", "value": "Purchase_order_scan.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9e2caa3-68ec-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640812701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640812701, "uuid": "d634470c-1190-48ee-b84d-86b27658d767", "comment": "Malware payload", "value": "a1d9d2b9440b1a33370302895edbf43b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640812701, "uuid": "22f23b78-33d5-4df4-8578-3f8031b016e3", "comment": "Malware payload", "value": "fb8acf77891e1897c9dcab222d5a9424e1fd4eb0273e0def4e2872bd870c9901", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640812701, "uuid": "9007b3e9-efb3-44ba-a985-2a30d323dfa6", "comment": "Malware payload", "value": "fce98aa07b88962d4768679b6dcc229e9df42233", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640812701, "uuid": "d592cc7e-0355-4002-8167-43a8a8b387fe", "comment": "Malware payload", "value": "7e7aaef4b752625275803bd787fd39d6c00cb70a1d6e725993c269adad531f65c653d50610a18917418020bf46b673cd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640812701, "uuid": "bc249055-970d-4026-9be7-8fdf5aaea4e2", "value": "T1BF54CE3E005539A3DE1BE5FEF3562637FE68B3F25836F01B9666CE80D211091A8581DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640812701, "uuid": "c3e730fa-da20-4ebc-92c5-ed7b1248725f", "value": "dc25ee78e2ef4d36faa0badf1e7461c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640812701, "uuid": "fb36b979-352e-465d-ac17-46a81aec9b55", "value": "6144:0RM7UyLqQrVmwZWIfByVxH9bhd99q5EKWtOQDxw:0KQEqoVmwlZy/99lNw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640812701, "uuid": "e38cb564-f89c-4691-8b2a-73caceb3b392", "value": 284672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640812701, "uuid": "1f07cec0-aaae-48ed-b472-843487252cc0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640812701, "uuid": "3d4a7bdf-ad7a-457f-861e-bde619ab51f7", "value": "a1d9d2b9440b1a33370302895edbf43b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf9d3e3a-6845-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640740958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740958, "uuid": "490fa3a7-53a4-4ab9-94c1-fe13f8db7bcf", "comment": "Malware payload", "value": "d10dc64b7a979ad56e44c20925e25afc", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740958, "uuid": "74da41c0-8328-4de4-861e-15fe743848b3", "comment": "Malware payload", "value": "fba496aebf9c25b8ae814814897d985d38f6c00a6fe298b82b7b3be9f0b6d309", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740958, "uuid": "3181a113-29bc-4726-9736-5b76d253af05", "comment": "Malware payload", "value": "97f0ce4ea3850e184d33904e72c5412bc2f5fe05", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640740958, "uuid": "3321bdf4-f528-4bc2-b758-515315795f8d", "comment": "Malware payload", "value": "8c6f75870e5b9659cd18907e4b1130ffcfa890c2f598a9320dc1b65ec7eb68c13af4aeb1438bf8cc832e4cfc338835dd", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740958, "uuid": "3019b7ed-e330-430d-95e9-07ad71ab0c19", "value": "T1DA64AE58BE9414F4DABBD63589972D6A727335320BD2DE9E135CB3E21F27360AF06900", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740958, "uuid": "6eb45316-218b-43cc-a67a-00537b2c421c", "value": "6144:Cj236RQojJh9gd+ZBLEEgOBo9UnQ7cPWa:GgodWmLMO0UnQ7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640740958, "uuid": "da3d0e1a-4b49-44bd-af72-b184a1b2a13a", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640740958, "uuid": "0762e476-5d56-4f92-b0ba-2016b006a351", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640740958, "uuid": "5787167f-8190-470c-bcf7-bca72a465934", "value": "attacments_1015.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bf74f3f-685a-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1640749864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640749864, "uuid": "f1c7089a-ecb5-454d-a998-5c4bb81f5930", "comment": "Malware payload (CoinMiner)", "value": "0533cee2af44cb10f5ce4edb07c91e7c", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640749864, "uuid": "766d9eb2-6ce1-429e-9814-61f4cc546895", "comment": "Malware payload (CoinMiner)", "value": "fe148f70fd3ee3fb63d9b3b09d479b77af5c6979598a9d3c3295b6bbeee4ab07", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640749864, "uuid": "55591e18-db20-4f6a-a1c7-c25e1d2757cd", "comment": "Malware payload (CoinMiner)", "value": "11e1e1666a4fd76075f55748a8cd4f61ecdd5715", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640749864, "uuid": "51e474ac-af2a-46d6-a52e-d8deee634cb7", "comment": "Malware payload (CoinMiner)", "value": "89ae7d9783b615f816d14119cde5db033c5630b5bca5e874b6b206e60bb83ab5e1555d6b47700a13d4eaef65faea8945", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640749864, "uuid": "27b0d975-4288-41a0-aa8b-5b0e9d676d2f", "value": "T131863342BC8B1CD8F22C027F2AFE355D1D53D94BB7FE120626D0A255D6CDB89B897812", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640749864, "uuid": "083821e3-198b-4cd7-97b7-b1ed926e538e", "value": "9dc580b98fdc55e0bc3b6c6f01e8c0c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640749864, "uuid": "04450f16-f395-4a1f-813d-02f4ab3657a8", "value": "196608:uUiPLikndoVifqsoAR04iyWdnTDbwkgcPzECyIp/aenB4J:eLikd5qsgyWdTDbfryIBaMB4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640749864, "uuid": "f63bc107-97c0-44e9-b202-82d4c4b651fe", "value": 8496128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640749864, "uuid": "96350532-7965-4fb8-b649-07641b60efe3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640749864, "uuid": "cab17ba9-395d-4dd7-82c6-7ee46c69c098", "value": "0533cee2af44cb10f5ce4edb07c91e7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86ad8883-68c9-11ec-9275-42010a9c0029", "comment": "Malware payload (QuasarRAT)", "timestamp": 1640797529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640797529, "uuid": "fe382a6b-f04f-4a52-867f-980feb372c75", "comment": "Malware payload (QuasarRAT)", "value": "a33158a247af4645f659be6e7c3b9d24", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640797529, "uuid": "37588b15-c80e-4164-a9f0-81ad40dbad27", "comment": "Malware payload (QuasarRAT)", "value": "ffdb5268f26c49da0613b5d2b107fb870bee389603e17aa890b5f30c0d61c0c8", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640797529, "uuid": "130974a6-36e0-4d48-98b0-23f88b3f2c96", "comment": "Malware payload (QuasarRAT)", "value": "a860bcfba9236aa89652428d69e767082a8614c1", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640797529, "uuid": "b1ee26c5-c8a2-4329-bdc6-039495838067", "comment": "Malware payload (QuasarRAT)", "value": "40e90f6afb8ae6e4032c6b68319776e60f7f5af65911c57ab469fa0aa25105d1db2e1b68ef163e1d268dc7371a438a68", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640797529, "uuid": "7b8c3f3f-ae28-41ee-9ae8-6803ad5f8b8e", "value": "T1C3D3AD617A41C816D9854B710DE2C6E87B3BFC52AEB707073652F72E2E736D08913B0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640797529, "uuid": "f32eb564-a6f6-4202-b097-ece7bb795bc3", "value": "3072:4rxEtjPOtioVjDGUU1qfDlaGGx+cL2QnA4/h3gRqCCwtnvTZxcCZUeRaqwZUdEAN:SxEtjPOtioVjDGUU1qfDlavx+W2QnAG0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640797529, "uuid": "b173be19-d38f-4a72-b054-f81956f823c3", "value": 141312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640797529, "uuid": "ce7a0048-ace9-4d64-93c4-ca365dddd14e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640797529, "uuid": "57ce34dc-349b-44c2-b30f-768f87f9f5bf", "value": "Comprobante.de.Pago.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }