{ "Event": { "published": true, "date": "2022-06-18", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-06-18", "timestamp": 1655596981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "237c58f9-0aeb-4b10-85ff-fd44969c38b0", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45d4d52c-eecc-11ec-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1655532165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655532165, "uuid": "4bccacdc-1ab3-4245-b130-00332b3fb973", "comment": "Malware payload (RemcosRAT)", "value": "b88d08039e00b7f812f00612bdacd07c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655532165, "uuid": "f0ea868d-3ad0-4484-a6ee-898c77c0c11a", "comment": "Malware payload (RemcosRAT)", "value": "0034f34143b149f33ed3706a6a09c9cb46b20f4f75b2d16704e5cedac7b243b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655532165, "uuid": "8f32ebea-25f0-4f7b-a3a3-58e5011be793", "comment": "Malware payload (RemcosRAT)", "value": "e1fcfb27300b3bd70b435e657e1a409f667581a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655532165, "uuid": "83a579c4-ded6-4057-ae4b-3ebfd5939690", "comment": "Malware payload (RemcosRAT)", "value": "2a9f6f9a660d669d1cc06faaad1f9636a968054240ba7109e006d076c65d3a74b730518178132345c4d376c78a6051ab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655532165, "uuid": "050d9544-af11-4e7f-ae4e-8ff5dbc01ed4", "value": "T144A4BF11BAD2C072D97251340D29EB35DEBCBD202935957BB3E61D5BFE30080A72A6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655532165, "uuid": "6ac89566-d43f-489c-8936-c2985f31c692", "value": "029a987f21e33b48f24d21b6f9ff1129", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655532165, "uuid": "f9b185c6-ccfa-4fe2-9bb3-7fdf2057c936", "value": "6144:pOFBH/FMNjt18F+9a/NgAeDB4CcOtKp03b13a4LJ+sAOZZPWXbTcUtyg:pOFtiNBuFgawDB4NOmuwsfZPOyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655532165, "uuid": "66f4f288-0a3e-48d1-b08a-a230f801061e", "value": 474112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655532165, "uuid": "c937cc6f-5a41-433a-8369-b201eec6613d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655532165, "uuid": "b0669512-8676-4310-a2a7-f764d0af707b", "value": "b88d08039e00b7f812f00612bdacd07c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aaae7cf-eefb-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655552252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552252, "uuid": "7f41bf8f-da23-4c49-8290-168158831509", "comment": "Malware payload (Mirai)", "value": "069fcd544a993c4feadb9c82e8d1b20e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552252, "uuid": "ecd00daa-6158-44a8-9d77-314e47237938", "comment": "Malware payload (Mirai)", "value": "0053787d88c642100b50d5b91fba21658112015b016124248d8b3171febd0548", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552252, "uuid": "be892ff8-2aaf-4f64-89bc-563a88874dee", "comment": "Malware payload (Mirai)", "value": "d1b9259144b2f36e41213113a978bac1e7756b18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552252, "uuid": "e4bd25a8-dc54-4ec9-b712-bf94699f69eb", "comment": "Malware payload (Mirai)", "value": "76955b11e80a51187355fc1a0b29eb95e145932277e9e1c66d99998b8107b1854c722662d0af043192a1f167a537efdd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655552252, "uuid": "c0155d9b-40e1-4b03-b3c3-adac37042d07", "value": "T17C533B02731C0947D1635EB13A3F1BE193BEED9121E4F685791FEB8A9232D724685E8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655552252, "uuid": "2c940297-03a6-4d1e-b838-b07104c151ad", "value": "768:SwAv1L1RUYudACISyKoh2sRDkHX5ipvC9AzseJaVWUDmZscIr8FfFPGtEs51JIxZ:Qvd1+UKJ88A/UsUDm6cIrM5GOsFGZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655552252, "uuid": "335fd193-bc62-4f22-bad8-62dc90b72a4f", "value": 63060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655552252, "uuid": "0711cc64-8748-4a11-adfe-e1303497dab9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655552252, "uuid": "db83f993-82fa-40ce-8024-364a3d98a3ba", "value": "crppc.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ecb9864-ef20-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655568338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655568338, "uuid": "e2d1ca08-af34-4f3e-b5a3-d72f7e8bb7f7", "comment": "Malware payload", "value": "7566cafb97f020ef49ed32b58087484b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655568338, "uuid": "b33a8f90-5a67-4504-be03-995335763905", "comment": "Malware payload", "value": "006b0bccd2afb1d061b2245bdf0adf0940f2b536e66cca94a3e30392d13c61d8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655568338, "uuid": "5987bf3b-3226-4798-a546-9cdb06657fdf", "comment": "Malware payload", "value": "cbe29c6381a257ef717a4e843f62323b8a7ad3b8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655568338, "uuid": "3ca5aeb6-3745-4f97-b047-4390c5ff693e", "comment": "Malware payload", "value": "93dd99e3f2b6b558d795406cb0a1a1b3391657cb5b418349b4a17cdaea1b26c128997365fedc428fb70cce53076aa8b4", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655568338, "uuid": "0baa4dd3-da97-4ff6-835b-0271842556f6", "value": "T11E218626E7D94A4FCB2E1675EA8E271B5352542F02BEB316430133B965C415A27389F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655568338, "uuid": "e349818a-7406-4c3f-a5c1-0a1046f02d4f", "value": "24:dCc1cpXvP2iCNMorAkpC6Ko0fyO893gWycTN02c5NW9AuO5J2q:0cuX2fBCno0789gWysN035NiOXt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655568338, "uuid": "3a6ecc14-56ee-4df3-bf5a-e299f1593545", "value": 1135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655568338, "uuid": "6ad1697f-0bce-437d-b602-ceabb9aada30", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655568338, "uuid": "14c72ee5-c5e7-477e-9f7a-c5fe319d32a8", "value": "Items4934.zip.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b147ce54-eeef-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655547378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655547378, "uuid": "92f91e25-a005-48ae-9a0b-c051d138c0fd", "comment": "Malware payload (Heodo)", "value": "f04261fc7c0534071e22ee8592172244", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655547378, "uuid": "bf969290-4519-4b8a-b080-1d451c1e068c", "comment": "Malware payload (Heodo)", "value": "008cab430eedc8fc343af01f640b1663737c5b81149ec7d1c214f90774a1e344", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655547378, "uuid": "fabba1f5-16ef-4e83-9646-04324b296aff", "comment": "Malware payload (Heodo)", "value": "d407d44af45be87202ad2f8c26bcffccc761fa16", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655547378, "uuid": "7594bb8b-132f-471e-933c-d69304d7748d", "comment": "Malware payload (Heodo)", "value": "52b581e6b9ca74d97006d79782394bf08ccd13901c3c8c4c944bf73a68e1d385ba0d7ecf0ac2040369df7af03275b166", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655547378, "uuid": "2b1780db-3f69-4ea8-b145-f9bb30754967", "value": "T1BEE48D9967E60778F4BEA5348A368961FA72FC440730874F03A3517ADF37B24596A323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655547378, "uuid": "d0afe85e-c10c-4571-ad98-c7eee6c973b5", "value": "3453e632ce30879aafc5b698fff99cee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655547378, "uuid": "f294cbca-1743-4dd5-95b0-80008de21a99", "value": "12288:OuLAIfbduxjLrrXpRoZqAQq30PiW6iSp5tMcPNMCthT6mx:X0IfS1Rocq30PynMyNDT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655547378, "uuid": "484f6785-a51d-4ed4-86be-5033764749b1", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655547378, "uuid": "983c48c5-23fd-4358-a588-e4002c211f70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655547378, "uuid": "200836d9-a9b0-47a2-9514-13a2b33247ec", "value": "f04261fc7c0534071e22ee8592172244", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b0c8168-ef25-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655570345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570345, "uuid": "662313ab-d9cb-46ad-b926-3c99c552bb89", "comment": "Malware payload", "value": "1dca747a666e854e745f2ca0f9eaaf2f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570345, "uuid": "96ff6ff4-de19-4ee7-b4d7-ac7154cf43be", "comment": "Malware payload", "value": "01e463073a3716483324ce4a5bee973340e435c0c5a70569b79f1cad3fa964fa", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570345, "uuid": "cb6979d6-0d77-4bd5-a485-081019a310ab", "comment": "Malware payload", "value": "6f5d0a6e2bbbd534648b49b1087f79cd5fa30250", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570345, "uuid": "3cbe9bc4-4ec3-4e05-93fe-441b49325647", "comment": "Malware payload", "value": "b2ebbf18303df719444c9415971b22fa8da05bdf11fe65ac1bf76ab15bc90e20247aa0a41cce76c46a2132c6dc0e5f19", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570345, "uuid": "2549703e-a658-4be5-882f-3e7dc4ac305c", "value": "T12121B9E6EC988075D82A1476B0BD6EC492C5D1980CCB5E2F4DA1D480FD7B910AEB0DD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570345, "uuid": "7d889baf-c6e1-47a7-add0-7d62dbe22c18", "value": "24:7KhTll0HvRxh5UGbHPLwyoMMcdYzKtdY69iA3fB/f9C190Bb:OMPR5bHPLw7MTd/1T3p39CwBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655570345, "uuid": "461da747-5886-4d76-be3e-52b97cf384b6", "value": 1126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655570345, "uuid": "3e4427a9-25be-4945-94a5-396d3438e685", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570345, "uuid": "defcf3fc-fdf5-401c-837b-40f16d8eb5a0", "value": "Copy2633.zip.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c57e4ae0-ef26-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655571034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655571034, "uuid": "adf3e4bf-957d-4727-a771-884b0d5d3de2", "comment": "Malware payload", "value": "5c4591036a730f24e4e842632b9b889d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655571034, "uuid": "a78d4523-2326-47b5-8c4f-14cc663b4556", "comment": "Malware payload", "value": "03cc03b09405935b44fb47359a9a97a8267df474b61e395aa0f34340de4a854c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655571034, "uuid": "e7e34eb2-0e93-4d6a-a53c-b25b38cc7c95", "comment": "Malware payload", "value": "931bba0e75791521cd2df487e36c604686d73ad0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655571034, "uuid": "46647b5a-82b7-42b5-bb8f-5ba072f362b3", "comment": "Malware payload", "value": "c41c7dc8ae02daef16d57993c02e05ebc0d2a50e5e67a44f1b7107704f5ba0d7567795af01f87bc5adb6d74d5226bda4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655571034, "uuid": "129e1904-4fab-48f8-8970-bda4815201a0", "value": "T14021D0DA1172C5316CA2EF677679860871C0D0EB74E75F39E8EC39E6508CE296440FA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655571034, "uuid": "859fb5ae-8ac3-47ca-9c27-54350264fbd8", "value": "24:vachfaohuYJKSmsZnLnFbWCJK2/5L7NIlT:vachfaohuKKS3ZnLFb1JK2/5LET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655571034, "uuid": "8ec4ed38-2d9b-41e2-93a8-461e922d3e06", "value": 1112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655571034, "uuid": "66bb4e84-4f51-446d-baa3-4ce3e1514b7b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655571034, "uuid": "8b6d85d0-fa01-48cd-90ec-d59b96a60a00", "value": "skid.sh.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0e11dc4-eee6-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655543619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655543619, "uuid": "7a70679f-f388-4c92-966f-f81441d9737e", "comment": "Malware payload", "value": "fe266b94e321ac669cb921a88b498527", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655543619, "uuid": "43a21697-6450-4728-8cd7-5bd498dc2a2d", "comment": "Malware payload", "value": "03d904fc80cccdd55c8065e9af038c4edfd5526af17bac93ce2731db19b02126", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655543619, "uuid": "366be6fc-594e-4edb-a519-dbc7ee74a671", "comment": "Malware payload", "value": "1d950d743baa568c70ecfeda9cad7800f658f291", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655543619, "uuid": "d16ef538-0af2-4da2-99e2-6d339fa78dc1", "comment": "Malware payload", "value": "73d36a512bc6dd7ca5670cfab600e38a0beff054ebc7ce474f60f23a79509e8b8e976c15c186ea2551f7fd16fc64761c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655543619, "uuid": "9a3bf8fb-1d4e-4fba-b5c4-5f40f4f58072", "value": "T1DC13F03F90C188E6EE778976194E1335BF349AF52111CC1B051866F50E826BEA4F7F88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655543619, "uuid": "3dbaf43a-7a9b-4beb-b36b-d44656eb5821", "value": "768:G76K35ngVhBhNUaDac0CrqMxSAT9UI2tFFElzrh0HIA6X2chJgGlzDpxYsqIYgDw:G7ld87MaMs1SPS/mczVrYeD1nm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655543619, "uuid": "936ab364-48c3-4eb9-aff4-29308f2c5442", "value": 45088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655543619, "uuid": "bdb9c6bc-ba71-43a5-a119-4827386e3ad8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655543619, "uuid": "fa4abed8-ccbd-437a-993a-e268bf5b01c7", "value": "gummy.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a357ce3-eee7-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655543822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655543822, "uuid": "068d8534-7980-4300-a103-833b8bef17f1", "comment": "Malware payload", "value": "639793bc890de66cfeac99258df66f59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655543822, "uuid": "69c9be85-1e92-4c2e-bad7-cf3a092ab2a2", "comment": "Malware payload", "value": "061a74c4aa4ff7f9d34872f6d704587d3714c7cd9acc77a86f489c39324141fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655543822, "uuid": "7e4b04ed-534b-489e-b873-1fe80dcf1d57", "comment": "Malware payload", "value": "6fb5a6271d59b544f91257c28d5e8d5185a3aead", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655543822, "uuid": "b9c2f755-1210-457f-8a8d-6ca4b60e5e07", "comment": "Malware payload", "value": "c614a3ea383c892da40f84a02a09ec5ccb9c2af70e5011207c876a0dbbf57a660d86ea68f5b44f78cd167d434622078b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655543822, "uuid": "2e50198e-9298-43c0-ae17-ab763ac3579d", "value": "T1A3571148A0CEC510E675A3BD0328FD9543289E3372354DE7BE4F1AE12A75AD9E27940F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655543822, "uuid": "bcdc6248-629e-4373-b094-742e3e543614", "value": "f3092d67658852632c1a8e44a170c231", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655543822, "uuid": "902d813b-662c-4590-979b-ffa3f0584c98", "value": "786432:QAw+aatdKty2ghS8EQqVYul0P+RHg5xkS:QANKM2MwQnP+hg5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655543822, "uuid": "b16f993d-a0ab-4262-9700-67b2a813bd4c", "value": 27143680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655543822, "uuid": "64862b50-6a15-4af0-a6f8-aa868b57aa17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655543822, "uuid": "b5425ceb-bce1-4fa2-9b45-32f75c608608", "value": "061a74c4aa4ff7f9d34872f6d704587d3714c7cd9acc77a86f489c39324141fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a704b73-ef1b-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655566237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655566237, "uuid": "52d1b509-e180-4b75-8564-8f255b545b46", "comment": "Malware payload", "value": "519e1c12e6642f5b81ba0b72ab746250", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655566237, "uuid": "19c2504e-25d5-4835-8d40-85aacead7cbd", "comment": "Malware payload", "value": "0747b0dde3ea9d22d30c000c4b07dd5e55bdedc7a36c4a75a74b302d840afb94", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655566237, "uuid": "308fdfb4-9a53-4637-bc22-20d2b79b23fc", "comment": "Malware payload", "value": "740c27b5228a02637be480678653c29dc6ae2b04", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655566237, "uuid": "8bbbd44a-6895-4bc1-a210-76b1c3d686ec", "comment": "Malware payload", "value": "32541a97fdfd77ec131f2da724b6d55c81d512138a96f535a799e9231ea654ba5a1a0eb76a7ef97c00b572b23d2ecc60", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655566237, "uuid": "c180606a-6a45-44b1-aa5f-40892fc1cc0e", "value": "T1140121EB16641185441DEE1C7276ED887256DBC2B3650F2BACECB63A945EC11F062F60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655566237, "uuid": "3f24c299-e094-424a-b8d6-0ba78fb51167", "value": "24:oR3rDRGRNuKRE1vtRXZgRpRmHRlXRvNI5RfKaRx6KRS:opA/uKChtNZgvCbXWJnOK8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655566237, "uuid": "6d8ee62f-3f2b-40e3-8c8a-dc7a63f60200", "value": 792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655566237, "uuid": "872483b2-1f78-4514-965a-fa78f790fdb3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655566237, "uuid": "4743a098-4575-4762-8e23-834e8f75ec19", "value": "a.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5630e72e-eed5-11ec-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1655536058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536058, "uuid": "92833422-a9b6-4c7d-9735-a8953f4ae9b7", "comment": "Malware payload (ArkeiStealer)", "value": "1d6b2cd6a5fce9e880253b33a8b41835", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536058, "uuid": "ddb5e783-efa1-4ce8-a278-d0ec787a8428", "comment": "Malware payload (ArkeiStealer)", "value": "07e84141feddeaaab03997f3ed320a344c90b82dfe05bc2a4423a14bd15e6324", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536058, "uuid": "66bfc481-13f3-4992-8de7-2c30a2e63a18", "comment": "Malware payload (ArkeiStealer)", "value": "f08e559a6ceae4df0b192bee5cbadd89521ec448", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536058, "uuid": "6fc3ae47-91cd-490f-a80b-8e3e34df60b5", "comment": "Malware payload (ArkeiStealer)", "value": "921d6ac3932fcda0935ff7a925e28e05face773a30149309ec250ed24f7d853e17b19f345df37ab1cf6613f58859efba", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655536058, "uuid": "caac06f9-b4dc-46d7-a7f8-4f799b8514ae", "value": "T19964F1317760C0B3C5A322348AB28B625E7B357216B4C65B7764073A5FA0BA45FF931A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655536058, "uuid": "ca65c81f-c929-41ef-a1c7-935a635204cc", "value": "26e62c1b99f00f667cc6a84daee95b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655536058, "uuid": "38fd2be5-0c62-4dbd-9f28-34c0eee3a8ae", "value": "6144:P/dPNbx7Pu9SPThUpod0yA5NYhdZHSo+YlSweBFRziomFR5kz:NNbx7PUS1U7revZjmwevR+DpW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655536058, "uuid": "702cde35-956c-4776-b1e3-2d22f6bbb936", "value": 317440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655536058, "uuid": "54237e4b-9947-4b76-bc7b-34e7f880b6c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655536058, "uuid": "042e4620-f54d-4bce-8242-d0e15b6cc53d", "value": "1d6b2cd6a5fce9e880253b33a8b41835.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "884b2226-eee1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655541296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541296, "uuid": "c4982b3a-f745-4bc6-afee-63d950425b84", "comment": "Malware payload (Mirai)", "value": "cae35e6c4adf2fa36df1aefa7840b363", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541296, "uuid": "46acfa25-1596-4739-908f-08f5c80d7b19", "comment": "Malware payload (Mirai)", "value": "093370d1e626a5089f6447a17a4b00e570e2fe1bdb4b57cc75c70f8349436f33", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541296, "uuid": "3d3a9141-52f2-4f58-9d96-49c4f4d47b44", "comment": "Malware payload (Mirai)", "value": "baa22647bdd8dd975b1d90f0b5ebd5588969ccc7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541296, "uuid": "0666db80-c9f9-4669-b8c3-15592b411bb5", "comment": "Malware payload (Mirai)", "value": "980c0c546c4baf91d753bd0aed1e3e873c49e902bfdfcf993453db485fc55208b348fdd04b19077b4efe05415f11fe2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541296, "uuid": "53826eaf-1b32-4261-b7fb-1ecb837ad810", "value": "T11423F14E892574CBDEED6DBF90ED266171D222C2731B0BEAEF3384C956E0D392446478", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541296, "uuid": "664dd4b1-5e5e-4070-ba9d-4452eaf4f792", "value": "768:9PCFVDXN5/p5AYrpFbn9r3GQZNc2mmowWMZ9mjGsMu+tWoMqI35kNCaKF:UVlBFbn9r3ZXcbmobMjmGc+pMqI3Hv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655541296, "uuid": "59888df3-4eb0-4445-8068-c6d650c6b5cc", "value": 49376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655541296, "uuid": "26394d1e-7e9d-4a59-a29b-89b4a1b00719", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541296, "uuid": "2630efeb-f411-4124-9dda-7b5c223d94f7", "value": "KFS.mpsl.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1a81e8a-eea3-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655514790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655514790, "uuid": "9ad6af38-e26f-4622-b496-4b34a74ae46a", "comment": "Malware payload", "value": "ae649d4f54f026bc4c0e4fcd2d6b527a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655514790, "uuid": "214f1aca-7546-4a24-8dab-c5fe2d52c34f", "comment": "Malware payload", "value": "0a4b6b8b5247b08c451cdf5cff0074c7cd45179fe0b9b46d6af34f6d8fc79691", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655514790, "uuid": "d0a64976-9949-4abd-b7ed-5a952e2e6311", "comment": "Malware payload", "value": "2270e74739cd004b57e0cef104de2a4d72e4cb61", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655514790, "uuid": "581d98d7-e174-4f9b-b655-e347a428292b", "comment": "Malware payload", "value": "62f2787a3844a8a51404d69a00add89d5819f11e9648248c09077d129b61cd645f4a3a996369ff1dc1030d7c79089000", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655514790, "uuid": "c6176dd3-8019-459b-9d07-fb4efd5cdc2e", "value": "T1D1057D35EB80F125EAE3553E87D84A5A167D023337A453CBBF498468853F2DAB43439E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655514790, "uuid": "bcece980-efe3-4a33-8180-62cf15c6bb63", "value": "c84c1027327b354a17f1cc3cd5f25f3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655514790, "uuid": "a6249be6-232e-43dd-93e5-e554ea427601", "value": "24576:JkGHNjgaefkO/gA2AUOfrFQpbswwwwwYs82ugb3tdP:CGHNjpefkO/rHFQpbswwwwwYszuybP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655514790, "uuid": "d1dbefd6-836d-4dca-b49f-cc2cadb5dacf", "value": 858310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655514790, "uuid": "726da188-fd0b-40b4-b8d0-725b874a9368", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655514790, "uuid": "ee3ef6f9-7f03-47e1-b8a8-68d8b9f62fb5", "value": "ae649d4f54f026bc4c0e4fcd2d6b527a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78cd4828-ef20-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655568328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655568328, "uuid": "770025db-d88c-47ec-94b0-ea9f08b0eb14", "comment": "Malware payload", "value": "436e0ff5fe5edd028d06d07dbddc5414", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655568328, "uuid": "03eecd42-8c04-4563-8360-a1391e3961c8", "comment": "Malware payload", "value": "0a82b9ef75d1d2a3914e6609070da138ec4b724fc62753290d8c4fc51818d0a6", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655568328, "uuid": "99c050ff-4b1a-429a-9676-06cbd56872a3", "comment": "Malware payload", "value": "d551230a8a5bc3bb24a3e176e66d1b829c62c0fd", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655568328, "uuid": "8bf67c7c-f4d7-4fca-8f3e-5ac2014557c0", "comment": "Malware payload", "value": "2ef80dedcdd59c87a372409e4bd2dccf01c4d0f1a918af48b01145c380b987e35c1b0d6a7e07bfab0442adea1892f0b7", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655568328, "uuid": "cc960155-5369-4ec1-bdbd-9d48c0cf9c2a", "value": "T19D21B974D7560812DF0F79394993379D9966973F8A4B7D8B2490B3D0FF05026A3342C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655568328, "uuid": "bfd7e5a0-6e21-4301-b966-7559f303e990", "value": "12:5ps4Zlk0WjnZlkr1gbFCx8DtjleoAyM3qAbef9eQg6dWi/aSzH0F+j7pUmvjlw/a:dCbocFCejLHsozjtUd/G9dnBdtVO5Hq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655568328, "uuid": "1e53ffe2-0d2c-4bc4-9c49-7007290e1c87", "value": 1135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655568328, "uuid": "75ff8904-a362-4e13-afd1-40bfe72c1509", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655568328, "uuid": "fe136aa8-6d7a-47fc-993d-7bbfb67231d4", "value": "Items4900 (2).zip.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18d9f54c-ef17-11ec-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1655564302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655564302, "uuid": "2397fc4a-7c49-4e86-bce6-889b88c2360e", "comment": "Malware payload (njrat)", "value": "5df7a52ae27616421b65fff5a3c35db4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655564302, "uuid": "30e3a559-352e-4e98-95db-5e3771b00f30", "comment": "Malware payload (njrat)", "value": "0adf971c4bd895a1176ae6bff7cdd055015a9f21461277ed8a200425413bb2ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655564302, "uuid": "34c3419f-fc9d-4494-ad4f-e7bfebebfd36", "comment": "Malware payload (njrat)", "value": "d543a0c1f50bbfd493535de06e320c765cbd8550", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655564302, "uuid": "9fb488e2-4091-4ba8-9a89-d5df28e4294b", "comment": "Malware payload (njrat)", "value": "c7ae1c553fbddac7bc7758e0a6d055a133b2141e57b91f86c4f0d568a56ffc8189ffbb6bef742c0eea2970bdffd78530", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655564302, "uuid": "3646ba63-9d1d-47d0-b1eb-8439a8defcb0", "value": "T1AC032A4D7FE181A8C5FD057B05B2D412077AE04B6E23D91ECEF664AA37636C18B50AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655564302, "uuid": "aeabeb77-5087-4518-a653-346bfdc87efc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655564302, "uuid": "3f7e9c99-6395-471d-a9f2-f2e2941ee264", "value": "384:ySKvEiTbHvpWNcZ0y8f7CTvvrILkCwE3rAF+rMRTyN/0L+EcoinblneHQM3epzXv:3KXTZ38f7CTv8FwKrM+rMRa8Nu0Ot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655564302, "uuid": "91ebe00d-6d78-4b62-a151-d89f231a0a00", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655564302, "uuid": "bac3d00e-9530-498f-a553-f7fe01693325", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655564302, "uuid": "caa6de7b-3d5a-47bd-a933-34fc2ea064ba", "value": "Server.exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f72432ab-ef1a-11ec-93bb-42010a9c0043", "comment": "Malware payload (IcedID)", "timestamp": 1655565963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655565963, "uuid": "898cdd3d-70b0-44cc-b7b5-3e935765c1c3", "comment": "Malware payload (IcedID)", "value": "c52c6bea91aab8d2d8e3f51cb0a25d67", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655565963, "uuid": "523b5643-1a0e-457d-87c2-15b3ebf24f43", "comment": "Malware payload (IcedID)", "value": "0b527920cf0e0fe06858c1fbe642ccdf643c85b8b3729632e3236d5931b4534b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655565963, "uuid": "d3c1b72b-19e3-4c7d-9627-be812c3df6ee", "comment": "Malware payload (IcedID)", "value": "37d557a4ad770f2acfbbfac42960f6badcf699a3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655565963, "uuid": "bec21bd7-72ec-4367-8d75-122778f641a4", "comment": "Malware payload (IcedID)", "value": "51c0b99d0f0e73734aabc76c3f6e5aec01bbcdc0e2608e4bd35c18b553a3498f6b39ca0ce374e561ab4dc1f445cbed84", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655565963, "uuid": "7c4fba43-d257-477b-bc38-68de984c3575", "value": "T15ED4BFB876047CD6B66F577BCA966CED13B62663CA8BA4CD40647BC305A3371FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655565963, "uuid": "d5c21423-2650-4e62-8f56-a33dd1563e33", "value": "12288:3Ja5otQOxWeQqZjPnPUAUwsFaH/k1Oe93cA2Bt82AyelVGpZYQqJkEZ1z:5ic5QqZDnPU0b/k1X1c5BaVip2d1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655565963, "uuid": "d3c2bb44-5126-415a-b417-effc1e14d80a", "value": 614912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655565963, "uuid": "ee3c27c0-b2df-4fe8-9a24-cd66feb59895", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655565963, "uuid": "189ebfb2-6828-4bd4-bf1c-2ddb2b013ef3", "value": "c52c6bea91aab8d2d8e3f51cb0a25d67.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "667a7cd9-ef25-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655570445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570445, "uuid": "593f5446-bb6d-4e7a-8642-a129884a0e77", "comment": "Malware payload (Mirai)", "value": "3b5bbb1cc91db998a0b6f3792b6eabc7", "object_relation": "md5", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570445, "uuid": "ab2b9878-7934-4672-ac08-249fa6718ce0", "comment": "Malware payload (Mirai)", "value": "0d33222991fe8ed6289d62b7d4194597d6021be51b8a1d30cbabf3fe2dcc4a9d", "object_relation": "sha256", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570445, "uuid": "6e4f6440-b4cf-4700-87eb-7da32cf6bcfe", "comment": "Malware payload (Mirai)", "value": "be2128b4ca63bf1f87c3e7ce3db3c009b12ed62a", "object_relation": "sha1", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570445, "uuid": "20b6953a-fca8-463a-934b-557b9448ccb4", "comment": "Malware payload (Mirai)", "value": "f3667294f580181fda7cc5ea5ca61c3c1757dff73ddb989b80e2f012694cee7423663d9e04d167a9e0e445ea88e75bbd", "object_relation": "sha3-384", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570445, "uuid": "c8464ea1-3a7d-445e-aefe-6b3915996313", "value": "T1A5D2E041115F0B70A374E0B5BD6057C2D68B6A3DE3EA35396D8C4B4CBBE750B24B84AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570445, "uuid": "90549969-b2d6-4952-bd9e-250ef6f3c1ba", "value": "768:FNR6nXHzQZgd9AzTdAftG8xNSsxTE14qTGOtr8bTmTn/s3UozHY:oXVmpA1TSAMTGOYKyz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655570445, "uuid": "e2366525-1b57-4525-a628-b205a67ca6db", "value": 30796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655570445, "uuid": "9e4f12ca-305c-4e58-8967-58bec9e2a34b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570445, "uuid": "7cf2e92f-025a-412d-b044-4df56e95d108", "value": "irc.arm.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "985c551b-ef25-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655570529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570529, "uuid": "9039a092-d7b4-4421-829b-3ae50b6e37fe", "comment": "Malware payload (Mirai)", "value": "8400a3d2f5aac136b6b0e368265c417f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570529, "uuid": "7e3c4ef2-5799-453f-8977-a0aea997ed58", "comment": "Malware payload (Mirai)", "value": "0d389a4a8d6445796a7c101929c9e88408fbaa99770297180f30d3758289a695", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570529, "uuid": "b1e2309f-8ba1-4f67-bf57-d945c109d72e", "comment": "Malware payload (Mirai)", "value": "2d8bdf6407e958dd586f90c86f4bb90eb80878fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570529, "uuid": "127e029c-e626-4e27-9343-699c9316dc55", "comment": "Malware payload (Mirai)", "value": "05a814b2e7f75322c8d78a3bb02815f3dc2183055d000cd945ed85a1cbf683ad97e7f1cb4089f78c98c1300259ade6e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570529, "uuid": "f606885c-6d5a-4e40-8172-5778b62faa46", "value": "T15CE2E11CD36582BAE353907EAF611F815E1B05223802EDBA7097E6735E805B23DA37D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570529, "uuid": "a0eeb45d-bdfc-408a-bdcc-f00b80bc6a12", "value": "768:3gTFxw09WM33sCEWUyqLEkE9GgggmN+7YqgHdJgGlzDpbuR1J/:QZx3Wk3sFEPfgZA7Yqu3VJux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655570529, "uuid": "23c930d2-c53d-42af-a683-a60310e79cd6", "value": 32452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655570529, "uuid": "02ec00ec-f2b2-456d-8d27-4eb2ce13b369", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570529, "uuid": "c1e317c9-409b-4000-bacf-d4594b35610f", "value": "irc.mips.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb719a3f-ef33-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655576627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655576627, "uuid": "324e7181-7e8e-4af6-ab0c-0f590445b7df", "comment": "Malware payload (AgentTesla)", "value": "5ab1a442740746d555c6fd1830747c83", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655576627, "uuid": "e7d02725-5044-4a52-90f7-7dd2734b2d25", "comment": "Malware payload (AgentTesla)", "value": "0db752d626f02c2c5cd98d753f90d8a172b2ad7f22560a6cb167bf1aed7289ce", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655576627, "uuid": "89fff221-bdeb-4aa1-89fd-63d6a67cf5e2", "comment": "Malware payload (AgentTesla)", "value": "851ac16dd421062d7a609e839ae51c4cb733f8bc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655576627, "uuid": "22096c92-500e-45ee-83c4-56298ba0ade7", "comment": "Malware payload (AgentTesla)", "value": "35d0fe19112734d525cc16a8b982413348a12fc488158a896bed3c10745e20a4ee151418f63f1adb9b6d2dd97327149b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655576627, "uuid": "4dd0e204-a3db-4fcd-9d6b-9453f6b6f5b8", "value": "T17315E0AC3260F49FC4579AB2C9685CF06A603D27D707C117A0533E9CBA3E7DB8A155A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655576627, "uuid": "96f6da78-e2b6-491d-9b36-30f41ad81d03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655576627, "uuid": "584af66b-d9ba-4338-a902-2e8930e898b0", "value": "24576:T2rPxESF5FraLSgZe0DAj71IpxH1Xrg0jAodND:yr2SISV0DA9WX80RB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655576627, "uuid": "52a1680a-363e-43f7-995b-70a3c9e63431", "value": 920576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655576627, "uuid": "2e1ccca3-ae6c-4c1f-ba03-36ceeaa98670", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655576627, "uuid": "1ad71e7c-cede-4172-af38-f10f218bd2e5", "value": "Swift COPY 54643121822.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ef569a5-ef27-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655571184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655571184, "uuid": "fffb4cb8-ca0d-4f90-8818-630dd6965fcb", "comment": "Malware payload", "value": "df7abba2e84ba444a482c66d127d83c7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655571184, "uuid": "cb8fea23-6fec-4220-b105-c9b379d46591", "comment": "Malware payload", "value": "0ef90f496d7e2181389a13278fad77fe7697487daf0627982edfb6683fe99522", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655571184, "uuid": "2aee7efa-e90c-4d1f-a127-1a5e0760ef84", "comment": "Malware payload", "value": "1a70e8f2a501d138ff4277ffe852d21a7350ab54", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655571184, "uuid": "d60fd4a5-bb3a-402f-9211-286ca9ee5fb5", "comment": "Malware payload", "value": "7e954a648a57e59c766ac9042702ed98634fbe23b77eea33a3122b20ede5fb6168e7c024c8a1da152c909415b5a2a3c0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655571184, "uuid": "de18cbe3-d325-4285-86e6-2bd0f6cde381", "value": "T1F0156A2223C45F14F67DE33A20B5501943F5F4D3D390EE6EBDA588CC1D63BC25AAA626", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655571184, "uuid": "04f7a15b-52a8-4359-88fe-ec41de1ea2d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655571184, "uuid": "ba9d605c-51d7-4a43-af58-5cc4a74c44fd", "value": "12288:CvZTkdSbmCz3xvZX2i5RgKNNTK2xyDIf//FVs7SqGZJ:qZTPFIUg8Dy0H/Y7ST", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655571184, "uuid": "09dab0c7-2560-4a5b-8ac9-2a0ceb64b237", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655571184, "uuid": "0b865a22-6f62-460d-9710-27bc54f55d43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655571184, "uuid": "0cfee60f-e366-40d6-b86b-818cef4f0180", "value": "Stainless Steel Plates Sheets and Coil product inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b3b40a5-ef25-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655570372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570372, "uuid": "f240f3a8-ca5c-4d3d-b66c-80805050af08", "comment": "Malware payload", "value": "36b816082e7565290ce319c7fb119901", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570372, "uuid": "bc955486-0cea-4869-b8a1-e8a1e3acee7f", "comment": "Malware payload", "value": "10a68e97377499dbd03f0ae1af25e96261237b2f6dda9d6f27c15b7e873e683c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570372, "uuid": "7165f057-5219-4a0a-be3b-8b1a8fc0ab2f", "comment": "Malware payload", "value": "12e7403665bea11dd2024fecb5e4407616711d8a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570372, "uuid": "533ef278-eb76-4681-a0db-83b3b26ef876", "comment": "Malware payload", "value": "66a3f67fccfcdc685e55f4fafeb8eb1cfb954061fc2ed53867c9848790aca5fa01f616c512ac7e797110b7ba2c193571", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570372, "uuid": "aabe1140-9454-42b4-975d-382302ad6ef6", "value": "T15A218925DDD4D156C84B9D7E417A84AD73BF408710C4DF57384260E6A56FC0137A8ACE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570372, "uuid": "6380ad8f-3314-479a-bb66-d4f15e48a004", "value": "24:7KhT5F2dfsfk28e+aOevrPBgYLgVfvVyf3dL1kLnBLTpFud5b:OakfkDe+aOezPBgY8lvcFLQn1i5b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655570372, "uuid": "9d9a9eca-d002-4782-b002-2fabdb9685af", "value": 1126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655570372, "uuid": "f9926b0d-722c-46bc-a127-ee27d06be453", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570372, "uuid": "5c9c9b25-41d3-4e56-bc6a-50f73b2c7d3d", "value": "Copy4078.zip.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5bfde64-ef43-11ec-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1655583463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655583463, "uuid": "5d682ed6-9175-425f-8899-093ef59500c5", "comment": "Malware payload (Smoke Loader)", "value": "138923bf34cf7646ade9cf8c52745069", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655583463, "uuid": "7bb91ae0-a737-4347-bdcc-1ae3143a4483", "comment": "Malware payload (Smoke Loader)", "value": "118cf10b46ae12b5f1b4dfa125d08adb554fa3b165b73dea02203993d93234e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655583463, "uuid": "1b3978e2-304b-4b64-b2cc-2c544619c732", "comment": "Malware payload (Smoke Loader)", "value": "6ae911c7c0a12ab5049983be41422146c6efc9ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655583463, "uuid": "915c3b79-2f0a-46f0-a05a-95e6a90dc298", "comment": "Malware payload (Smoke Loader)", "value": "78357e9f90600c113aaae7bd3c3d9a22e7475b5a243d9fc9aec7eddff31c2caee78a916e132fcd0b21ae69fcd06aa6be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655583463, "uuid": "b5b29b3a-8463-4b7e-a3a4-c086e46742a7", "value": "T132154BE93135F09EE496D4B9D8941CFC55512C6EDA0F911B50033968F9BCE8E8F0BAB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655583463, "uuid": "b24db0b6-3142-46eb-9db5-a964aa712ce0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655583463, "uuid": "30571e9e-2f27-4cf2-8d28-c1803f4b559a", "value": "12288:v5FBcwe157CjdrbNOnwk3lFljT1g/HzFuMFDY3hxkbN0GIIE3pyN//0BEqiU5kzn:v2lTAr0wujNC7FqxkbaGIIu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655583463, "uuid": "a0d68660-8c34-4c68-a44c-bcc866c2b385", "value": 923648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655583463, "uuid": "73cb6ee3-8db4-4cce-9832-e982254b06c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655583463, "uuid": "b86da9bc-50cd-4dcc-922b-f4e7df02596f", "value": "Incoming_transactions.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e4f99aa-ef18-11ec-93bb-42010a9c0043", "comment": "Malware payload (IcedID)", "timestamp": 1655564767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655564767, "uuid": "84398abd-f45a-4a28-b2b3-db4c8b7f96df", "comment": "Malware payload (IcedID)", "value": "c2d755858109c26566f7efcc2929201b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655564767, "uuid": "8ed628c8-59d3-409f-a48d-e1659d5ff809", "comment": "Malware payload (IcedID)", "value": "14d20132b72f71aa405b34060416c574a3412be2e5f5b027a19d2ae3683e86c5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655564767, "uuid": "1be99d50-53d8-4666-905b-6a4e7b9d63e4", "comment": "Malware payload (IcedID)", "value": "d5ae23e24c7a43c15c3fb489c55035a6e42dd650", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655564767, "uuid": "64f15c76-2628-4cff-9d0a-8971d0f20904", "comment": "Malware payload (IcedID)", "value": "31876a6bc050ee35922dc44c0b0f9d5c31eccf3c42d55573948d71f555ac45c01543fa643e5cf9c5b515723e4aeb1302", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655564767, "uuid": "e7136cbc-a9c8-44dc-a295-6db0d9b11eb5", "value": "T197D4BFB875047DE6A67F467BCA96BDDD13B627629A87A4CD8064B7C305A3331FF02804", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655564767, "uuid": "2831ee6f-5c33-4b64-9e00-2b397a1105c9", "value": "12288:k0s2tpsfoVvnMDvlDDw+DhSj3nQIyzvadokr2EnB/6bQT9YofWHKfugOM:k09WAyDtE+D4j9yzvS/LnByWHOHWuPM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655564767, "uuid": "3c4acbfb-3f41-424c-9121-4a814746fd74", "value": 614400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655564767, "uuid": "ae722eb0-1c77-4cc2-8db4-d82a302931df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655564767, "uuid": "a50cc5ec-ab98-40e1-8882-85967627594c", "value": "c2d755858109c26566f7efcc2929201b.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f952dcc2-eed6-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655536761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536761, "uuid": "6c85d247-d4a2-4d7b-aeef-04c36902c4b1", "comment": "Malware payload (AgentTesla)", "value": "8136f3cfee0cac998ed2a9b9e78bbe56", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536761, "uuid": "240bda99-8b7f-4708-b248-a5710b6dbef1", "comment": "Malware payload (AgentTesla)", "value": "15323a57be2ef840a74074f3af4e20d2348ed99b201f35afb04b5f9ce729630c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536761, "uuid": "e3d411a1-56e8-4d95-8c30-4f8fccc7e744", "comment": "Malware payload (AgentTesla)", "value": "18e25c21d0001bebbcabae61223579c6450246df", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536761, "uuid": "5b0cb2cc-2951-4e07-8890-616878f6c391", "comment": "Malware payload (AgentTesla)", "value": "7aa47dbffb079366cae4e592cdcfe39779be380c7ee537139674a8b13db559adecc36c9f01556978f3c3d41502cc9d2d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655536761, "uuid": "d12c56f7-cd5c-4e23-be9b-719fddd2a608", "value": "T18A25DF983DE1E89EC4E7C976CC981CF059243CE7D622C12B70477E5CBA3D6D68E085A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655536761, "uuid": "7b7e44ca-907c-49c3-a567-a17ddee6a689", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655536761, "uuid": "d585910b-1dec-4f9c-b5eb-3491c60e15a7", "value": "12288:9/kWw4jdrICADMwEa2EqJQBpyjfIiGCwC1KqM5+xUhgEx5KGKLXa8VCvVudSJ8cn:KOr5aBpsQiQ+xWgEx5bKLK8WVN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655536761, "uuid": "7a4bdedb-c873-450f-b4f0-0f7a47d4fbae", "value": 972800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655536761, "uuid": "e682e923-3e9e-4279-9b07-b5cdc5805a8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655536761, "uuid": "b2540674-f4a0-442f-8f10-f3979331ee5d", "value": "DHL SHIPMENT NOTIFICATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11bee42e-eee4-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655542385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655542385, "uuid": "a4d0e582-748f-4c30-b4d8-307ed96851b6", "comment": "Malware payload", "value": "612d340583cb9e11a707496c1f29dcfe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655542385, "uuid": "a660001d-a064-486a-94d3-20dc53f9fed8", "comment": "Malware payload", "value": "157309f0e70964df3b84f400e2b6f6898bc6e47233ff963deb37a9203c654b32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655542385, "uuid": "8a6dd5b9-fc29-4534-9d63-8f79f3ca6b8c", "comment": "Malware payload", "value": "8121c56a394c5adb8e2560d2ed39aaf3db44c7e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655542385, "uuid": "10734e33-3802-4da4-bbac-cc48511d4fd2", "comment": "Malware payload", "value": "ce9c633905f2bf87ccd940c92b1d0bb021a0a3bbf8c879df29685bc8ffb58c55f9f9e2181ab60ff36e055108949360ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655542385, "uuid": "bcc62080-e964-45dc-ac4a-7fd9d963a7bc", "value": "T1A8937D45F2E242F7E6F2053201A6716FE735A6388724E8DBC74C2D429943AD1A73D3E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655542385, "uuid": "38602957-33d5-4e7d-a9a1-3ad0c6429941", "value": "2c5f2513605e48f2d8ea5440a870cb9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655542385, "uuid": "a5ee6891-e256-48d8-92d1-c7afac33931f", "value": "1536://7ftfkS5g9YOms+gZcQipICdXkNDqLLZX9lItVGL++eIOlnToIfAwC:/zFfHgTWmCRkGbKGLeNTBfA3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655542385, "uuid": "58ff3ecf-2492-4778-9cde-d0363804911b", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655542385, "uuid": "5ceda950-8ca0-49d5-ba4e-572d2c582a96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655542385, "uuid": "953c8a14-6082-416d-8f3e-1c2c0a0d92e6", "value": "avdisable.exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91e130d3-eeee-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655546895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655546895, "uuid": "42940e30-9b08-4f54-887b-e456752b5d00", "comment": "Malware payload (Mirai)", "value": "ee59934f72479fbf2a85c19853a52286", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655546895, "uuid": "03d381e3-b0d4-4a41-8fdd-b301df5742cf", "comment": "Malware payload (Mirai)", "value": "15b79ecd6b8dd29a417a1861eff56f6c788f1b9af396b6f1cfd2aabc6ea2317c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655546895, "uuid": "805dab71-0ff5-4330-8bf4-fc291379d34a", "comment": "Malware payload (Mirai)", "value": "d50a9f1da0c2ec075a63ab045ad72e2a93c39f75", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655546895, "uuid": "0c614fbe-cd85-40dc-a1e7-022f50cadb6b", "comment": "Malware payload (Mirai)", "value": "7b312aa212528ec8b1a7490a6f9ee5aac5350c8c67328705fa283c920765f3c02678fdd5634740661d172b1a9339a580", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655546895, "uuid": "cdf06b8c-fc63-4ef4-a1c9-25f299e39e61", "value": "T17F334BC59AC3D8B6EC5205712137AF738737F1692015EA97E3DCA527EC12702A61B38D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655546895, "uuid": "6e5421d6-8ea2-46ab-b88b-e1069629a941", "value": "1536:pAtF3Saut2dp5PHm1CoAbD4XHJ20tVmKhWSlA:M3Saut2l4AbMXp20P9hdA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655546895, "uuid": "8223526f-79e4-45de-9d8e-8e9b1ecada28", "value": 54576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655546895, "uuid": "ee07efa4-96b4-4be5-95b2-5da97ed91f42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655546895, "uuid": "9188f743-4247-4d77-a2c2-8c50ebfbfc05", "value": "ee59934f72479fbf2a85c19853a52286", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e79b33b-eee5-11ec-93bb-42010a9c0043", "comment": "Malware payload (GandCrab)", "timestamp": 1655542944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655542944, "uuid": "eff70980-9caa-41cf-a6a5-6fa5c0f9024a", "comment": "Malware payload (GandCrab)", "value": "fcc1f0f8892c09964f2c0cbc1e416a0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655542944, "uuid": "10c30b58-2f02-4aa1-a4b8-b57b3ecb0de7", "comment": "Malware payload (GandCrab)", "value": "16c7811696471900b3a83f0b8949a6f14fe1aaf67c424d9ceeedce51dc3016fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655542944, "uuid": "c11a3d68-645c-4271-a452-2e32d158e800", "comment": "Malware payload (GandCrab)", "value": "63fe034e482e4a773195e6a436661f57ff0be293", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655542944, "uuid": "8f5a6039-f2e8-478b-9368-edf3dad6a334", "comment": "Malware payload (GandCrab)", "value": "d68166745ef85786712a6dc596a4e87c5e42ee5dd603477c77007dd799cdb15e4b2ef4e1a3864dffff39bcdd9ee02846", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655542944, "uuid": "ada1a84c-0ac4-4eed-a5c7-261e69f804a2", "value": "T13F369E3CF6D6D902D02CCB31C1AB314415B3A6E8DA058F9FD2E06D9729097E6D5DE0AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655542944, "uuid": "41634d20-eef2-4dca-96af-298c7f8da2b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655542944, "uuid": "525c5bc8-6cd2-44d7-9800-f7902355ae8a", "value": "6144:zOepSKhPDpE4c06ncWCZynROn5rLSPqKKFURY361y7wMlCwh8i4JH350y/wducZx:CepST0xWC+O7JbVl9h8i2Hp0Ky5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655542944, "uuid": "0a5d1da3-0ea3-4858-8c07-4ba2d12547fc", "value": 5242880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655542944, "uuid": "29d2862e-7ffc-4be0-96e8-c816f132e568", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655542944, "uuid": "8fd4f068-c1f2-4f73-aa5a-daac13b04ba5", "value": "Stely.exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d63aced-eefa-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655551934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655551934, "uuid": "90c4d255-eb91-45ee-ad88-04c7e5c06aa8", "comment": "Malware payload (Mirai)", "value": "e9d22cdee2883a47958b980ab4710f4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655551934, "uuid": "fdc5c8ab-17ab-4842-a43f-af6f4a430904", "comment": "Malware payload (Mirai)", "value": "194a237e056525e4eec4445312861ee73b67a9ce4e8f2ef7e0471680ad9cca6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655551934, "uuid": "fec60abf-ae1f-4b51-b279-a1fc278f4a50", "comment": "Malware payload (Mirai)", "value": "4d07deac8089ea01807758378bc045ecd7ab97f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655551934, "uuid": "d1e60888-3d2e-4230-9fcf-96eb432480e6", "comment": "Malware payload (Mirai)", "value": "afa430c96e0f87fe22ead01ec450341faf4cff5ddc384fbc182e959d5b1ccaa1c2a8e9b6d143895b323ec2785529f836", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655551934, "uuid": "4a912d98-5b82-427b-91ac-606969362716", "value": "T105635B21BA751D27C0D4657F61F35325B2F2939A24ACCA2E3CB20E8DBF64A4062577F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655551934, "uuid": "c6a35685-bea3-469c-a071-387c76623273", "value": "768:IUo+87UahKjFtkfKrA192kC8Trceo9eO+lM5VjR8MGpyhgL7G1tEzlwSGdI5N:IUh87UuGFtkfKE1IlelM5twpAtsl2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655551934, "uuid": "e281d79b-378d-4871-9912-b160d379e62c", "value": 67456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655551934, "uuid": "cb9c93a8-d423-453c-ae54-410e6cf3b74a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655551934, "uuid": "821c215d-e189-4943-b583-fd8caaa89473", "value": "ZG9zspc.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a8f512f-eeff-11ec-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1655554211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655554211, "uuid": "3fe2f57e-3650-4aa0-9745-0abe5915344d", "comment": "Malware payload (njrat)", "value": "8d58b0ed9d0f8f9a24155c90c3e2dd1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655554211, "uuid": "98cccdaf-6b78-49f6-bd12-4c4152943862", "comment": "Malware payload (njrat)", "value": "19644edf3abd6ec9eeca8c1cbb852ef4eb3626e303c068517b9c1b28542eef73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655554211, "uuid": "02953ad7-a2ea-47e8-9756-fe10867d8658", "comment": "Malware payload (njrat)", "value": "bef5de9f14cd173b37403014ab9e354d45b17db9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655554211, "uuid": "655b2ed7-01f6-4528-b720-62c705e0fc68", "comment": "Malware payload (njrat)", "value": "b9690b9ffd83ff1d326b0d7297f3bcf781fbcf60ee722df82d1e7dfee3c4a2cb8d98f5affc3f60e06cbca117fc31a8f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655554211, "uuid": "52312e01-5fc7-4c42-84b5-c2f436581c53", "value": "T1463533100E4D1F9CE6B856FCA8B56E0EB5CCE4A5D1B6997F8372021932D9ADBC7DC009", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655554211, "uuid": "77c58784-c7eb-45e6-a84c-511611563942", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655554211, "uuid": "a3bc5947-188a-49af-b714-21b307e1f7ca", "value": "24576:6k0RfpRL5BBvZtJ2imXsaBlBc9peYTzIfW:sRRvZtJzmXsa7BcPRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655554211, "uuid": "2ad97d1f-66b9-409b-98b7-1f8a31a51d12", "value": 1126912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655554211, "uuid": "9f6951e8-6bdf-4220-b0f2-92b29973d1e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655554211, "uuid": "df324031-2e8a-4bab-9b2c-6429b7a0e70a", "value": "Cleaner.exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31cff453-eed5-11ec-93bb-42010a9c0043", "comment": "Malware payload (IcedID)", "timestamp": 1655535997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655535997, "uuid": "b745a17c-01b2-47c4-8d58-b3d2efcf2a8b", "comment": "Malware payload (IcedID)", "value": "8c739f87bab9691cf57a45d41f49690a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655535997, "uuid": "1c650d62-ffa8-4df5-a833-7d0a7d9e7282", "comment": "Malware payload (IcedID)", "value": "1a9b3d506e58c53448e784a61849bcdb6494ba427f7bedbed6b887f1586aac7e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655535997, "uuid": "9ab1cc86-ad62-4fa9-b589-a44cfe5a0e14", "comment": "Malware payload (IcedID)", "value": "bde1854766b9ce6f7d4d19eca8c32213c1a39284", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655535997, "uuid": "59540ba5-76c2-4b1b-9ef3-3a2f4ca90aa9", "comment": "Malware payload (IcedID)", "value": "a7df6d98f7873f0ed5c8015bc7db0d4efb094719a172e8da27a63349b8942158cd2b18486a5c9e4e7fb885a3a4764d13", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655535997, "uuid": "6f54ff04-0cd9-4d6f-91ee-8bee27aed83f", "value": "T100D4B0B875047DD6AA7E477BCD96ADE813B627628EC7A4CD806877C305B3375EE02804", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655535997, "uuid": "1bca2374-ab4a-4afb-af50-f539eefb6782", "value": "12288:sYldoSYW7bMLxiVhUeim1ZZxqgroRNIj2ce/epyzHfTJ2I91ajZ:HldoSYW7WGURYrxqGiij2ceGIzHrJnfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655535997, "uuid": "89461c62-3cef-4c5f-9d88-be7c00c41114", "value": 614400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655535997, "uuid": "ec46b162-cd70-4dfd-a91d-acc8c293701d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655535997, "uuid": "a94e8800-e4bb-4abd-b836-42f09a4a3ce5", "value": "8c739f87bab9691cf57a45d41f49690a.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c27e07c-ef25-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655570401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570401, "uuid": "17d93b09-9aa1-49ed-9c15-576baba56226", "comment": "Malware payload", "value": "6c0cef16078cdff48110d528717ef4b1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570401, "uuid": "0b9fdac5-36b1-42ce-95eb-8765c0852cc9", "comment": "Malware payload", "value": "1aea77141f30cbee6b955997d975510127ab36665bb1510b71e35909b51df435", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570401, "uuid": "6ecf9e72-3491-49a9-85d7-14ab94966a34", "comment": "Malware payload", "value": "416476c2629af069060bb7167a2007c5b4cf276b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570401, "uuid": "2b6b1e6c-ddea-4afc-a824-402934d859ca", "comment": "Malware payload", "value": "9f18397c98306f07f1cbf6df943ae759386d4bcb2227a8d50babdb703414217daee377e7e67355db5e6642c8d830ce0e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570401, "uuid": "bd0c2cbc-90de-4ae1-9c02-7040b5515a42", "value": "T1EC218228D6353948CD7F1A3EB06E9EEE17C1110C0CE8760B3E886CA5348E5209B10CCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570401, "uuid": "b60ebea3-4e5d-4700-b6d6-f708cf6e8a3e", "value": "24:7KEOHSE/XiP9qcWW5feQ2Qpoi0f64EcTuPJ1IfwWw7+g/jq:eyP9qtWdeQ9qgfjoRg/G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655570401, "uuid": "e86f78f7-ec43-416a-a0c5-ed8534db1afb", "value": 1126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655570401, "uuid": "e0d867e1-75ff-4b7c-bda3-b4e6d33bb793", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570401, "uuid": "74dc7856-d250-474c-a205-956bbbd60b41", "value": "Copy8151.zip.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f300587-eee1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655541334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541334, "uuid": "60059a6d-2b46-4ba5-844e-4336448cf873", "comment": "Malware payload (Mirai)", "value": "dc069265128f3846a7f2044847730a5d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541334, "uuid": "64c70a17-b2cb-4a88-8748-2de26e7a7d0e", "comment": "Malware payload (Mirai)", "value": "1b100e6069d1633d5fc4ae1efbab5820c743543c9945eccfcb52cabd377c4df9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541334, "uuid": "12f78ffb-4320-4519-9be2-334c2d7df7e8", "comment": "Malware payload (Mirai)", "value": "a1f6b7e013a3a1caed8c9b2ea73e5e30dadaf740", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541334, "uuid": "9541e58c-14b2-41dc-a5de-32eac4462a6b", "comment": "Malware payload (Mirai)", "value": "d5aee4a9732858d21d980513993b202f9042547577d99ab27c973021b259b431e77d241153c93251174b68cc3691bb33", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541334, "uuid": "8e0f16d0-e528-48cf-895a-83de91411523", "value": "T1F3C32993F800DE66F40AEA3605D70725B630FB724F531A7263573AA69E362E47827F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541334, "uuid": "32fd42e2-f57c-43a0-9087-c39d54ff7d08", "value": "3072:2INYDFHe69owRBpE2yI2RJ3AP4ILmvI0PDGnSQNER:2INYD9e69owlyIcJ3+FLmvI0PDGnSQNM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655541334, "uuid": "995a8196-f5d1-4c51-9241-be3da58cf144", "value": 118298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655541334, "uuid": "4bb9806c-27f8-4728-9700-1d2d99696c29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541334, "uuid": "fa3e181f-0371-4f2c-8ccf-125af84035ef", "value": "dc069265128f3846a7f2044847730a5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1222d1bb-eed7-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655536803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536803, "uuid": "5e17f67f-008c-4b4f-ad9a-04bafbdce23f", "comment": "Malware payload", "value": "39336320d5de3e622bad37a8fa0c33e5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536803, "uuid": "469c0361-05b6-44aa-8bb5-0808166734f1", "comment": "Malware payload", "value": "1b91813689aa31e614b24c21f53f4a57037439e4b9b922c794c4e41a359a4f60", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536803, "uuid": "95d0839a-e294-46cf-9176-f89f770139e5", "comment": "Malware payload", "value": "e514ccc6d886d2a2f1015e3c849a3978392b8e24", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536803, "uuid": "051cb1ac-ccc1-4077-b851-981bc7d34cdd", "comment": "Malware payload", "value": "d9c6cde672da4126e889eb59877cfbadbeb377dfc6a95762d0da864a2f458142cf4359717242307f3bb2d3e41cf6d521", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655536803, "uuid": "a2851880-89e4-41c2-99d1-a281ba4212d0", "value": "T17833708173D17C83458787723326B2F6F4399D99B68948DAF080BC94F5ED910FAD46B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655536803, "uuid": "3cdacb21-51fe-4709-afe1-794440f1429a", "value": "1536:8XNAj6OVA+ma80HwFYvKG21A0J0p/HMFKW:8GARa8FFZG21A0J01sFKW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655536803, "uuid": "2285f1b5-454d-4cc1-a2c5-715ee5be0847", "value": 50940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655536803, "uuid": "d8e25005-2b19-438e-a496-496dd8a2f60e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655536803, "uuid": "cb7fb813-202e-4a0a-a6d4-781bfc2b0af4", "value": "Captura2022360.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37943a09-eefa-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655551898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655551898, "uuid": "d3d8c997-e455-47b4-ab80-1986162c0082", "comment": "Malware payload (Mirai)", "value": "bd74825a77b99b6115c919a0ce9ead40", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655551898, "uuid": "003e01c5-56d1-4dd8-9953-8e58482a1948", "comment": "Malware payload (Mirai)", "value": "1c0adbde9e23afc48692bd8156dc7cee3bc37e76e7325d8c74e60d5216f8a43e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655551898, "uuid": "42961b95-4e65-43f6-bcf3-764962d955ef", "comment": "Malware payload (Mirai)", "value": "a16a48f6ef49d904bfcc952a642d571b99bfe22f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655551898, "uuid": "0d6438b7-ebf4-4960-a122-9608844c0974", "comment": "Malware payload (Mirai)", "value": "d5f47497b01ef779680f92b37b2538a773e763b6f04eb41d375f0d00aad3f81f33215ce8353028a2b88dcae97abaec19", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655551898, "uuid": "9e82258f-3c64-43a1-b76c-9b9d993afc22", "value": "T18FE33A56EB808F03C0D6277AFA9F424533239B54D3DB33069928AFB43F8669E4E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655551898, "uuid": "5ae3b55e-16b5-4cd6-a520-1c0b1bb52b93", "value": "3072:maI1tHtVNra7Vwt778EdpW78GARHOeWXV/RM/9xwjnh:PI1tHNra7Vwt77hdlGCOeWXVpM/9xMnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655551898, "uuid": "6308cee8-9c16-4af4-9154-2f95e31feb7f", "value": 144234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655551898, "uuid": "d284e2a0-84b9-4f35-acac-a44249e6d03b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655551898, "uuid": "0418d959-36a3-45c7-ab6b-538b72cb2ef5", "value": "ZG9zarm7.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e621372-ef25-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655570539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570539, "uuid": "9eae8d44-075a-4b9d-ad1f-75860e0a3cb3", "comment": "Malware payload (Mirai)", "value": "6c00205821eecf00064054abba8e54dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mipsel", "colour": "#FA7E95", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570539, "uuid": "2a3b37ed-8d58-46c7-9980-e14b9958057d", "comment": "Malware payload (Mirai)", "value": "1d400bbe8454db2172e059cacc774e02c394a7e87a2e53d7e7e68ef2e4ee24fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mipsel", "colour": "#FA7E95", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570539, "uuid": "5cb04a6c-0267-4025-9ce3-1b027363d180", "comment": "Malware payload (Mirai)", "value": "9ac8144b630cdffc0206f646e5fa93619b9130cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mipsel", "colour": "#FA7E95", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570539, "uuid": "7af1589d-1578-4d97-8095-e0ddc2c74e6c", "comment": "Malware payload (Mirai)", "value": "6369a2bd4cc231e5b96b0e3642a44e896e0084a034a3df2dc432132956a9abd5fa94420f054edc2e4709e99171ceaf84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mipsel", "colour": "#FA7E95", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570539, "uuid": "b72baff5-f971-45df-8f3d-4f468ddbc870", "value": "T154E2D06EECA61E89CDDD25FCD14F27E4FA61B3C022436B588713DE95B72608A52844FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570539, "uuid": "c6c82a40-dbe1-4778-ade6-8f4cf0dc73d7", "value": "768:8kYLbBi4ZJa1S2S5BNjxgBD6JvhxmuPsQfXW8ntmDWK:PYLbBE1S2SQBDyxvWOtm7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655570539, "uuid": "8eb8447e-867c-4150-beba-f08af2786f14", "value": 33556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655570539, "uuid": "57a8356c-a2da-4d39-affa-de59dd78d07e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570539, "uuid": "80cce802-0b62-4ed5-91c4-0403fcc25474", "value": "irc.mpsl.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ae338c3-ef1f-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655567929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567929, "uuid": "d1615195-7d8c-4721-ad17-1ea11dff33cc", "comment": "Malware payload", "value": "118cd75e4270c637160692ee8dee2e96", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567929, "uuid": "edac1d30-8861-4342-8175-61bc4ed840f4", "comment": "Malware payload", "value": "1ef1d706af6fe5c6adb9663bcd1e7a41594fa400b429ca95d9250b4a06429ad3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567929, "uuid": "3488040d-46da-41b9-af6f-058794f957c0", "comment": "Malware payload", "value": "5a07888a824a6e8a4848ee9345cf22de55ae33d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567929, "uuid": "80df5550-7a4d-4bec-8c9e-e3b5543818cb", "comment": "Malware payload", "value": "c23f92f0df10d937eee03cf4ada24701f118ef8c0865d766f991aa42b764048030e66ba0c9f972c572ac1ff1dc816e8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567929, "uuid": "5fda1d92-c437-4ff1-8634-a7f9a4c0782a", "value": "T1CB138D63CD211E58E2488EB170219F785763D16AC1871EFB246AC765C443ECDF26A7F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567929, "uuid": "76df8694-9ac9-43c5-ba30-1bd8c2c67dc0", "value": "768:c9TU7DxAJs2u4KkkdCaazyo461yQ7CLrAupfZoLHX0cI:Go7DxA/bKkkdcJ4XQ7CL9ob5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655567929, "uuid": "62e331dd-82d7-44b0-8add-f581fd016cdf", "value": 42768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655567929, "uuid": "2197da65-63dd-4a45-945a-d97f0de560d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567929, "uuid": "27154aca-22f3-4b26-b380-171e4a37cc37", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cd763d1-ef1f-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655567959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567959, "uuid": "6183cfbf-b708-4a39-9e1f-c086e5fe6852", "comment": "Malware payload", "value": "6894b23f52073c7d27ff1eefee1cb03a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567959, "uuid": "5d21ce58-9f77-44f8-850f-98c04c8f20b8", "comment": "Malware payload", "value": "1f55fbb660d847edf4c8698b5a480567d143213adec69841e3f61166b2fedc16", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567959, "uuid": "fa78fe09-9731-40e5-a154-273ff7afa6e2", "comment": "Malware payload", "value": "f20d80673589404956121ea1ba6c81a5567bf9bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567959, "uuid": "c42c2da4-d1e6-4bdb-8778-8311ae3bd35e", "comment": "Malware payload", "value": "787333c3cefd641f171944badc0d802348fe0e531e37fa8de8f7ef7b34ef1d64853023844df539d9579560bf19887b7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567959, "uuid": "7f24cb86-60f7-4ec4-9a33-7b9e3e16397a", "value": "T1E2034B47E603C0B5E81B00B12137A373C677D9BE90E9DB56CB699936EC6281163277DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567959, "uuid": "61cfd5c4-6e9b-4d63-a44b-b8684af5f3af", "value": "768:8ZefvkNCq7DmR43XPMX4EOOaKoiq2bf8LrParAXk3IC:8ZeWCq7DmKnjEB3ttbCjarAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655567959, "uuid": "ccea90c9-88ae-4ec5-9874-33f4e1474188", "value": 39572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655567959, "uuid": "8e3d4aa2-6658-405e-a5b4-8fbe816199af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567959, "uuid": "990cc142-44db-4d9a-8d39-65ec6b66bb3c", "value": "x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98b1e9b0-ef0b-11ec-93bb-42010a9c0043", "comment": "Malware payload (IcedID)", "timestamp": 1655559362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655559362, "uuid": "65c9ee62-461b-457e-891f-a6d70c80ac2a", "comment": "Malware payload (IcedID)", "value": "b353dbcf3117f1893de7c1fca72c33ac", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655559362, "uuid": "d3df0b20-191c-4cc6-8862-9fa427c3839c", "comment": "Malware payload (IcedID)", "value": "1f84e1d59a892c266ae192aaad311d4b66671f5bf7ce7029bd902a4859bb3e12", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655559362, "uuid": "7152b353-3f85-4440-b2b3-213f4368c372", "comment": "Malware payload (IcedID)", "value": "0a6ba772813e6bc891671c612ca694dd0c1d399d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655559362, "uuid": "834dac55-7d92-405f-a86b-e91a920e66b8", "comment": "Malware payload (IcedID)", "value": "25d37fee1aec9d9c29868952cfd40a88e2123dd5dcebc12795143524becf59eda30eae17271b747c79b8db74489f9e7b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655559362, "uuid": "d548857b-8920-4062-88d1-a51c3b7cc4d5", "value": "T1EBD4B0B875047DD6AA7E477BCD96ADE813B627628EC7A4CD806877C305A3375EE02804", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655559362, "uuid": "1d7ae116-6f38-40cc-92a7-ff181949f87c", "value": "12288:FYxdoSYW7bMLxiVhUeim1ZZxqgroRNIj2ce/epyzHfTJ2I91ajZ:mxdoSYW7WGURYrxqGiij2ceGIzHrJnfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655559362, "uuid": "85a20e33-eb04-404e-824c-ec7e8577269e", "value": 614400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655559362, "uuid": "b7367ddb-c448-4dc9-b877-6bd49c597f88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655559362, "uuid": "0a6ad240-2d5e-4831-9efc-46ffaac36fc9", "value": "b353dbcf3117f1893de7c1fca72c33ac.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff71625a-eee0-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655541066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541066, "uuid": "481ecc86-3a21-4fbe-8333-7676efd92b14", "comment": "Malware payload", "value": "3180cc717538925c4104e03dcded46e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541066, "uuid": "b46bdacb-e335-45eb-babc-4c3bd4a18f96", "comment": "Malware payload", "value": "208456d77b3702b1b5ae05273327feca114be373ab54c8e26937e54a605ee2f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541066, "uuid": "e2b522a3-a560-4b78-a7b4-1c95cfb80cbf", "comment": "Malware payload", "value": "8799a593c8f39e6f82919d74179ad4bd713fac15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541066, "uuid": "c5fc0770-6d1a-4607-bd8d-4896b5c90fba", "comment": "Malware payload", "value": "072e732d0a901334e2c40696559ff13c9d27e035bba8f13809ed075d4a836442eeaebb99295a2b6d2545a79c78efc238", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541066, "uuid": "c7311b15-6b8d-4449-b03e-277c0afae4c1", "value": "T10E43E14C7BC90A12D1BC827936BE436B7775F50A9CF2D79AE828514B484B3C749163F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541066, "uuid": "524f2947-1a10-466b-aa6b-2bfd05d49e3d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541066, "uuid": "241457e4-70cb-4fad-9669-5b8eb103da49", "value": "1536:HFy6BMh5Bzn3OVF/CprNvcewLRcT12fNnkL8a1ZO:HFy6BC5BzeVFSNvcNLRcT2q0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655541066, "uuid": "ab61e278-374c-4484-b967-8a1eb97f39e6", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655541066, "uuid": "7a81063a-cceb-455d-95e6-de88a8f6a489", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541066, "uuid": "fbe34286-324d-4b79-a764-9ae3cb3068e8", "value": "Client.exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8b1850d-ef33-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655576596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655576596, "uuid": "808727d5-4d34-4761-b2fc-c65fe098621e", "comment": "Malware payload (AgentTesla)", "value": "8eb076e20d96be65d2d8fcf75264735e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655576596, "uuid": "e94bbea7-2e88-4f71-9885-23878c9773a7", "comment": "Malware payload (AgentTesla)", "value": "20e446521a65a3904de1e6eb9dcccc1bafec649c82537ad5d124eb4db803ea80", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655576596, "uuid": "feaee8e3-67aa-4a43-843a-96adb5c3b751", "comment": "Malware payload (AgentTesla)", "value": "9e99d3bd906378a3e2c9a09e3cad0727bfcebd20", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655576596, "uuid": "66a21722-9971-4757-82d0-2e33f84fcb61", "comment": "Malware payload (AgentTesla)", "value": "da0ee8e296c99a9e1549881c407d96ef4b4728913416e79e16c051c3e4fab0991f28a252d32527bee5dea6529b4a9ded", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655576596, "uuid": "d7a578ed-07e9-4faf-a0e5-f0f897ca41e6", "value": "T14BA42313C4DB5F66EF9631EA4C2D10AB8E244C2C33DB5A3F0619978B2ED8D85D1AB153", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655576596, "uuid": "dc87e796-e720-4567-b6ef-9e3542340130", "value": "12288:plCqTQg7PW1iUe1U3hqkdcAGFoQbxS39kLkjhd:plCDgz7UDUkeLFiuLwhd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655576596, "uuid": "6708ee71-5b62-4b19-a15e-dc5fe521dde7", "value": 463587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655576596, "uuid": "25918dec-6c27-4d70-aa61-21869f03f393", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655576596, "uuid": "c0b9b3e7-56dc-4d32-b10b-2c95de787011", "value": "061822Payment Advice.LZH", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bac4ad8-ef06-11ec-93bb-42010a9c0043", "comment": "Malware payload (IcedID)", "timestamp": 1655556978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655556978, "uuid": "994ab28a-bbbc-4084-a2af-ffd99e265ea6", "comment": "Malware payload (IcedID)", "value": "abbf5df1f6a680d39d9a1ca29c1173da", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655556978, "uuid": "f6c496db-bc49-4373-8938-d855b14b3254", "comment": "Malware payload (IcedID)", "value": "20f825cd68b183f9ce5dd3448e75b48a935eb51b077edb6dd595ea388b75b0a3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655556978, "uuid": "637eeba3-1809-4119-a6b0-27b876ad1524", "comment": "Malware payload (IcedID)", "value": "c3ee31cd67e2397ac772a452b2df663a15209a34", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655556978, "uuid": "9e6482bc-fea1-4692-b00f-ef5ff56eddce", "comment": "Malware payload (IcedID)", "value": "a364a53a861aef35a2d70939613201cc2d962d675cc30bb95b6a2534b0b3018a9082a4f16c45222062481285f7bd0b7d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655556978, "uuid": "9e49c93e-3a33-4b0d-81b4-1ed06ec373aa", "value": "T11ED4B0B875047DD6AA7E477BCD96ADE813B627628AC7A4CD806877C305B3375EE02804", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655556978, "uuid": "a7ef3a70-6ba2-430c-8556-b7a83ab17e6f", "value": "12288:BYgdoSYW7bMLxiVhUeim1ZZxqgroRNIj2ce/epyzHfTJ2I91ajZ:KgdoSYW7WGURYrxqGiij2ceGIzHrJnfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655556978, "uuid": "e3c3dbe2-fda8-4501-bac9-9534e18332b0", "value": 614400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655556978, "uuid": "5966ae7e-0129-495b-83a5-071ca2c3f27b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655556978, "uuid": "715985ae-a614-4d1d-a7bb-7297cbf0dfea", "value": "abbf5df1f6a680d39d9a1ca29c1173da.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bc424e1-eee3-11ec-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1655542080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655542080, "uuid": "fba0b057-5c87-4782-a81f-0a32f39b696b", "comment": "Malware payload (Gafgyt)", "value": "1cd104cd5351a8a5166eea171ec86322", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655542080, "uuid": "16931e77-2c22-4f37-b19d-2277461183ef", "comment": "Malware payload (Gafgyt)", "value": "22294f45a7d9ad3201e242af9b525855c14c78781276688e7b55df62ced51530", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655542080, "uuid": "2ab73205-d2e7-45d1-93ce-fe3ea53fcbd4", "comment": "Malware payload (Gafgyt)", "value": "9575f6f132840e5f7014ecf8a93c5e020d3bc8c2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655542080, "uuid": "885644a4-72fd-428d-bded-728dbf3975a5", "comment": "Malware payload (Gafgyt)", "value": "66f70e0b85c44d25eac69745aa5d0c1e885601629e717b5919396496ac76301c7b7ec503ea15166ffd07cfd3741f7b3a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655542080, "uuid": "83171586-117a-4942-8147-92fa11369d88", "value": "T16953F16312036147CF2036B6E6EA5E2B49674BBC609EF1B13071A71E67E4C9076F4D8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655542080, "uuid": "47738508-142c-407a-af9b-ba4025ce64dd", "value": "1536:fOPG1sHhwb2f+Ad8dvltjTpEKCGtjme2L509bz1U4XIEe:f52hYvBXjTCijme2L50Ry", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655542080, "uuid": "341f3f44-37a2-4241-b6c2-9b916d5ba267", "value": 61944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655542080, "uuid": "4c8d0888-be8c-4a34-b184-b045f9b0f0cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655542080, "uuid": "1a02ef8e-cb2f-457d-a0dd-11188455b9f8", "value": "1cd104cd5351a8a5166eea171ec86322", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fe64144-eecd-11ec-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1655532611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655532611, "uuid": "6d59525b-066f-40af-bc50-f6ebbe9a886f", "comment": "Malware payload (RemcosRAT)", "value": "dac30ffff266ed8b7aaaadde0dd0df1c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655532611, "uuid": "3f135126-6260-4b49-b23a-ac35bb134e5b", "comment": "Malware payload (RemcosRAT)", "value": "24bd6994df7331d8a622b287b239a4c50f3aebb29eb0072d04d7c8063cfe7c6f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655532611, "uuid": "4b059cfa-f627-44b2-84bd-f908a0ff640c", "comment": "Malware payload (RemcosRAT)", "value": "0efdc41f68d63897d47fd935405739a088b09189", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655532611, "uuid": "49d51d61-20db-4923-a75b-be459e8f7b04", "comment": "Malware payload (RemcosRAT)", "value": "4946e4eeefb2d08a0d326ca6750eb28898426ef45543e245e8ccd7e63ebdcb43655dd3ea5aa78401ff5f1aa5852380d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655532611, "uuid": "3ad9cdb7-b2d0-4818-a1a9-d4a1b9db406a", "value": "T1EAA4BF11BAD2C072D97251340D29EB35DEBCBD202935857BB3E61D5BFE30180A72A6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655532611, "uuid": "afeaa6ea-f5b7-471c-9f5e-e10461b03a53", "value": "029a987f21e33b48f24d21b6f9ff1129", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655532611, "uuid": "5090197f-6fbb-495f-b075-8ce5eedbcb00", "value": "6144:hOFBH/FMNjt18F+9a/NgAeDB4CcOtKp03b13a4LJ+sAOZZPWXbTcUjyg:hOFtiNBuFgawDB4NOmuwsfZPkyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655532611, "uuid": "891cb0b8-8d73-4694-8195-4cea864b7dac", "value": 474112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655532611, "uuid": "f34634da-f256-4e00-803f-6a55e17aff4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655532611, "uuid": "ffd47896-c97d-4846-99b9-3e41111a2272", "value": "dac30ffff266ed8b7aaaadde0dd0df1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dd2885e-ef27-11ec-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1655571182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655571182, "uuid": "b9fb6ac6-e186-4056-bfbe-4d5ba8c9707c", "comment": "Malware payload (AsyncRAT)", "value": "574a73d2e22a1298f821feaa9dca95ef", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655571182, "uuid": "8d7ffda3-93f1-4538-addb-eb1b5518df62", "comment": "Malware payload (AsyncRAT)", "value": "257bb979b170c1e86b2686de2f3a4bfaf1dd62645a909d57d2f7ca01738b0bc2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655571182, "uuid": "a6ca2883-4caa-4366-b506-e2a59349b112", "comment": "Malware payload (AsyncRAT)", "value": "aff46b7d8c0164a9a778c8ba8b4cf20cd4066b56", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655571182, "uuid": "81a27d78-13eb-44fb-acdb-535c25cd6027", "comment": "Malware payload (AsyncRAT)", "value": "0b4bcadf33a0e2799e5fa8dd8e0e269c9c9ddfd0827cdb0883e11bf4d22640f715be47e936dce9bde114f66d4303bb7c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655571182, "uuid": "e7dd22c4-00c2-4deb-988f-3b579e689e95", "value": "T14E743A9BE346A984F2282C7A1562D9FE51B42E656820D01B70E5FF7FF2315431C8B87E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655571182, "uuid": "43abf1a4-86b7-464f-b76e-58d6117a231b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655571182, "uuid": "32a4b804-2df8-43c4-b75a-0202c8dab342", "value": "6144:/u6HUzotgwbi8+HtKSLGL3S3aSGtZGtVGGNidJIaGTGK7GspbVGwdy:/ttgV8e6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655571182, "uuid": "ac21b79d-8040-4703-bb04-be4246b761ae", "value": 342528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655571182, "uuid": "fcdc9996-08fe-48f6-ab3b-26caa14731b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655571182, "uuid": "04851ff4-c311-4bcf-baf7-9870d3fe741d", "value": "Malwarebytes Gears.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06964b2e-ef4e-11ec-93bb-42010a9c0043", "comment": "Malware payload (FormBook)", "timestamp": 1655587893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655587893, "uuid": "9aec8b8e-fbc0-47ae-8bf7-6b63d5df0216", "comment": "Malware payload (FormBook)", "value": "2f54478ff3ea553fd34af1a0d207d704", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655587893, "uuid": "de5c35ed-bbec-4660-a7be-1b322225e79e", "comment": "Malware payload (FormBook)", "value": "259275b0c056a9fec50378b2d268c48447e8ebe8827e8e55aae4484aba8b1939", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655587893, "uuid": "4e4c6723-e23a-4ef8-bf14-b64a48f73462", "comment": "Malware payload (FormBook)", "value": "20a9f40fe6b15c8fe7de61b85a730e01c2b71661", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655587893, "uuid": "1bd2aad9-0b3d-44fd-9596-d51cce08ca23", "comment": "Malware payload (FormBook)", "value": "7ea5a4c6d7cff6129c47c7da99ca4136daf7448f5eae5ae4350a2c1c9f0d0bf0d884c3d0738939004226b6e761be3af1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655587893, "uuid": "b4d6c17b-2a8a-41cd-a555-879c9595ad2a", "value": "T1BCA4AD20229C873DD33E7B7612A0224F63F6E51193E2D65F7DE0528B1C5EE758B22B16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655587893, "uuid": "06702426-b236-488b-a580-0324d6f73de2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655587893, "uuid": "2dffea6a-3273-47a2-936f-d3f83ed80de1", "value": "12288:EjVP6oZRvzhkVuXXkLfz3gUxxzou3i4c+uHw8k:iVCoZNhuq6Zxxz9c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655587893, "uuid": "0e62c0a3-6913-4b0c-b262-c25b02696792", "value": 476160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655587893, "uuid": "e66eba79-88f2-4c73-b5c6-0d7bb635f55b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655587893, "uuid": "349a389c-99ab-45f0-9a15-6a1bc2b0a120", "value": "SecuriteInfo.com.Trojan.Inject4.7626.27045.4610", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6298b4ae-eee3-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655542092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655542092, "uuid": "49ecfc9b-9b6e-4c26-aa70-b0eb445368c6", "comment": "Malware payload (Mirai)", "value": "4050327d864521ebd1c3d4ad27b390d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655542092, "uuid": "cca52fea-8ebe-4910-bf31-1d05ad4be132", "comment": "Malware payload (Mirai)", "value": "25ccabc91c4b000d3db97e72fb0afec5bf0dd44144f1514fda3dcc8b90c69d23", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655542092, "uuid": "56c75b61-0052-4454-8cd9-3b551acc5411", "comment": "Malware payload (Mirai)", "value": "ead5b5946331607157bb7415157121b868893b36", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655542092, "uuid": "abc43152-fc28-4748-96b2-d896dd497d58", "comment": "Malware payload (Mirai)", "value": "71635641d2c9223e65cfb09dc3e9a4e303737c5f9b6bb8cb82fd9b9ad91857a8e5c291eb206a0028c4613c8091db152b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655542092, "uuid": "1b0f545f-99c3-4077-be33-071474dbc5f3", "value": "T18BC32B273B231E23C0C9547102E31331FAB9DB6938B953D7E9D06DAC2F26A943456BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655542092, "uuid": "3f979ad9-d3d8-4e23-b9e1-b8624b9112eb", "value": "3072:/YNa/GLBNPoQEphakpiQ9/nYEP/UnSQf/R:6a/ylojphakp39/nYEP/UnSQf/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655542092, "uuid": "0307c6b8-bbc1-4bf9-a674-f82e6f2cc2f5", "value": 126929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655542092, "uuid": "804229d8-a1d9-4667-8c26-70da73a9e4d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655542092, "uuid": "4f85754e-20c7-465f-809f-75ad974b5ec6", "value": "4050327d864521ebd1c3d4ad27b390d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5750f38-ef58-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655592562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655592562, "uuid": "bfac0d86-d7ca-45b2-85df-99078ea6119a", "comment": "Malware payload", "value": "ffdd7b87bd478145223fc12790103ee5", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655592562, "uuid": "38d62381-1818-462f-8292-7c7819e8648c", "comment": "Malware payload", "value": "25f730bb8736c19189a0102603a2cbd0cdd6d3664f5a4432fcf3f73b42014d76", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655592562, "uuid": "24eaff1a-e21e-4a1e-9411-5806a68b6dfd", "comment": "Malware payload", "value": "8b981a53c2e2699d92aea62191f1df66476dbaaa", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655592562, "uuid": "ff3f1007-c022-4777-83ac-d4debbd35b25", "comment": "Malware payload", "value": "974bd78589ced0ca1b552d790f4427fc02b8719d822a3c2e49124ffc7a79cea87748a39b31aa600e1576a02497bcb984", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655592562, "uuid": "7835d31e-de59-4b48-8d13-43ac04ef3e1a", "value": "T1AF8312E1831E9C1545B2B91E882CCF59584FACA44598DB9FB039444B73B8F6325117EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655592562, "uuid": "6138c2f1-6783-41ad-be8a-3afbc6f86fa9", "value": "1536:u4PuVxyCcaGzDr2NmPS85szzlQ5bSP6KTLbvIpFL5MQYuFivqyM5FhAZhJrCX:u4PcyC7EDr2NmPozeg6KTHvIn5MnuF79", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655592562, "uuid": "9fe2b4b8-52ee-4ab5-a32f-289d0d25e883", "value": 84992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655592562, "uuid": "f4a966d1-253f-4418-90ce-70f47dae7b2b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655592562, "uuid": "403e42d6-b5bb-4087-9d6e-9f31e3e470fe", "value": "lista+de+pedidos+y+productos.PDF.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62bc71b4-eee6-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655543380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655543380, "uuid": "58e4e494-f5ec-4e7b-9cf7-646cb6483e58", "comment": "Malware payload", "value": "406cd2bcac9b23b19065a9729dccc381", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655543380, "uuid": "2a02e7b5-0680-4e28-a698-c99d34d0ff68", "comment": "Malware payload", "value": "262ba468da62c43265c8613ca2a4b5e461f0dcb51881cbdc6d7c7dc1018cf213", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655543380, "uuid": "fc614e6a-b55e-447f-8055-9923948dbf55", "comment": "Malware payload", "value": "19b6f9c525acc8dd0e99daacf3d629b710770cde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655543380, "uuid": "b84b19d0-93be-4837-883f-ed5403c1bee9", "comment": "Malware payload", "value": "17ae21c641b79668c818a5af1d64480ca54729cdccb7af8c14b824b9b8b5ef710189e51ad58f6e31ea34c7080b1ed264", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655543380, "uuid": "023cd738-307d-4898-980d-9b059fd5e9c5", "value": "T1CE63F756F2D358F8C26BC17486E26732F931BC124134AF6D57A4FB312E16E60AE5E720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655543380, "uuid": "f281c088-7ce4-48fb-93dc-f1bfd8503298", "value": "427d9adcbfac8be53d865e8dcb0bdd6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655543380, "uuid": "3b6a5102-706a-48d2-81a4-416f07c37596", "value": "768:ZtlGfs7aFQXcffr36NfxZky2YA/qpwz2nj7sJsAzShkJN/XEKaKPlUMgOPm1FhuR:xG6kQaf2NUm0+j78wvMlUMlP/pe2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655543380, "uuid": "430a7755-6f44-44eb-8751-f58c8911fbb6", "value": 72704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655543380, "uuid": "6f69bdfb-fdb7-4654-8db3-762f42362a9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655543380, "uuid": "6ba7f46b-3033-482c-9b70-879c50c3fc69", "value": "23s.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d915130d-ef18-11ec-93bb-42010a9c0043", "comment": "Malware payload (IcedID)", "timestamp": 1655565054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655565054, "uuid": "f9ed0fa5-1806-4157-9eb4-952ecc7935b8", "comment": "Malware payload (IcedID)", "value": "c3b5e0562a3128c8eb6dea414fdc03c8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655565054, "uuid": "bd1695d8-dc65-45e9-b9b3-7027c867e3ac", "comment": "Malware payload (IcedID)", "value": "2746749049b4fb2cfe4ad433e25df8bdc5e14e746282269ccc0134d34ea7b09b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655565054, "uuid": "bf29cf07-dee8-4e56-b980-94541c8ef598", "comment": "Malware payload (IcedID)", "value": "9d668bbe8c3034e1dba0948cbd4ee594911fc567", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655565054, "uuid": "79511cbb-0075-46ec-a766-aca9e1ded856", "comment": "Malware payload (IcedID)", "value": "697efe0f582e016fd1f60391967266f18c467abda993a295f7240622915c7b7317d4e7a12543ca472f03ce0798cdc1af", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655565054, "uuid": "7ba54fa2-1784-489d-8f3e-7e31dea04d0a", "value": "T1D3D4BFB876047CD6B66F577BCA966CED13B62663CA8BA4CD40647BC305A3371FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655565054, "uuid": "ca3b7136-5b4d-40a7-bc7c-13091a6ea316", "value": "12288:zHa5otQOxWeQqZjPnPUAUwsFaH/k1Oe93cA2Bt82AyelVGpZYQqJkEZ1z:7ic5QqZDnPU0b/k1X1c5BaVip2d1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655565054, "uuid": "972e46d9-37a8-47d9-818a-2e7d65d13255", "value": 614912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655565054, "uuid": "bd3626d2-d618-4ce8-ab65-33f606407536", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655565054, "uuid": "c3f5274a-f56a-4fee-aa28-dc23e8bac0f9", "value": "c3b5e0562a3128c8eb6dea414fdc03c8.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d1d22a0-ef16-11ec-93bb-42010a9c0043", "comment": "Malware payload (IcedID)", "timestamp": 1655563852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655563852, "uuid": "fe2d1984-07b1-4221-8ec3-20ade5425a98", "comment": "Malware payload (IcedID)", "value": "bef20fd6573c02bcb136974048c6e173", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655563852, "uuid": "c6253093-49bc-4356-aad6-aed63975e9a4", "comment": "Malware payload (IcedID)", "value": "283cf54e73056f4e644496d2a9bf4fc61a0fca4379ffbd1543da371d5df6320d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655563852, "uuid": "feb5cf9f-ab02-4e2e-a46b-8d925dd904cf", "comment": "Malware payload (IcedID)", "value": "35cf629945607e82d48e64a13648f8c08592bf54", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655563852, "uuid": "016dccef-3ebb-4b11-be44-ea13d9dc58ee", "comment": "Malware payload (IcedID)", "value": "955160e01c38e20778b037426aeeac5641305e9bd88ed4fe4acacec172279ad062b9914fab1dca62425556bcadfe0c0d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655563852, "uuid": "8e80ce67-efdc-45d7-a1fc-2e6254f6c961", "value": "T1EFD4B0B875047DD6AA7E477BCD96ADEC13B627628EC7A4CD806877C305A3375EE02804", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655563852, "uuid": "3e10bdf3-4b82-4e17-93e9-eb92a9e50294", "value": "12288:aYldoSYW7bMLxiVhUeim1ZZxqgroRNIj2ce/epyzHfTJ2I91ajZ:VldoSYW7WGURYrxqGiij2ceGIzHrJnfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655563852, "uuid": "f9748a59-2608-4e63-b391-8cfe2dfde398", "value": 614400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655563852, "uuid": "c89620dc-66d9-45db-b8fc-d61894aa764e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655563852, "uuid": "2244e4b5-6037-431d-a5fc-2f596f54f0ec", "value": "bef20fd6573c02bcb136974048c6e173.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e30f85f-ef1f-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655567800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567800, "uuid": "b9e35d70-3504-469c-bb19-690c6695342a", "comment": "Malware payload", "value": "868fc43b13e6d26fae090d62afb1af4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567800, "uuid": "e2d65dbf-5339-45c9-a895-28ba797615c6", "comment": "Malware payload", "value": "29712e28c4b2674caaea2e1f362a1d9228f1b2e2be6e375fa27442d5157a8e29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567800, "uuid": "983e4ccf-2313-4d76-a6ba-423f27525d86", "comment": "Malware payload", "value": "ba726e049912a85a20aa39ef198dd30ea0cdb84c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567800, "uuid": "f00b3be9-034e-4fbd-a2d0-2783b008478d", "comment": "Malware payload", "value": "813e23cbdc465c1a22909285674601a67fb7520417e0f5181d3da12a56efa137357f9da630805bf8daeeb63133ebd993", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567800, "uuid": "d5f881a1-134c-485c-a1b7-b37711d2d30c", "value": "T14D938C9FF24B0890C8128AF04BC36B9D3E232261DE5B98F73D1E1A7A29751DF59067D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567800, "uuid": "a688d1bb-cb9d-42bc-a09e-5a5b264c71ad", "value": "768:wo29ejwyNJye7KYmpZYJuWsMfPoYmI5Fck7CEJLjHAtE4gVKLTYwI554RZh7IfuL:wo2gN57mphHFY1biEdj2gy/LW3W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655567800, "uuid": "1fd2c31f-87af-4e63-914c-07d59ca66c4b", "value": 91884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655567800, "uuid": "dded1591-280a-4cef-a9df-2dcddc0b59f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567800, "uuid": "a0702a41-9307-4c11-a6be-923b35328643", "value": "s.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "457f9636-ef29-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655572108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655572108, "uuid": "bfc0befe-046c-4e39-af8c-6731a601bb36", "comment": "Malware payload", "value": "44dc17df78be74c433cca9d04fce0b4c", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655572108, "uuid": "3e890a80-dc79-40ca-9ecd-3632819d92ab", "comment": "Malware payload", "value": "29bfcdb8164725fe1d44b9c85f1c35dda3b718b104c48c077dfeb82f495abd0b", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655572108, "uuid": "b933977d-66f5-49eb-b14b-29aa4533b75b", "comment": "Malware payload", "value": "e8c71f2ee23125ffea355a9cc12a17bc55f8e23a", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655572108, "uuid": "d57c01d8-2f56-4c2e-b6bd-d3363f3d6092", "comment": "Malware payload", "value": "371eeb6502694a302318c0dc17290b2b19b752c52eb9e686ea4550f668c0385de989e9bb9e5219eaba1820152e62f63d", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655572108, "uuid": "24f481e8-0461-4829-9cae-1bc742d315cf", "value": "T1805633640D3D2D9795F95EFD026F2D338E3D272948963F0A3919183F42D7522E8938AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655572108, "uuid": "8ddcff54-6ab0-45c8-916c-5fd02f6f3302", "value": "98304:OMm9NOw96YCsNOBGEXNxUwVJdkoFc6/op1Be6M4XUDLtI/h1e8keeryJ:OMm9gw9tb1wpAkooP02tIZ1e8kOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655572108, "uuid": "437a9eff-3c13-4ce2-97d2-cdef1bb7f253", "value": 6143918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655572108, "uuid": "54c8c536-a215-40e7-bfca-a584368b43a4", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655572108, "uuid": "e56b17d6-12c1-409b-81e7-875cf11cf272", "value": "rust macros.rar.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50ab6c49-eefa-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655551940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655551940, "uuid": "0f5a4293-97c3-4f06-9f27-8a2419ce8a6d", "comment": "Malware payload (Mirai)", "value": "e4af5c3b06acf4b553733fa09da6768b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655551940, "uuid": "7071a5b4-532d-4110-bf6a-aef3a6275d06", "comment": "Malware payload (Mirai)", "value": "2c6bf2eb724071584ee19a76caf61c778fb9285c1d4f2e09ea46d226c863b162", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655551940, "uuid": "0a0cf01a-d60f-4f29-94cb-daf14558d9e8", "comment": "Malware payload (Mirai)", "value": "5341cea35122aeb5dc1b867a4eabd0ebb5c87e65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655551940, "uuid": "865f50f6-c065-4c64-9c2f-a663b1404d3e", "comment": "Malware payload (Mirai)", "value": "d7de0903e53a7a857d0d5f001c6bd5cd9fb3ae5d80e00ceb2a9b150698812a5d21c66d9de4ac079e232de6ba765bb3c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655551940, "uuid": "6fe8a372-054c-49c8-a563-7f291efe2264", "value": "T182335CC59AC3D9F6EC12067621779F77C737F1692025EA87D398A53BED12602A10B38C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655551940, "uuid": "bcb85d61-0816-4662-af99-66af6d26c3e7", "value": "1536:r7LUk1I8i5wXkj2mBuWs6ZikeaRwDmK1pSCT1:m8Mj2mkWsyizaRO91dT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655551940, "uuid": "3829b0ae-9f64-4f0b-826c-d0e092c0bdf8", "value": 54576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655551940, "uuid": "01491b48-8178-4e86-ac6f-1fb13822698e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655551940, "uuid": "e2b22892-41b8-4caf-9f90-97e7df88b8d6", "value": "ZG9zx86.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6170d543-eefe-11ec-93bb-42010a9c0043", "comment": "Malware payload (DarkComet)", "timestamp": 1655553686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655553686, "uuid": "295f278d-5b35-4526-9ee7-65b015132e88", "comment": "Malware payload (DarkComet)", "value": "b29a3f72100e48f0122e75a2280f13c0", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655553686, "uuid": "caa3ecea-aeee-4c9f-9e32-8c2f15251827", "comment": "Malware payload (DarkComet)", "value": "2d45d900fec91d72f0e034e20a6b9a88790a67dbc655638baa24741f375b6f62", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655553686, "uuid": "9b60494e-1143-4e23-a842-b39cfcbfa80e", "comment": "Malware payload (DarkComet)", "value": "4592ac347999cc134770f30b6935053d85c8cc59", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655553686, "uuid": "1ef81814-7c08-47f5-bd43-a585873fa2a6", "comment": "Malware payload (DarkComet)", "value": "a8de8461f973e5cbad2df5d3eb0ba80c29b740b6be5add6dd500d38ad920eab1912e0eec4853d3e527a4396e2ed2dbae", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655553686, "uuid": "1affea66-2e36-4541-b41d-5355b70fc8ff", "value": "T158E48E31F1808837D97219789C5F92E6982A7E202E39754B3AE62F4C5F3D6C239193D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655553686, "uuid": "5a74e350-7fc0-455f-8407-e01290016389", "value": "e5b4359a3773764a372173074ae9b6bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655553686, "uuid": "3cda354d-4ef2-4503-ba0b-1e31a833699f", "value": "12288:y9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hg:eZ1xuVVjfFoynPaVBUR8f+kN10EBa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655553686, "uuid": "e1d601e9-0308-404e-8ee2-04440d25c7fd", "value": 674304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655553686, "uuid": "0fc91f7f-03c1-46ec-a834-2153203552d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655553686, "uuid": "1d2961da-1f2d-4d5a-a71e-9103c25cd72c", "value": "denemestub1.exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44beb4bb-eefd-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1655553208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655553208, "uuid": "d6f57e39-6108-4486-b8c3-ac59ca7e6cb4", "comment": "Malware payload (RedLineStealer)", "value": "a643d3bd11b33a9b3009880a4d7b371e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655553208, "uuid": "a0831698-8072-4ce3-be89-dbd787db7c95", "comment": "Malware payload (RedLineStealer)", "value": "2daf3cbbd577f1c77a9ee93582c9faa564445669e1cb6ffdc772abfc69004a72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655553208, "uuid": "b0b690e5-34b7-4b3b-8b6d-a6e973f9ab75", "comment": "Malware payload (RedLineStealer)", "value": "2571dff037b1d67f351d70343736dcf421c579a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655553208, "uuid": "b0bfb618-f830-44e6-86cc-b8f2c3c8a059", "comment": "Malware payload (RedLineStealer)", "value": "1bba2cd81a61d0f05009e9ec4b92090e5b88b20638835859cdb50e61cdacd8fe1e85b0e0ceb2f3decd47671d106aee95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655553208, "uuid": "5645558a-2fe7-4449-a193-f7db0cd11f92", "value": "T1B2B509035A8B4E75CDC27BB461CB633B9734EE30CA2A9B7FF609C53599532C4681A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655553208, "uuid": "e9be7cb1-b6cc-4ec3-bf85-827e445167f8", "value": "173f21264bb93a9594f52769c5258a5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655553208, "uuid": "c7b10f49-8bdf-4706-8e5d-45f1b1810d1a", "value": "24576:bY5JxPXrLW1rfyP18TZWmD8/KWJ7YEi01dDuQ5p3h3u:s5KfLIf7YS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655553208, "uuid": "73e1db66-ca23-4080-be58-3756d4f97707", "value": 2346257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655553208, "uuid": "85cbca71-87e2-458d-8778-a76833672b91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655553208, "uuid": "9d00fb31-ad88-438e-a03f-eeb801ce6f5d", "value": "Loader.exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f09de1ce-eef5-11ec-93bb-42010a9c0043", "comment": "Malware payload (IcedID)", "timestamp": 1655550061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655550061, "uuid": "f71f972b-8b10-4214-bafa-3e9cf8b38739", "comment": "Malware payload (IcedID)", "value": "97c5190f20629f5fd8afc4679f06dd34", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655550061, "uuid": "617ef676-4ae9-472e-8431-45cc76c989ef", "comment": "Malware payload (IcedID)", "value": "2eaadf2ec105d8be345146c35038e6e31f8848763011294cd0ad1f556dc1d9dd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655550061, "uuid": "e9d09bc3-4f75-4e06-961e-70dab3509844", "comment": "Malware payload (IcedID)", "value": "1b1f87378f514896eba5457e497a8d99f8a47e5b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655550061, "uuid": "785c7415-7f2a-49cf-89f1-ee4ccb4ed1ff", "comment": "Malware payload (IcedID)", "value": "39d8adceb09e7617d416bc5d66a0f5db1eb4aa25b49758ee8da598145c1748d8f68244819e462555a3c161dc2e85ac73", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655550061, "uuid": "61bbfb06-50ea-49b8-8eb7-606811c57be8", "value": "T17CD4BFB876047CD6B66F577BCA966CED13B62663CA8BA4CD40647BC305A3371FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655550061, "uuid": "823f7942-a35c-4459-a5f3-c8987430be19", "value": "12288:oBa5otQOxWeQqZjPnPUAUwsFaH/k1Oe93cA2Bt82AyelVGpZYQqJkEZ1z:aic5QqZDnPU0b/k1X1c5BaVip2d1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655550061, "uuid": "e08de3f0-98f3-42d2-b297-c238e226ae59", "value": 614912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655550061, "uuid": "1f1dd5ef-1437-45af-b9db-071c7b62cafa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655550061, "uuid": "b76b3b41-26e8-4663-8d90-43a0b5882aa9", "value": "97c5190f20629f5fd8afc4679f06dd34.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72f0218e-eeeb-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655545555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655545555, "uuid": "dd46f666-23e3-4e15-b2ce-e3940cd62091", "comment": "Malware payload (AgentTesla)", "value": "c254a6b8dc85e44cd20091ae8065f3f5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655545555, "uuid": "bc02b4b6-15fb-4f21-866f-c53ca7ed9e57", "comment": "Malware payload (AgentTesla)", "value": "2ee5e49cc83e9e221b15a05cd937748423de703928177cdf13fe8fd922b7a9f8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655545555, "uuid": "8732d6d1-c40b-4592-aeb4-5d2648549a98", "comment": "Malware payload (AgentTesla)", "value": "79412e626182b43434b6796dcb46ed053ec98e2e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655545555, "uuid": "19a81b6c-1ad9-4d10-b050-0ccba4882db6", "comment": "Malware payload (AgentTesla)", "value": "28049d5c51c4a3db11e5370608ce022e7b3af311db8550123d53139e4131e40996b418f6b7376763ce8600b38831eb52", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655545555, "uuid": "e4c9b257-d19e-4494-a880-c549203bf636", "value": "T16EE4025176F976A7D2DB8B75D078296067B23767C824FB0B20A40ACE0EAD6435601FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655545555, "uuid": "8b9b6c74-17f2-46e3-939b-a7d6427f106c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655545555, "uuid": "db244b18-c689-4dd4-b6c0-9123bcd7f6cd", "value": "12288:3aigGGVwDk56bsjcmlQdcD/DD2N4jVENK7Dx+wtIU:3aigGGVws6bpmTbD2+E2k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655545555, "uuid": "533067c3-c2aa-461a-80ca-8166a9c2ed82", "value": 705024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655545555, "uuid": "b0f25ee7-e9eb-471f-a94d-3d6145ace977", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655545555, "uuid": "94aeb100-4cb3-4767-9b11-58d70d97caf3", "value": "SecuriteInfo.com.Variant.Tedy.124427.2266.7369", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d447d836-eea3-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655514795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655514795, "uuid": "13cb8757-7507-45d2-b7bf-efa046e3bcf1", "comment": "Malware payload", "value": "37d10b00861bd71db15a53683fd134fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655514795, "uuid": "6faacd8d-02eb-4511-bff0-9c2777fdb6e9", "comment": "Malware payload", "value": "2eef102af89502af920b7a436f6d7e191f6caaf7c190b1e3ba608f11eb1894e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655514795, "uuid": "2519063b-1fa2-46e9-a182-eede07e821b7", "comment": "Malware payload", "value": "b28ab1a04ba194315a40bd496b9aa578e8ecfc58", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655514795, "uuid": "05a1f0d4-5c4b-42d3-9270-c69d15f1a3dc", "comment": "Malware payload", "value": "4bcc122ae930217ebbf222a28dbaf588fe0700c99e4e5542b024820749baba2d287241e0eb2cc6b2078ae66a9b090594", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655514795, "uuid": "5a65206b-81c6-4b48-962f-7a2f47c4319f", "value": "T1AB057D35EB80F125EAE3553E87D84A5A167D023337A453CBBF498468853F2DAB43439E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655514795, "uuid": "e3dc030c-0b62-42d5-9962-0b5b32f4ccbb", "value": "c84c1027327b354a17f1cc3cd5f25f3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655514795, "uuid": "a39d589f-88bf-4c2e-a502-cc33fba5b2af", "value": "24576:JkGHNjgaefkO/gA2AUOfrFQpbswwwwwYs82ugb3tdP:CGHNjpefkO/rHFQpbswwwwwYszuybP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655514795, "uuid": "00b6bee1-3d3f-4d59-8b3a-e2f75a9ab639", "value": 858308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655514795, "uuid": "ab92df8b-ddfd-46fc-a59e-dd7667bf7c4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655514795, "uuid": "e115b6b7-f848-4959-8b0f-67e233aef635", "value": "37d10b00861bd71db15a53683fd134fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfc3aba5-eed5-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655536262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536262, "uuid": "39da0e45-dd48-477a-857a-b706af290402", "comment": "Malware payload (Formbook)", "value": "39d6e5cfe3f9929678bd5ca71753fa2b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536262, "uuid": "48e1568a-ae00-47e1-a605-fed27510fa12", "comment": "Malware payload (Formbook)", "value": "2fdf06dd322265706d4221dc6c30262b058b9ece980de002150ce6cbf6e6c6e5", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536262, "uuid": "fee11bc7-9f69-4515-8263-cd1c53a5746a", "comment": "Malware payload (Formbook)", "value": "5ba3880753cc4313b41cef56a28be5237cceb230", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536262, "uuid": "d9656cea-7272-4953-980f-5d42e9e2cae2", "comment": "Malware payload (Formbook)", "value": "b3fb17752397615bb22fea38dd6f30ed444b8b33929e3f56dbe6420ea6aad5a3aa2fbb157d288c5acaf0f0d80385d37b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655536262, "uuid": "b89cd818-e2d7-41d1-82ce-a5bf3d42d46c", "value": "T1AD33CF25BB6A1677EC63867F89DC04358E646E24750FED5BD989334FE17248C442E30B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655536262, "uuid": "f645fbb6-cf54-4576-af92-647e517855f5", "value": "1536:p6uD51RiuEe/MiB9dway+pm7YEscjg53:pD1auEeE/ygY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655536262, "uuid": "ce35802a-32ae-4316-9aba-273c5637eb2c", "value": 53760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655536262, "uuid": "40acd6b8-236f-49e7-bf1d-8c7c9e0ce7c5", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655536262, "uuid": "29f28d44-b144-4c8c-b3e7-e8c69aa153a2", "value": "SWIFT COPY.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "252891d9-ef25-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655570335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570335, "uuid": "89c39b70-d3e4-4fe0-8dc5-1020a87c4c26", "comment": "Malware payload", "value": "80823d5e62bbddbf9f556c80eba8da3b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570335, "uuid": "7d6b23ec-9851-4f6e-8abe-0ee2394e877a", "comment": "Malware payload", "value": "339d745a9ff739fb5cfa701ed061983691eedfb3b855ea42164d1cf0003a2cb1", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570335, "uuid": "7f5f8a5c-1a99-433e-b865-582ddfe1e8a9", "comment": "Malware payload", "value": "11315e65fc68748b3c6a369a9b1c2435ba53381b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570335, "uuid": "5531623c-6872-41e4-843a-2b90bafe0e04", "comment": "Malware payload", "value": "3623bce4df6d4551c3b5df224ec2b35f58cca26e9d474edfbb140840181d7262db1529fada601d82a21823969df23c2d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570335, "uuid": "0b22d446-8d07-49a6-a3dd-5cff68a5e5d7", "value": "T1C52142C9D9C553A8C4BF44BAC6ABCD55106E405869C52F9702D8D360B133F502A20CDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570335, "uuid": "9ed9557c-43d1-4023-801d-07a633ace6b8", "value": "24:7KEOd+lSlFUwQ9EExJtOLSxfk5Z7+UJbJB9XuNGX:eglS6FLtzfkj7+UJNBQsX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655570335, "uuid": "4c149c74-d63d-4612-af77-8189bec7f7d9", "value": 1124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655570335, "uuid": "e182ee9b-4169-440d-ad6d-2d76429d0e9d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570335, "uuid": "baf04dbb-377f-46be-9b20-832c3e0c930e", "value": "Copy1756.zip.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd13f0b6-ef1b-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655566349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655566349, "uuid": "d5e85eb9-ba9f-4778-beb0-2b6c67004e28", "comment": "Malware payload", "value": "860f6161106b356b710c0ae6b929ce83", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655566349, "uuid": "16b06117-21a2-4316-ae06-df9f16f99330", "comment": "Malware payload", "value": "341236a1baeacb48a5d1a06c8bd7466f5b8769bc5c1123b90e607fce5541bcec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655566349, "uuid": "a716b0fd-c5a5-4573-b9c1-009ec0282424", "comment": "Malware payload", "value": "f963ddcec08572d904c18cfbd945eec12895f022", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655566349, "uuid": "66c5510c-21e7-4e42-890f-4c0256833dfa", "comment": "Malware payload", "value": "097011bbcd794e801816f30dfbf48937a2834d679db5ef63a12c499332cacb1f6fe1ddaa0904bf26fe19eacdeaab2243", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655566349, "uuid": "4c396434-04a1-4c4b-a70e-092325bd479f", "value": "T160134A82F9409A02C6C11977FB0F538C7B2A5368D2EE3203AE295F6177D39570F6B991", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655566349, "uuid": "e983b511-ebbf-4ab2-a9c3-a64467ed4db7", "value": "768:/NuipqJ9LTCiFkM2Rb4Utzo27+bD1yRBWX0xI:Dqnyy2R8b27wD2BW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655566349, "uuid": "9fc77aac-24db-4b36-82b3-fff290d8746e", "value": 44548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655566349, "uuid": "5ced2591-0bc1-4900-ae37-50a9108bb232", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655566349, "uuid": "9b335be6-4040-4769-a20e-06e1a511778f", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab8d135b-eed5-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655536201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536201, "uuid": "ce5abf9a-a450-4fb3-962a-7ecddf0dbc86", "comment": "Malware payload", "value": "b93343996deae53e4de26e6ddd885b7e", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536201, "uuid": "2470e9c5-381f-4e51-9283-90f6507db22e", "comment": "Malware payload", "value": "370a31e8bb36a91a28175a9110098b6148f959bae030dbce62f99c8ef246d277", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536201, "uuid": "92c01950-59f1-4abd-8900-fcf29b3a025a", "comment": "Malware payload", "value": "99c680e8d5a6be60135f289b6bdef15bb657e702", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536201, "uuid": "78f068b4-ae8a-40d7-8ac7-5ebd1b91b036", "comment": "Malware payload", "value": "67c4f99b692b916b16903bb776efd8fa6d4027ce01a0f121a13ac31bfdc7ef02c5a078058753b1362b165bffbe4c7d13", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655536201, "uuid": "499064e8-7bcd-4ce0-b75f-5adddf245a94", "value": "T16344A0CED57292A5EBC0D13134BB60286CA45EAE818F76C59B5833044E3609DFEFC799", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655536201, "uuid": "2450cdd1-3e88-4bce-af8d-3458f98936de", "value": "6144:AGFguoA1FMgh0Gl0nmwYvNFmfNHqDqd/D:AGV1FMgh0GumwVfNqqd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655536201, "uuid": "a2559a1b-38b2-42f1-ba0a-30a44ae4ed59", "value": 261832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655536201, "uuid": "0a9f6b77-460d-42dd-85ad-4029e98d6eaa", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655536201, "uuid": "8633cf51-c769-4274-95de-a62fe685ab2a", "value": "SKTGCM_Cota\u00e7\u00e3o.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba7f250d-ef25-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655570586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570586, "uuid": "08d5fa34-83be-4fde-9d81-8c5999d1a123", "comment": "Malware payload (Mirai)", "value": "815ba24c77e60069baa2fba582d6248f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570586, "uuid": "9583926a-44a6-4121-99b8-388846a05034", "comment": "Malware payload (Mirai)", "value": "37c2fee0cc33f8e198b6823111e13d9bf5f8a40e0feb51e30cb7b09653e736a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570586, "uuid": "1b31dd7c-97ce-404e-884b-2b3bef09601c", "comment": "Malware payload (Mirai)", "value": "15bc05149aee2cde38e87ab546aabbe74b729781", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570586, "uuid": "19eff8ad-29ec-45ec-8584-8cb45780681d", "comment": "Malware payload (Mirai)", "value": "f921aff2d6e5bd6f429fa26d07567633bb3e278961d4f6af0e93f807d1a63564ea429e9c38b04e4142c4371a4939e8ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570586, "uuid": "e3803fd5-5070-46c7-a217-86473ce44826", "value": "T15BD2F1271CDE6F7AE0789173448FFC2F6980A006A16796E7F34631BE2885360573C6C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570586, "uuid": "90441475-fbc8-46b6-ad7f-ac0f6e3d4ef3", "value": "768:e7DKYz0sH1zzMMAD9jCzRYAI0h2nzq2zSV2ClJvS3ojqZbwuo1QnbcuyD7UHQRjD:JYlH1sT4yA1h2zrzSgi63ojMw51Qnouq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655570586, "uuid": "bb76a260-cbe4-453f-891a-4eb9a99e97b2", "value": 31020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655570586, "uuid": "8122cda7-a525-4c1d-af2f-59b07878e8ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570586, "uuid": "bbc16e16-d912-470d-b4be-5ec1fe13571d", "value": "irc.x86.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d772381-eed7-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655536795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536795, "uuid": "bc7c10a4-e08f-4f08-a2ef-006ba44a956c", "comment": "Malware payload", "value": "8fa217cb4a524d6325141e76c47548d0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536795, "uuid": "fc83f83c-ad4a-427f-9a5d-16641b1d0738", "comment": "Malware payload", "value": "3985a66eb78e177d51dedad9a32dacff5dca160c78216945fe3d183dd7abe95a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536795, "uuid": "4fdfe7ab-e92d-4b52-9463-2a03e1bb86da", "comment": "Malware payload", "value": "5d7067924f341992db556c9c24f2161c5052ef26", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536795, "uuid": "53204f4b-c5f5-4457-bc89-2e6ed47adf10", "comment": "Malware payload", "value": "a3612b18b251763e56042fcba41b3011eaaf2bdf948007a190d51f3bd2249d0fad083aed370b500aa499f7d38cb1c2bc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655536795, "uuid": "20612b5a-f786-47da-acc6-fe3321b76c5e", "value": "T12D336182B3D1FC8321475B73731BA6E5E42D9C95B58988DEF500BC68F0ACA11FAD46B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655536795, "uuid": "6a4ef6d5-183f-46a2-bd2b-281f4c9eb0d1", "value": "1536:3pL2Q+ex+k9LItrVS2hReGwqn2cLoz2Wqj09:3h2ex+kKVrbJno2WF9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655536795, "uuid": "5cd2a5be-50e3-4e41-b266-3d0441ffe9e3", "value": 52645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655536795, "uuid": "3043a8fe-9c2b-432b-ad98-f46fb1e98745", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655536795, "uuid": "4ece5739-472e-4afc-aa26-cb9e05b05dce", "value": "Captura2022360.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cceb0de-eee3-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655542189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655542189, "uuid": "8f99edad-db89-43a1-bb98-6d5e1a2af821", "comment": "Malware payload", "value": "14861618c80760d01dc6cef223c27363", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655542189, "uuid": "f5d52987-155b-4645-b22a-2c94d4e71928", "comment": "Malware payload", "value": "3a299f5d332475584bac0d153c6cb7669a7c65aeab8e0050d04d4e609ce8917e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655542189, "uuid": "9059bfbc-bfa4-4aba-abf1-bccba8540d3a", "comment": "Malware payload", "value": "a4f90d1aff9597ea5d50b192631d601da52513be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655542189, "uuid": "4eddb937-55a2-4cbb-8f8a-b589f12800ea", "comment": "Malware payload", "value": "426b7b72852de88fb3b44ee265fe8669c8492e7cc11d4053761af91f5fc9ce1e0b7c0e541f904838ac779fdd858d0275", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655542189, "uuid": "149c202c-2d43-4fe1-bc3b-e27243b96e41", "value": "T15C54E1313AD1C8FAC2420431CDE97FE5F0F9DA680E318D7767940E1D6EBD654C226A66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655542189, "uuid": "0e53ba44-4c62-42d6-8ee4-cfe22c1f9727", "value": "a63d48c3ce8aa43e0eb4aa1523dfe1e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655542189, "uuid": "f4615133-1d9e-48c7-8ae1-69a295763e56", "value": "6144:sjODTivf263n4bCZAehIsGYlgB85rgTpx2MfThAzda4/gaHnfl:sjODTivF9GzlS5rgTpxRopHnfl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655542189, "uuid": "ac6f34b8-5af8-49f9-8253-fbb8233cc667", "value": 281600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655542189, "uuid": "3fa07c25-9a11-4f0b-a614-14d574b8c738", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655542189, "uuid": "d6d99622-cf0e-41e0-bd6b-b4a82d3b6665", "value": "Step-4. Phonetic-Keyboard.exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd73feff-eee1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655541385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541385, "uuid": "6c9637c6-230b-447c-86c4-ab9c75e6d490", "comment": "Malware payload (Mirai)", "value": "d78ecd6c6d0fd950d7ab658f74f81979", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541385, "uuid": "6c44ee33-c9c9-4944-b8ee-bbeb3adbd187", "comment": "Malware payload (Mirai)", "value": "3acc18d48476a8a8f86b9d31c99aea12a7b38490b65dd0903cdc9fbc9396b26a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541385, "uuid": "940dac10-2d89-40e3-aa54-6613286e2019", "comment": "Malware payload (Mirai)", "value": "cace08f3ec80045e06ccb2b9cb0de24b8929295d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541385, "uuid": "a03f6377-9aa7-45cd-8664-7dcd071e306e", "comment": "Malware payload (Mirai)", "value": "d5ed555b1264377c97d73e75302d087165b7604d692f1e009000ef247faa62a4189ab7217a333188bfd24843a9d97566", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541385, "uuid": "786df026-6c81-4373-b5b4-0ae155cd198e", "value": "T150044A05DA809B17C6E237BAF79B428E73239B5467D733058928ABF03FC27995E36015", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541385, "uuid": "1060ada2-6d69-418a-b8f1-1c487dc5e7e1", "value": "3072:sV/Yb/dnp+eQPGq+/nTCappbzHdQLpzcMbPB7+45hLSC3zVbYM/992qEmmw3Bq/C:++bCappbz9QLJbPB15hLSC3z+M/90qEc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655541385, "uuid": "a099df0b-c699-44b2-a743-1b35f2570d5f", "value": 180192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655541385, "uuid": "ad0888ca-e84e-46ec-bfe8-3c223415d7b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541385, "uuid": "407346c9-0bbf-40c8-ac18-ac7336eaef7b", "value": "d78ecd6c6d0fd950d7ab658f74f81979", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4456327a-ef25-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655570388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570388, "uuid": "72090fa8-f4a1-412b-b68c-707367bfe025", "comment": "Malware payload", "value": "c20ec1d7d7179622fdb82fba496d0401", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570388, "uuid": "4426b31f-96c3-44a2-875a-9f64d8f72366", "comment": "Malware payload", "value": "3b7e9ff3458b1b014dcfd1842ae81f09301efde8be6037def3942c372698d6a7", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570388, "uuid": "54b5f604-57a2-418a-9a1a-6112a2dc71de", "comment": "Malware payload", "value": "449bdcf0484bf035fc68c717c87dddafc7bce15c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570388, "uuid": "0b4f80ef-7276-4b70-a51b-a83b2e0a92e0", "comment": "Malware payload", "value": "d5c46c170df85b857028e7f322446052c05f45c93654b176e002e8d38e2f28c69242e221128a58929c789a4727551985", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570388, "uuid": "014dde69-81b0-4ca0-88e2-7545cafc9e3f", "value": "T11D218691CF580D56C45BC5FBE15FC638228111DB28EB5A174C438147334FC65226428A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570388, "uuid": "e74cdfaf-cf57-4ea1-ae03-ed3fc26f5567", "value": "24:7KEOpp5DJuBPK9FLxTN7sicaV4pN0QU5neCkCuvT+nCp1l:enNQtAFJNwi1W5UNGa+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655570388, "uuid": "8541de97-cb97-407b-95f2-812baab6500c", "value": 1116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655570388, "uuid": "9a4b04e2-8e0d-4b64-8004-8a9326f96248", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570388, "uuid": "dd3b70e3-93b2-47e8-ae90-baade9e21738", "value": "Copy5174.zip.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae56a258-ef25-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655570565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570565, "uuid": "90e47d5b-a49b-4eb9-8d68-bc416044faa4", "comment": "Malware payload (Mirai)", "value": "2fa43b46522a434d2e31975c5be88967", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570565, "uuid": "16c9249d-92d4-44b6-9eda-b11d3d6f55ac", "comment": "Malware payload (Mirai)", "value": "3c1ae2342ce259e345069ed36c75a22523eb76770137d72871fd7707322dc362", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570565, "uuid": "51aa64f4-dde1-4dd5-9fb3-8d2f31f5a4a1", "comment": "Malware payload (Mirai)", "value": "9bbb0332c7141956a9767b29e6655b0955894182", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570565, "uuid": "87a3968f-8ec3-4789-b457-9160234e0f0b", "comment": "Malware payload (Mirai)", "value": "04a6d02169ff1e8c032089cac0f9332c3f74048e2acdeba6c26c3e3354e918fa88939cb5a73bc4db77d578e73c55ad96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570565, "uuid": "db29545c-ee7d-41f6-8faa-7e61a50ef4f8", "value": "T1EB63AE29D1B4DA54C1958574BA98CD394B23E08497833EF7EAD183A2E417AEDF049FF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570565, "uuid": "ae44703c-a2c5-4932-92c0-b2b25e4b29fc", "value": "1536:1aT/eYzROR3OWjNs7tiOAGFfbI3MZvG0VHrH0tCOhr/:1umJOTtiOxFfeuDVHrH0tRL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655570565, "uuid": "1f7440d6-0402-491f-8ed2-09fbb4ad1882", "value": 70648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655570565, "uuid": "fdc49382-84eb-447a-b40a-53617173578a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570565, "uuid": "56a368f4-6c65-4411-bf5e-642d5fb9e819", "value": "irc.sh4.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f81f59f4-eee1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655541483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541483, "uuid": "5c6316c5-32f6-4950-9389-f851991190f5", "comment": "Malware payload (Mirai)", "value": "79b5cc8a7e8729b562cd24f91b986d91", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541483, "uuid": "035fe332-cf92-4693-a867-b4bdce23da21", "comment": "Malware payload (Mirai)", "value": "3efcd0114db09ff8b8ef029dc9e47217cee5b019d1a5ff49bd7d80b7c50240b6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541483, "uuid": "07a5773c-9fba-4d21-95b9-0894b686bd6d", "comment": "Malware payload (Mirai)", "value": "81603396516f852e3e77f1a97baf2d12fa84c396", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541483, "uuid": "147d87ca-cc8c-4bd8-931d-6de85aab91d5", "comment": "Malware payload (Mirai)", "value": "6f02efa1a3c69a81bd02622f7b4ea2e3b87b99f68ea2aaefa83dcf008a32c56ac49e8fd4da450ba6ad4644beb60008c1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541483, "uuid": "5e6c7870-108b-499d-852c-4a2398468fab", "value": "T134C31905FD404B27C7D22BBAF79E438D773666586BD333115A296EB02FC1B982E39160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541483, "uuid": "59811ae7-298d-4fa8-bf6f-a964ef83e514", "value": "3072:4DJDZ+6lJQTnoo3jKiXb6DwXg05hLNF9u+CyhAnjqojwQQRh6RYAvZR:4Gb6yg05hLNF9u0ojwQQRh6RYAvZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655541483, "uuid": "2a363c9b-6c26-49c7-9626-9e64f4068be2", "value": 128317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655541483, "uuid": "deb36f01-4066-4cc8-8baf-e91e29610ee2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541483, "uuid": "e27aedeb-22a9-4b0b-bffc-7598a93a4a14", "value": "79b5cc8a7e8729b562cd24f91b986d91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f90024c-ef25-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655570487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570487, "uuid": "86dabd82-ac69-4b63-9dce-211f5eb53d19", "comment": "Malware payload (Mirai)", "value": "ae5c07e800eb564252900f1c3917e5c5", "object_relation": "md5", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570487, "uuid": "1d37e767-6de3-4912-b3ec-80d60c05ea68", "comment": "Malware payload (Mirai)", "value": "412f1b4f0c347117f5332db523aa853b714144c5ec32ec6773fe77c94d653e71", "object_relation": "sha256", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570487, "uuid": "f7d4f3a1-0d41-4a73-abce-22bfe0dfb6a4", "comment": "Malware payload (Mirai)", "value": "1c1680b279d1113afbccec79a08bbf2142730a34", "object_relation": "sha1", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570487, "uuid": "96edff07-766f-45a4-b39d-96a13cb51bbc", "comment": "Malware payload (Mirai)", "value": "26bfe19ccfc36c829d182a229a3a373609883a19efb5da7082ce3b324163ef505dd2e39136af3df76a6cfad59b16e222", "object_relation": "sha3-384", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570487, "uuid": "426710fb-7a5e-49e3-a7d3-8fac8d0347e3", "value": "T12943F1C5A0BB1C5AC7E31B21CC3C9BD3128E9EEDE0B574E562014755FBD484A92AB8C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570487, "uuid": "dd422a82-0889-4918-a621-eeff19efa243", "value": "1536:C5cbYfyrMb8tBgeuEIj0DIDA9A9SL9YFYFlD2xsRw0H:mWYfWMb4BXuEIj+gSL6FYNe0H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655570487, "uuid": "be2528d4-c7d9-4ebe-ab2a-b1bcc9cd136a", "value": 55348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655570487, "uuid": "fbda8af4-2d14-44c7-9aa0-9f2d6fb3e592", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570487, "uuid": "29a2e965-cb23-42cb-9388-6206dc29f95c", "value": "irc.arm7.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10624b58-eed7-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655536800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536800, "uuid": "8eb11af0-e802-4535-98b0-b8c2ed28397d", "comment": "Malware payload", "value": "069ccbfab090b4f9f2e3935d32e3f9d3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536800, "uuid": "722d88f4-e215-441b-b274-612aee7c34c1", "comment": "Malware payload", "value": "423a19136bba3ed3c7323aaa32b65672ea19e18b53189650e9624328811e0c9c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536800, "uuid": "3e25149d-2b0e-4acc-9a15-f2e27a41ab87", "comment": "Malware payload", "value": "fef8b3793debd4c7bdbb56211e85f40930cdc3be", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536800, "uuid": "ab5f606e-2e42-4cf0-99df-15670f8f5c39", "comment": "Malware payload", "value": "9b626e4af0f3a87559bad45b25cea34b33e128fd3de4237346b6e00e453303494f427b5aa77a032601f15ca5b662c4ab", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655536800, "uuid": "8f62f5d4-5176-40fa-8a01-b14c6d87c0c3", "value": "T157332FC073D5BC42264B5B73372AB6F5F4396DA9B58808CAF404BCA4F5AD810FAD4A71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655536800, "uuid": "cd8c2b76-6cce-4937-9abc-a344a7ddfa12", "value": "1536:Y0mPsBzVgV4/x+FATgtkXJjXBPzjZSvRYAKYZyE/Po:9mkBzVZcWekXJjBkvRYA1r/Po", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655536800, "uuid": "260eab1c-80e0-47a5-9520-1ecf8377d5c1", "value": 53107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655536800, "uuid": "e8025f80-52f8-4f17-a758-de0711a87d3a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655536800, "uuid": "7dddbd14-86a5-4569-815e-17c6c7833b08", "value": "Captura2022360.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3837dc69-eea5-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655515392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655515392, "uuid": "cbcd212e-a107-4bef-8d4e-c7c58d9d7248", "comment": "Malware payload", "value": "263631d2d4ab6dfc43eb89e961b142d2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655515392, "uuid": "22d70a4c-976b-41c2-9f7c-b376c55cda88", "comment": "Malware payload", "value": "42afa32734a60dfbc90cbaab7143674916099ff785a6b7a4fdab0eb66f975ff4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655515392, "uuid": "e5ab2d6a-565c-4163-975f-696104585610", "comment": "Malware payload", "value": "42d0788b2ad2cc1935d2c1a437a7cacff26aa387", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655515392, "uuid": "af2dc7fb-6094-463a-b441-b10f8d67c24f", "comment": "Malware payload", "value": "7c8091003e04a6217602fb0a0b85e293f9f7bd9108c1625e82c3714731092995d7d1664f00ac2442ef86785d9f495974", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655515392, "uuid": "4f27bca5-513d-4bf2-a740-4a662552a366", "value": "T1CB057D35EB80F125EAE3553E87D84A5A167D027337A443CBBF498468853F2DAB43439E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655515392, "uuid": "a5242c46-68f7-4480-a7a2-f9e26e7f35f8", "value": "c84c1027327b354a17f1cc3cd5f25f3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655515392, "uuid": "6ab70272-ab33-4a08-9844-33d7293b7b1a", "value": "24576:lXncfLXfRI/gA2AUOfrFQpbswwwwwYs82ugb3tdL:lXnczXfRI/rHFQpbswwwwwYszuybL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655515392, "uuid": "07558606-ce2b-41da-98f9-8a9a3b99f846", "value": 848912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655515392, "uuid": "818174b2-81f0-4bed-91f1-05a4bfba3ee3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655515392, "uuid": "68d7e5c2-06ec-41ad-aa85-6ec685ca669d", "value": "263631d2d4ab6dfc43eb89e961b142d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07cea83a-eeeb-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655545375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655545375, "uuid": "fe80432d-74d3-47b5-82a0-939a7a0016cc", "comment": "Malware payload", "value": "748916e8ed91e8775b9d74c373c82a86", "object_relation": "md5", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vkdj", "colour": "#3FC928", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655545375, "uuid": "02516b59-61df-4078-8149-adb5df49be75", "comment": "Malware payload", "value": "445ab3421fbfb7786ee2e2d8f5e09d919ce27392da08f35bbad07de05aed43c2", "object_relation": "sha256", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vkdj", "colour": "#3FC928", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655545375, "uuid": "dadd28e8-0ff2-4262-9c86-3b028afb4b0c", "comment": "Malware payload", "value": "effcba29e69944f2bcaee0f77b605fa628572f01", "object_relation": "sha1", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vkdj", "colour": "#3FC928", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655545375, "uuid": "f9647858-e726-4f30-9a5a-b92ce2848921", "comment": "Malware payload", "value": "d2b29f1e3dee90402aae81c0dd1dfddc9391685e025947afabd565b637b74a915e2eff51df0f05e35bafff1f38f75bf5", "object_relation": "sha3-384", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vkdj", "colour": "#3FC928", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655545375, "uuid": "a90de65c-e2b0-4bfa-8bf1-616e52317504", "value": "T1C995C03BF268A53EC46E1B3245B39250597BBA60B81A8C1F07FC384DCF765601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655545375, "uuid": "14b75b09-e3f9-4c2c-9ac0-c8b65f170799", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655545375, "uuid": "6e9e295c-b13d-4392-aebf-809d9101baff", "value": "24576:q4nXubIQGyxbPV0db26WaJVEuX/tsv1Et9uGpckT52zedlq89Ws5uIzk5aM/phdV:qqe3f68yqSffPMWrQ0Zkh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655545375, "uuid": "2985747b-2b82-48e5-9bec-f170d0ce1d07", "value": 1935728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655545375, "uuid": "71fa5d34-d38e-4486-873a-8c062b960529", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655545375, "uuid": "79e9bed9-c853-44da-9431-4da8c6989446", "value": "VkDJ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49479a17-ef25-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655570396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570396, "uuid": "dcd7c077-4f92-4d38-970c-7e467bd58457", "comment": "Malware payload", "value": "3c011083a3e319c9ae6820b80c46db75", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570396, "uuid": "27d3902e-f0cc-4ad8-b28f-74c30861acca", "comment": "Malware payload", "value": "44ff433f1107cd93b9abf8f51d12955f18f35aa2b272e251fe81968a8d1c5433", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570396, "uuid": "19e0d5bf-e4ac-4713-af92-91d56c3583d8", "comment": "Malware payload", "value": "c60ed6785a1677a7528cbb48d043e7daeccac88f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570396, "uuid": "94e745ff-4ac4-4c70-bae3-b1778a7daf5d", "comment": "Malware payload", "value": "1280492c3952b451195399c39493b878a934c592ea24c563364f7de65936459e1c35e459bfb68834bbe57f7d1023f4a0", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570396, "uuid": "6c58c6b9-3157-4247-8050-28d845c80a7f", "value": "T1C52186ACDD684851FE1F0236C96807CC4609D18945CAB8CB2FC8746674564943E237EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570396, "uuid": "eb39fbfa-1316-4b71-b005-2cecb15d2278", "value": "24:7KhTSQ5ZGjR2xrmgtMn32cG45ugBtGLYYxx4MuiQRZ4b:OHZ0RImgcG45VGLcjZ4b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655570396, "uuid": "c2783b46-bf5a-4861-8290-e44cc7bbf9b0", "value": 1126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655570396, "uuid": "5c553732-26d8-4bc8-a11f-96400885745e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570396, "uuid": "2139a28f-4cf0-4953-ae39-a825277ee898", "value": "Copy5787.zip.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f6d03f6-eed5-11ec-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1655535993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655535993, "uuid": "cb8a348a-5d62-4c47-ac0b-5850eca4133a", "comment": "Malware payload (ArkeiStealer)", "value": "60906ed90d85419237db6b6785107da5", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655535993, "uuid": "4981840e-5f4c-4888-902d-8c75c0614b80", "comment": "Malware payload (ArkeiStealer)", "value": "4590ab5cb4c03c8c7dbe19c6fb03841b0f1bd3a971e442458ececda8fd100d4c", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655535993, "uuid": "c8cc7fb3-403a-435d-be38-8085c0272b03", "comment": "Malware payload (ArkeiStealer)", "value": "9366deb00078ba10d1b5db344bff90e777ffc582", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655535993, "uuid": "3f64c238-6de7-4270-97e7-eacde87d92b9", "comment": "Malware payload (ArkeiStealer)", "value": "22ff5c43ab63ca60ae718e60d2bae34f9a230650e6e3e528f1030b90b9d74d5979b68d1c153e39d6758674f548bc64ac", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655535993, "uuid": "db1f6d0c-4a18-487a-80de-8971b23d7b2c", "value": "T15C44F13137A0C032D4931670DD79CAA26F7F79621675918FB7A82A3E2E703C15EB5346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655535993, "uuid": "a764e92c-95ea-4e72-89cb-70c127f6e6f4", "value": "c99ad8a6bd42c42af4d281fc572cc9a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655535993, "uuid": "44bc4ded-970f-436e-9517-d1c5626c5bdb", "value": "6144:o/RHQHggzvdLzqtxfimtlwoe8/NqvoHYV6I6udNUa35z:yHQHpzvdqnim7Nqgcf5h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655535993, "uuid": "5758a792-58a6-425f-b9d6-51733187b7e7", "value": 274944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655535993, "uuid": "59a21ff2-81fa-48b4-93c8-d4856ee0e7ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655535993, "uuid": "649e1c78-3ac0-435f-94e0-7a5569d93f6c", "value": "60906ed90d85419237db6b6785107da5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74f56239-eef9-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1655551571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655551571, "uuid": "a59970f0-4416-44be-89ca-324aca617414", "comment": "Malware payload (RedLineStealer)", "value": "da03878b02f18552090e0f7214626bfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "holdthismoney", "colour": "#E0E791", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655551571, "uuid": "f0b5362e-820c-44cc-8ca5-b2af8583c9d0", "comment": "Malware payload (RedLineStealer)", "value": "463bff1aff34d4cde9a01e32e65f0ee643b474e25ec0526448e2e71dddea7a5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "holdthismoney", "colour": "#E0E791", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655551571, "uuid": "22219352-dd8d-499d-9c31-7ca5b037b890", "comment": "Malware payload (RedLineStealer)", "value": "138ea8932d071ebf33f810057a52463a750f2e5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "holdthismoney", "colour": "#E0E791", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655551571, "uuid": "ff9b4d80-9fdf-4c59-8d16-e906530cbbce", "comment": "Malware payload (RedLineStealer)", "value": "2a0a7a069810459042fe23dc1db102cbc3172886834a199b0ef41c6ab7fd120e9a2d5bd18d7d66b472e79bdd87076597", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "holdthismoney", "colour": "#E0E791", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655551571, "uuid": "217820b2-1cf6-47a8-a8a8-c5b169198872", "value": "T1EC94459D726072DFC857D472DEA82CA8EA6174BB931F4213902715EDAE4D89BCF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655551571, "uuid": "518ebc86-fee2-433e-a3df-6047a02d8253", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655551571, "uuid": "68204476-0385-4ccd-9aa9-d4e76acb7723", "value": "12288:8q9z8QB0nHLUnb7A5z7nFlY+uAnklSRQ7ujZu58NfRX8zs6IurkaaLXStj+piByD:8q9zhSnHj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655551571, "uuid": "4a2a6cfd-3323-4ea1-9288-94e564c3096e", "value": 431616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655551571, "uuid": "85c3272c-3412-49f3-a67c-8e100406d316", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655551571, "uuid": "be4fa5b2-7e03-440e-b84e-16343524dc36", "value": "build.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00382809-ee9e-11ec-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1655512291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655512291, "uuid": "3732a9b1-81ef-4010-baf0-cce1ffe692a8", "comment": "Malware payload (RemcosRAT)", "value": "52a9260e6823c488899b496d7d645655", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655512291, "uuid": "97794740-cb0f-44de-8f13-4139a3c1129e", "comment": "Malware payload (RemcosRAT)", "value": "46a0bee0884ccdd5f8d303f963a00f57b212d4d5da38cff00cf7293a04b0ac58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655512291, "uuid": "fca9189d-c497-4373-a381-d790bb4fbf6c", "comment": "Malware payload (RemcosRAT)", "value": "9dfebd9065bf36289f64fd6a098b7e2578bce62d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655512291, "uuid": "625b4f40-6203-422b-825b-8bf781dc9a62", "comment": "Malware payload (RemcosRAT)", "value": "edddfc248d0db7922d75a0a8cb1c786f801096a85b1de8432a6c61f9dbad46cd3ec139da35647b14b867adc5357e20e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655512291, "uuid": "f46c5c38-1e2d-4bb6-9e34-8fba28ca5ac4", "value": "T10615124EE9F4CD59C1F3033988E5CA1FBB30D845F63EC68C5206A6CE26C7E992718961", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655512291, "uuid": "8f2346cf-b91d-4128-8069-10f62423dcf2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655512291, "uuid": "c33b0dc0-5758-43aa-ba53-ec6f4645aa71", "value": "12288:Yk+r9M6tVGt6g52R5vF7QxV/7YFFkbSR6cdcam27l+QQEd7A1Ny+H7QbJpt5q8B5:o9MCYLO7TFFuSpF+8AhbUL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655512291, "uuid": "d0ae77eb-729c-4f8b-bbed-12a6168e8e01", "value": 896512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655512291, "uuid": "d22adffa-ad60-4b7a-bc46-ed6729440e02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655512291, "uuid": "c0fb7189-cb74-46f8-b0bf-a358b7a40822", "value": "SecuriteInfo.com.Variant.MSILHeracles.33841.22776.23730", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e03f854c-eedf-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655540584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655540584, "uuid": "ee64a3fd-55ea-40ad-b5a5-eb3a2fc9773d", "comment": "Malware payload (Mirai)", "value": "cb20b12be03565257cc573ebbb4ca4dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655540584, "uuid": "bd1e43b9-e958-4ae0-8c86-2b566165e133", "comment": "Malware payload (Mirai)", "value": "46c5ee27d4c794dbbeedb73921355de9e7f58dee161f171118fcefd5b1c4a997", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655540584, "uuid": "8cdfda9d-d056-47c6-a739-3e922a06b161", "comment": "Malware payload (Mirai)", "value": "306b26283f79ed97ea04cc972aa52dcb89d0d421", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655540584, "uuid": "8ee16a48-862b-4eec-97c0-ff695187c5c9", "comment": "Malware payload (Mirai)", "value": "b0e652e56b9b96ee64299122e8d76e208cbc8f3c55e83a4786e373797ef996cca302f00b1d9ff584081a02cc4c4ea60e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655540584, "uuid": "c4f17e1d-15a0-49b0-a644-7f9661285018", "value": "T1FC635B21BA711D17C0D5A5BA61F35324B2F1539A25ACCB2E3CB20E8DBF65A4062636F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655540584, "uuid": "e41e3470-328e-4175-86e0-cbd61f10f2f9", "value": "768:XuboRkSkJdyWi9ryA974bEi/5eO+lM5VaRgXNjb+1tGH3lwSGdIy:ebGkSkJdyWi9TCalM5Qlt0l21", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655540584, "uuid": "ae468f99-53d6-4c2d-91bb-b7ec09a38ff9", "value": 67640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655540584, "uuid": "93044dac-358a-4471-b7d5-222c22681710", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655540584, "uuid": "7212252d-7e09-4a0c-b5e4-11e428ea31e9", "value": "crspc.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b1e75a8-ef58-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655592438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655592438, "uuid": "2061f12c-c550-448d-93c6-19f210825958", "comment": "Malware payload", "value": "6b5b155c94347e027d34a226b5947da0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655592438, "uuid": "4eea9873-bb48-4738-88f6-c59db8266ed7", "comment": "Malware payload", "value": "4895b09c8a93de5fb2c9cd5559a0d14a8c90608e0b82edd07891785fcb2e28e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655592438, "uuid": "2675d03a-3820-43bc-9075-415474f65fae", "comment": "Malware payload", "value": "df3de172e5aa333d3ba2dcbb78fa048f2cfd143b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655592438, "uuid": "b5a480ca-bba1-44ef-b633-c07c74d6ae16", "comment": "Malware payload", "value": "b998c83a4aa187424215fb42ca7fe9801e4c9fc8d1b2eddbf309c7a9641baf3e6358e496174efa4d10f4c4edb646f2ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655592438, "uuid": "12ab5c51-2597-486c-bd5d-8d15adbb2a0d", "value": "T1CEB50A135A8B0E75DDC23BB461CB633B9734EE30CA2A9F7FE609C43599532C5681A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655592438, "uuid": "75842fd2-aaa5-457d-9d98-4c275e9a66cf", "value": "e70c2ef1874649f5282ec26388f82e73", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655592438, "uuid": "a54bce18-cb51-439c-9525-9868e59990d0", "value": "24576:WOBJNeU++s07tb39z0iyWJQ2yG7tOSNauQ5p3h3a:W4xsqk2y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655592438, "uuid": "d5c36ee3-2bba-4f67-9d8b-1fc0d8ed8e82", "value": 2297369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655592438, "uuid": "48446c17-fc1c-4de8-be65-4b81f7b34cc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655592438, "uuid": "d16f5099-ae88-43d9-be9d-fb1c047c13d5", "value": "main.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cf220a5-eedf-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655540284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655540284, "uuid": "42eb0ea0-8e6d-4afb-be8f-d6d15161ab89", "comment": "Malware payload", "value": "9d5b80a839024128cabce5fb438ad996", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655540284, "uuid": "2f546ab5-6900-4060-bff6-cd9a8836c402", "comment": "Malware payload", "value": "48ef4d0cb9fcba1529a5685877caa2a41d993dbb9e9cd7578b8d7773db2eedcb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655540284, "uuid": "7a3923d0-efb7-4573-bcea-84bf0c6a4821", "comment": "Malware payload", "value": "5087b2eba8962bf761b462b97ad52a1dd53ec917", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655540284, "uuid": "0623202b-1053-4e92-b122-56e73600fbd4", "comment": "Malware payload", "value": "aeaafe944615fbe18470472800cac80e8ca52af86c5d73f400415ba31c4b670e0ee6af5287ab076482f7d9d47bd540b0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655540284, "uuid": "fd352ea7-f7f6-4868-bfec-78d9fecc255a", "value": "T10F7439EC7610B5DFC85BCD739AA81C64AA6079BB570BE203A41716EDD90D98BCF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655540284, "uuid": "b80b822f-995f-47d5-89df-10bb4239b10c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655540284, "uuid": "6d246c4a-1d2f-4bee-9518-8a9cf6e9f6c0", "value": "6144:+wIijdUC35mbLy/iI+HwPPU001prASS4xRAKGtrtE+1xf+K69xkOYizS27Y1dvKf:+Sb34CMwPsJV/xJGtrtE+1oD9xkOYizx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655540284, "uuid": "22045107-56f8-4d36-8659-64699bc0583e", "value": 346624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655540284, "uuid": "aaf61f0f-275e-47a9-abbe-832698eee844", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655540284, "uuid": "3ed8a95c-57c6-4627-a7f9-1a540b5d2766", "value": "9d5b80a839024128cabce5fb438ad996", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46c60fca-ef2c-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655573398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655573398, "uuid": "48dd8b93-ab8c-4674-b0bb-3cbf626757c0", "comment": "Malware payload", "value": "1804ca792a18f885cbaad8d17418a9fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655573398, "uuid": "32c5e93f-4ead-4a04-8009-9f9651627a38", "comment": "Malware payload", "value": "4ab7b8db0ce2d74777e5b1cad075dd383581e6301980eaae5926fbc62a509269", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655573398, "uuid": "8c5a458b-b837-4eaf-8137-f07972e10e4e", "comment": "Malware payload", "value": "c69d82c0b6b699ebfcdc983dbb0213e03769ccc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655573398, "uuid": "e46c8548-aa59-4b5a-a599-649814d256cf", "comment": "Malware payload", "value": "7030404607e50f1ab7b11a4e50242b9f28d6e1386cc46be581f3dc4b0bdbb5c4c42aaf1c0b266ba3bcdbb7d1b18de28b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655573398, "uuid": "5fb787d5-7910-4139-b633-512294b001ab", "value": "T105C59D325292F925C67884F0DEF89A6DCDDDACE4EBFA30E3B584257628F4890CD6C511", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655573398, "uuid": "d5816ed1-6bbe-4012-9d60-f6a4755f2b44", "value": "5fb6ab06805d8acf2b05002031e32bea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655573398, "uuid": "237e5773-faa8-4023-bc4b-bd9d38632d46", "value": "49152:Q58rZI+ndHzXXuGVRVirw7g+jzTV2oiKYlzLikRWc+aXQ/h8qbuwyF:MGZTfZYlzLikRF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655573398, "uuid": "e0a8eef5-0f45-421b-b07a-ec98fe350655", "value": 2619665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655573398, "uuid": "e0a393c3-42d6-4b0b-bfeb-154fe3c3ee09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655573398, "uuid": "516ec853-300e-437b-b3e5-b95bf625b7b5", "value": "Xrangerstub.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9883fc99-ef20-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655568381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655568381, "uuid": "070c55dc-ff66-4b4d-9eec-c812bc8b3f6f", "comment": "Malware payload", "value": "68d6ef433bbcf8351d770c49feb5dfb8", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655568381, "uuid": "b4591fc0-3143-48e6-be80-0dab42859439", "comment": "Malware payload", "value": "4c4b672ee4c9aaad1f94714bea1465c49fec992f215d85f086a2717de56487ec", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655568381, "uuid": "52d13bb4-aee5-4676-8d01-4836827cf0c2", "comment": "Malware payload", "value": "071b47d48dc9232c89bcc7bc447c760b6e77f33a", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655568381, "uuid": "95211dd0-f91b-4731-9499-998f5533d4e4", "comment": "Malware payload", "value": "ec1e6bc0861b6d4df4ac3566cc55136e4e4f862d309c900cc8805a65a8766d64cbf266b5646e663a62129aba3589e57e", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655568381, "uuid": "4e87ee15-7df5-44ff-9e8b-2e72f1ebc75b", "value": "T1A015475303891BBDF69D0EC9C94B205B20F2D4677D251299EBB36EE7BC3B9849430636", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655568381, "uuid": "201f8e0a-b600-4ada-a078-0ca17d700256", "value": "1536:QkDsplBo67e6ApGd8UbFd/BhD5JV7xdakR56Jw93hhlTJXKHkNY9Yn9kMdKfb5VF:B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655568381, "uuid": "f93fa502-3d8f-426f-b6a1-de8d6f2b80b0", "value": 942739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655568381, "uuid": "fa8008f6-9277-453c-b39b-be833b7a184f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655568381, "uuid": "9b99814d-fa81-4675-a2de-bc4a34e779a4", "value": "snippet.ps1.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ac53853-eecd-11ec-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1655532522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655532522, "uuid": "11931ea7-8652-4c54-8dc2-57661b106c2c", "comment": "Malware payload (RemcosRAT)", "value": "28afb35b42a002ef55e554c060e730cd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655532522, "uuid": "a596c17c-8f99-4d3e-b74d-d781793c32ac", "comment": "Malware payload (RemcosRAT)", "value": "4d63c5fe1b80f31f5977a0be3e0bb98d469d18564bacf3035a0db49130648c33", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655532522, "uuid": "18cd8a7c-5d15-4c27-bb03-eef9b4b0569e", "comment": "Malware payload (RemcosRAT)", "value": "eaca656c092f8821b403a7f7c64278281f3a7d3a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655532522, "uuid": "010e6220-58dd-478f-a033-b85f85427bb0", "comment": "Malware payload (RemcosRAT)", "value": "72fa6f8344a883bf588259f5413d6760d08fe11efdd56207199b2b0da2c42639a49b4448fc174395135353a00e18940c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655532522, "uuid": "58bc7e35-73ba-4267-8611-1a1a6b154588", "value": "T18CA4BE11BAD2C072D97251340D29EB35DEBCBD202935857BB3E61D5BFE30180A72A6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655532522, "uuid": "084dcc95-cf0d-4e51-a609-8a75a14e1ac5", "value": "029a987f21e33b48f24d21b6f9ff1129", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655532522, "uuid": "e6813a3b-3ae4-422a-b4c0-bac1023e9204", "value": "6144:hOFBH/FMNjt18F+9a/NgAeDB4CcOtKp03b13a4LJ+sAOZZPWXbTcUCyg:hOFtiNBuFgawDB4NOmuwsfZPhyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655532522, "uuid": "dde9cb53-4255-437e-9aea-84ad4419d4c6", "value": 474112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655532522, "uuid": "e1eb0caa-4e85-4408-87a4-f0b3616365b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655532522, "uuid": "98942879-6bc4-4982-915a-0ce565d86fd6", "value": "28afb35b42a002ef55e554c060e730cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01c790be-eefc-11ec-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1655552667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552667, "uuid": "2b31b94a-5058-43fc-9839-38bb8f1af966", "comment": "Malware payload (AsyncRAT)", "value": "f166602fa92d4eb68c0a1f9d59278786", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552667, "uuid": "b1f3f852-aab8-4850-a0e3-c269bf7e85f4", "comment": "Malware payload (AsyncRAT)", "value": "4e6d7e736f12b41b0bbfe1e09ebc3ef8da29ddb9a49895dc01ea472ed2d6f141", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552667, "uuid": "7ae8e1ca-06be-4d6f-83ed-7f8cddae6a06", "comment": "Malware payload (AsyncRAT)", "value": "b9462b9f865027234dd39555af9ba3f756dd27ee", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552667, "uuid": "ca279d2b-7b99-455a-a8e4-8cdd7b6822f7", "comment": "Malware payload (AsyncRAT)", "value": "824dc7b333d0af3b5a01ca33405769920179cccc7df7ebd58e0bad751fed909eb5c84ae09a7d8c84daacdeda97f81517", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655552667, "uuid": "6422b311-88d5-4075-88e7-555dbd0aa9cb", "value": "T158333C0437E9812AF2BE4F7858F26145867BE6633603C9497CCC11D76F13BC69A426F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655552667, "uuid": "4f26d007-2d22-4069-9901-ac257f19238b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655552667, "uuid": "35fe0c9a-6ed8-4cfc-89d2-3dbeb2fe9982", "value": "1536:/xK7MxncrCSK76ycbbO/xb2ftrcKmVcl:/xK7MxncrCS1bbOh2FAK8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655552667, "uuid": "b02fde14-3d2a-4811-a9f3-5e7250df1a83", "value": 50176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655552667, "uuid": "d18df298-b8ac-40e0-a682-d93d0c1bc68b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655552667, "uuid": "97c742be-92b5-4c51-9620-c607d14e72aa", "value": "ASYNCCLIENT.exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "913e0e32-ef2a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655572664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655572664, "uuid": "76b37fbe-aeca-41ae-8d91-e2bc4b89fdb4", "comment": "Malware payload (Formbook)", "value": "d5b8cdb24a4fad0676c24966fa119e7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655572664, "uuid": "2146816e-75f4-4302-8d38-76936d9a914d", "comment": "Malware payload (Formbook)", "value": "4faae449552b88aec5358a81a7b24616d07d5002d0eeb4a9797ca38798f7144b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655572664, "uuid": "0e97e703-3b9a-47af-b636-d8ee9a4144b5", "comment": "Malware payload (Formbook)", "value": "7c59d9572f56d983387a8809fe27f231ce115254", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655572664, "uuid": "ac3f52fa-4f94-4a85-b4ee-3c8ed3ed4c98", "comment": "Malware payload (Formbook)", "value": "0209f7c4593f64d4bb95fce60e096531d91afc69f97330175dc365b069cc6342d0f0d267c1a1360d6ea8e69500d0be1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655572664, "uuid": "62eed8ee-36dd-4b8d-9a02-5e85893720a8", "value": "T14C94E1203A6C7921D9AFCF765551C1A081359DCFBD37F22E1BA73C8FA93474182A1A36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655572664, "uuid": "0d61513b-f3ec-4f62-a0bf-50c24ab4c512", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655572664, "uuid": "66ed0256-9ab8-471e-971a-e7b3c4ee82f0", "value": "6144:DQcIx92WYqKslhDCZUB+3w8QI2pl9l8uwmHsUx/uzTCbmSX3rwfBh+cTk8CLg:DQ+qvdIEfBHsUBuzTA7X7wZh9A8Ck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655572664, "uuid": "26a41f1a-2fe4-4869-b233-37340a5ff419", "value": 437760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655572664, "uuid": "9fa07a25-9d8b-4526-a24e-3a025acc747a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655572664, "uuid": "2ec44882-58ee-4263-809b-ce2d708e10c9", "value": "PO-10152022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d002e7b6-eee1-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655541416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541416, "uuid": "aab1a492-da2e-47d7-a92d-2268c11c8b35", "comment": "Malware payload", "value": "ea1d1ef590118e27c9b53b3a33446264", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541416, "uuid": "b21dac86-2d3a-4403-8068-f46471549d9c", "comment": "Malware payload", "value": "4fe7ebb10611f59c167c65f3d78a002a4655f852ade27b687f9495bd97b18a9b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541416, "uuid": "fab3f6ee-5989-4501-89b2-abaa6bed1af8", "comment": "Malware payload", "value": "a8638fa88e83586863861e5d04267003f9b31bcc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541416, "uuid": "ec2ef1db-a1fc-4b2f-bbad-a5840273e0b4", "comment": "Malware payload", "value": "69da12a5aed728ae3c2eed0a65aa73cd4e45825d94f2aff2f5a30729ef18c9cda0a0aaedb1d3e0e9778a6a6684ec0286", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541416, "uuid": "11277b48-5085-402a-8253-de7c560438e6", "value": "T12813F128A169C86541B4987652C5C695F60F67F0E2AF77F31C489773E38A82829F4EC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541416, "uuid": "14fb8cfd-4d54-4464-ba84-a6ada3ad283a", "value": "768:NHxlks8yqmx9lpbOQ9m4IM5dnM04Qs3UozsNelMc+:txlSyq8FpI61Mlz7lMn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655541416, "uuid": "a51577e1-99dd-4ba2-b5f6-439c063990fd", "value": 42264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655541416, "uuid": "6ffee91d-6f4d-4a9f-b0bb-bb1e42212363", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541416, "uuid": "2cd5d200-5f74-461c-be14-d95d9e196c1e", "value": "ea1d1ef590118e27c9b53b3a33446264", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ec4fd38-ef24-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1655570110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570110, "uuid": "3ab81ad8-67be-41bf-a67f-bbf77b95cef8", "comment": "Malware payload (RedLineStealer)", "value": "091e5232b917a09910ef7fadc864bf2b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570110, "uuid": "26bd02a2-ccdc-4311-8b12-d7d81d6eb48a", "comment": "Malware payload (RedLineStealer)", "value": "5031ef16176b528d27581a3ceb8b3c188a3907beee86108ccd445bbffbe44ed4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570110, "uuid": "96114bb1-7f3d-40ea-8a90-7a22b51d0ca5", "comment": "Malware payload (RedLineStealer)", "value": "c4daa3d7b3d5b5f29c7828f2500c40309718bad2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570110, "uuid": "88cb8224-af61-4281-aabe-7e7bfe735bde", "comment": "Malware payload (RedLineStealer)", "value": "48a0b391677e75bb116a8bc14e9922fb611283c9dc0dc0e9237f21678ae3b877eee4369ac202fdb5c4909a6763ec5482", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570110, "uuid": "6437806b-cb39-42ae-ae8a-82aaedc3f9e4", "value": "T1B794F11277E1D037D4F35270807ACA527ABE75229778861B3BE8263E6E213C14FB6359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570110, "uuid": "00a76c65-e827-4672-b1e9-45dfb19a88d9", "value": "da02586c62eb6e81c7645aee3bf28479", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570110, "uuid": "c38e71e8-94fc-46af-bb00-c343700f9631", "value": "6144:67NgyjyXQBtmDxFM+zziGsoZODH7D0cOnaMWrDMiOiz:6BByXvqGWyn/I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655570110, "uuid": "d9e062f5-7bd7-4b27-a58d-15bdf74b3da9", "value": 432128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655570110, "uuid": "e3d87774-ea30-461b-90d5-7678cd472ea7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570110, "uuid": "c9b644b1-f277-4ebd-905a-db994c2e6f9e", "value": "091e5232b917a09910ef7fadc864bf2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66f5bbee-eee5-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655542958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655542958, "uuid": "b7d7f1b5-6f5c-4b0b-9771-496860c1f0ff", "comment": "Malware payload", "value": "d98a1d37857475b60d0ee422087fe54e", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655542958, "uuid": "6d9bcdd6-82e8-45ae-afb2-7db4b1ccac7b", "comment": "Malware payload", "value": "52175b1e7ddd1a0869d690e9990ac949c673b1a20192c9814b51f678abcfdaa5", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655542958, "uuid": "885e9ac0-9c10-481f-9b27-d0491d3a5ce3", "comment": "Malware payload", "value": "248104f5c4801b01c640620a803976418c141e57", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655542958, "uuid": "8c912818-4574-43f9-a5a6-25b814878844", "comment": "Malware payload", "value": "209909325c1c8ef9c7bb362edceca093c3e4026c4b0a613dcd8ae8c5fd588285f665673768f471365626ff5e6d187988", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655542958, "uuid": "cb02a8a5-8277-4fc0-8a1e-caa1e5217e7c", "value": "T1DAE02B313FD4ACB14075CA0D5C362055FB87E0C355561F40789F24304F960D7B42C153", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655542958, "uuid": "45be0823-db35-41f8-b739-f533663086e5", "value": "6:hzaoXLsLVov0gBmcVKx+x+jylcJB0bE90rnNKfBm0cFVCE90+XTFFsOJpp9Rs:9agLLB6h2aJ/UnNwcvH7JFsOdA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655542958, "uuid": "f8c705c0-75f2-442c-89ea-d8071bcc965b", "value": 389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655542958, "uuid": "c9ed867b-29d6-43b8-8c6e-8883e5442591", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655542958, "uuid": "8fcfd56e-d3ab-40cc-839d-79e1764cf9c3", "value": "Free_followers_ig_V2.bat.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "047e568e-eee1-11ec-93bb-42010a9c0043", "comment": "Malware payload (QuasarRAT)", "timestamp": 1655541075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541075, "uuid": "89530fe8-591a-45bd-9460-0ae9d5bf9675", "comment": "Malware payload (QuasarRAT)", "value": "76c2c66ad231271e1743d1fb42750d3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541075, "uuid": "a3a62059-740c-4aad-b2ef-cb64878de5f9", "comment": "Malware payload (QuasarRAT)", "value": "54b4c294aa0af37842024f57ba18af262f84859ff35c15a8a6595749f23c9524", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541075, "uuid": "4cc5f30c-4657-436c-9501-72c134982391", "comment": "Malware payload (QuasarRAT)", "value": "f63cf9954016a4fc27e574f6d2465d21c188f6a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541075, "uuid": "ea57d05a-d514-4aaa-9b50-e607228b081f", "comment": "Malware payload (QuasarRAT)", "value": "5c8aa2525aaa8508f8a0c96a21e56c1a2fb42624f1c26a070729a9e014d1e78486e2f6e0e6cf69d959791efbd6568cca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541075, "uuid": "8dec0f71-ba28-4201-a9d7-88694236d7a1", "value": "T1A2B45B8123FC851BE1AE57BDE8B14421ABF4F407A6A7EB4F4940A1F92C967429D407F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541075, "uuid": "29b97869-3723-490f-a9ec-af88de5ec8a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541075, "uuid": "74d01943-2f8c-4573-b404-3eaf61c6dcc7", "value": "6144:1TEgdc0YSX7IxUpGREW1nLdmATEmPu5Etq4+yw4JUcEhOb8F9y0dKGHAgcTR3W:1TEgdfYrxUwLdzv4lywBxpHHrcdW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655541075, "uuid": "35ba488c-577a-4191-af50-9e0b8e14e846", "value": 514048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655541075, "uuid": "4b904e6a-5f22-4326-9e92-b576799c158a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541075, "uuid": "568fc7db-7aae-4554-8351-c414dab834bb", "value": "monolithhotfix.exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "604d98d6-ef25-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655570435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570435, "uuid": "a3fca4d3-d66d-424d-a7eb-d7aa759bc7a9", "comment": "Malware payload (Mirai)", "value": "15a03f1340835a28f8930c90e7262ace", "object_relation": "md5", "Tag": [ { "name": "arc", "colour": "#C3096D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570435, "uuid": "05de18c5-1aad-4a25-9b27-fd281f0050c8", "comment": "Malware payload (Mirai)", "value": "55cfd75605140e5a130ec358eb757a8bcee143db990b5d6ff966eef1c953301f", "object_relation": "sha256", "Tag": [ { "name": "arc", "colour": "#C3096D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570435, "uuid": "5f43638c-9052-41b9-a756-45eaa2a44a20", "comment": "Malware payload (Mirai)", "value": "974660e322d93202deed758033c9ae44622c3e56", "object_relation": "sha1", "Tag": [ { "name": "arc", "colour": "#C3096D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570435, "uuid": "a32e423a-e6e8-41a1-b167-6cb0c7815f43", "comment": "Malware payload (Mirai)", "value": "f21d395dd58db7507809c82326b7360ec27b9ef6ee1d247c465ec503f6acafe588ff08a3eb7cc983de492ed282e8e884", "object_relation": "sha3-384", "Tag": [ { "name": "arc", "colour": "#C3096D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570435, "uuid": "ed3df4ac-a345-41bf-acaf-cee378269505", "value": "T188C39DABB68F1551C81202F50FCBDF8E3F6711919E6B94E72C2E26372C7A1DB1905B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570435, "uuid": "5e8496f3-e533-486e-aebe-5070f0dc3882", "value": "1536:ihzJNeMXXtD4Wo9IJ6YqWj7a1JpLyMmOLPbVGZFhgRPnd/LWM:mzJUMntyoRqWvOJMMmUbVGZFhgRPdq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655570435, "uuid": "91ba7d6d-cced-4937-a9fb-0a951f7039ed", "value": 124184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655570435, "uuid": "e306a1c9-ab46-42da-b8d2-e6f09f9c95b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570435, "uuid": "650f5df8-2e44-453f-9abc-8cc9a21013c6", "value": "irc.arc.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec272cc7-eec4-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655529008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655529008, "uuid": "af69fbbc-98f6-4b10-a30c-1d605b6522ac", "comment": "Malware payload (Mirai)", "value": "9dd325faafabb8465e762b20440fe236", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655529008, "uuid": "05e0ac29-7e0c-493a-b454-02fdecebdaac", "comment": "Malware payload (Mirai)", "value": "583baf115524ce8c01d14c1f71724e88de2ecda41138300665bb3c3550356892", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655529008, "uuid": "17c9346c-6f18-410c-bde8-d41fc3048024", "comment": "Malware payload (Mirai)", "value": "7ca7fac05e1bb28f3b0915a73781c089538705de", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655529008, "uuid": "8690aea2-03bf-4ef1-b9f1-f6425f12a2d2", "comment": "Malware payload (Mirai)", "value": "4973557757204f80fe84400df18c22d87515f2e57e0c4f22d4c322bee2c94610628f5fc08c71fba47881036185bf871d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655529008, "uuid": "8a64ed5e-e3f3-4a16-bc6f-6da475f9500c", "value": "T1282302ECAB0141F7F6E3D4F8D5BA4B11B67106A75C019C8622AAF8474C41DE8772769C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655529008, "uuid": "041f1819-6ff9-4be9-b794-87c3dafcc475", "value": "768:mbDrZGTqwu9Ppttp/AZLLx93crIlhPH9PlLpsffvAs/7UOJgGlzDpbuR1JWnxptv:m7ZGFuBptDAhL73csLPHBdavAs/Y6VJt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655529008, "uuid": "40cb4ec5-bcf8-4e62-8223-4a7e9243c56e", "value": 48884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655529008, "uuid": "3da6037f-bad7-40e2-993d-7a87567ff541", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655529008, "uuid": "aadba0a8-f58f-4372-8bc6-0933c44dee8a", "value": "9dd325faafabb8465e762b20440fe236", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d8c3398-eef0-11ec-93bb-42010a9c0043", "comment": "Malware payload (IcedID)", "timestamp": 1655547667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655547667, "uuid": "88564c9c-0d74-459e-8846-1406b07bc355", "comment": "Malware payload (IcedID)", "value": "93c79a52dcd665ff1f23a5a600bd5a8c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655547667, "uuid": "68ef51d6-40ba-4647-924a-fd35feaa591e", "comment": "Malware payload (IcedID)", "value": "59442e454336e739c1e698e97b524973803300ce32b3d671e65c64e9b8032800", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655547667, "uuid": "5c45791d-1704-4d3e-b423-22a0e9acb60b", "comment": "Malware payload (IcedID)", "value": "68b87f50f979742b9350391466386046fd267d7d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655547667, "uuid": "bed9d312-0014-4581-9b75-411ced3b5cfa", "comment": "Malware payload (IcedID)", "value": "b86fa11ee927d5cf5f8fa5b0b4c0f13db55b5bb9850b1ff027f9878dd8211e03ba83100ff8a7f9b9e4a76bc2c8a89769", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655547667, "uuid": "d5628e8b-0558-4fef-8246-1ded94f162c5", "value": "T11CD4B0B875047DD6AA7E477BCD96ADE813B627628AC7A4CD806877C305A3371EE02804", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655547667, "uuid": "fce192d3-595d-4747-acdd-9f6d55be0108", "value": "12288:GYSdoSYW7bMLxiVhUeim1ZZxqgroRNIj2ce/epyzHfTJ2I91ajZ:5SdoSYW7WGURYrxqGiij2ceGIzHrJnfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655547667, "uuid": "95325721-a561-420d-82e1-63452eeceb39", "value": 614400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655547667, "uuid": "5b2919d7-fd7b-4ff3-b45d-6dc996f82399", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655547667, "uuid": "d3d8a47c-422f-4744-8666-49e000cbc10a", "value": "93c79a52dcd665ff1f23a5a600bd5a8c.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa280af7-ef3a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Stop)", "timestamp": 1655579712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655579712, "uuid": "64934347-3366-433a-bb3c-9bd22db87e3e", "comment": "Malware payload (Stop)", "value": "505d564e02b600967f65ce37d79b80e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655579712, "uuid": "96a19688-0524-4747-a4c1-370c3d240f83", "comment": "Malware payload (Stop)", "value": "595a5d21b386ba8e30b567cbe575b24ed104ee589037a48aa2d277452ba0b6a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655579712, "uuid": "3d78c599-81ad-44d7-b981-13efb3a0f511", "comment": "Malware payload (Stop)", "value": "6dd0ebfb6692ff48101744cbbcf78183ead269f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655579712, "uuid": "b850140e-5b92-4bdb-aeb8-524f53db9ff4", "comment": "Malware payload (Stop)", "value": "e685f4625a9103e91775420ad4f1c6e18a2d764c0463515b11e4aafb22234b3cc9cf83d6552c79feae863965ded36637", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655579712, "uuid": "7f4bc20b-c640-428f-97a3-8aadad099b04", "value": "T151245B24B181F47AE4A30035E4EA83F4996D69306BA448FFE7D44F2B5B352D2D631B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655579712, "uuid": "16780678-1c1e-4af5-9bc7-2a1140ca62d5", "value": "acdcb3eeeb627a85bc10fa3bf256b492", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655579712, "uuid": "41407c2d-c674-4fdb-b0ee-653227d4a048", "value": "3072:JDk4lsjQ41pj8rH4Zm+7T1pTF7HxcUfhVg+HgjTJSubWP9CdOISnzGG0L:jIQEA7AJDT9xXvHcTj0qN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655579712, "uuid": "b1b8070a-bf76-4c10-b6e0-466f61901d6c", "value": 213401, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655579712, "uuid": "5882220c-c890-415b-ab92-d89dc50a8dbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655579712, "uuid": "80f4bfca-1717-4a2d-82b3-891c69e3c259", "value": "505d564e02b600967f65ce37d79b80e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8543916-ef26-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655571012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655571012, "uuid": "b7cefc92-333d-4a42-a3a8-667305bd130c", "comment": "Malware payload", "value": "7523f53371e0c1784baf9caed1b94e95", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655571012, "uuid": "b15ed851-4d92-4883-8e01-5408ab3719ae", "comment": "Malware payload", "value": "5968c3e2838932293e0bef478f3b150fb767dbf26ab13d303ea8793cfefaac6c", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655571012, "uuid": "324056f3-5c98-41cb-aaef-774144e2c32c", "comment": "Malware payload", "value": "13d3c079e7baad17d4bfa609c03f951e7ec9d95c", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655571012, "uuid": "ea9a56b6-18fc-44f0-9a80-fd938a48e3e0", "comment": "Malware payload", "value": "ea218d4923d79412ce944f8d934ddac37fafbf20327ac190e4cf7bf363b956d1e5de6a39aabdc438c1f827e46a2a5546", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655571012, "uuid": "7be3b2b8-4914-46e8-9504-ab8f2620f3c9", "value": "T1652419313AB5A008B1707FF78A5BF5E2973FD387BE49699D105502B54FE068482FA362", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655571012, "uuid": "1abed92d-2317-4133-9752-0f032b4289ce", "value": "6144:P8888888888888l888k88888888888888888888888V88888888N88188hRb8A8i:P8888888888888l888k888888888888o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655571012, "uuid": "07127056-22e5-4555-993b-5dbfac21f98a", "value": 216094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655571012, "uuid": "46f2381a-fc65-42a0-b5ec-5aa2d964ea4c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655571012, "uuid": "4899f1f5-a756-48d8-aafb-352ffc054842", "value": "CrptedJatTyl.vbs.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fef6aca-ef08-11ec-93bb-42010a9c0043", "comment": "Malware payload (IcedID)", "timestamp": 1655557871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655557871, "uuid": "c03ed959-a1ed-4a66-b4d7-e589094a788a", "comment": "Malware payload (IcedID)", "value": "ae2f56a6fd53d37505478c6ea87ee439", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655557871, "uuid": "86592ff5-007a-4c8e-85ae-353c6f5d8e6e", "comment": "Malware payload (IcedID)", "value": "5a27f7e259899fab0ab737bf0b6ff097b3baa66c4521c1639b6cfc2f03a18fd1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655557871, "uuid": "87a129f8-08c2-414a-bb81-1439705e930e", "comment": "Malware payload (IcedID)", "value": "e887c2cbccccabf1bcbb60be4d6470e6073646f0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655557871, "uuid": "458e98fc-bbc3-4bc6-ac48-540bee39abe0", "comment": "Malware payload (IcedID)", "value": "2feea2f5365fd5825654ce8a409d85bf41e81ecfe05c0770e6eaafa36618812f2052b07b8daec1bbdc2c2944009ea881", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655557871, "uuid": "cdd551f1-1d20-4d84-af4b-442e42755423", "value": "T147D4BFB876047CD6B66F577BCA966CED13B62663CA8BA4CD40647BC305A3371FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655557871, "uuid": "439d1559-fec0-42c5-ba67-54683fe8502b", "value": "12288:CCa5otQOxWeQqZjPnPUAUwsFaH/k1Oe93cA2Bt82AyelVGpZYQqJkEZ1z:Hic5QqZDnPU0b/k1X1c5BaVip2d1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655557871, "uuid": "a253477f-e6a9-444a-be85-768ca46b070f", "value": 614912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655557871, "uuid": "6ac6d06d-f211-40c9-9be9-5b95d4d11be8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655557871, "uuid": "aa7f06bd-7819-4ded-b6f4-5e47c7836c43", "value": "ae2f56a6fd53d37505478c6ea87ee439.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eefa33b-eefa-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655551910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655551910, "uuid": "d8f84f16-1ab3-4707-95d6-2a2cf7bb6b23", "comment": "Malware payload (Mirai)", "value": "634489eedab6c261a31163186982c6a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655551910, "uuid": "b4c940b1-4d59-4de9-a29f-e71e0b5e6d1f", "comment": "Malware payload (Mirai)", "value": "5d8cdff37c08d4b6434a9cc7d97c7827f186695402ed1ef52947507fb4cb9caf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655551910, "uuid": "d658dd4f-2a44-406a-80c1-1bda86ff34ec", "comment": "Malware payload (Mirai)", "value": "765bf624b7c7f4f415fe2b02dff9386e08381b27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655551910, "uuid": "a135b1e7-1da8-4254-b8ec-c074e71033a4", "comment": "Malware payload (Mirai)", "value": "03b5e0c4aeab7b164c33709025505f6e3fa6158c099a406ea6d2b6ace59057ae4b8445e2da0d315b4eb6ca55096bf822", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655551910, "uuid": "69dcce83-f420-411a-bc72-621f303cc94f", "value": "T1F083D90E3E219FEDFBAD823587B74A215759339537D1C284D2ACEA011F7024E681F7A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655551910, "uuid": "8c320c40-6cbd-45ef-a768-e639aacc15f3", "value": "1536:vzQdT/CgneU2QFiv/3CzJFGS7PKv96Peqmye0Hc:vzuT/NeU3GcJFGS7PKvYMX08", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655551910, "uuid": "7476722c-7c8e-41d5-b83d-46a216de3964", "value": 80772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655551910, "uuid": "0fdf058e-c68e-4b64-b87c-b748a5bb8c2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655551910, "uuid": "ba30ea11-9712-4005-b223-fd4bb8c6f354", "value": "ZG9zmips.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77e37607-eee0-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655540839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655540839, "uuid": "77ff6dd3-c681-4515-a501-ba9fcca9f207", "comment": "Malware payload (Formbook)", "value": "2664c291da2b5ccd3f401d5207a9a268", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655540839, "uuid": "ac6f37df-029a-4193-a762-5a80395860bc", "comment": "Malware payload (Formbook)", "value": "5ea02b2f047f77380f1ce3425291460c5ed2cc3b82b3d97f56be41f4fb76c51f", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655540839, "uuid": "dc487697-6450-401f-92dc-0f433c235d49", "comment": "Malware payload (Formbook)", "value": "d19aa839d40e57d60058d1b8d89b5a978dbcdb2a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655540839, "uuid": "dc6336fd-8c2d-4846-857f-7f4e5e92f651", "comment": "Malware payload (Formbook)", "value": "22efa029d0b20c439daf625b9e843861f4a1646eabae5436457d2ea1f03d2917428f4d3447ebb59bf86b6cfcbaad8d36", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655540839, "uuid": "a09a48dd-df12-41b2-a4bb-74053108968d", "value": "T190827E7DF14B0E98CF86D6A8160A3B821648F51D73D884F637BCEB3C755586B8622D38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655540839, "uuid": "b67064fc-5ccc-432d-b0b6-8b693c212fc3", "value": "384:BSScf0/Ft5o6RND5J2UaRKAdpDJ0z003zY:zcf0tZ5JCRK8Jx0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655540839, "uuid": "8e00ada4-d40d-4a62-b7a8-e34709c8fee7", "value": 17922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655540839, "uuid": "0d10536a-af09-4996-b431-94779dcbc00e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655540839, "uuid": "c95d5427-c581-4649-8819-81bbefb45c79", "value": "c_document.doc.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28f621f5-eed5-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1655535982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655535982, "uuid": "511999a9-33ae-4c45-8182-fea789ffba80", "comment": "Malware payload (SnakeKeylogger)", "value": "846999c96d1600ba8871cf4b6cc5ca35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655535982, "uuid": "96ac9115-7e05-4616-b05f-5d9623b7aa7d", "comment": "Malware payload (SnakeKeylogger)", "value": "5f9634ef761988a890c812eb450a36f72ca2edc90d32896340e75413d399c58b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655535982, "uuid": "f2e00b0d-4d30-46e0-9d06-7d06ecd95ae1", "comment": "Malware payload (SnakeKeylogger)", "value": "e0634a9749dd0f1c8a80060a977b6319feed8614", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655535982, "uuid": "04818989-0f91-4b59-9fcb-fbae593b4c80", "comment": "Malware payload (SnakeKeylogger)", "value": "ae9da2c6f5295856e6e8fac07d553eda4cf720fe5e41d62f0cd67a71763b440b6a52af10c966b59901725015ef21d0a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655535982, "uuid": "118c733b-29af-40e5-bda9-14c4ae8677a9", "value": "T11CC3F71D3BF88804E6FE8A7315B15251C7B9B8510A5ACE1D1BC1F86D2A7CA80DE16FD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655535982, "uuid": "624ef4c0-ee03-426b-905b-90fdd0bae238", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655535982, "uuid": "e03ddfa2-c3ee-45b7-9206-a17467bb97bf", "value": "1536:A+emeTasBX1sHPMDTK3LitNWxRsyosrsOb/UzrQ9+3PpiOWBi6F0Kcl:A+eme+sTsHPMDT+b8HQg3hwBi6FbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655535982, "uuid": "ceced74c-d18c-455d-8c8c-c75cc77cd8e6", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655535982, "uuid": "a726a90a-3dfd-4f25-a82e-8112c0a7e1e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655535982, "uuid": "e25af3cc-6b64-42d0-9141-724989a814ed", "value": "846999c96d1600ba8871cf4b6cc5ca35.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "485f5522-eee4-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655542477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655542477, "uuid": "16abb5cd-3792-407d-8cc4-cbe25ee032f4", "comment": "Malware payload", "value": "82c25a584da1a0fd68833cd91fad8621", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655542477, "uuid": "8c234927-d98e-4678-b02b-c4d274aa341e", "comment": "Malware payload", "value": "61fd38f18b69916e4627a100e2d3625a786880fbe00ae2ac1fe2312eef8a4d92", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655542477, "uuid": "a316076e-6b12-42d7-a7a9-0b0d2203f99c", "comment": "Malware payload", "value": "fc7c8c4cb5410cead020329ef85bf9280cba8570", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655542477, "uuid": "1e72ffc4-5760-413c-8853-eb59d6ecbc50", "comment": "Malware payload", "value": "ef950e9b9690427c34c5b15ff7c5ae4bd503bf6ca098002e964233bbf99454b338cb339bdb2820cd2ce6ad912e0b0b6c", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655542477, "uuid": "66117c23-bd4f-4444-8ba8-2d5280118de8", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655542477, "uuid": "46ba55f2-4cbf-4444-b063-6f8f0da6957a", "value": "48:F0vqDqDqDqDqDqDqDqDqDqDqDqDqDqDqDqDqDqDqDqDqDqDqDqDqDqDqDqDqDqDG:Ff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655542477, "uuid": "6d25a888-a7ba-4330-a3a1-92c008920416", "value": 8173799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655542477, "uuid": "123d0fbb-9bd9-4e21-b37e-b04fdbfafc78", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655542477, "uuid": "ff2e664e-eab6-4479-bb8f-8418b33e15c6", "value": "discord_nitro_finder_by_codex.bat.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baf38821-eeef-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655547394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655547394, "uuid": "89d7bc11-871e-40ee-91d1-d8d1452a52e3", "comment": "Malware payload", "value": "65bbe8c88aeac93ad555a864d0f982fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655547394, "uuid": "cc149137-301f-4916-8045-7e79f78751b8", "comment": "Malware payload", "value": "6235fb06b4873d7167c47c5e180e0f58f720b664dfe4d4ae38949d167b965ed0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655547394, "uuid": "72a5f48d-b119-444c-a3d0-fbc30441bd2c", "comment": "Malware payload", "value": "3192f2b4698d0a657d20cad1d5303837e87ca2d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655547394, "uuid": "81ff44f4-ea66-4971-b53b-cba833714ceb", "comment": "Malware payload", "value": "35023b820a5ecd87b69d70c059a8eda6d0e0fee3cc40342afd704c92c5b08cd90781a390cbef9e9332db34fb4f4f0178", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655547394, "uuid": "3efacf2c-d7ef-4697-a755-a4ef65904acd", "value": "T12DE523683660F5DFC91689B3C4985CF065607DA6DB07D21770873EA8BB3DAD78B002A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655547394, "uuid": "c7c7e728-ee15-453e-af9d-9262f8eb82b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655547394, "uuid": "c6433745-db23-4be1-8bde-b15f02b12ef7", "value": "49152:3NIrTSeTnDHdtMVeMZUkBIu2xRv/0jujUWo2qagrumeGw9EWHUwc63/70nxWf63L:3wSCDHIVJkSII3agS36WHUT63/7N6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655547394, "uuid": "95af1667-0003-44a8-a7c0-7c2c7e950155", "value": 3175424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655547394, "uuid": "ace01f28-bcd6-468d-a657-6fbf206bfc30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655547394, "uuid": "3ddb4777-8aba-4d89-8698-8d45babb8452", "value": "65bbe8c88aeac93ad555a864d0f982fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f18e5e8-ef25-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655570325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570325, "uuid": "9081f9a6-e430-4937-985f-f853afc88c7e", "comment": "Malware payload", "value": "77d8c6379474ced8b85a7db7b12bb968", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570325, "uuid": "c3ae2455-9982-42e4-87f8-76c841513eab", "comment": "Malware payload", "value": "628dfd41cd36834eeb5b948c87c43ad0a3f7e53c22040b6adba8cf03c1381da8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570325, "uuid": "4f079560-9d04-45be-9235-c1938c1530f7", "comment": "Malware payload", "value": "ed35a824aa9b4f19d4636738fa088d857009faae", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570325, "uuid": "125b75e5-3c35-4e28-9f1d-a49684b09b8b", "comment": "Malware payload", "value": "e1b8803b3606aec6eb0e0ca7b77115fe637891c2cdbdd96aa0104ae0bac348e9ff1a869495f9a358472e4fd464f1b87c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570325, "uuid": "4b521e0b-13aa-4332-a456-2e13105381c9", "value": "T1FB21B589AC486982C80F9439CDFE4F51511160FD12D25E9B1AC06320B34A1E26F28EBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570325, "uuid": "c2ea5b34-0e93-4f09-b24e-5bff3a593baa", "value": "24:7KhTrUJm+UlAbEmOJozJ7KZ4e0slFBvqxczHKhzSkITPQQVq:O4Jm+UFm2Z4+FBvpK0LQQVq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655570325, "uuid": "db793eaa-b30f-4f28-9dab-0e5c428577cc", "value": 1115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655570325, "uuid": "1f2f781d-37dc-4652-877a-f5f6b675adc0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570325, "uuid": "8d66761e-87d1-4b9d-9d29-b980b7ab960b", "value": "Copy1614.zip.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18efb7d1-eefb-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655552276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552276, "uuid": "e783a816-8f0a-4ad7-a0ee-e984785c422e", "comment": "Malware payload (Mirai)", "value": "4eadc2dfe13016aa05d198b51db14869", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552276, "uuid": "832c4083-bf17-4762-8e9e-c6e545c8eb2d", "comment": "Malware payload (Mirai)", "value": "62b9790a373d05a38dc5fa7db2ac883331fc950ef2b65baf48307429a1fb68c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552276, "uuid": "fd26bcd6-5136-4bfe-87ce-6bba6813b0bc", "comment": "Malware payload (Mirai)", "value": "43591113a8fc238c01843c2c87a9a0e6830c3d47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552276, "uuid": "d96f26ad-9683-4436-9a6b-948db6317ec9", "comment": "Malware payload (Mirai)", "value": "5b204c10652a5ec162ce89d847f64a4c4e715ade46c32312f18f2cda524528950fea6c9eb0ba93c6cdbed1b9041169db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655552276, "uuid": "5748deab-80f1-4e6a-956e-409a2b4e1115", "value": "T1B1E32A56EB818F13C0D62776FADF425533239B64D3DB33069928AFB43F8269A0E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655552276, "uuid": "3ec9ecde-87dd-4a69-a849-6c6893a91917", "value": "3072:kLiiC4Rp6WLa3Vwt77rxdDP74GARHKWowDM/9kFnh:kLiiC4RFLa3Vwt77VdQGCKWowM/9Gnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655552276, "uuid": "b309e21d-ce89-4e03-bb9b-4c1d276e1f4f", "value": 144602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655552276, "uuid": "72417aa9-1623-4c7b-87e3-30a8cca920f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655552276, "uuid": "64e32fa8-3789-400e-a7df-b67f43a831df", "value": "crarm7.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2816ff6-ef25-11ec-93bb-42010a9c0043", "comment": "Malware payload (XFilesStealer)", "timestamp": 1655570626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570626, "uuid": "b32f5de4-cbcb-4455-87e6-1f22239ac0f9", "comment": "Malware payload (XFilesStealer)", "value": "12a98e38794ab1e0fee029fbab5f5a58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570626, "uuid": "7c6efaea-bf58-4b11-8fd4-20997185bda0", "comment": "Malware payload (XFilesStealer)", "value": "63c9e7ec3a191e9ffbfc388a3cf7375693b609f4fd223b3fbcc9d7d21759b1bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570626, "uuid": "eaed9dcf-fb52-4db7-9e75-49078e294a3d", "comment": "Malware payload (XFilesStealer)", "value": "da728b74a70441f9bcc357ed9cdefe25f18a3aa6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570626, "uuid": "5f2b0604-256d-4312-b16e-c683415ea332", "comment": "Malware payload (XFilesStealer)", "value": "f9f913006261092e6ebf30ca21e2822ab81dd2fa386f914f741ae73380d5f4b57668e0981ea24d51ff8b8de54c86f9d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570626, "uuid": "b98c80b1-fa14-4fb5-b99d-115a8bc8c050", "value": "T1CB44A04A7EE6FD60DC4E8C3AB8172007D75648D29F68EDA624D932D436BE4E730178B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570626, "uuid": "fea53c46-a8da-4105-9dea-4d470ea3c3cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570626, "uuid": "3e53c952-870a-4344-9d6b-38479418d9cf", "value": "3072:omi+YyixM+1RTWLQ7JCD+gZuMPiKqI8+iFAWRkJ8MzQdsbdNOSo3:Ti+WZhEmCigZuSiKqeaRkJ8MzQCbs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655570626, "uuid": "f7f7b817-5678-471c-9897-f43c9c1d2095", "value": 258048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655570626, "uuid": "a35dacc3-97af-430c-8769-2099a649698b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570626, "uuid": "96bde305-10d5-4fc4-bec8-f85ba27ed6b7", "value": "Solidbit.exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a77ce015-ef1e-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655567547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567547, "uuid": "9bc0422a-9fe4-4ad2-8669-53c552cef3b6", "comment": "Malware payload", "value": "b2ef3d41bc85f1d333df9cd803e603e3", "object_relation": "md5", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567547, "uuid": "01cac3e9-9224-47fa-a1d4-b81870f795dd", "comment": "Malware payload", "value": "63d38efb7105ff228427fb9d8ff2d60d56da5c8c0e939e033efda7cc4de8b008", "object_relation": "sha256", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567547, "uuid": "47141a87-eaec-40be-ae76-7b3884ef0cfb", "comment": "Malware payload", "value": "d26d7083e5145fa08adaa18298665c00e3342440", "object_relation": "sha1", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567547, "uuid": "0f82d4d1-9f87-412f-ad6c-5fb47358a108", "comment": "Malware payload", "value": "9de31ab20e7b0a469407035213b5c4120312645861eb49caf555f8a72d3a73fd8f8bb6e36e7a17ebdf7ce2ad94ab4130", "object_relation": "sha3-384", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567547, "uuid": "96ce644f-ec3e-4856-bf89-d065363fd6d6", "value": "T1C0B3023B5B3AFA56F1E2BAB68FBB590A1CD42D82C24487732153771E8C7194534073AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567547, "uuid": "b2957ff5-6d80-4aa4-b281-d85060f5cbd3", "value": "1536:+l2gSB9be/PYPHEnwyc19eAsjwLdK0OmupdZOSwZ2nEgmlp8NVUSgtNtLYHTVCmV:8r0y/8Hi9Bju1OIYENnSeNt0xCs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655567547, "uuid": "3d1633fd-0b3a-4517-9412-8db09f3d3b07", "value": 117248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655567547, "uuid": "c4904459-90c2-4d6a-ac7f-0ea2ce04bde9", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567547, "uuid": "601a7f53-4e39-4267-9c8a-3700fcc65531", "value": "1191464638-94.xlsb.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c3f4377-ef25-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655570320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570320, "uuid": "ff1a6063-80a4-4652-afcf-db29a5a4ebc5", "comment": "Malware payload", "value": "46585d0e6e8ea833eccba8729761c0f5", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570320, "uuid": "acee11ee-6006-4823-9769-d202195316c7", "comment": "Malware payload", "value": "643c4282806a84202430f34c108587e2f9a06b499382adc5cbcb24ae3678519a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570320, "uuid": "2d819386-05b9-4ac1-88da-474614704a17", "comment": "Malware payload", "value": "64f889700e262a465f7dd52f90c4114bcc99eea0", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570320, "uuid": "bfca6c86-6445-4946-b731-cd210af08eac", "comment": "Malware payload", "value": "a284e822ee4d3231cf2cec1e8eb8c2c018683e36e9b79a04f3258f0a939aefdca3b692e1595d1e0f0f12a5db7e4a59c6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570320, "uuid": "a47e33d2-024e-452d-9fdb-c28b305ed4d0", "value": "T1FC2186228E024874F35F8975D47E79E3B75BC10E15975E6F54C411E0325A0410F24CC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570320, "uuid": "845ec1d0-c0b5-4b05-9d88-75bce794627b", "value": "24:7KhT+qWl3PzqVdScgsAWtuR1jN97/Wc39Zg3Gp5u8P:OwpP+QR1x97/vNS3GnjP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655570320, "uuid": "21afb0c1-aa4b-423e-9f79-45eebbd0fa8c", "value": 1114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655570320, "uuid": "a808e6fb-b272-45e2-be6c-e765cfb0d182", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570320, "uuid": "c97beab7-e13d-4218-9489-763a3b01971e", "value": "Copy1469.zip.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6e25261-eed5-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655536220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536220, "uuid": "796c0e4b-d5df-4c76-87ae-17e25fb3786a", "comment": "Malware payload", "value": "e3f9a394e15322cacb8f20f87c1a6aba", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536220, "uuid": "66133ead-88ef-4498-ba97-9c820fbde270", "comment": "Malware payload", "value": "65ae9e49e23624693fa65a13ebc6a21b92a04c3e9df470ea1919dcccb8e38c7d", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536220, "uuid": "4952561c-f973-460d-b011-d4cf74bfee4c", "comment": "Malware payload", "value": "ff5aa72d49edb6eaf0d43e8c3e2ccede686d18fe", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536220, "uuid": "a9fe576d-605b-4a0e-a629-2f26aa8ec970", "comment": "Malware payload", "value": "52befa608d00296acd9e5c555f134740eb4b0d4c1c2028692978df9a025649aaa2cd76a9acbbb6c1a50e5a8c533a71a9", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655536220, "uuid": "5ad0cfbb-a543-4724-82aa-f3dd79f5e651", "value": "T16333ADDA6EECD903C59F37B0A408F8DB54B12FC447A4B25A221D3349253B64C49A77FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655536220, "uuid": "9d33a43b-06f8-4631-b8cc-5e28da02662b", "value": "768:miDcQqV5u4C8okgncWmqLTFfxu11UryI0jMU+sL0rweXpPwjavYnIrVZ6MdkPtxo:mJgkghi11UOx3+ZPniIrVZh0tTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655536220, "uuid": "f0ab2ba2-630a-4b1a-afa3-78262adcd0f3", "value": 53760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655536220, "uuid": "848aab8e-0314-4075-81e1-0cc443796d38", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655536220, "uuid": "205a90f5-28fe-433a-824e-25a28760fee2", "value": "103_300TEME221660088_23848928.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ada74f0-ef20-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655568358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655568358, "uuid": "0546e951-7a88-4b40-9517-0bffb60fef1d", "comment": "Malware payload", "value": "192019689171b4e3026b092aa8edc7cf", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655568358, "uuid": "959609a5-c849-4e41-ae4d-9a5debc8ce49", "comment": "Malware payload", "value": "660402f39d2467372ff0179ba55b8dee9ee8e7409f02728009548384afc788b1", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655568358, "uuid": "fe8c3a5c-25ed-414f-8d70-5646c2cc57b4", "comment": "Malware payload", "value": "1127013f4053a5eca2548a57edf7a952fddaaa16", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655568358, "uuid": "9604e515-c451-4aa3-875d-91e912f7ed03", "comment": "Malware payload", "value": "d3ea75be54f96c8ea499f579f53c866dd974ff48acb91f337a30766ff2e04dd7025dfeb7ee310226e3be3522cb29fb08", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655568358, "uuid": "2f6c3f74-0427-4c21-9807-c4c6d2e556ee", "value": "T19621B972C1855B4DD31E58739C47310F36B0F26FB3C2B3400585A278AEF5062B1380A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655568358, "uuid": "f1ceb261-d1c5-40b2-b534-6757f60f7eb2", "value": "24:dCbDsJkElpFPt+HKd0nK+oMD1O2Sf4n+jwbQ2U88HLRO5DD:0HD+QIMw2SQcwbQ2atO5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655568358, "uuid": "7caf8a70-df89-4373-9f6a-e1de45e5c7dd", "value": 1136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655568358, "uuid": "8d2ce3ab-397f-463b-b265-ce6598a8f9ae", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655568358, "uuid": "99f6612f-40cf-4455-87e1-b242be88c9b4", "value": "Items8282.zip.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddf1529e-eed8-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655537574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655537574, "uuid": "d63cd550-8ae7-4677-828e-1a4d1cbf3d9c", "comment": "Malware payload", "value": "3b8ea49ad3ec402bcd1010a6b0cef20d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655537574, "uuid": "a5ec77aa-4d88-417a-8335-df100e064874", "comment": "Malware payload", "value": "6720d110912229585fb6f1710e64470821924f4ace8d3c220e1af1d5a7491290", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655537574, "uuid": "580b816d-0b70-4a74-ba51-0baeeef9e42b", "comment": "Malware payload", "value": "739743ee872504cceb3d9d2ea07bc6fe2442cf08", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655537574, "uuid": "b4191336-9dba-49d2-a5b0-ac4ccfbfe821", "comment": "Malware payload", "value": "a6f701b8cad4d74a57cbc3b9229dd934ce756d3db8168cf5372c8721d35a9751ca2bbd48ba28eaa5e45143aa376fa7de", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655537574, "uuid": "7d36c027-6cc5-4ebc-b42d-b2b692f01e08", "value": "T1CD457D1173D41E24C37F4334683A341CEAB4C2A3623D1698B56EB29FAFB6A151D67723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655537574, "uuid": "fcc3cace-da67-444f-91bb-7d58c001b613", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655537574, "uuid": "1743854d-d6f3-4331-ac23-0aba4ebc9249", "value": "24576:uPRBTghzXYR0+QDOrpl4V/dEIJdm9T8O6:WEDZb6dw/dO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655537574, "uuid": "4622a384-20b3-4327-abc2-630903e2cb1e", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655537574, "uuid": "aa5462ed-de55-4c38-81f0-d5407b0d7a57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655537574, "uuid": "8a40b43f-044b-4b73-9f09-17dafb4e27e0", "value": "3b8ea49ad3ec402bcd1010a6b0cef20d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78fff4ac-ef2f-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655574771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655574771, "uuid": "942b8ab8-b769-435f-878f-2ea5b840736d", "comment": "Malware payload (AgentTesla)", "value": "53343dca2dfc72998024874637164e6c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655574771, "uuid": "3537b6a2-0a4c-4071-9852-0bd2fc198e1a", "comment": "Malware payload (AgentTesla)", "value": "6a7c1245ab7715f6470cc8d7d2caef1d96eb84916c9ca440889fabf4ab6a959c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655574771, "uuid": "75cb4d6e-42f8-44c9-b12c-a8fce3f2ffff", "comment": "Malware payload (AgentTesla)", "value": "dc10b4cb0c5ffb3bf10eb329d01014b5ea6c1b53", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655574771, "uuid": "d1d7611e-054b-4816-9fac-92dd923f53d6", "comment": "Malware payload (AgentTesla)", "value": "4e018f00811857eeba53b661cf1e70b9f822e9391d4950ce3bcf1e5e0152180d6aafad4c2fcc984a6808de207a544aed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655574771, "uuid": "4d4301c1-aec0-42f4-894f-76a8fe7a57aa", "value": "T145A4E0003AAC7521DAABCF755161C19491389D8FBD33F12A6FA73CCF6939B008261B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655574771, "uuid": "b622a42a-0333-419f-810f-a2d45999bc14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655574771, "uuid": "d5f70548-ea99-4785-b4ae-6c0864f04afd", "value": "12288:ybLqZw1h8qkV6d94H28axR6qb8GwGQGa0W1vtYb:y/912qO6v4HixM88Gw91v+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655574771, "uuid": "f93b0234-91a2-410d-80b3-dbd4b8393af1", "value": 455168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655574771, "uuid": "fd74494c-a4a8-43ac-a446-64acc8fb8174", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655574771, "uuid": "96f38a5c-802e-4665-822b-b137e9292c76", "value": "PROFORMA INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f992175-ef01-11ec-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1655555079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655555079, "uuid": "1b8e8abc-94fa-4d6a-aefe-9b44d16a8dff", "comment": "Malware payload (njrat)", "value": "5d0f3c63c7068bff15ea2737c722bad7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655555079, "uuid": "04cd94b7-8736-4ef1-83f8-2100925a8f8b", "comment": "Malware payload (njrat)", "value": "6b52d72f06fe64df132b4dfa0b07531fd4db4d4af0d0cd3673a9806d33c3f0e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655555079, "uuid": "6e9b8a5d-7cee-4da0-8550-2998d21c61cc", "comment": "Malware payload (njrat)", "value": "6f4d257badafa78a5cdb783a5decad2968dbb70c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655555079, "uuid": "f9e77551-0321-42e7-ac61-3c7044f5cc80", "comment": "Malware payload (njrat)", "value": "5585072d96feed612b80960fbe28eafcbbf7fcaa6858c888d0dc2e0aa15fb8771b5e474ca947f90ae99016522d905969", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655555079, "uuid": "9a8b4e96-0374-46a0-904e-25fb6543c6ee", "value": "T11893D74977E92524E1BF56F75471F2004F38B58B1602E39D48F259AA0A33AC44F89FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655555079, "uuid": "11558a78-2323-4689-9938-89a992bb5396", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655555079, "uuid": "89ed8b7a-6974-4a72-a94e-2502d21f4463", "value": "768:gY3nchhpC0EoQspgnOmWNW6tsX2JADll2gSXxrjEtCdnl2pi1Rz4Rk38sGdptgS7:vcXpVEoKOmWM6sdl4jEwzGi1dD0DtgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655555079, "uuid": "74ac7ce6-b135-4c92-a3b2-3937d8415622", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655555079, "uuid": "cb37d4f5-121b-4028-baf6-7f153cbe09e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655555079, "uuid": "b2f4c278-6251-4269-a4b9-c24ce9b391a9", "value": "Server.exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e36d150-ef5b-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655593624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655593624, "uuid": "571e9fe9-8b97-4c50-9338-7b87c035651a", "comment": "Malware payload", "value": "52ec7c00d8ef7a15a9124647faa64816", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655593624, "uuid": "ba8f6b8a-801a-402f-ab5f-c77dbc59415a", "comment": "Malware payload", "value": "6baed7364aabf35edb6f23430438177165ffedd8f2fe153f1e3a6e60c154001f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655593624, "uuid": "2a07368a-ee99-4d69-a126-78cbd1d722e1", "comment": "Malware payload", "value": "cb8dddcd3e425573087922ac41e2b182b6cbd799", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655593624, "uuid": "8503d040-d28c-4166-9ef3-6c7b3bf82c2e", "comment": "Malware payload", "value": "6e30e5f14b0757eca72583fece39c4609454af46fddb3209b519aa6d05aa0547b99605bafc0ee59f630c0b47b7c62285", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655593624, "uuid": "e88a7ce7-9843-4abc-a56c-dcc218e70bba", "value": "T15F03F10FC0478F870236D16B4675FC01215AD99AF52F18EEF4B964ADB58A0F098CD2F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655593624, "uuid": "d2b36c32-ac0e-4ca8-9ca4-9a0365fe4dac", "value": "768:vGqYIZuaQOiiwwZ+ZRLU2o7Y1oKCWpO1+WWGPszPrXRPX:OqYIZu99ZqjsoCyQG+BPX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655593624, "uuid": "fa50faf3-82e0-47f7-861f-a7d6b2ab2282", "value": 39839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655593624, "uuid": "aa00c5ed-fd61-48e1-b88a-4abf0c5584e5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655593624, "uuid": "50ea084f-5f45-4f9c-a379-a500bf52c11e", "value": "Detalles+del+banco.pdf.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f097b559-eee5-11ec-93bb-42010a9c0043", "comment": "Malware payload (GCleaner)", "timestamp": 1655543189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655543189, "uuid": "187ecaa3-199e-4f90-94f1-6e9669875fe4", "comment": "Malware payload (GCleaner)", "value": "90c7efe55fff3704de712084227e84a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655543189, "uuid": "4c24fb1e-ec57-4611-80cd-5ee82b1466e0", "comment": "Malware payload (GCleaner)", "value": "6bb5f93524d19c19ad102c9577107b7761e1ce94ea2229594fab55fdb98a7e34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655543189, "uuid": "86926b65-a86f-4c51-b2ae-91a1fdc608fd", "comment": "Malware payload (GCleaner)", "value": "b60983bec0346c6fdc0569f641e9091b7f201a5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655543189, "uuid": "7fb58d58-073c-4146-b6c0-ed718cfb61d2", "comment": "Malware payload (GCleaner)", "value": "480593eb580716fb87250a7046052a00d0f6f0d418f334afcb69bbd9ee4d9ae7efe50968784a1a2a9c460345c3f2530e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655543189, "uuid": "dd450047-d5fa-4ca6-8a8b-c19cb9c1ebcf", "value": "T17FD36B167AC1C072E66141323A64D7F0896DFD355BA18AA733845BBF4F202F26DA1F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655543189, "uuid": "35fc638c-ed46-43ab-9ba0-ddf37b9dd0f7", "value": "f357e85531c6f51e747b50e32a172ccb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655543189, "uuid": "072f1aa9-7b00-47f0-a8e2-d2e62e15eed8", "value": "3072:UkS7y4Oot/ZhJ3br4VkSlXWoQY2FRNu5UWzvzH9IHAz6ZS5:w7bRVb8TfQYERNu5UImE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655543189, "uuid": "b3c6429f-0dc0-46f0-8169-fa09334e433a", "value": 139264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655543189, "uuid": "2cfbf6e6-abc7-436b-8167-ed4be7e5115f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655543189, "uuid": "2c7f935a-847c-45cb-a0ee-b16ffc3c9e53", "value": "6BB5F93524D19C19AD102C9577107B7761E1CE94EA222.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b93b0423-eee1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1655541378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541378, "uuid": "7d1fc6f3-8abe-4dd6-bc9c-bd47df0a2b23", "comment": "Malware payload (Gafgyt)", "value": "1a60982bb5778fc1d4c219934d46355d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541378, "uuid": "a42456d0-d80b-4e9f-ab57-d221b40b3126", "comment": "Malware payload (Gafgyt)", "value": "6bba18c2a7be915cca1d931238c0b476a5ffb3ee1cd6eea10fc50051015b67c3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541378, "uuid": "bb96045b-8273-4ca1-9b5b-f99e5c42fe9c", "comment": "Malware payload (Gafgyt)", "value": "e9556b2dbe4761b45c9d6648527af81a92ba02d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541378, "uuid": "cbef5773-48bc-4803-b18e-cb5720dca2ee", "comment": "Malware payload (Gafgyt)", "value": "bc515abcd5b271e3d0e14fff2a4c3cadccc55e5c67a0479fbd593680e0ebfd1bed727d8b333c2a19fc0e31aef608534e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541378, "uuid": "5b98ef49-a1a9-4e24-b5bf-438ae723f84d", "value": "T13A23F223B21F6497D2B28D3E2D5DC20E2A693BBC61942937BB6343703CD13A25660BD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541378, "uuid": "fd1d1d12-9e6e-43c4-b322-6ce608ade40a", "value": "768:fY8RThemrekefsx2/xaTrEUIMSnKU0NbfknwZOeAbb9q3UELq+Ja2KYi9fl:Dqge0Q/x6rEUIM8L0RMwZ8eLZkci9t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655541378, "uuid": "c70068f0-5ce7-4b6d-94b9-a8790e518376", "value": 48252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655541378, "uuid": "447c8848-72ea-433c-9585-45638b3fed23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541378, "uuid": "7e4ef279-f946-4b8e-8edf-99afda182ac5", "value": "1a60982bb5778fc1d4c219934d46355d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "115af5fc-ef17-11ec-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1655564289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655564289, "uuid": "a45a8e92-909c-493f-9484-b0bab8d8561e", "comment": "Malware payload (njrat)", "value": "3c9c99d44fb77e53f1e5f156943726bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655564289, "uuid": "03cee67e-8523-4484-8bef-3dbbd05bbf6d", "comment": "Malware payload (njrat)", "value": "6d2bdf7783c3b676dbc65357edf2377a36a240cedec90a2d4f2a391ea9c7e885", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655564289, "uuid": "7b1270ee-733a-4d7c-bbfb-214305ef81ca", "comment": "Malware payload (njrat)", "value": "57bf33d8e372d4c9f2d8dd4e045aeca5b7850a88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655564289, "uuid": "235d2ac7-aeac-4186-81d8-0b29d1742964", "comment": "Malware payload (njrat)", "value": "8d9e3864b1877cfd572ddefd8e3f70f3172905d269a4f27a197bc662ebfcfd9eefbc13fee2a969e55170fbc206f591cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655564289, "uuid": "5c9a65dd-cd47-4045-abb9-9af2a21362c4", "value": "T137733A4877F54A12D1BF1DB5897292220B36FC036926F66D09D174AA5FB36C08A09FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655564289, "uuid": "628a226a-fe92-4e5b-aea3-e24a8ed00e53", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655564289, "uuid": "171c6c31-18e0-4447-8aad-70731b308e5e", "value": "1536:qBw+HD37DpxS5wpOk3JCK6pFo6v406fOpd/9nEh9TGHT4pR:oQwpOk5CK6MO/9ESz4p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655564289, "uuid": "2249215f-1f99-4813-9947-10f426480fc2", "value": 79872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655564289, "uuid": "31df9f46-cf2b-4a00-b725-bf1e40d2dfc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655564289, "uuid": "2c223619-8571-49ca-b808-873d80dc4bdc", "value": "New Client.exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c8763ad-eefa-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655551879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655551879, "uuid": "4162a4d0-2642-4d6c-abea-dd19115f9cde", "comment": "Malware payload (Mirai)", "value": "e4d98342c67669de20c55af7b446c8af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655551879, "uuid": "8b385d4a-759f-4039-80db-9123bea82d5d", "comment": "Malware payload (Mirai)", "value": "6da31fadd234e1475843c471409123d439ca49a38a5d8f42584663b89221df56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655551879, "uuid": "71f3abcd-3ab2-4ab3-a7ba-2e53a837aa90", "comment": "Malware payload (Mirai)", "value": "161df58211b285dccb2f756171998eba471bfaa5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655551879, "uuid": "3c5866e8-f0f4-451f-9877-389f8c72e9dd", "comment": "Malware payload (Mirai)", "value": "3f404104d46bb8b65934481bee19e4429342e7d949325702d5b6877a83046f4962e68b4027a9405cf6566a284e6e3abf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655551879, "uuid": "f63e6f83-b90b-451c-ac95-410a913ecaac", "value": "T1E7533A86BCD2AA12C6D015B7FB5E418C372613E8D2EF33039D256F11378792B0E67655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655551879, "uuid": "858e4adf-5cb9-411c-94ef-c279c84473d4", "value": "1536:pWnC8gwzdlX2xzN5obLp5ztrMc94AT2v+X:pW/vMzz8Lp5BVCv+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655551879, "uuid": "112ade5a-59d6-4352-a1ce-cef26ba67f26", "value": 63612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655551879, "uuid": "a63388c2-92ee-45a4-9d4d-4706e3edb150", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655551879, "uuid": "2dd30612-fe55-4590-80a2-fdb72357b434", "value": "ZG9zarm.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82e253fa-ee9d-11ec-93bb-42010a9c0043", "comment": "Malware payload (DanaBot)", "timestamp": 1655512081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655512081, "uuid": "1a51b6af-4bcc-4766-9d54-884ab76505dd", "comment": "Malware payload (DanaBot)", "value": "7c055d31ed3d8770f6468bb20772ef41", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655512081, "uuid": "eff48129-0f84-4f66-ba7f-48445a5a007c", "comment": "Malware payload (DanaBot)", "value": "6decc0a786c251a804555cd2b51aefa1928745cac10933cbb830d19115904b60", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655512081, "uuid": "6492e1d2-60f8-429e-a597-2bf68b45372d", "comment": "Malware payload (DanaBot)", "value": "b5ff8d245d5cb3e85a8ab9d861c55a03a5f3ff7e", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655512081, "uuid": "26f1bcc7-4cf5-4c5c-a3df-fed767d9874e", "comment": "Malware payload (DanaBot)", "value": "ea0b74e10aee18186de914318ccd852113e76867b76db74b00eee9d3863cb3566bbf0a2cba1f7f5da4d78c0a4919ccd6", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655512081, "uuid": "774a0146-b151-40bc-9c9d-a700e6120218", "value": "T17B65236076B48A67E6B32130B9B45A906937FC12FA71B00D26874B7F5D267D3B1B4383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655512081, "uuid": "40ec02b7-386c-4f33-b20d-cb8e3f11ae30", "value": "e854b16b1e5e4f4b4d041111d063dc14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655512081, "uuid": "04a66b88-2c3d-4591-aa7f-7af1cf129cd0", "value": "24576:L+qNBNfbJx8L98o0mqkG7LLRaFlD0F3+iZ17F3tY3p36wQra+kKfA0mn3:dNPfbJxDoGkGfLRaFOzY3p3srrzm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655512081, "uuid": "9f1b10b4-e557-4466-9f97-902835db384d", "value": 1465856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655512081, "uuid": "9495bc6b-aa31-4826-ac5b-9ce85f7e161a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655512081, "uuid": "df9fceac-918c-407c-b9c2-6064f51fc9ad", "value": "6DECC0A786C251A804555CD2B51AEFA1928745CAC1093.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de2b9bc3-eefd-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1655553466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655553466, "uuid": "ec7e7c19-5606-4226-95cf-22b03d8293f3", "comment": "Malware payload (RedLineStealer)", "value": "a185ad6475abbf4dba040088440072e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655553466, "uuid": "94b5e522-c443-44a3-9f41-6f5c8a046e34", "comment": "Malware payload (RedLineStealer)", "value": "6e06a52abd89d2d3c4b6f20017b6f5e2f559801077bb2f4287ee4328e43348a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655553466, "uuid": "4e902646-bd9e-495f-837b-a38f49c29d14", "comment": "Malware payload (RedLineStealer)", "value": "75177dfdcb70edfe604b6d6ad9ff9b438ec3f64b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655553466, "uuid": "88f368e3-88fb-4287-bf5d-3d47a5e87a90", "comment": "Malware payload (RedLineStealer)", "value": "adebf0205838ac84e0748f950f1e559183ec65ccbfaf59335ba92b5959f84b7510f02eb2dd848d561dba45c4ccf64eb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655553466, "uuid": "81e18358-3f28-434b-9365-0a91d8140498", "value": "T175A463BC546F9E5EF9BE0DFC60C86B086394DCB194864100F1C338AABE723DE69519E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655553466, "uuid": "0e819e3e-5a0b-4dca-bad0-0fd7ed423b35", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655553466, "uuid": "b6e01119-2430-4082-a097-d927e569e1e3", "value": "6144:yiHZS/Os+d1G1mFVTXjbuYD3eOMSTHcA:yiHZSm9d1NzHuU3eeTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655553466, "uuid": "b084ea4f-e136-4f4a-8cf9-f722f500f984", "value": 480256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655553466, "uuid": "353e89da-da0c-487d-b162-6bf2ab26e4bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655553466, "uuid": "d435a03e-3bb4-4b89-a30a-3ee733b0c238", "value": "6E06A52ABD89D2D3C4B6F20017B6F5E2F559801077BB2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18f761d9-ef25-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655570315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570315, "uuid": "2cafd311-d006-44c7-940a-a78fef98a2e1", "comment": "Malware payload", "value": "892ae5a5dc67b4e38de0809ac93bbaa7", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570315, "uuid": "622b0a1f-acea-4381-9c44-b2fe65459c0f", "comment": "Malware payload", "value": "6e558acb007a638f71bff4d2edf45c3fa2c230afd9ea67b918f33c64f942236b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570315, "uuid": "72eac820-05a4-48f7-a468-310cdf66572c", "comment": "Malware payload", "value": "268cba014f5090919c8ff2faa3a6260b4671db45", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570315, "uuid": "ce572f88-0175-4fc0-881a-9600e6cecba1", "comment": "Malware payload", "value": "7df64a6a73d0d4cdaa02a3fd3a724497db1b0c5fcba64ee12a584c803b82066cd7bdd090f6e63292198a53eb85fd4e26", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570315, "uuid": "37898a70-269b-4448-abd1-5259f9b713dc", "value": "T18421B699BD286188DB3FC031D0BF8DC9389F62C589D4A80B1DC4A0D57F26011ABB1888", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570315, "uuid": "f2f51537-94e7-493b-8ced-92b61df074a0", "value": "24:7KhTd9BFdG2h/cjQnyogBeXYHrWCcNRUWOXWb+BNDN9Xhn:OdJdG2CjXozoLWCQAjBNDNhhn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655570315, "uuid": "bbd57ebc-f194-465d-bdd2-bf5a1bfe1d1e", "value": 1128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655570315, "uuid": "8f9441c9-29cf-4bb2-9ee8-d4f3471e6d35", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570315, "uuid": "3ef967d0-5bf6-4fc6-a0a7-fca2bfd86fbf", "value": "Copy1227.zip.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f13a820-eed9-11ec-93bb-42010a9c0043", "comment": "Malware payload (Vjw0rm)", "timestamp": 1655537791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655537791, "uuid": "474b5ea8-47eb-40ab-9ca1-9ec73a5ff388", "comment": "Malware payload (Vjw0rm)", "value": "9279ce6d838dae04a670dd9414db00eb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655537791, "uuid": "e7311f4f-c1d5-4ed7-a510-5f3323763f9a", "comment": "Malware payload (Vjw0rm)", "value": "6e5e0e9f651300eb398ab45b10aa881ce9218088fb6a48c0e381be206c44b7b4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655537791, "uuid": "10528b8c-d19b-41ba-917a-a2ee9692f4ef", "comment": "Malware payload (Vjw0rm)", "value": "960f79f13370c8bbaafed34d188cec956abb9cf5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655537791, "uuid": "b8c6f96d-405c-41d3-9bbf-224673ca87fc", "comment": "Malware payload (Vjw0rm)", "value": "1305fe983dae3ccdb51d834ba64c8ab4983727b554191c343a69112bd7f60001f4fa1a2902565dfa2757ec3afe5d438c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655537791, "uuid": "0aeaad1f-5b91-4029-be41-17c935136bcb", "value": "T151D382A95B08AAADC47497213C357CCC43B85A3FA192F3A9741F71508B7CF91C7CA5A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655537791, "uuid": "779073c1-648a-41c9-ae31-81bf17d40c6b", "value": "1536:q9JFFzMqSTy6Gc0lXKysTZ2Pz1SstknXEO6Cs5VJ9qVAGkBApyspl+:kFFp0y6V0l2Ts9knXERNqUmgs/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655537791, "uuid": "32411267-1bab-48fe-9c3f-98c6b2488561", "value": 130787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655537791, "uuid": "df3baa5e-13d2-419e-8702-1ce1c0fff7d7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655537791, "uuid": "33d2fe35-dc89-4606-a62c-c0ad06fca086", "value": "Electronic receipt #AMZ-HWRM-1605160622.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "703ec5d5-ef20-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655568314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655568314, "uuid": "3d5822c8-59d3-4532-8e1f-fe0979bb7e41", "comment": "Malware payload", "value": "25b54b1b36bed047512442c41a5ed72a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655568314, "uuid": "94db7f06-d122-4f0f-8cdf-185232651c50", "comment": "Malware payload", "value": "6f31f04c8194b5154671d21d4ab451980dc8021774ed247010ef1ace3ec5aa05", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655568314, "uuid": "f7c8e883-b1d8-40d8-8b96-405c74adcdce", "comment": "Malware payload", "value": "8a52f9ebf03fdada78f11dc90f0773fc6d04cfbc", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655568314, "uuid": "88046a3f-96ab-422d-8c88-dff80fb3ea01", "comment": "Malware payload", "value": "8234668f171eacde453b38c6b1d52805cf51ebe4fcc1f43ac8e5ca8d07872600e41c2b11b15accce4d2bde85ff810629", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655568314, "uuid": "83c4ad15-703d-4e40-8060-acdec235f8b4", "value": "T14121826FC4E51C9FD2EFAF38E09B720E5262EB68E983738D0F40204D7993156A234994", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655568314, "uuid": "ee18d3d3-7407-440f-a7b1-5c2fe2c32227", "value": "24:BCplWJJNjc/UNqSR3EpxZPY/yRh3+H730l3jHFa6nrXOwUg:wvYyUDR3Ep3ekjA6nrXOg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655568314, "uuid": "4c927092-4b44-4b6a-9a44-0f789a1b3518", "value": 1137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655568314, "uuid": "1e9df46e-31a6-4837-8837-57f5c602b3c9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655568314, "uuid": "f71d87ee-607b-4ba5-8b04-3f7c986732fb", "value": "Items3567.zip.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9fda8fb-ef2d-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1655574075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655574075, "uuid": "04bc6744-b6c2-4d8b-93ad-0d5dffbc2ff4", "comment": "Malware payload (SnakeKeylogger)", "value": "995efcdf49fe1af7920f73489e865ef0", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655574075, "uuid": "d94d0b2a-c431-4fb2-86a1-f384243b8cc6", "comment": "Malware payload (SnakeKeylogger)", "value": "6f7bfdce0d7ce107a62137dc446b7325cb7d7cfeb5ef97b51085d4ef9d4695dd", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655574075, "uuid": "597b6c54-f1bf-49ef-b16c-5088c554294f", "comment": "Malware payload (SnakeKeylogger)", "value": "082bd07e8a2edab6276cce294ddafd75f17472d4", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655574075, "uuid": "4d7bbb04-b67d-4db6-89ec-8e83721e3b5d", "comment": "Malware payload (SnakeKeylogger)", "value": "8933b607c84da0bf5b7dc6ba3b0090459a43e283bc99dad1e6a062e68610becf1d6c2d48220578f3beaa9df75eb2ecd5", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655574075, "uuid": "1e1c3488-909c-42d8-b9c9-b73934ad4f6e", "value": "T16952C09485268132B466E9E30D8C656B4BD3F8E41D21D796402AB8D471FA0FCF23F9E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655574075, "uuid": "6624f92d-6f74-4ae5-8986-921129bfa9ab", "value": "192:8RgDgLoBdM1wJBDXLIA2lMieG91kdcR1ZTXTnTDZD4nxJdmhHi:1DZ4ABDXLIAGMskdETX7V4nDqi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655574075, "uuid": "d5313238-8827-44b5-be36-4aefb4712a1c", "value": 14225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655574075, "uuid": "20a7ed36-7765-4e5e-980a-1f716f7e7210", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655574075, "uuid": "6189f770-878f-422c-8a84-f429128f1692", "value": "MV Rising Sun vessel details.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "968616dc-eeff-11ec-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1655554205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655554205, "uuid": "052b20a1-460e-40c8-936e-4e70eaa374d2", "comment": "Malware payload (AsyncRAT)", "value": "a50c0acfc3c44408a44f64542e0d964c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655554205, "uuid": "dc30ec2c-5bf7-432c-96d6-ab2efec795f7", "comment": "Malware payload (AsyncRAT)", "value": "709df2fcaf912ef11f49152efe8bc6eacfbf51e46f14c1ff0bf61352607c2ada", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655554205, "uuid": "9a6a699d-7539-45da-bc7d-08285d48f9d0", "comment": "Malware payload (AsyncRAT)", "value": "09fb3b50c14ed8837e2f2c29d63f3e742dbde992", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655554205, "uuid": "72e07257-0eeb-4ff8-85f9-621467b7926d", "comment": "Malware payload (AsyncRAT)", "value": "2cf129c18eef568aeac849aa2bb798c63992c8225352acd545f7370a49a55753820e78f1668810fa7754c7450008927d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655554205, "uuid": "522a206e-067b-4a94-8c9f-539178a94dfb", "value": "T1FC536B003788C965E2AD4AF8ACF2850147B1D6772101DB5E7CC814DBAB9EFC64A537EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655554205, "uuid": "cb43428f-a8ed-4d54-896e-fe395959ee98", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655554205, "uuid": "04cb7bda-67df-461e-9748-447840818042", "value": "1536:jhfhLzkQU/Qj83nxy1ReeiMl8GbbXwxh7G5ZVclN:jhfhLzkQU/QQnxy1UeFmGbbXSGzY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655554205, "uuid": "b8e15236-f1ee-4403-bafd-a0bebb3a81b7", "value": 64512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655554205, "uuid": "ff7f928b-5715-464f-9387-edfc1b6f84e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655554205, "uuid": "9c2c1eb4-3d3a-456e-849c-ed2634ed8421", "value": "Client (2).exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1794afdc-ef4c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655587063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655587063, "uuid": "3c79f0cc-dcef-481f-8053-ad32fa7e3e5b", "comment": "Malware payload (Formbook)", "value": "eae807df907ea663a0f7bc1d4d8ebcce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655587063, "uuid": "1d87bf91-6f14-4bec-ac41-0377ad6edfdc", "comment": "Malware payload (Formbook)", "value": "717ab44671da707ee8ad9e5c6e4ade18d6f47841e65a6bd0cebd56c8c1533fcf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655587063, "uuid": "f6a21509-5f00-46e0-9f88-9757884b31b7", "comment": "Malware payload (Formbook)", "value": "e4edac384575b263a70990cfe88098ad6e4e6fc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655587063, "uuid": "0a131208-8b26-4d9e-9091-63cb1f9faffa", "comment": "Malware payload (Formbook)", "value": "270607a7d94f7d4a3ca4abe9543d3bec7e4680e9d351a9ebbe4ce3fc83856ecc1f1da63e6902bea85c3c9f27ddc5cb1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655587063, "uuid": "e4f0ed10-199d-43b6-8dd6-03c463483937", "value": "T1A5A4F1003BAC3900D99BCB7541A1C56481759D8FBD77F12A1EA37CCFA839B44A6B1E36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655587063, "uuid": "7eab356b-711e-4e03-81dd-75722b090994", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655587063, "uuid": "e3f5ea42-086d-4574-b86a-701761ed6339", "value": "6144:H489UIG92WYqKnBo8XyQqAivqx4N5XlNoHXApkCYIF1EFV68wUd0RGk7OLkQGiqC:Y89xq8o8Ag3AiLIrUd0Uk7O6iQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655587063, "uuid": "ac010fcb-0dc7-486a-8ee8-1ffca9d3f8ae", "value": 452608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655587063, "uuid": "c5e9c35d-5ae2-4572-8825-d5a99decd0f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655587063, "uuid": "55dbd39a-444c-4640-8d99-e5012f621ead", "value": "INQUIRY 215082A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08a67223-ef4e-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655587897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655587897, "uuid": "cd5bd05e-d173-4740-a531-312f9b2f49c0", "comment": "Malware payload", "value": "5cc7fab73fddba81647be5208aed8971", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655587897, "uuid": "d3bbaf8f-8498-4bb6-9419-4d9e855ca1d4", "comment": "Malware payload", "value": "71c58a1bd8addff8fa4c5df4f6773eeb4400cc89253ea8ea0be1c04b56c51b27", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655587897, "uuid": "bc0e4bbf-9e40-4570-b268-197899164396", "comment": "Malware payload", "value": "af0f77ac9e85395770b6052e642545d3f0e73e9d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655587897, "uuid": "024e622f-1a93-4b2d-85eb-eaf86dec53ec", "comment": "Malware payload", "value": "9c31d6af3022d5cc0b13c751c4e0552d6cb4793e0703a6c9c5060d9a356d46248db486937509383d5b14c5942a8e6547", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655587897, "uuid": "0277951e-8ab7-4e1a-b931-56094b571ef6", "value": "T15B03F1F4135066BFCDC54B7EA827A9B724D3B2DAA20A0AB4869A05C48D3CDC6F541363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655587897, "uuid": "61042816-5efe-4594-b6f1-ed0737aa1b28", "value": "0a0563c3f9bdc532aa578f457b27651a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655587897, "uuid": "4047093d-d1c2-48fd-b750-5b6a3b900e39", "value": "768:1RTf5Q2vmIKpDJukaw4y/421IBV87PKyr/cULsU1JmjcBIKeuatz/Vd:130IO0zytIB6P3XLsemz/ua9Vd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655587897, "uuid": "87926bf0-1d9b-4944-b817-af66e161778a", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655587897, "uuid": "e028210d-5a57-428c-be28-e713b59f5be4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655587897, "uuid": "37d43bb7-a052-4697-95ba-bd56ff41d282", "value": "SecuriteInfo.com.Trojan.Packed2.42870.5743.8847", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08d199d2-eeff-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655553967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655553967, "uuid": "0b678236-a8b2-4c2f-8dbb-34fb28dfc79c", "comment": "Malware payload", "value": "caeb482c51fa6a43aaaf35a7a8ae87c9", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655553967, "uuid": "20e3eea6-fc6d-4901-bd85-63fd3e6f3b8d", "comment": "Malware payload", "value": "72497d00c08b581a166d7d3f32cb3b0ffd97f198a07f24ae3f2683a6627f52db", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655553967, "uuid": "5b0563f8-1068-4977-8cab-e4ff890630c8", "comment": "Malware payload", "value": "15bc42baf76156bf5c0e26c2f29435bbd9ad6fd1", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655553967, "uuid": "c8651d05-98e4-4b9c-a4a1-e350adfe885c", "comment": "Malware payload", "value": "42ea5b94455bbdc46112d46c3f27bd39e1f3013926f39dca8b89737b8422907dd3154cda69dece043065331e503d31d8", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655553967, "uuid": "cb45c724-413a-4239-a915-cc5b0dae7ae2", "value": "T10A4712AAE798D85EC4F64335C87642A2F1434E1707439EA73A7CB2781F734D24E85AC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655553967, "uuid": "10e5aa3f-6b28-4ce6-a0f3-707fd8495df3", "value": "393216:W+aJORRRRRRRRd0guzQ1q0xQWHbng+ngBj1niYLuEbFgKFgVfvomKlZhh1E:yORRRRRRRRSguz0WWHbng+ngBj1nb6EQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655553967, "uuid": "da6a9aed-0866-479d-bf3f-a650d6eb707a", "value": 24793971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655553967, "uuid": "5892cf63-1bf5-45f9-bb07-ade1989269da", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655553967, "uuid": "807f5546-5bf0-4366-9869-b8d4cffca691", "value": "Super PDF Scanner_1.4.5.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "289aeb32-eecd-11ec-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1655532545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655532545, "uuid": "3b8c2697-b354-4ef6-a302-b5f0b720055d", "comment": "Malware payload (RemcosRAT)", "value": "edb7d4821efa469977296d4a1e443f9f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655532545, "uuid": "f581d9de-6f8b-40b3-9b49-693890dc516f", "comment": "Malware payload (RemcosRAT)", "value": "725dcbf4b7ccc0a9f562f0dd2e308c2b541200a9101520457f6beb64620b4226", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655532545, "uuid": "279e343e-cb39-421b-9931-9bfd98f2d643", "comment": "Malware payload (RemcosRAT)", "value": "76878f4743f56d678054948a0c942cfe98c195b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655532545, "uuid": "6d3ffb90-7c1f-4b8e-b67e-7241084d6e9e", "comment": "Malware payload (RemcosRAT)", "value": "9729103821e12f4c7c609970fecafe5bf98ab568d9200188654f241bf21b7f28e7f497e7c72aed1ab111791889db0f60", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655532545, "uuid": "b71e4be8-0c4e-43ac-a429-4c2c5df09dea", "value": "T15CA4AF11BAC2C072D57251340D29EB35DEFCBD212935867BB3D61D9BFE30180A72A6B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655532545, "uuid": "13fec84f-6283-4ca4-9d37-ded2d45a6180", "value": "a7296afab03588778ff3a4f804abab68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655532545, "uuid": "14e41f94-646e-420b-9b24-c75171faa570", "value": "12288:asrjeS3UVprYfELtx6uz6s3Q4KsfZV7tS6d:/HeaUVxYVuzB3hZ10a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655532545, "uuid": "993b36fe-a37f-4b76-ae8f-aa37280e547d", "value": 475648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655532545, "uuid": "bf56d30a-2b22-4a45-aca9-d075e3eca702", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655532545, "uuid": "e1ac2819-2edf-4127-963c-feef5af85788", "value": "edb7d4821efa469977296d4a1e443f9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7d5b7dc-eefe-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1655553804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655553804, "uuid": "f266f0d1-9739-49d3-9905-8941a815ebd3", "comment": "Malware payload (RedLineStealer)", "value": "ae6fe2df78169ded8716bb674c717f63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655553804, "uuid": "66644f54-003d-4a3e-b8be-366ac7410785", "comment": "Malware payload (RedLineStealer)", "value": "74aee30ce1fd2e305307be59aa6b15b8a33854af361242547826f3b77a6bb169", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655553804, "uuid": "f08ec62a-04d2-4fb6-b1db-0f5054dcff44", "comment": "Malware payload (RedLineStealer)", "value": "2766c35c6959da709609f64a3dc1a0154ec2ef5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655553804, "uuid": "a9eeeb91-68db-46c9-8db8-0fddbd647f4e", "comment": "Malware payload (RedLineStealer)", "value": "a48ccf5d290c44cc3bb440b8ebf2f5e2dfce5a95f63d648d681593a081fa2075c27fb462c6945d41c5bbbf807927ddca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655553804, "uuid": "983dfd2b-90da-4052-aa06-eec37f900282", "value": "T145D63311B7A04D6AE1BE133AF4B59434D232FC46A355F30B1FA924A92D633C99D913B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655553804, "uuid": "9d7182d8-45fa-4043-a3e8-1314c813a483", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655553804, "uuid": "d9af18f4-7bdb-46de-8035-8a57a599590e", "value": "393216:Hkp1KhW9c5hlERV5RFJzFcguYtN3ZW7FNBQxLd:H81XEhkVhZtN3+FNBu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655553804, "uuid": "4159fce7-da3b-4e07-9487-87d29edde4a4", "value": 13433856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655553804, "uuid": "71da1976-cb17-4ce0-917a-cf3690ec3512", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655553804, "uuid": "91405037-6cae-48bb-9ec9-2b3b9de99c63", "value": "MAGICD_1.exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40559058-ef27-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655571240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655571240, "uuid": "4bacbf4f-b6e8-4a6b-beb0-8666588ba13b", "comment": "Malware payload (AgentTesla)", "value": "6ba39d7d867628bf91a0bc5c1764fefe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655571240, "uuid": "a4331c61-359f-44d3-9959-f446c366812b", "comment": "Malware payload (AgentTesla)", "value": "74d10be5602700512969c0311237d5897059c783a9018cb2f819a68918d29bf3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655571240, "uuid": "546a859d-f5a0-429d-ad6f-cda2ac58384c", "comment": "Malware payload (AgentTesla)", "value": "8185212c5acef73ca25ba2afb2530713c4025dce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655571240, "uuid": "b33f7dfc-097c-44b4-97d4-36eb047790d5", "comment": "Malware payload (AgentTesla)", "value": "2d8d187ad4bb08efe95e845d859ac67077094ff3b453e5946a7748acab5d4686b6acb5bb5a7ca1007ac916ba03332d1a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655571240, "uuid": "2ce21d20-c6c9-45b3-88b9-0bf8b6458b40", "value": "T1F5D4AE88731DBCBEE41BD473A9508C14B760246FA7A7D023956B258EB85CB478FF0972", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655571240, "uuid": "4817e66f-c1d6-46d2-b97f-67e40c9249f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655571240, "uuid": "f7a787f1-516e-4764-8773-354516544f8a", "value": "12288:AEn27IkeR02Pn18qoHlg2xkrL9PfWqGYMbuZPgx5g:AjbwxPmqAlg2x2LZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655571240, "uuid": "4b7edc01-ce5f-4285-9b9b-79b92cfb8412", "value": 607232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655571240, "uuid": "5d74f2e0-d436-4427-9ba7-0a6a8d3b0d4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655571240, "uuid": "dbbd719a-e15e-4501-9a63-ec0225b0ddb3", "value": "dd6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56978a81-eee3-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655542071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655542071, "uuid": "bd086315-2cd4-4d44-89b7-508523c0df02", "comment": "Malware payload (Mirai)", "value": "5461d39bbc1b1572b283ff6fb3f536bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655542071, "uuid": "08838b45-dd81-46b5-b741-aa67188b0915", "comment": "Malware payload (Mirai)", "value": "7752752efda8fe3293e30a5cdf8333c792774b5936a139f542a263069b48b8cf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655542071, "uuid": "5b4cb0c3-04e8-4509-81a2-59d147a393f5", "comment": "Malware payload (Mirai)", "value": "31cddb941504f49edb4152162562fba8aa2640d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655542071, "uuid": "dcf1b743-7b1a-47bf-b6fc-2b5e4ca84ec0", "comment": "Malware payload (Mirai)", "value": "0f61650593113681a1bd55096ab6fbf9b9b74b2184fb143b6985738d62ed9bc9bc41635a0857728356c2274115987256", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655542071, "uuid": "4e4e00e0-0a55-4fc8-8e02-eb5e0c2ffbe8", "value": "T140C30805FC404B27C7E22BBAF79E438D773666586BD733116A295EF02BC5B882D39160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655542071, "uuid": "c9316616-2c5c-4b30-91d6-f47ac91b02c0", "value": "3072:sJDZ+6lJQTnoo3nKVz3ecxPWT5hLSFuX0wX4eoC9DQlD6ObAF5R:k3eo+T5hLSFuDJoC9DQlD6ObAF5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655542071, "uuid": "004a869e-ce49-4cbc-bd31-8aeaddd99ff7", "value": 120771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655542071, "uuid": "33b2384d-e110-47c5-9797-3265f50bacef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655542071, "uuid": "bd7f5f30-8a66-42cb-8271-630d317eed96", "value": "5461d39bbc1b1572b283ff6fb3f536bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aa9d856-ee9e-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655512336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655512336, "uuid": "754450db-b3f2-42b0-8403-9a7f0b4a1a62", "comment": "Malware payload", "value": "4b4f8f739f00e08137dfe25d57dfcec0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655512336, "uuid": "0c111f45-6cb6-4e49-a3ca-635bf623a8a1", "comment": "Malware payload", "value": "77a73ab0f21967b9e07289fed93c5c7ad1269881b517c1cc378a2b7e5790a4d7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655512336, "uuid": "d106a47a-2f65-4dba-bac3-f03036323a6f", "comment": "Malware payload", "value": "6d38d0adca7bbe1fedd9cdf8eddcd583f6b75086", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655512336, "uuid": "33d8a7e0-c3f4-4c72-a7a9-41ce4d816e99", "comment": "Malware payload", "value": "64df4c7c4d6aca845e624e01584999e706ff14eda18fb6ba2584db90a88665aa3528570bb91dfe7eee52cb3b4696bc1a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655512336, "uuid": "38edc9c2-c123-48a5-bfd1-bb4cf1722893", "value": "T13BF2BF9AF394CA25C9760AB16D7343020F70F452DC62EF5E28D4A44B6F223950A46FFA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655512336, "uuid": "e5ffc86f-43ba-4d9b-8f05-ad20ab4e8d3c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655512336, "uuid": "0eeabbb3-6527-4dd7-bbd4-96a38c0ce0b3", "value": "768:gwEYF6e3bxVuiNf7oDFYwQbXvLWRgcL0ST8iNxy2P:gwrF6e3bxEMG7IWRgcL9HNxvP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655512336, "uuid": "6095e6d8-da13-4572-98e7-5b4ba05e5f30", "value": 34304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655512336, "uuid": "05962dcf-dbd7-4bc9-96f4-a5e9469882a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655512336, "uuid": "9efcb2cb-db53-4a01-a907-2c69f4298e17", "value": "4b4f8f739f00e08137dfe25d57dfcec0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dd82bfd-ef17-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655564283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655564283, "uuid": "74aef33b-1684-4692-a826-aafa6a4d1852", "comment": "Malware payload", "value": "dfec2f74baa3204a1e5fb4106d5e01d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655564283, "uuid": "85bd6d79-93cf-498b-9931-273931f4f861", "comment": "Malware payload", "value": "78fa276eecc5518c088efa45943b34bfca9b04f0baa9bf82a06776327d2b52e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655564283, "uuid": "ce03a425-7595-4ce6-a52c-ed0ddc16bac7", "comment": "Malware payload", "value": "d16e57d4327b370e7cb24166ef3467aebb3c1cd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655564283, "uuid": "2301f08e-7649-419f-a5ea-b1d9ce512497", "comment": "Malware payload", "value": "c20cfc8f0568a4360fcf3f7959b70716405850d978101ea23ed781de5929143d59225bbce6fc5346863992cbad283440", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655564283, "uuid": "da80ca80-a1c6-4136-9313-df267c07465a", "value": "T1821633027A91AC72C13105F65AA4FF5075786E100F348DABB7B47EADE8F4091AF39627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655564283, "uuid": "38da07f1-d9d7-43af-985f-0a08aba99f04", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655564283, "uuid": "4649da4d-2c33-451a-9b10-43ceda7d5745", "value": "98304:/PrZifQCGPubfzsd6o48KuokEL5v351iI7t4VHn:XrZN/GrsF48sr/QIJ4VH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655564283, "uuid": "dfd69dde-1438-4d20-996d-13e9b323b04a", "value": 4249506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655564283, "uuid": "b798c592-bec7-4b5e-b627-2dfacb68021f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655564283, "uuid": "f4f71c39-1361-48d1-8bbb-665175675611", "value": "GTA5.exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cad65f4f-eee1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655541407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541407, "uuid": "2160f754-1c9e-4644-8ab5-f01b76d7734e", "comment": "Malware payload (Mirai)", "value": "bca48e092c49528265e7af37fbd58727", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541407, "uuid": "400369d1-b1cb-4cd5-98ff-137518192a77", "comment": "Malware payload (Mirai)", "value": "790d84e275c3b172d64ff4f39defb50d506d727bb8a1cce24d3e5c4b389b3dc9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541407, "uuid": "5188eb89-351d-4973-91c0-c0e2db992bbd", "comment": "Malware payload (Mirai)", "value": "a3b947183b9b37d7d3e0a00424a60b08699a17ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541407, "uuid": "08966e0c-3482-4bc8-8a31-2f7f5a8168e1", "comment": "Malware payload (Mirai)", "value": "a55e5b7a759047404b17a63319da6b140ede9a3bff41fa5e1a2ef6838cdf2bad4e566b3adbe35c8a26e54af9c2935eb5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541407, "uuid": "d68bea60-1adb-408c-aff2-84cbe235d643", "value": "T15CD33B05D8509767C6D227BAF79E428D73236B68A7D733115A28AFB42FC1B9D1E3D020", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541407, "uuid": "131bc83a-36d8-421f-bacf-75c0c0bf9fb3", "value": "3072:4VfyQ+d+pceQGfBbPTa+jthWOiwzte6Xd45hLEDyh3O46dZBjUmydQCYMhEFg:CbPTa+jthoEX+5hLE+3C3gmydQCYMhE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655541407, "uuid": "3bba9a23-fe5a-41f7-8379-f7db26177837", "value": 142751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655541407, "uuid": "2c16a4ff-4590-4de6-aee0-3a745d34e1dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541407, "uuid": "51f59011-2e0a-4b37-802c-0a7f3276e188", "value": "bca48e092c49528265e7af37fbd58727", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fde88ac1-ef4d-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655587879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655587879, "uuid": "2d6b92a6-2cb8-45db-b92a-bb59a0093f52", "comment": "Malware payload", "value": "9c6ef7b1cfe3f9da31442d75843bd0cf", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655587879, "uuid": "1302a3d4-778a-40a2-82c9-b2f9cb2fc92e", "comment": "Malware payload", "value": "7a1ac49143e4dc8d3e7f3d033b1b382b3120bfdebfbaf3a304ab2f086456a896", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655587879, "uuid": "e000d7c9-64f7-4126-bf6e-fcc5d001bd9a", "comment": "Malware payload", "value": "bdc41f134ad86d8c442bf843a8c1174e67481d72", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655587879, "uuid": "a25cc5f6-25fc-4b76-85c2-1cb1b6d695d6", "comment": "Malware payload", "value": "27b88a6a35248026814ba3d983441880f359546c5ccc4f218c9a20aaea682360c11dc2d9f480f6350119a39f87fc9f1e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655587879, "uuid": "f1c7841a-637a-4dc7-920a-86bf1262757b", "value": "T13395E01368A24F84C9AD013990EB6F4666ACAB4F5202C71F5761E2AF3FF37F09C25456", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655587879, "uuid": "502e41df-4a8d-4225-b26f-0e3d5000aad1", "value": "24576:3URqqTz/qbNyjcEEhNDWfsb6L9nAcDzbEppLiVjBYS4rr:3UnINxEitWfsyNRauYFH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655587879, "uuid": "d6f7ef7a-69a4-40d3-b586-58c6dcc191f5", "value": 1937691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655587879, "uuid": "f79d1370-5e7d-4470-a095-4c6384146690", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655587879, "uuid": "8cc13046-a269-42f8-801b-776e39f57963", "value": "Installer.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "775c72d2-eed5-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655536113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536113, "uuid": "141ea0d2-d781-4740-a6e6-96197b8f8ddb", "comment": "Malware payload", "value": "ef774adcd7fec1edca85cecbbbf7409a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536113, "uuid": "4edee0c0-9062-43c3-91f6-6eac79ab74e3", "comment": "Malware payload", "value": "7c5832a5b9fe43c40b03c255e6b593191c88ec28d6245e152920f3b0e40c132e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536113, "uuid": "94c12a09-e4f1-47f2-81f9-c73eb0e30c5c", "comment": "Malware payload", "value": "003aa20f1f3d36463b04b44937b72a3a6bfd0c82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536113, "uuid": "0491a3a7-1f97-4392-8505-7baf7c8e9c6d", "comment": "Malware payload", "value": "cbb22ed709f11692846dd404c73a412cad832b482214cfe8414463170269693ac36749dfcf158b01f7f42bba23eae7ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655536113, "uuid": "82fcb4a2-dd0f-4a1d-84b9-a9048811fe2d", "value": "T19506127DA188339CC01A88B44623ED45F2F5971F06F4D6E976D7BA807BEB810EA43B45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655536113, "uuid": "532c2797-e5c1-4bb3-be1c-616a3f60eb35", "value": "bb46f1abb2c1ede95f964a725f9d1284", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655536113, "uuid": "7b19b42c-7d36-4914-8942-0c1f2e27b59a", "value": "98304:OOE7M3BhEPmAcoStrUmSqOfGZT5KeoxmmYldJwuC:OOIuh3pRJnVKeK0d3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655536113, "uuid": "be2e0115-07e5-405e-861a-24eda0755715", "value": 3868160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655536113, "uuid": "e8668d7f-5282-44d6-b492-481b2d918b15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655536113, "uuid": "169ec335-5a0e-4e14-be3f-b3f8b6f206d9", "value": "ef774adcd7fec1edca85cecbbbf7409a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35e552b0-eecb-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655531709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655531709, "uuid": "6b391bdc-7b9e-42bf-8e0a-0677e4f848bd", "comment": "Malware payload", "value": "98b98fa960c5ab142e8013f5f364ca87", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655531709, "uuid": "44d69af8-7410-4854-9740-8f51f19a328b", "comment": "Malware payload", "value": "7ead5b2d7330e8402cc2c881aad10615204f7a313446d173e10c11805ad54a8a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655531709, "uuid": "19367b90-5300-4379-982b-aa6e7ee131cb", "comment": "Malware payload", "value": "0590b90862181447da86eaad3df75d0a7b9d1c01", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655531709, "uuid": "421e7b1f-bdb4-41f3-9b1b-2e265e62d898", "comment": "Malware payload", "value": "f5bc089b5b32666fc54dbd047a17e4e54fabf2ceea58f9ddb599ed53cdf93627cd14514c04e7f77df236bb760f17b805", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655531709, "uuid": "51431a3f-b972-41eb-a13b-1499e2ae7b74", "value": "T147E56C13AA8B0E75DDD37BB461CB533B9734EE30CA269B7FE608C43599532C4681A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655531709, "uuid": "e45c6088-3df1-4b97-9b91-667492cd7528", "value": "173f21264bb93a9594f52769c5258a5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655531709, "uuid": "ea09dfab-16e5-4d9d-a763-ddb5ee975be6", "value": "24576:PK6+EnrLD1YZ2ccUFMLvvW9dZECQaIu/4SQC4Gw3QeuWZHRV+JPRECIfBUkDfkc/:PP/1zSneuWxR8JPRwBUkDvD4+pY6aA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655531709, "uuid": "66e212df-c79c-4e44-9a2a-e5fe0ef2bb26", "value": 3208798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655531709, "uuid": "0d948a9c-4e21-46a1-9c40-677bace9f738", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655531709, "uuid": "d70c2c0b-78ef-4667-b8e6-ae1c230d6510", "value": "98b98fa960c5ab142e8013f5f364ca87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0932a24b-ef4e-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655587898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655587898, "uuid": "d12031f1-7a82-4f6a-a76b-3ac8114277a1", "comment": "Malware payload", "value": "15dc8b417dfe1eb789f72d5e5bcc0911", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655587898, "uuid": "eafb8993-10c9-4a10-80ce-f1e9135eece3", "comment": "Malware payload", "value": "7ee90ba491aed8db7d5d2661a432dbb411d1932c0edeb691f8bc7a2a122ffa24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655587898, "uuid": "2f6435c0-e888-43f5-ab51-7a21e0449166", "comment": "Malware payload", "value": "9349927e82e67a7f2096a278413e19a9a7f5e174", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655587898, "uuid": "1630acea-db89-4a07-812a-1da2a8938abd", "comment": "Malware payload", "value": "e433e8b60dbcd389406868627586fa577a1b41eac76c1d73a7a61bdab1634278d678ce61e10cc6565c1dad177a315575", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655587898, "uuid": "49e73a62-0f36-4bb1-a186-54ff48fb1859", "value": "T176238110F9C89917D02D3E775052371853BB26D2389A97EE2E4CD2FE3B329D1290FA55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655587898, "uuid": "d2e5a13d-bd18-41c3-8b69-b837d47e42f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655587898, "uuid": "2ca6aa14-a230-4368-995d-73e5ca5e9394", "value": "768:Czqultzjh4ZeQS1lrdV3wOuGjU0S4HAXDxCuWhUG:Cbtfhoe7DT3w/F4HATQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655587898, "uuid": "9edc4de5-5125-49cc-88b1-93b7f0da1238", "value": 49840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655587898, "uuid": "87f362d5-a4b3-4148-a98f-a149701d2d44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655587898, "uuid": "380bd1d3-835b-4d55-af74-9cee08167d90", "value": "SecuriteInfo.com.Trojan.Mardom.MN.24.13177.22646", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd87dbc0-eefb-11ec-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1655552659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552659, "uuid": "b7554237-3845-4a07-afec-2e66986eed4f", "comment": "Malware payload (AsyncRAT)", "value": "2b8b21482b39c249145f2617b722e0bc", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552659, "uuid": "acc9c6d1-8578-4223-a95f-3dbcbd4faa20", "comment": "Malware payload (AsyncRAT)", "value": "7f2c2a81785e4dd2b343dc4d1e1bf685918ee1565fd26f354323a58387a8a988", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552659, "uuid": "e543fee7-e76e-4749-97cd-d275be5615cc", "comment": "Malware payload (AsyncRAT)", "value": "c04fabd954bad2036a1036ab2e14975c11485463", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552659, "uuid": "fe8e7ea1-e5e8-4b49-a75a-13bf5cc1a9e3", "comment": "Malware payload (AsyncRAT)", "value": "e20a044b21cf821855f256ca62b61bb76c340b071ce182fe8ea9bb9409fd74f341ee50729cf290ddfbca2d59c78692da", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655552659, "uuid": "d62b5470-ec14-46d2-a333-da029a015269", "value": "T104236C003798C53AF2FD4BB4A9F2D2458275D66B2D03CB596CC864EA2B13BC556036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655552659, "uuid": "cde52e54-26c7-48d0-8f03-546ab89486b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655552659, "uuid": "dcc18929-7bd9-4f9c-9c0e-b9020653b0cb", "value": "768:5IjOTlILKimG+LiWQaosiw8YbKgeXKhqhF+jWZvEgK/JDZVc6KN:5IjMK5aDzbdUKUT+jWZnkJDZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655552659, "uuid": "105bef60-3553-4f3d-92a6-388ed8def139", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655552659, "uuid": "22cd78f7-79aa-45bd-b20a-906519fe742f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655552659, "uuid": "af224cd3-6191-4aaf-87cc-0f7186b4f89d", "value": "API.exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f44b243-eefc-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655552716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552716, "uuid": "abcc1b67-ca09-4e6b-99c2-f973c3462934", "comment": "Malware payload", "value": "d773536e5406b5faa70e71e8c8dc6540", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552716, "uuid": "da591fef-5f05-47f8-8fef-139b316a9341", "comment": "Malware payload", "value": "7fd64afc81c09a97345af499695862fb1506789db401a96b2aa9ad605713d233", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552716, "uuid": "8d544a6b-46e3-48e2-9c02-406b1af37f0d", "comment": "Malware payload", "value": "04029497c6b83196e61cd45aaab535352b2214a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552716, "uuid": "4faa2f2c-8f37-44d9-8218-1df7d11f2360", "comment": "Malware payload", "value": "6f7199b74467e91a585265b6fa2ad6680ee3d58459925395f3b18790ffe3fc08b50807c4879b7fc024c1c2b3195cc835", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655552716, "uuid": "c881a919-2a13-4cc1-a6f6-897493a97d32", "value": "T158F633782ADD248BCCD3DFBB04918613D7FADEE6A177D25CC233AA5A79009850CCA5C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655552716, "uuid": "323724ac-c46b-46ad-aafb-fd67409d2b1b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655552716, "uuid": "d18bc859-6d8d-48df-b7de-d3a18b7009b3", "value": "393216:yLuDlt98U4FttYOI0NpcVOvAIDx3WTCpgxHbtiYG:eUlL8U0cO5gOv7Dx3upX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655552716, "uuid": "75e22e9f-6a25-4425-b04b-6c303919811b", "value": 15501312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655552716, "uuid": "1ba31bdf-3d12-4c86-b0c6-3387bb312b7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655552716, "uuid": "eec51c15-d461-471f-8982-a87511dbb03a", "value": "nuker.exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14c0ba40-eefb-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655552269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552269, "uuid": "68dff8f2-791c-4287-bb30-f5c3ea4fdf94", "comment": "Malware payload (Mirai)", "value": "bcccf7a9cfd4bb9bdb4c460ed68f24ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552269, "uuid": "e649273d-2c49-401a-88ed-b1d2d6e13eee", "comment": "Malware payload (Mirai)", "value": "809190bc8cf15bc0c895862dfcfaf57bd83166c79302612a8efa0058dd70c96f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552269, "uuid": "52aca844-b9c1-4bd9-b397-e3a4e6a9e563", "comment": "Malware payload (Mirai)", "value": "e4febf8058f582b80d248497e6ce7e9d52e98ac0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552269, "uuid": "3a990f3b-874e-4ade-ae63-93d5f76b6dad", "comment": "Malware payload (Mirai)", "value": "5726d7868571abc7b2ec45c0259b7b9bde5a9b12192ff8007e72d86999da977f15df59ee1bcd0011179b0786e47709f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655552269, "uuid": "8c4d2079-d3c1-4265-bbe2-971bc5a2488f", "value": "T1EB6318EAF800ED7DFC0EE67A4457090EB630A26046930F7773A7BD53BD321A4592AE45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655552269, "uuid": "0cc185c5-ff1e-4cda-8e5b-2cfb49b2edd4", "value": "1536:/MWcfNEBCpVOAnAlkAN+SU7Ub8LuCpRYk8NNcBWmwwKqtEG:/vclq2ydU7URvk+NQ9tEG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655552269, "uuid": "66b15072-d499-4515-92bf-3deb45a9e37c", "value": 68224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655552269, "uuid": "4d575cf2-1a04-4f50-b7f9-4cea41461a72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655552269, "uuid": "5a86f6ab-e39e-4824-84e9-4920856932b1", "value": "crm68k.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00829093-ef1f-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655567697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567697, "uuid": "f85d3e56-3ab6-4499-9755-20f67b9c8318", "comment": "Malware payload", "value": "16ecc526a342af0df269f28f2fddc513", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567697, "uuid": "3cafec43-0c3f-470f-b76c-658fc419e2e3", "comment": "Malware payload", "value": "80e2d034befe59f55ab19bc0b483be404c0082c521166d6e9a9671ae32b87d0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567697, "uuid": "83d457b6-a0dd-4e8f-b1a8-eb09c88dfbaa", "comment": "Malware payload", "value": "4a2e01ed5884bd2ba2c72a293481bf8175b2aea2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567697, "uuid": "a144bdb9-35b6-40ac-928f-d78d86eb39c4", "comment": "Malware payload", "value": "1855d0672df5dc712b5a39e01abece8975de11dfb894682ec93f57638325aea709de316dca5d500544dd5b7e77fbbbd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567697, "uuid": "105bc1b3-4878-4b2b-985d-577ef571523a", "value": "T10B542A2B3A598D61C2C84776D5EB2A1007E296827637EB0A35CA13C54D473FEDC8F687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567697, "uuid": "97c09a30-0d1e-466d-b37a-ef164874abc2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567697, "uuid": "308bc34d-f350-423c-9bf1-d4237d3231ad", "value": "3072:ptqJlALnudCnTm2nsPNt0zSHhPzUA50EzzZa83hmskpWXbTY8nf05zkA06vPqF8g:jgArud2WnXBPzUABhmsk08cMTtPIj1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655567697, "uuid": "6a36f5c8-41e2-425a-8496-3d760a2eeb4d", "value": 301568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655567697, "uuid": "98f09fd6-2286-46ad-b0a4-cc2745a52268", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567697, "uuid": "75b96eee-1c9d-4df5-81ce-c19416e89252", "value": "onedio.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eb0b068-eecd-11ec-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1655532582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655532582, "uuid": "0d95be00-2e7a-4aa5-858a-e0aac46f6519", "comment": "Malware payload (RemcosRAT)", "value": "e37ca9486ea18cef00f0322d2385c2ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655532582, "uuid": "cae9bea8-9f4b-4c4a-b81d-c78634f8dbc5", "comment": "Malware payload (RemcosRAT)", "value": "811028f37e56643a922d717eb919a194c848ab3af9433acffb6245b00344cf82", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655532582, "uuid": "5aec6787-78cf-4346-b1f1-fb59ed14a36d", "comment": "Malware payload (RemcosRAT)", "value": "7f0b422c39df21934ed9e05c7fff001abf5eeae9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655532582, "uuid": "70f8acee-5dd5-4101-993d-c68b19f269d9", "comment": "Malware payload (RemcosRAT)", "value": "4079e755137f062fcc3a7cfb4871d6e11a9f21421b3a52672fa4c713e7d35da859af3d406ee74dc836ec09e0996a88a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655532582, "uuid": "716c1b64-74c0-436e-bd48-54310ab43da5", "value": "T1F9A4BF11BAD2C072D97251340D29EB35DEBCBD202935857BB3E61D5BFE30180A72A6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655532582, "uuid": "1913ca49-c0e8-448a-a789-fdf7d54b5a3a", "value": "029a987f21e33b48f24d21b6f9ff1129", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655532582, "uuid": "c11cef7c-523c-4d93-a807-bf27eb028b8d", "value": "6144:JOFBH/FMNjt18F+9a/NgAeDB4CcOtKp03b13a4LJ+sAOZZPWXbTcUhyg:JOFtiNBuFgawDB4NOmuwsfZPiyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655532582, "uuid": "1b56e3fe-43c0-4800-ac18-a844d6389d35", "value": 474112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655532582, "uuid": "69b0c8e9-0ef1-4744-83e6-d1c4304a47a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655532582, "uuid": "90d67f54-0497-4c20-a403-1903bccad851", "value": "e37ca9486ea18cef00f0322d2385c2ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "156a5729-ef1f-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655567732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567732, "uuid": "a7ecd425-e682-4c85-8ad4-cee7a5f4a617", "comment": "Malware payload", "value": "2fa89642249ee2625e63b92772469a6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567732, "uuid": "151eb181-c61a-4693-996a-5fd3c7f80bd4", "comment": "Malware payload", "value": "814e181346ff0c8fb68dcef4976d87b7fb25565d914fea1534504c7baa2edaf8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567732, "uuid": "7a01a805-e154-4cdc-8875-9878da11754d", "comment": "Malware payload", "value": "1061bdd35e58a5eaca17476373a2a086663e3d50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567732, "uuid": "75bc9546-bc14-4325-a921-077f61a4d53d", "comment": "Malware payload", "value": "4458d508141906c0f56b311bcf31a0265a49bf5a686be267292eb2e4082992e8546254c28fd15796bd7da36742602c1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567732, "uuid": "c7966b4e-5e21-427a-95e3-dcc54dd1acd2", "value": "T179135B82F60384F5EC1705B60137BB7EDB71D13A802AA66AEB19CD65E9139412337BD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567732, "uuid": "6d2670f5-f53a-4eb6-a788-ed451afd594e", "value": "768:5HTRcNWGQTbhKpp0TUzqhw1aKxmpfwi/v0nFXk3IN:5HTaNWGMKcUzGuaK630nFq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655567732, "uuid": "ee1a48f8-aa1b-471e-a572-388c45e6fb47", "value": 42612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655567732, "uuid": "c8db6d0c-a523-4324-883e-ccaeea9d02e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567732, "uuid": "4ca6fd97-55df-4f2f-bbd3-05b93e08b6a7", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6544cad-eed5-11ec-93bb-42010a9c0043", "comment": "Malware payload (IcedID)", "timestamp": 1655536300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536300, "uuid": "a6d78490-34cb-4394-a65a-0f52c06c4ff7", "comment": "Malware payload (IcedID)", "value": "8c7d1386ae24574bf5c386152566fa2b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536300, "uuid": "cf6b496a-520c-442a-8aca-02ac08bd9cc7", "comment": "Malware payload (IcedID)", "value": "8190716008970cc6de36035ad1c403e833ba1f2b573cbf0eee723558783d2065", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536300, "uuid": "37b57473-223b-42f0-8176-a8f4fe1b0bca", "comment": "Malware payload (IcedID)", "value": "33b82407c711027128cab324c9bbdf29281ed4b1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536300, "uuid": "170fc269-076b-4ba4-a728-e3650aca3bd7", "comment": "Malware payload (IcedID)", "value": "c067a4f8a1bb7c4b2de6a14a675ed080197d84ea01e77291bf6876e3a193aaab7c9ddcf67e493ab818702e5757c4cca0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655536300, "uuid": "b1a85902-5eb0-4f22-9036-a3ac1705fe18", "value": "T1E6D4B0B875047DD6AA7E477BCD96ADE813B627628EC7A4CD806877C305B3371EE02804", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655536300, "uuid": "312112b6-f48a-4fb0-b20b-7728cbdc704c", "value": "12288:PYidoSYW7bMLxiVhUeim1ZZxqgroRNIj2ce/epyzHfTJ2I91ajZ:QidoSYW7WGURYrxqGiij2ceGIzHrJnfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655536300, "uuid": "982d2726-4de7-47be-abc9-ba87bfce08b7", "value": 614400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655536300, "uuid": "d03a4707-67b0-4708-b7d0-8c5809c8fa54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655536300, "uuid": "b9f225c5-ff3f-408f-956d-7a1fd478044e", "value": "8c7d1386ae24574bf5c386152566fa2b.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c9e77b1-eed5-11ec-93bb-42010a9c0043", "comment": "Malware payload (XFilesStealer)", "timestamp": 1655536149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536149, "uuid": "52bf6678-046a-4fee-a773-e4310a233419", "comment": "Malware payload (XFilesStealer)", "value": "3d51118bd3775c73d2bc56296bd3909b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536149, "uuid": "edec9f45-2fbf-4ebf-8441-f6142d391ed8", "comment": "Malware payload (XFilesStealer)", "value": "81f75d7663c3bf908f5d2302cca533ff9165ddb32b8b54923abf7a75cf27de01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536149, "uuid": "183bcae3-b9f3-4b10-bd80-329462e31466", "comment": "Malware payload (XFilesStealer)", "value": "7aa8391d8e88b59fc3f57ad120c0644b81877c93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536149, "uuid": "62a1fe05-cbea-46a0-a7b6-a079d3c704aa", "comment": "Malware payload (XFilesStealer)", "value": "dbce8bac73fcbf3797bf2c6343c99d78996038b4d7d20ef9c386a4268ccef7cb554dd9ee225bb3afd86ee13de6fbf844", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655536149, "uuid": "dcb46b62-ed24-4797-9762-73ef15474f62", "value": "T1D5C23908B7E94224E2FE4BB65DB622404376FA074D13D75E2CD0915B1A73F84CAA2773", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655536149, "uuid": "2d36e022-f9fb-4e40-ac03-d616008c5c87", "value": "384:V2rs4fsuqmx11gMT+g5V3D8b9bVCu64t/WIHlBAFvdK45lj+YPsPYMvsDstCI:gY4EQfh+AVIb9kuMXlj9PsPYXsEI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655536149, "uuid": "fb85d80e-5b4d-44c2-b2d1-6bca3962b7d6", "value": 26112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655536149, "uuid": "5fbce57f-4cca-4ac6-9d7b-f1568b01602f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655536149, "uuid": "f2cd64bd-1894-47d8-9f12-4199cd2f72a3", "value": "3d51118bd3775c73d2bc56296bd3909b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c730920b-ef33-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655576620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655576620, "uuid": "c926f26e-39c7-40c8-9427-dc61b89a61f1", "comment": "Malware payload (AgentTesla)", "value": "9309e7b2022b63fdbfe96121c3ebcb5e", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655576620, "uuid": "f5f7a4ed-62aa-4dbe-b31b-d14e3c5d6771", "comment": "Malware payload (AgentTesla)", "value": "8222f0d87a58447f7f32dd8334f78286fd69cb89cd854442f2436064a97164fb", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655576620, "uuid": "73e7cb86-d28c-4839-8db9-0887884eaa37", "comment": "Malware payload (AgentTesla)", "value": "7cdef85b3e492143ffb2775a4631b5ab648b5c14", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655576620, "uuid": "60a52851-a594-46d0-a991-1337d61a5a3a", "comment": "Malware payload (AgentTesla)", "value": "dc29023c5f70a8be8281c6dd1574d8e91df0acb5b309c70e76ce54c7552092f8528a838eeaa96acde7eb0d44967e3c72", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655576620, "uuid": "332a05e1-eca6-4004-b985-62284780b887", "value": "T137F423EC4967C8D281C573357B4925F32C674B2BCE05B10AD60FA6533C22F919ABE792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655576620, "uuid": "4bdbc012-831d-48f7-99f7-8f14b5b7c57b", "value": "12288:tfRlpAqqU0wc/jUGFYhmjk15/CkrOzebu4toKPXRD/0IIHkuBksO/6s2fcwqr2be:tfHpAi0FjUGGhmQ5xoe6yhXoDBksMXrj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655576620, "uuid": "8d391bcb-3208-430b-93cf-311b28a0f3e0", "value": 766054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655576620, "uuid": "d224f497-ed5d-4666-97b7-01d4ed891afd", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655576620, "uuid": "1b38aa83-c6c2-47ce-b516-22f0d091f826", "value": "Swift COPY 54643121822.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa181a49-ef0e-11ec-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1655560814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655560814, "uuid": "f12edaed-2327-4548-97d9-78cbec4cacc6", "comment": "Malware payload (AveMariaRAT)", "value": "4bb7e896d68b55fd4c2424e1fffec842", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655560814, "uuid": "ddbf354a-dba8-48cd-be97-932b264aca2b", "comment": "Malware payload (AveMariaRAT)", "value": "8234459bca875caecf379ae0c4a84e76e0ef172de612dba3a060b406a922010c", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655560814, "uuid": "d8949fd5-253b-467e-893f-b68b86375551", "comment": "Malware payload (AveMariaRAT)", "value": "ca61cbac1a5531596f12905af556def32afab6f7", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655560814, "uuid": "0a9bffac-99bc-4232-b703-46f24b115ccf", "comment": "Malware payload (AveMariaRAT)", "value": "ede5a006dbe8632127a58f7b8cd541019e689eeb78717d70c0d34ee38d83fb5db762fa61bb47ef2a778146c4b9374716", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655560814, "uuid": "2b35745c-3851-4b17-b4db-e4bfd9775c7f", "value": "T153E49E22B9D04533E0320A769F5BEBDD5C26BE012D18685F3AD52F4C5F3A6813D3A1A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655560814, "uuid": "f8a0abbe-f2a3-4552-8e04-dffe8d85610c", "value": "c63436501a8ef8fdb307c5808d7ed8fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655560814, "uuid": "b446ff3e-4a9c-487d-b96c-d95c9a51a79b", "value": "12288:Bb1COtoPXBcAXXlMeR3c8TUwMJCNsBWeOkD:9AFPXB5XXlZ7T5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655560814, "uuid": "b231c784-06cb-4d69-b0ba-f95fa780ba49", "value": 694272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655560814, "uuid": "537c4745-3a47-4a14-9878-14d587e6d8fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655560814, "uuid": "98a39b44-d867-4e0e-9747-fc0b61366607", "value": "Kawashima Export Co., Ltd Demo Samples PI_220617.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f42e341f-eee1-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655541477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541477, "uuid": "3ad5ffa6-1ff4-47bf-8fe7-5e2b76e0cf83", "comment": "Malware payload", "value": "62d4945d34b49c6f3049bd9c0ddc5805", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541477, "uuid": "c81057f4-8fdd-4521-94dc-99d87f94c3c0", "comment": "Malware payload", "value": "83b5b60743c3ec009a804bb2c4f71c0317b4cd4bdd80ba1cccf4a919c3ce32c4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541477, "uuid": "8cb1aaae-c5e3-4755-9dd4-2fc7eb28b991", "comment": "Malware payload", "value": "9c0f57e2f35409b105dfb20c1cdf837208311359", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541477, "uuid": "215c8d7c-4f17-45a9-8734-fcb9ed648367", "comment": "Malware payload", "value": "9f24a7ebf5816f91712fe4aba86bfb04b309851abd6a2a9044621b8667797406cc64c70a03831d89b1388c9d6e929efc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541477, "uuid": "00070fb7-f4c1-472a-ad33-3f4c3d1ed2c6", "value": "T1EE13F2DEB0D57CCBCE6C6CBE514517A24E05E44067C9EE852262CB08DB7E28FF584467", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541477, "uuid": "69a26efc-39cf-4dd8-ade7-a30855b8780e", "value": "768:xYeQBij36T4fbTRXcl/lJXImmu4VocZYqrgV7WlleqYp:PQRT4KZXIhV53NYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655541477, "uuid": "59e960d4-3448-4cd3-841c-89c6bc44ff56", "value": 42952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655541477, "uuid": "c4876a0d-aa88-4c65-a919-41ed2e311af3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541477, "uuid": "c56b9da5-3af4-40a3-928e-0d9124ac4c47", "value": "62d4945d34b49c6f3049bd9c0ddc5805", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5316d3ad-ef25-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655570412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570412, "uuid": "fed817e0-1744-4066-8325-5005b9358761", "comment": "Malware payload", "value": "2754b9240b5a157a9483231d15fbdd3a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570412, "uuid": "cd6e52d2-8754-4fea-a4b7-d2b348d1ca50", "comment": "Malware payload", "value": "83f50df8504cb59a919886800d9eb67e789e1be753cd3fa0ed52f798adb980ba", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570412, "uuid": "efc38a10-9f83-470a-8a0c-4d258cba7b6e", "comment": "Malware payload", "value": "054f2c8325b894085aaadb8ab8c07d91fd82c55b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570412, "uuid": "d7c9dd1d-4a33-41a6-b3f7-cb54ce86ce75", "comment": "Malware payload", "value": "e32829d5247cb8bcba0436bff9af6711d6c9a7f11e04cdac01b3944714bd0412eabf82241abd5392561d65b92562cb6f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570412, "uuid": "0142327b-44a3-458c-856b-77f0fa0a634a", "value": "T120C5337FD2EC346DBF1C326D11AA85139BC02ADD00AA85F5D094C29D398FF9356E269C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570412, "uuid": "509f36f1-dcc1-42d4-86e6-1def07c81896", "value": "49152:bkRuB/DsPOMNboJxK/9iu5whH2e61w9ZdYBFzMHtM3zU4Pkfsn75vj:bkRY/Ds2MN8Jx4t1t83YB+ujdWsNr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655570412, "uuid": "ef43e156-8ed9-42e9-a758-98043e014dfe", "value": 2580801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655570412, "uuid": "7d5bb3c3-d690-4f4c-b4e1-34a869853c82", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570412, "uuid": "c26ade7f-57a2-4e10-a9d2-83eb2a0573aa", "value": "InternetSecurityGuard.zip.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2c9c4a3-eee1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655541448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541448, "uuid": "11139600-b3e6-44ee-9f41-dbb35a14aa9d", "comment": "Malware payload (Mirai)", "value": "ef0e55012908fb84a7023c83dd8a00a5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541448, "uuid": "6c2fb7d3-2d9e-4931-8e24-e7e91d5e9f6b", "comment": "Malware payload (Mirai)", "value": "847cc98519861d8c698921fade3900c774c470274cbb846e8828a30cd5f0f772", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541448, "uuid": "33abc7ed-cfac-4ac4-a80d-45fef27586b5", "comment": "Malware payload (Mirai)", "value": "25d51c019b00d1de597bf1375bd7555ec66e9f36", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541448, "uuid": "3f02dada-0729-4e09-965a-ecb4d2864ec7", "comment": "Malware payload (Mirai)", "value": "badf5eaba0ccf024df8b8a43c6b0e179bc315c33baa946a0328e140e1e58d882931aaa4c3917ea71c068b149bfcfad50", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541448, "uuid": "83df32d9-cfab-4b18-9b4d-de09a1dcd1c0", "value": "T19FA34A82A740D5B3D1A306F6129B8B150133FB3F4A6B9EA6F35D3CF48B509C57221B99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541448, "uuid": "ff52336c-6217-4853-83fb-afe05983a84e", "value": "3072:Jg4eodUWUh917j8mc2deiPUDAZURyPfs5hQTSvxinf0OzTyoQQub:JdRu917j8mc2H5Z5P05h8cxinf0OzTyv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655541448, "uuid": "18bd0330-6f8d-4700-be39-a41c15463d84", "value": 99709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655541448, "uuid": "c31d257d-773e-480f-9fa2-3788db0e8ee2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541448, "uuid": "28849b59-7afa-4e5e-8f67-532ed8778aca", "value": "ef0e55012908fb84a7023c83dd8a00a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8e49d73-eeb0-11ec-93bb-42010a9c0043", "comment": "Malware payload (IcedID)", "timestamp": 1655520413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655520413, "uuid": "91694866-3095-4ff5-a9f2-474977356a53", "comment": "Malware payload (IcedID)", "value": "822f75a31d5fa24baa7b24e59e5b67db", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655520413, "uuid": "43c0cf1c-7c80-4546-8d82-0e45e6792d18", "comment": "Malware payload (IcedID)", "value": "85506aeca70359a972c9f42e3e42e232d13f7d3a5db8434c89a435412bfafc82", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655520413, "uuid": "f902e7c0-c513-472c-971d-d98a4330d8c3", "comment": "Malware payload (IcedID)", "value": "7e86a2474291cfa17951b812d70a3a833c26d927", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655520413, "uuid": "beadad3c-f0e7-4813-becf-0e4ddf053d34", "comment": "Malware payload (IcedID)", "value": "8761a23a268c38e3d871f010539d267472a9edca6a35713c3bb1debd3d0ace075a27794e7372416fe3c4fc90a36c3863", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655520413, "uuid": "ef4e7952-5b86-4b82-aff7-c1f1c0f45352", "value": "T185D4BFB876047CD6B66F577BCA966CED13B62663CA8BA4CD40647BC305A3371FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655520413, "uuid": "f2c9b11c-3777-4226-8bd0-b4a0aea26444", "value": "12288:Ypa5otQOxWeQqZjPnPUAUwsFaH/k1Oe93cA2Bt82AyelVGpZYQqJkEZ1z:Wic5QqZDnPU0b/k1X1c5BaVip2d1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655520413, "uuid": "8f8dea16-ab7a-4368-ba24-49f94c11131d", "value": 614912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655520413, "uuid": "5186cf1d-1574-413e-92fa-68fd45ae1898", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655520413, "uuid": "ab98fc08-03b0-4eaf-8b21-d3dc37bbbd36", "value": "822f75a31d5fa24baa7b24e59e5b67db.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57ced33c-eee0-11ec-93bb-42010a9c0043", "comment": "Malware payload (XFilesStealer)", "timestamp": 1655540785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655540785, "uuid": "aaad7d99-daaa-41ea-84b8-f51824f1978d", "comment": "Malware payload (XFilesStealer)", "value": "b337cd3c0a8b2264d938b30340892e45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655540785, "uuid": "9f47d228-6e37-4c58-9e35-8f979eec2054", "comment": "Malware payload (XFilesStealer)", "value": "868bb2b1387c06898cc942fc7a2858a19c907622379e9705eeed3591c488cdb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655540785, "uuid": "6339632d-4db2-4740-947d-2eb60a05a95f", "comment": "Malware payload (XFilesStealer)", "value": "728c6afda0cc5278b289b2819b9d1bace762ee47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655540785, "uuid": "5be64c26-d2a0-4c3a-b65c-46e1555e6415", "comment": "Malware payload (XFilesStealer)", "value": "502b3d37c5504268f582e6ed9a6b607c533b2940a1d0ebafaf84f9655522f2ea514cc61f075fcf91308a8cba465e03a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655540785, "uuid": "a3a81f43-ebe7-45ff-94a5-3ca8d6189af2", "value": "T1D3362374BA80C071D6F31939CADE6330EB3938D15E27898F83A457585B671F1AA2D732", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655540785, "uuid": "8de3f71e-bcbd-44af-8545-90040726c0cb", "value": "ab9ff6e4872ea2766a5f5c6af5649e9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655540785, "uuid": "7ea2200c-8664-4c7e-be07-e4025fb751b4", "value": "98304:mJ4W4xF9+xLNzVSmmozXYQPmk07EfyEvwLIeC+qoqzD7w+ATQKE1Sv:mJU+xppS6XVmFm9whTv1v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655540785, "uuid": "e9cfcaed-5c95-4d49-b055-d0c7008c42de", "value": 5149718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655540785, "uuid": "727b76ca-1f8d-4025-b87c-6be519a093af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655540785, "uuid": "4d52d347-a6cb-4534-9505-98ec2bb8785b", "value": "Driver Booster Pro License Keys.exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ee3859f-ef25-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655570405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570405, "uuid": "5c0873b3-769a-4277-85e8-85af29195efb", "comment": "Malware payload", "value": "7c82f347418292c9223624168b9e9cbf", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570405, "uuid": "f1db1f0f-cefd-4f2a-a146-2881a93e44ae", "comment": "Malware payload", "value": "86ecb50693e4eeaf9d740f51ff7f661cd2aa49889eca6d953adb02fdbb2c19a2", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570405, "uuid": "be03aa7d-eec8-4cb5-bddb-9d4b4bc80285", "comment": "Malware payload", "value": "38b1b010bf8d8f5463d41542af5c4f3dfc7ed75c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570405, "uuid": "2939b725-f59c-415d-a3a7-bdfccd161bc6", "comment": "Malware payload", "value": "a73590bfee8733e4ea5696bf8e447da0d77d4a668095a3eb19f354247735d4ca7ca66d27de18073e30dbf5552fe5d1ba", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570405, "uuid": "40f42730-0684-45b5-9c5c-eaff569ed6cc", "value": "T11C212024CA85181ADC5F793BE0BB1A94A912714891846DEBDE882B31B23E4512931B6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570405, "uuid": "fac759ad-b123-402d-942a-76dffd696bd8", "value": "24:7KhThkotRo/N2iElFbNU1fE1KaPVG+3rH59g6hxmq:OhE12zlNYFaPVj375i6hxmq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655570405, "uuid": "4418a5dd-de2d-40ff-a882-8ced4f3dc1a2", "value": 1115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655570405, "uuid": "19348dc4-602b-4deb-9417-7604968c8d2d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570405, "uuid": "440f6681-69be-4a2f-8e33-48aefabfe425", "value": "Copy9188.zip.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2976e616-ee9e-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655512360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655512360, "uuid": "32b9a583-49fb-412f-890b-acc250a78a78", "comment": "Malware payload (Heodo)", "value": "58440e0e53d7722a9ee8e8bc4b0efed7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655512360, "uuid": "0c1010c5-76c3-400c-8bb2-e11c6430f828", "comment": "Malware payload (Heodo)", "value": "8801111e1cf32b275feaead42adabae1e5d15a163c6862a6c97a40085e9e12f8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655512360, "uuid": "d56f8aad-b05b-4df7-ac3f-a567f482a44b", "comment": "Malware payload (Heodo)", "value": "4be090212e9da5820629571c6b3f88369de18e60", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655512360, "uuid": "eda1f7eb-3095-4aaf-a4d8-d234382d4dd3", "comment": "Malware payload (Heodo)", "value": "b16f90fff7e0f6f2b478546be4e1afa3ce9330f9c88b7792acd07b11645511e3bfa5022c8007fa984f48a6ef0fa9623f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655512360, "uuid": "6dd71acf-8d7c-4afe-a5c9-be86c90b0dd8", "value": "T178E48D9967E60778F4BEA5348A368961FA72FC440730874F03A3517ADF37B24596A323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655512360, "uuid": "a025d68b-47e6-487f-84ab-eb68636530f4", "value": "3453e632ce30879aafc5b698fff99cee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655512360, "uuid": "19bbc885-1069-4560-ad0e-328f1da9b6f6", "value": "12288:OuLAIfbduxjLrrXpRoZqAQq30PkW6iSp5tMcPNMCthT6mx:X0IfS1Rocq30PonMyNDT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655512360, "uuid": "b57f335a-c771-4d10-91fa-dbfb52a6429e", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655512360, "uuid": "2f46bad4-1065-4df6-bf3d-ce88f338f990", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655512360, "uuid": "dc477bd0-f5c2-440d-89a6-ce40d699af92", "value": "58440e0e53d7722a9ee8e8bc4b0efed7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecbae69f-eeae-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655519560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655519560, "uuid": "e0ced825-906b-4e64-9915-911f8d2a6ce5", "comment": "Malware payload", "value": "7db586abe1dd7d90d48fb97c3e256747", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655519560, "uuid": "b3d43cd9-0211-40ea-a4a0-dac7717f93ba", "comment": "Malware payload", "value": "8c61e4fd31535722ca02c4136f6410165723407ba961caebf6dd751ac5aa5d5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655519560, "uuid": "265aa485-b5b4-44e0-9de2-a50313543e57", "comment": "Malware payload", "value": "5362bde874008d4e3bbaaa630ae86bab822a8289", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655519560, "uuid": "e6fb64c9-710f-4ee3-a294-ef59dd23142e", "comment": "Malware payload", "value": "2102841148ae7ed0809edef86c99a06f8f6ab80b82aa7f392e19ab31ce11c1f0c9eaf287abb38598db397c2209574e69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655519560, "uuid": "b4cc2ba9-bbdd-4b1f-9e41-5c540faeca04", "value": "T12FE329102115F82BF4BAC13538A3B5627A967F2458B04EAB93033E3D59B2154DAFFD39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655519560, "uuid": "751b3d16-dd26-4e5c-a03e-d84484f70297", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655519560, "uuid": "d5add635-fff9-4a40-bf56-3a193507dc94", "value": "3072:GbG7N2kDTHUpou2eb0ZKPybROmm72bQAMh:GbE/HUJaKd1nJh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655519560, "uuid": "b2fba44f-c162-48d2-8a22-4e5579efd270", "value": 156448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655519560, "uuid": "32d9de28-420e-455e-bd3f-3a87cfd1b786", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655519560, "uuid": "83424ccf-a4b9-465d-9d1f-a72915ad8b04", "value": "SecuriteInfo.com.Gen.Variant.Nemesis.8377.20483.17426", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b5b58bf-ef2c-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655573379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655573379, "uuid": "a075e38e-fbe3-4b73-98c3-9f4f2fa160aa", "comment": "Malware payload", "value": "48cacea1fdac8a8e5c38c0fecea660a5", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655573379, "uuid": "96fd32ff-092c-4c3b-a6d5-77f4b4283efb", "comment": "Malware payload", "value": "8f7456229d4a5725de365e27c5830979ae18945191a7beb3ff64930c6b20040b", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655573379, "uuid": "058fbb27-7bd9-4155-acc2-2623e1429867", "comment": "Malware payload", "value": "f0525948fcf9a09397d9e078edf0195c7704bcdf", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655573379, "uuid": "c1a11a48-f3c6-4ca0-85bc-5aac887232ec", "comment": "Malware payload", "value": "39fc3cfdaaebd4792f59feb0fb106661182abd26aebee7a37bb9a817058f8b893f656f82d5cb12aca62ba8facf2ec92b", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655573379, "uuid": "1a204355-ca65-4258-bf1d-e618d67b7d2c", "value": "T135B533E9FCD1E73A4462038D5DEB66087F317E2A137D07B08B825AB7B52E5D61203678", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655573379, "uuid": "b0fd1566-4434-42b4-b811-38647fff1bcd", "value": "49152:6tgRmfGwzuJf8leLY/4FJOkhMvCTvL57ldEhtrB4B+N0:vmDa2CFBKgvLuhEBZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655573379, "uuid": "8406b146-b3cd-407e-bb81-5bac9819a65b", "value": 2272553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655573379, "uuid": "2f020d52-df2a-4b1b-a67e-8f42fde78a2f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655573379, "uuid": "e659421c-e6de-4148-8e3b-5ec47de09fa3", "value": "Violinite.rar.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9282df12-ef25-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655570519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570519, "uuid": "9e6de73b-ab1d-4f65-b6fd-8c7056fe52e8", "comment": "Malware payload (Mirai)", "value": "bc59a7c5e280cc70096a6833619e1f8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570519, "uuid": "7d1ad63b-2765-4462-b8a6-fd1b06d9bc6d", "comment": "Malware payload (Mirai)", "value": "8fd33d845661e520f1ad05f935f1eb0411aaeb1bfdb4d9057a78936a87c89ea3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570519, "uuid": "fafc6108-34e9-469f-ad58-bc29916880aa", "comment": "Malware payload (Mirai)", "value": "d38defa5efa7d5140fe368c90ccb4b4636ad5ffb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570519, "uuid": "1cef077e-2e52-47e5-8a97-b12022e92f4c", "comment": "Malware payload (Mirai)", "value": "22652765e7c940762da275591f5953b48d73d578012526c46e3f4e17c96dbb05ac00bdd3d85621aa587882ca16964f9b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570519, "uuid": "17ad6399-ca02-45fa-9582-6c36ff54400f", "value": "T13773199AB4028EACF987E57A41160F09F82172914FA30F27A773FDB37D631959C0AD46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570519, "uuid": "b8dc2dde-80ec-4031-b456-f746949ed9da", "value": "1536:YxhFdtjN97l/UH7wh5N2KHOY7Gyn6g1pVC+h8XPf4TTPexrPMu:YxjDNhlb2iObynDpV1SiexPx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655570519, "uuid": "9f07673d-63f5-4cd7-bef4-4823775e3099", "value": 74144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655570519, "uuid": "266df9c9-a192-4b25-9195-8a6b9558e1b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570519, "uuid": "284dbfbe-9556-4edb-9d81-7710eb53fb53", "value": "irc.m68k.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5e242b2-ef1b-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655566364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655566364, "uuid": "15d0c175-bc1b-4e7e-8378-68e5db21c990", "comment": "Malware payload", "value": "c1abd1bd5ad08a5d14cc02be16d3598c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655566364, "uuid": "2f4a1a42-50dc-425a-a43d-f97c0b621032", "comment": "Malware payload", "value": "923867b41da2a4632910f4cae0a35ef993928cd202f1d184af51c23b957f3fc9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655566364, "uuid": "a12bbe10-811f-4878-a47c-449dc6833d72", "comment": "Malware payload", "value": "f395dd2b7ecb0fefc7e6be45b26bf764a6f2cdf5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655566364, "uuid": "393a37d0-4e99-447f-b66f-3c0dcf7e47e2", "comment": "Malware payload", "value": "ad600fe9c7525bbd946dc9366c021e363734389abb1b5f2beb08a151e443a165922f9567b5e78c9dbd6c6e0ed08e03c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655566364, "uuid": "3a222983-661f-40ef-b6b9-5dd234b75aae", "value": "T153C32946E7418B13C0D22B75BBDB82113323DB6597EB33065928BFF43B8279A4E27516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655566364, "uuid": "c17f3aa7-3255-4247-9a70-c4b328499d62", "value": "3072:nyaNR9xzChWvo+ItQ3OzFM/99+nW3nmjwh0vqk:yaNR9dChu+Q3OxM/9YnmnmjwhQqk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655566364, "uuid": "64c6b9ad-6e8a-4bcd-97de-74419fab411f", "value": 128214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655566364, "uuid": "c666739d-cd1d-4f6c-bb47-be2664c0d31c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655566364, "uuid": "01b69c6b-62ec-4713-8dc9-661de77013e4", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "960a4ee9-ef58-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655592429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655592429, "uuid": "d8838bb8-471d-43f4-922a-af8cb3bc1bd1", "comment": "Malware payload (GuLoader)", "value": "3ae59f7408faf7e9ef796b9da7b098d7", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655592429, "uuid": "394b5481-a9fc-443f-8013-c9cd7f9e2504", "comment": "Malware payload (GuLoader)", "value": "9368b8412d688adce5198ff5439cf079822ef5a92d1b9abfdd252209dd5b4129", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655592429, "uuid": "d4ac3441-8233-4c5b-b6b0-e8c21b1b65cb", "comment": "Malware payload (GuLoader)", "value": "88123d1cebb89190557d75be43765be1027338c6", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655592429, "uuid": "d43697c0-04c8-4fad-8950-cc9012e20238", "comment": "Malware payload (GuLoader)", "value": "c58dec104221f5cdf8dd35a5007e82ffc6a4e0952821e09944ddf8232acf2ca1f7c1fc36ced84ae9934dc8bd2edea19d", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655592429, "uuid": "28c05b8b-593b-4fab-96bb-6bcef6a95c74", "value": "T17A3422C6F8C839B215D4FC8C874CE64919A570CBC1BA69988C1ACED1EF5EB0831D4ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655592429, "uuid": "ef0113b1-6cd2-4b22-885d-ff0948e187e1", "value": "3072:eEiWzN5icKJfjnXnbKpCK/5Y+mjeAaHUvSwIlqaTWEhphi6u8L1lSVWrONVz0fFo:pzh0XOpCKi6A2ztqdEhy6llSVWMz0fW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655592429, "uuid": "c3a38f9e-4a7c-40a4-967c-123fed89bd1d", "value": 243759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655592429, "uuid": "80ca3cf4-c3d1-4ed3-950e-ab9014379407", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655592429, "uuid": "5bf888a8-584f-4a36-aa0c-a9379bad5a79", "value": "JUSTIFICANTE+DE+PAGO.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0753ec4c-eefb-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655552246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552246, "uuid": "e9f8c1c0-eb05-4c70-b007-059c28e043a1", "comment": "Malware payload (Mirai)", "value": "2a84f77789f46fa0c234afd3ba165c0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552246, "uuid": "0aba0756-230f-49bc-b803-26721d01ef3a", "comment": "Malware payload (Mirai)", "value": "94315a3607626fbe4354cb6b7ebd86c63b340d3fa8a70330b5b4bacf4f96e068", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552246, "uuid": "a1e27024-6e9e-4c8b-8e76-6ded6c013911", "comment": "Malware payload (Mirai)", "value": "730cf7cb9007f824fa9846f5ffd8367c70728f2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552246, "uuid": "69695512-4ce2-41c9-b3e9-a17c9e422151", "comment": "Malware payload (Mirai)", "value": "90ab6a4b296bfe8895a84f0d28ee69664d749a0cc35892488db406237bb25450babfddcad4b5a00d35669199a7eb1011", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655552246, "uuid": "20168939-3000-4351-96d2-ce793925b16e", "value": "T1FF338DA2C8395C48D1988AF4B4388BF92773E404D64B2FFA456AC2795053EECF6563F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655552246, "uuid": "c93b99f9-d6fe-4afb-bbb6-354d8e0712f0", "value": "1536:fattwszGp13BKO+r2a5l/tZ3cTCRKw6dWl:fwwsS6Okn3cTS6gl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655552246, "uuid": "eec8b1de-42c3-4c71-be38-6a1b8b8723d7", "value": 54768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655552246, "uuid": "69e8ca48-ba1d-4968-a84d-5746c7686720", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655552246, "uuid": "272061e6-5ed3-419c-b91e-7be2056935b6", "value": "crsh4.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "239cfc6c-ef2c-11ec-93bb-42010a9c0043", "comment": "Malware payload (DarkComet)", "timestamp": 1655573339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655573339, "uuid": "bba837b4-bcc2-4946-8ff5-549962005977", "comment": "Malware payload (DarkComet)", "value": "6663d3f6afcb01729e9fb7e9e245c1ee", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655573339, "uuid": "3b5aed96-c50d-4dd1-895f-4f6c096b97b4", "comment": "Malware payload (DarkComet)", "value": "9434bc83bcf91eea11ec4994e62bf69d123a43106013f3e67ec1e67382fac0ae", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655573339, "uuid": "9c529355-c573-4e25-9343-9dea8584b12a", "comment": "Malware payload (DarkComet)", "value": "1b7be88046e58cdbb664dfbbfd52727ce3d5d395", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655573339, "uuid": "74784f05-4d84-4c07-8a3a-3b1bc5fac2ad", "comment": "Malware payload (DarkComet)", "value": "dc563c5e42ba59ab2fe71a8b6067ccc361e71356c52b0fec824b6c60119c89e0fa6d27f6c904e86f40787cea79a059a2", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655573339, "uuid": "f3f2bcb8-4d72-4a47-b6be-8bcd90d8a09e", "value": "T1A4E48E31F1808837D97219789C5F92E6982A7E202E39754B3AE62F4C5F3D6C239193D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655573339, "uuid": "e4eea26b-f14c-4413-aa53-87dafe2791db", "value": "e5b4359a3773764a372173074ae9b6bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655573339, "uuid": "3c4ee345-83c6-4e1a-8672-7fda1667193b", "value": "12288:y9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hZ:eZ1xuVVjfFoynPaVBUR8f+kN10EBn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655573339, "uuid": "f2da857a-e3ee-42ae-9f7a-c0ffa4a899a4", "value": 674304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655573339, "uuid": "a9b4084d-1728-49b2-8717-263ff15409a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655573339, "uuid": "259334a2-1813-4b0d-b9c8-f2be122b9d38", "value": "deneee.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f842b5c2-eefa-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655552221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552221, "uuid": "9d6278fa-e377-47a7-936e-ccb90c8ea86d", "comment": "Malware payload", "value": "499adf14bc26dbe34a81d3ef8381e93a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552221, "uuid": "743e26ba-cbd3-488d-ae09-c3f1c235cb42", "comment": "Malware payload", "value": "96e660146ede4ed62695aaab8790a82a242a0e6c8853079ae88ac6cda2bdd59c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552221, "uuid": "2a1b5d72-ac9f-4b95-a677-a920cc001475", "comment": "Malware payload", "value": "526a203bd76e1ed3bd7d8ef24cfddbeaf5741820", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552221, "uuid": "dd23d9cd-77e5-4637-80c2-a317353c4415", "comment": "Malware payload", "value": "3ff90c090f331218b889cde185ad8fb20759af9a3120917b3b3fe05d6c5aab9f8446be6d7aaa3865d239b18ad7a55dd6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655552221, "uuid": "9fd66282-2ec9-4216-95d8-ea679fbe0d8a", "value": "T188F0A4D91392013A6DA7DE2BB2F48A1476C064D5A4D86E44BDD87FEA0A4CD0634506A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655552221, "uuid": "d941ffd8-7ecc-40d7-a02e-ff3c87b5c943", "value": "12:v0FoDmzNnw90F5mKDm4cnw90F5m6iDmBnw90F5mSLDmfnwB:UCKwW5ZIwW5J8KwW5vnUwB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655552221, "uuid": "3478a9c4-4d69-4dc4-b3da-2f19ed427dcf", "value": 652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655552221, "uuid": "f857c6bc-4011-4327-bc4d-bec2e43c6725", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655552221, "uuid": "446bd37f-3f30-4115-abba-5a25e234745d", "value": "li.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc847cf4-eedd-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1655539665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655539665, "uuid": "4047f428-d63f-411b-8920-0261f3ddfc23", "comment": "Malware payload (RedLineStealer)", "value": "8e9522fd4e59bb31b592c02fb7fd7524", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655539665, "uuid": "e98941d7-3bfe-4cbc-8d9f-fb4938ba4337", "comment": "Malware payload (RedLineStealer)", "value": "971b3156e5e220c935e0475881eda095af77c273c4a27a6f17615d8e9bff180d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655539665, "uuid": "fa63dcc7-8f88-4265-9a5d-da81fcb40326", "comment": "Malware payload (RedLineStealer)", "value": "20f918a553777114ba276be17511ebf502fd8ea9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655539665, "uuid": "241f1154-6443-4fb0-9da2-571c1f2727ba", "comment": "Malware payload (RedLineStealer)", "value": "bcd61755753b028e4c1cf40d1f29ce3f7d64f3be436b6c327019f60fd7a11b6c26a1e3fd4948d7f897540e8185b2cafe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655539665, "uuid": "dc7bbc2f-52c5-4971-a331-0f71073e7cde", "value": "T118B31975B7CD9A04E6BF4FB06CB1109143F4E5536902DB5F4ECD20E91EA2780EA21AF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655539665, "uuid": "afdaf5a1-81f6-42b7-bc8d-9a1372230705", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655539665, "uuid": "91eec489-2c6a-47cf-a4e5-a90394f395d0", "value": "3072:yGhlBFCnyYzmIEl/lZVcfI/x1SyaTAhVgoaSK:yGhkPYVcK1CAhVgvS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655539665, "uuid": "53c0b151-408f-4862-ae60-1af0958f865d", "value": 109568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655539665, "uuid": "455ccb21-69e4-43a2-b2aa-31bf65094f51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655539665, "uuid": "6ad592ae-0a26-46ed-9841-b0ee61ec385c", "value": "8e9522fd4e59bb31b592c02fb7fd7524.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34828302-ef25-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655570361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570361, "uuid": "d45c7d13-6bb0-4d93-a128-d183f31ad0fb", "comment": "Malware payload", "value": "0202df34bc01aecbd7617858bca21e45", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570361, "uuid": "cf2aab7d-3c33-4802-8d24-77bfe0650848", "comment": "Malware payload", "value": "97625f294181ff81916dda641cd68742096f858da6303facee505ebdf45b73f3", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570361, "uuid": "4df7a29d-9c1c-4698-9a12-3944c54b65c3", "comment": "Malware payload", "value": "3d0e2e1ca8df9cbbdc80bb45809f4dbf308b553e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570361, "uuid": "aeea990f-d47d-4df7-91da-b71ab09fd41e", "comment": "Malware payload", "value": "953d1a95b3de25b08b328232d8cb376958711cd3613f657d7841af486467863ca4d8afaedce0c1d344c28a5b92ec27b0", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570361, "uuid": "a528fa1f-8f16-4d70-b263-b8b1995e6b2f", "value": "T111214611DCCEAD50C43EC2FFC0FABF9570754196C9D9FE07958465A035A2D91161898D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570361, "uuid": "386110de-a028-4ced-9f9b-a36424343cf6", "value": "12:5lKETWjk7q2bxj/eC5VAU9UB1j87RyDb0L2B0TVBg1G483b90/vnahKJBjfhiauN:7KEOF2VjmC5Z94ilp0n8KrJiaC/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655570361, "uuid": "21ea8e22-de1e-4ece-b92c-1259968ffa05", "value": 1115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655570361, "uuid": "4985fa36-52d8-441d-a6bb-bfe135ffad63", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570361, "uuid": "e9c85a17-5f68-44a6-ac48-b2ea70ab3946", "value": "Copy3595.zip.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62ba1d9d-ef16-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655563996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655563996, "uuid": "772df6ee-1d47-4394-86cf-e814350758ba", "comment": "Malware payload (AgentTesla)", "value": "7cbd88ed6bcfe51fa083a780492e87ec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655563996, "uuid": "fd03b7a0-c106-4899-931b-cfcb2bbb8788", "comment": "Malware payload (AgentTesla)", "value": "97860081c5edb5c5f425c9389fd88a0dc7362f0527a5165b3d3122dee9447768", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655563996, "uuid": "36397011-09ab-4b11-8938-0d5078e053e7", "comment": "Malware payload (AgentTesla)", "value": "85823d1364b384356b8cfaeaba91c22e80b243b2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655563996, "uuid": "4d8ab1c6-f0f5-4c1d-9a66-8e54c6dcdedd", "comment": "Malware payload (AgentTesla)", "value": "e13c643a9746639e119f7b0d0aa4d03e1df3ab1b624d0964ea8c3e35987126770cec842998c0bc68cb936ec6ac1a9883", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655563996, "uuid": "229d2e94-fce0-4335-9aa7-7fab0ce27b13", "value": "T1D6155A035BD85F66E2BDE33721B5840A43F6F4D21662DE9F2D9049CC26A3F814B62727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655563996, "uuid": "c3a280db-38b2-4e9f-888b-414881e825e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655563996, "uuid": "92916926-fc6a-406b-b2f4-b24775c85ceb", "value": "12288:QGFY8S53z6CSaD2cXWQSlnyJWcqpQiHJ9m2Sy3lk/nlQH2DsKns0Ggpp8:tWSWSgFip9m1OKnstgU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655563996, "uuid": "43f9363f-a568-4a90-90ae-7f3ce4f1447d", "value": 927232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655563996, "uuid": "8037f63b-71b1-4686-aa53-73dc10bae532", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655563996, "uuid": "ebc3bc57-bcc5-4e53-9772-6141a386ed6b", "value": "Stainless Steel Plates Sheets and Coil product inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7d70b71-ef2f-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655574876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655574876, "uuid": "97a6fbfa-9e7b-4877-a175-36f99b872c76", "comment": "Malware payload", "value": "e0560feab658d0ba9c6e3981c4b5c7b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655574876, "uuid": "82f4f4ba-2089-40d2-8ece-fa27f2d6de7b", "comment": "Malware payload", "value": "988fcf62c41a39cc6a59697c65be84119b52e7b73365064250fe1746b8f88b2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655574876, "uuid": "8241dea9-357e-4a77-99dc-d6059360f3a2", "comment": "Malware payload", "value": "42d78779e12e1d211eb147becc7c8b8e725effec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655574876, "uuid": "dd95cb47-0fb1-43bb-b22b-acb9b4d37ef6", "comment": "Malware payload", "value": "226c8d2cfb71c22ce30d3f66995cf1fe5c73a11fdb2da274fa94ac92e9d40bdac0316f95bdfcf6e7dd0c1173014bbd81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655574876, "uuid": "f3a8a303-1e75-4af3-be15-1240248f7ad5", "value": "T12CB4C012FEC29976CBA628319565EA2114787E9CCF698AFB6B80F59DCF300C0C631771", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655574876, "uuid": "680d5d58-3f62-4304-8fe8-6f8e083985c9", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655574876, "uuid": "42ebb7a6-0411-4872-ac6f-f883acae136a", "value": "12288:vToPWBv/cpGrU3yy+23qjoiJkV+rpQjvJJNd:vTbBv5rUVP3qjoOxcxJNd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655574876, "uuid": "0bc0ea79-7dbd-4b0d-9aff-506ff9f927a8", "value": 494006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655574876, "uuid": "3a968a40-2c84-4847-b5bb-214bf56519f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655574876, "uuid": "d3b7dab7-4be7-4085-b3e5-c6414df4cbca", "value": "Smada.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba2ef28a-eedd-11ec-93bb-42010a9c0043", "comment": "Malware payload (NetSupport)", "timestamp": 1655539662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655539662, "uuid": "f5dd7988-2c8e-4b1d-ac23-f5eea8c9db3f", "comment": "Malware payload (NetSupport)", "value": "8e8303890125fa304f80eda7359c04c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655539662, "uuid": "726f60de-635b-46d4-bc97-b1a2e98c68de", "comment": "Malware payload (NetSupport)", "value": "996004853edac15918294b18cc8f7145b2e4f230f83fc90314c8253a9eb3772f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655539662, "uuid": "3287f1ff-efb8-4e30-a635-250273fb38b0", "comment": "Malware payload (NetSupport)", "value": "e472eda6d01c2ccbc43a5a1b446411698cb98506", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655539662, "uuid": "396ff31a-f1ab-4250-8433-71ba43a5d667", "comment": "Malware payload (NetSupport)", "value": "752482ee6568e1168dc2d8188c437f018821e0741b055b4c67ff82c8ca82338c94709bd1dd3f44a55e281c571e6fb966", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655539662, "uuid": "69783a8d-1c45-4352-a822-715cb0c30dc4", "value": "T1BA9533113FD230BBD5B553315DAB061165BDA86B29B9F30ED7A2272F3930A11DA4CB23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655539662, "uuid": "c93c65cb-99e4-4798-b584-2a628d6d3cb4", "value": "dbb1eb5c3476069287a73206929932fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655539662, "uuid": "1e78820c-495d-4de0-9090-2013ed7fd975", "value": "49152:pmMXopFdrAskByVgEKEZv5zauP+Tx77KZbYj5IO3Tfl/:pmzndrAsQEnv53P+xyOjF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655539662, "uuid": "e68258cb-a6bc-4bed-af57-988a7d36e419", "value": 2007392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655539662, "uuid": "b9470d8e-8b18-4b6f-8d26-35608a2b018e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655539662, "uuid": "b8e84b96-865a-4584-a000-264e3849a328", "value": "8e8303890125fa304f80eda7359c04c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddc168e1-ef28-11ec-93bb-42010a9c0043", "comment": "Malware payload (DarkComet)", "timestamp": 1655571933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655571933, "uuid": "c83fc9a4-d992-49b0-b87e-7772ea9951a3", "comment": "Malware payload (DarkComet)", "value": "6e8192c0bad137cfd8e0a7279570aa10", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655571933, "uuid": "bcc1e043-11c9-4177-9cf2-2d56686b6da5", "comment": "Malware payload (DarkComet)", "value": "99870955e988faaf5dd449b8470ff7bfb8ac7aa4819df8843d4778ae8a59d034", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655571933, "uuid": "aae12983-1987-4d9f-b088-24a6bd9d7b2e", "comment": "Malware payload (DarkComet)", "value": "50412e7b7b23f08802c4a8ca433cec5fbc15abd3", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655571933, "uuid": "20f665c3-54bc-4f77-8b32-5a4b298e6ca3", "comment": "Malware payload (DarkComet)", "value": "ee426d1b313ddb93dafe3f8fc279ace8d011a97a891c480bc28697b8017f17496fe5dbe6ddf0954cda512812788372d4", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655571933, "uuid": "2ed9adcf-7858-412c-b27f-9df418b1925c", "value": "T125E48E31F1808837D97219789C5F92E6982A7E202E39754B3AE62F4C5F3D6C239193D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655571933, "uuid": "20677207-1d59-4a5b-86ab-1b06a4e1c5f1", "value": "e5b4359a3773764a372173074ae9b6bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655571933, "uuid": "e432878d-99e9-4288-b094-2da0d2f8db49", "value": "12288:S9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/he:+Z1xuVVjfFoynPaVBUR8f+kN10EBQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655571933, "uuid": "605482dc-789b-401c-bfc4-c455d8bc6bcb", "value": 674304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655571933, "uuid": "7de495a9-10fd-4918-8466-95705ceab533", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655571933, "uuid": "ce607998-44cd-4a3f-960e-4c9b03a49be3", "value": "xrangerwh.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e7347a5-ef1f-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655567935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567935, "uuid": "0160b90f-efb7-4f80-ba7a-54374d8c3a7a", "comment": "Malware payload", "value": "f675d8ed303ee81018a28c39a8b97cf3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567935, "uuid": "fecc608c-6706-4fee-a3b9-b7550993b49e", "comment": "Malware payload", "value": "9a98067dba2b4c4352b494a69dcad2f2f601b271b41f3f706215e5ac50be8211", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567935, "uuid": "4ef21eb2-28e5-45db-b1c0-b46784997579", "comment": "Malware payload", "value": "dfbd66d8ed406a566e216bdf8879796b667adbdf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567935, "uuid": "4bc0bcd1-91c7-4b59-9dc8-e84b552786d0", "comment": "Malware payload", "value": "d40914980ee11dbff21ed4fee104504d1308cee48699eaaba4156dfc48523c8af0a9ebcf4d63fe6b99b0a9a5dc9849c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567935, "uuid": "eebf0181-8bcb-4eb7-baf8-31513dde7ccc", "value": "T1D2334B22FF220C27C4D5957661E74729B6F6839F24BC4A2B3D610E8CBF24A4132576F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567935, "uuid": "e221b39c-1514-4468-9187-32c844362d2f", "value": "768:afKIw3oIKNDoPO+YM5QKHlYm1tpFj30ugIXb:afBwYI0cYM5l/tHjC8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655567935, "uuid": "f2ecd3f1-c0ba-4530-b04f-d5ba449bda30", "value": 51440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655567935, "uuid": "dd3d3de8-2060-4b1d-9c9d-596d1da54120", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567935, "uuid": "34280254-030c-471e-91b5-e2a18feeb083", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27f6ca0b-ef25-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655570340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570340, "uuid": "6744b249-81fd-42ef-a76c-05bc35f8c0c9", "comment": "Malware payload", "value": "3df622873472861f21da07259beb8f56", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570340, "uuid": "e0db62d7-819e-4207-8500-21b9a3c9f6ed", "comment": "Malware payload", "value": "9b7e9288499b0a658dab9d44876991c50fc208217d251746bad805b4de37523c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570340, "uuid": "6a500e17-0439-41d3-aa18-f224188c599a", "comment": "Malware payload", "value": "65ab30b4dff2d3d6435cc6dffb80e59aa0a5438a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570340, "uuid": "e1f09bd2-be68-426a-9b33-bb7d33e7f55f", "comment": "Malware payload", "value": "4bbba16a20c8478d5888fd6eaeea49bda4ca5501b4cc0fba832e5ed17537689c9a95c3054736c579db649c5e2ef4f2a7", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570340, "uuid": "ea472b57-3266-426d-966d-e858cc632346", "value": "T1EB21B5C5E892FD83E89FA0749D5D594346B0448C0CF06A1B3DC054803B4E8343A3A4FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570340, "uuid": "56bbf46f-2be4-4064-b488-b166d0c6d658", "value": "24:7KhTjExGSt6lSPpWGQ4ULgUqdGo6Aje/waCSNTQnWN5JgSeTsx44:OoxsMLpUqdGo6Ho2GWBeYx44", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655570340, "uuid": "9414458e-28cd-4da1-850e-846109048aa7", "value": 1125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655570340, "uuid": "810418e2-f131-4c2d-b7d9-7f99b6ba3065", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570340, "uuid": "e0d16774-4b9b-4f52-b58d-3adc5c14ae9b", "value": "Copy2376.zip.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05389eec-ef1f-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655567705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567705, "uuid": "38a86ade-8afa-438f-ae44-7cf4ed53d717", "comment": "Malware payload", "value": "d8353cba653e944a7a1bc1aec9607dbd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567705, "uuid": "321f8bba-959f-41db-a7b1-e06832cac1c7", "comment": "Malware payload", "value": "9b85967885158ae615aeccd9953b953f4cf250d9099ba83e02f8e588b44481a7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567705, "uuid": "13e88d32-5c19-4170-b225-32898766b853", "comment": "Malware payload", "value": "ee0063217bd54d80ed8036e28c8fce2794cd3b88", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567705, "uuid": "3bab1d93-1e06-4ab7-b07d-1b9b998a0027", "comment": "Malware payload", "value": "5d99d1b3394033cc85a8b86c0adbfad70d593795725b16f2d4032f71d6dfff3ad3409260b2f8d938e36f464a4525630e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567705, "uuid": "2642b24e-de34-44ef-a29c-cbaf55005fa0", "value": "T10AC092D726AC3204C009BB1C796BDE5CA157FBC162690B1AA8EAB625DA5D821F061F50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567705, "uuid": "3efdbaf0-ccdb-4432-a494-c6baadcbe07c", "value": "3:LMF93gWSKvGBzOdFLTUWzcMF93gWSKl3zOd/IUWA6:LMFhTwqrcMFhTbQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655567705, "uuid": "90ce9a93-96be-4dae-812f-430045cc873a", "value": 136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655567705, "uuid": "c1460e88-86cb-4713-9cfb-c14f84e7797a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567705, "uuid": "b448d547-154c-4b27-ae21-8dc1a54eed45", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b318c5b4-eee1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1655541368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541368, "uuid": "29738b4a-4038-4725-af5f-87ea9187b009", "comment": "Malware payload (Gafgyt)", "value": "6db718749df3a8fd899fad22e0a114ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541368, "uuid": "1d93e572-fb65-49bc-af61-783dee76718f", "comment": "Malware payload (Gafgyt)", "value": "9d3b48a90d324e694d03b88e999e857ad17a05e3860465bb04aa34dec6abe8f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541368, "uuid": "b5f36261-8f78-4f88-ab26-2b75f39af042", "comment": "Malware payload (Gafgyt)", "value": "c3ec7aef30416fb2f732fc5f2e2a3d2c571c50e6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541368, "uuid": "249ad8ac-1b0c-4a8f-9e6c-bd88ec0d4fe3", "comment": "Malware payload (Gafgyt)", "value": "a84c942b46aee1f44ff9ab52ae1146a6acb80c35183738055f7118655b7e9c761adc3b6b3da54c0009e0ae5c71150c76", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541368, "uuid": "529258cc-ae16-4372-a5ae-d20dfa263d6f", "value": "T13A03E031F0B52EE0C4E0C830DE2EDB253E5269BCE7B93475B640036859D6468A6FB0D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541368, "uuid": "e372f876-811d-4524-89be-45ff85fba8fe", "value": "768:V7yOob0WzrDP3xchms+gPpgQAtAs3UozLI8MJkltgNtu:zO0WrDPAxQzzLI8sBtu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655541368, "uuid": "578e8b16-7148-494f-8323-7d7b06a32655", "value": 40004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655541368, "uuid": "2be09354-b001-4881-96c6-d2617f297899", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541368, "uuid": "9260480d-af73-4b78-b803-470a4d219207", "value": "6db718749df3a8fd899fad22e0a114ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96e4e645-ef54-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655590712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655590712, "uuid": "ed3f137d-6375-4e11-9052-2b68e8b028f1", "comment": "Malware payload", "value": "2515bda09892371d06ad30b2dc92df1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655590712, "uuid": "3bed12c0-6333-4f0a-a3c4-a5788f5fcbcb", "comment": "Malware payload", "value": "9f1ce2ae7224c28ad642bc161b84f6a0acd70960695fe04a4d79f7497748fa0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655590712, "uuid": "87a1c887-e2ef-4fc6-8d30-85e71df5c744", "comment": "Malware payload", "value": "494ba849143058fe958e6dcbd91ea8c0e1addabb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655590712, "uuid": "f0d40839-4337-436f-8a31-875350c551db", "comment": "Malware payload", "value": "adf2d4dd64a852de2470eece4055f410a03d89d8fa8df35dd097dfeb19b18b2546730a38237f96a6d5fc63d5c81942de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655590712, "uuid": "8a440987-f8c2-4495-8c9a-2a9c601f95e9", "value": "T1AC630BDC765472DFC8ABD4B69AA81CA8EB6064BB431B9203901325EDDE0D997CF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655590712, "uuid": "e828d88b-84b5-4c97-9205-0743d2900874", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655590712, "uuid": "a768366f-aa46-4a66-bd57-ad57f46ee9a9", "value": "768:X0YhhRUNuYPfI6VW1sz0MmpwsGWkJWt1JR6T4te7MUaez67dOH+ozCAq03pKHi7q:E3s8fisMpEtJ94YBz67IejMOi7kWVZm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655590712, "uuid": "6db0cc85-67e1-49c7-8e59-fd5484beca97", "value": 68608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655590712, "uuid": "adb79b91-a080-4023-bd01-74862cc9c53e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655590712, "uuid": "31a92d43-0287-4036-8b58-1a438e9d1df5", "value": "Java.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78c3f782-ef25-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655570476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570476, "uuid": "5723d6eb-935a-4cb7-8535-87fe721e7102", "comment": "Malware payload (Mirai)", "value": "e9ec625876bd9b751429ad159d57247a", "object_relation": "md5", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570476, "uuid": "657deec4-3707-460b-b4ef-c8d24b8fd1b7", "comment": "Malware payload (Mirai)", "value": "9f21ab640843cc2e1b326a5d7f29dba693dc201eed1c5e8b6bf4bf198639186d", "object_relation": "sha256", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570476, "uuid": "3e1e6ebc-3929-48e4-a6f8-ea4fb834c990", "comment": "Malware payload (Mirai)", "value": "faf2a12e9ebd429d172034fd13f7b51f5513c19d", "object_relation": "sha1", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570476, "uuid": "95aff14c-b5fa-4b72-bcb1-450d30b71d78", "comment": "Malware payload (Mirai)", "value": "b6cc40e70f96b099421ba172e1019ee18e5bcef14ac56cc7c924d8c3651773d4b11e80cd77efb41ad6aa6da531a0ef81", "object_relation": "sha3-384", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570476, "uuid": "987c9a04-7d9f-4888-aa42-e1a2cd4112ef", "value": "T139F2F1A6856A1FB05B34A87349D192FA2E277E3DE17950B1BB891730BDC3D152AF010F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570476, "uuid": "0232b490-9174-4ce8-ac4f-07ff24570926", "value": "768:QOUpB+nDYamVrb9V1jJdiwTPDbkGcNzGUaNZcePQIs9q3UELaG:+b+nDT+rbVJdBTPvkjG/NZ/QI1Lz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655570476, "uuid": "ab7aebea-7353-482e-988e-450816aa0ff9", "value": 35944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655570476, "uuid": "8e9acba1-6591-4444-8b9a-c5458abde328", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570476, "uuid": "e91c2b3f-f9d0-44f2-9394-953b520dea40", "value": "irc.arm6.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cce563d3-eea3-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655514782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655514782, "uuid": "897a78ee-c7aa-4525-b4fe-4ea9f4a2a23f", "comment": "Malware payload", "value": "40be58e128d9ed42ede4807deab1e60d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655514782, "uuid": "bc2ffcac-195f-4cd1-b098-8db5cb8dc943", "comment": "Malware payload", "value": "9f3e7509dada284ac02173582d85fee8bfc06af2036eb8493a6b85f9d923a90e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655514782, "uuid": "6e679d71-c97b-4d3b-8b8d-4773ccf90410", "comment": "Malware payload", "value": "30e5585985466cdca4555120ad35c8f3fe3dac38", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655514782, "uuid": "54ebab5e-47cc-472e-b000-132498ea0d2c", "comment": "Malware payload", "value": "ae3c75290628912c99a6aaac4e25d80d8b7bd805a62ff96d82a47d4f0d436258236eeeb4f8fe6754da39221aac8fc18b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655514782, "uuid": "2bbaae37-5781-45c0-9732-154177f10ab0", "value": "T151057D35EB80F125EAE3553E87D84A5A167D023337A453CBBF498468853F2DAB43439E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655514782, "uuid": "b70505ac-20d8-4517-866b-b2b5b2c41978", "value": "c84c1027327b354a17f1cc3cd5f25f3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655514782, "uuid": "496969b6-c692-4d5f-be56-9498f5981007", "value": "24576:JkGHNjgaefkO/gA2AUOfrFQpbswwwwwYs82ugb3tdP:CGHNjpefkO/rHFQpbswwwwwYszuybP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655514782, "uuid": "8b9ad52d-5ad4-4c7e-92f4-cb7f363f3b31", "value": 858313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655514782, "uuid": "4052dbbb-ac0b-472c-8921-2f83e2fcd582", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655514782, "uuid": "d741c3d7-61d8-4581-98a3-a960ea94118e", "value": "40be58e128d9ed42ede4807deab1e60d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07932926-ef4e-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655587895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655587895, "uuid": "73c0d2dd-e44e-4276-8e23-979c6ec6550d", "comment": "Malware payload", "value": "5c76c97eb720be49dd25f66369b1de97", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655587895, "uuid": "1320fe9c-a689-4bdf-8ac6-636ef3237c55", "comment": "Malware payload", "value": "9fa3ada923910fa3851c716091ccf365cb65d6b55e44089ef18111f371505b8a", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655587895, "uuid": "85a28d3e-3bae-4565-b15b-d2b3a0a54507", "comment": "Malware payload", "value": "af896cfaff5727dfcc3196b5a4e6df127ffa6c86", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655587895, "uuid": "e3d44749-1d77-4d80-9560-381312ead44d", "comment": "Malware payload", "value": "3b648cee0f0b55915593b7e191c0b831c06936ec8405c1f9d6288f1c628b7506132de2c0f23850026228c96c6b4bf966", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655587895, "uuid": "63e5b5f6-4992-4ba9-ab3f-9e667c3b89dc", "value": "T14FB4AE01B2C6C63BC1BF06B0362A97AA55B6BD644BF1C4FB03C8592E1D725C15372EE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655587895, "uuid": "cbb3b620-18f0-4920-862b-c637a76f07ce", "value": "12288:v/TDYJSLWEY8Yep/sTfZ6LWG/2UPMTZobrAi:v/vYcWEOtRil/7PMT6brA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655587895, "uuid": "67d3600d-d93c-42c4-8ff4-a3cd145cb4af", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655587895, "uuid": "4321b2e5-3cb6-4033-8ad1-ead3a470d981", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655587895, "uuid": "d54d59d1-c28a-4c1d-bd50-3918b75b5ead", "value": "SecuriteInfo.com.JS.Trojan.Cryxos.6056.977.26687", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "695faf2e-ef25-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655570450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570450, "uuid": "be3621a0-cc12-483c-95d0-91b8ca5ddc71", "comment": "Malware payload (Mirai)", "value": "ecc91dda6e286614cafb1b9763a33c38", "object_relation": "md5", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570450, "uuid": "da5acdc0-04c2-4c25-8be1-a74e5c2aaa9f", "comment": "Malware payload (Mirai)", "value": "9fd9137800f1ede09e54beb7db11493cb9122fb45a6c5e79d691369897b1a6bc", "object_relation": "sha256", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570450, "uuid": "d5e26294-882d-456b-b22a-21f62cf0e2ef", "comment": "Malware payload (Mirai)", "value": "bd872848a44f3a6174fa4e2f0307a1b4402d271e", "object_relation": "sha1", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570450, "uuid": "eea7d383-c081-4697-9182-cc823b89238c", "comment": "Malware payload (Mirai)", "value": "526ff962cb122e0e4d9756af416b81a4a25786de1d472087d0042e25b32d1ea9f9cbaff3be98f7d1c6ae28cd0bc77ca9", "object_relation": "sha3-384", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570450, "uuid": "c618e428-386c-459c-a1ad-263deb292db7", "value": "T1ABD2F174E2DAAD52E7B02D317E38C18275EB5E73D4AB3923D4200B756AC35050BFC69A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570450, "uuid": "649a3a9a-d2f2-4aaf-ac9e-47b5cb19997f", "value": "768:fCZoxzheq3jwVTkG+z0d/XvgVcziKVs3UozB:fCZOeqMVoGtmzB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655570450, "uuid": "a7e40431-96e7-4ded-bf1e-4c3c2ea6a533", "value": 30088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655570450, "uuid": "06c813a5-2799-4deb-a8c4-5d2192d206d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570450, "uuid": "54957a90-e13f-4a4d-afdf-d1b5e7e75e8c", "value": "irc.arm5.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a56c3c71-ef25-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655570550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570550, "uuid": "967c390f-b597-45ee-a896-9e0162a73050", "comment": "Malware payload (Mirai)", "value": "27087e6f581b59712daaa4d80636d8bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570550, "uuid": "f0b9ed18-b78c-4e04-97b7-617a18b5d9fd", "comment": "Malware payload (Mirai)", "value": "9fe533c8a2cdbd0a8e3c33048c48a554b53ee36b3d8d1ef34614f4ea42df6cfe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570550, "uuid": "52371be9-be23-4110-9592-0f1e7752bdd1", "comment": "Malware payload (Mirai)", "value": "d2c3d8a1b7be7a3ccff26a8fc07603f2802892f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570550, "uuid": "2ef61a06-fbd0-4e89-8d47-336f773279ff", "comment": "Malware payload (Mirai)", "value": "14ce451d63d256afbb06453a85177d78750b39ecac9d086f35373f5c5571cafb0a78c8985dbd92a1badf5dc97b27383a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570550, "uuid": "462f9cc2-b731-42dd-a49a-4f14100806f8", "value": "T19FD2D054E4E92CB1EBEE7C74ADB2DAC23BF50BCD37319E850042A75216225879F10BA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570550, "uuid": "cb82ece8-236d-4a9f-a84c-fda58c2dfebb", "value": "768:i+3g4t4qQcJvdhZLaXsx3g5sB4uVcqgw09Z:1g4uqFJvVeyOA4u+qgw09Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655570550, "uuid": "9f4ad54e-2cca-4335-9330-1555baaa2c25", "value": 29904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655570550, "uuid": "e84b9128-b281-4ad0-919c-8958cf29612b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570550, "uuid": "21463ef9-076d-4b3f-b143-a1e91d4fd44a", "value": "irc.ppc.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "831a44d9-ef25-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655570493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570493, "uuid": "a66598cc-d6f5-4387-81b2-6e0a988ad934", "comment": "Malware payload (Mirai)", "value": "d7d1295f19ed273f0d26078600051315", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i486", "colour": "#328A83", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570493, "uuid": "2f1d135f-2c52-4b7d-a503-5486dd4cdb98", "comment": "Malware payload (Mirai)", "value": "a097a28be00c4b6317e8dade8330e8e8cd03816c0f07aafd669c5a59701b7dc1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i486", "colour": "#328A83", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570493, "uuid": "f70acd7c-7557-41e1-9b2a-1ee78c1f3c2b", "comment": "Malware payload (Mirai)", "value": "bc4baf4deebfb2ff974dbe7aaa60a39c8bf98594", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i486", "colour": "#328A83", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570493, "uuid": "5292f7c8-0bfb-4f1f-93d2-328d32045048", "comment": "Malware payload (Mirai)", "value": "5a2860175578029308874d93f5b519a26e5b5c907448ba45b2ae4540e024ee60f0b508944d1641605f0f4bd5eb4731e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i486", "colour": "#328A83", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570493, "uuid": "5b76ad03-68ab-4c02-a02a-75d3451d39a9", "value": "T168E2E183E0EC8799E576617C9ABB370F0554E52AF15D66FB9F0838701488F433B286D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570493, "uuid": "57ec25cc-912d-4e8e-afe2-5bb76aa1acbd", "value": "768:+bMyW45AJIxaMXV06NhX+EYas04gwDraD/F4j2nbcuyD7UHQRji0:EgSxhCEbBCOjF4Knouy8Hyu0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655570493, "uuid": "90ef00b8-5d01-4004-9323-c5092231be1b", "value": 32488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655570493, "uuid": "1f0b3383-084d-41a7-bf66-f5eeab94f659", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570493, "uuid": "fbc5a049-610c-405e-b6b4-0b478ec43b5e", "value": "irc.i486.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee5bcd3b-eee1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1655541467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541467, "uuid": "852af8eb-160e-4c2b-bf34-3dc95ed6a655", "comment": "Malware payload (Gafgyt)", "value": "47efce3c7ec74c754272015e9fbb93b1", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541467, "uuid": "605e1490-0fda-40b4-8c3b-e822f5e73126", "comment": "Malware payload (Gafgyt)", "value": "a1d5a060dfe1dbd80aae7a22d3619371109ac2f5e9cc4bf3ebf210da61595e9a", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541467, "uuid": "332f67a5-7187-49e8-8984-01ebb9ece7a6", "comment": "Malware payload (Gafgyt)", "value": "524c00dab6be305818d35374385f7dd402750603", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541467, "uuid": "a11bd9e9-30d2-4f2e-89b8-677467073424", "comment": "Malware payload (Gafgyt)", "value": "360276acc82e93ee5f5cf182d8f7dde651ab9951a75923f30e6f1eec1d5f4e77f3262bf7d0e80dbf79825f23cb7c4e88", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541467, "uuid": "c3aaaafd-11c0-4545-aa17-5deb5fbf0ea6", "value": "T18A13F1B232F7F5BAC0B1CE73E4681580FF91E95A639A13BB11E2710EA5D65907C24CD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541467, "uuid": "eb3bbcc2-bf97-4c3a-b100-760ea82f610e", "value": "768:qHYngfU205mpCLjWc5qgoxWYxC8dLDEhdxepX/EG1wyfpOx0qjyl9vzxIj:qCg9ZaCWYYCDExepPGDDjyjvOj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655541467, "uuid": "cf1cbc1b-f73c-4270-b7be-72618f261baf", "value": 42028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655541467, "uuid": "c8c46dc4-29ba-470e-8334-eb2cd169b030", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541467, "uuid": "6fe9254d-0dc7-4525-b61c-3db146c0120e", "value": "47efce3c7ec74c754272015e9fbb93b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01e4da26-ef54-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655590462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655590462, "uuid": "6bceecc4-9313-418d-b639-f483084577f2", "comment": "Malware payload", "value": "fff74074b87d2c6cfd9ed184591478b6", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655590462, "uuid": "611f5c1f-0223-478c-8d97-7d78a599a689", "comment": "Malware payload", "value": "a21d166905ac2464c03a8a85cabf4e79a3ce25c5f7ac10b4219e72b1a1ed94c8", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655590462, "uuid": "f3935a2a-2865-42dc-a104-7c9757d75602", "comment": "Malware payload", "value": "948633b2b28be818b031ef1c87dcf1bc78bd9323", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655590462, "uuid": "6832019d-1691-4d09-bb97-7b1d55bea276", "comment": "Malware payload", "value": "d1d7c998495747907722f04dbd6ee9550264409d032adbecdb3457c521b74ccf9750e21b6978948f61fa3380a65cb871", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655590462, "uuid": "2592aa1a-e8c4-4ddc-8fff-ca0afcce1517", "value": "T1CA1633D4C22DFB6446EE82CA588C3E1AE72E96480588783D496636F9F2C5C45314F7FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655590462, "uuid": "a2dcf023-ceef-4a9b-92f4-d2bfbec4d4ba", "value": "98304:w5okR5oCqgQthPNEuvuUbqaBLEK1r/W8FOhLENRx:w5fR3qgQ3PNXvR/EKl/MdEjx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655590462, "uuid": "593c4823-bda0-4b1c-8cea-39dd56dc2cc2", "value": 4094030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655590462, "uuid": "1d910d1d-acf3-40c9-b451-23aa5da79826", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655590462, "uuid": "c8ae804a-0f5f-415a-93d1-8aa658d783a4", "value": "Install.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "281bb2d0-ef2c-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655573347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655573347, "uuid": "cd86a5b6-9aa4-4d53-8d8f-afd58f2d76e5", "comment": "Malware payload", "value": "1c2d01bddf4cd5b658b3ea99335a7fe6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655573347, "uuid": "f3b2de2a-42e4-4c5c-add3-4ddee8c508a3", "comment": "Malware payload", "value": "a31ffbdea743038de8710e149117fce2035ed4682b1755fdda0a67ba272e4155", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655573347, "uuid": "eede0d52-2ed7-4ef0-bdbb-6aa77e2bad6f", "comment": "Malware payload", "value": "486b6215785fc8f2464202cff4e8c0ad3a38ff8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655573347, "uuid": "e5be74ed-2a02-43d1-ac48-a2317a0ff0f6", "comment": "Malware payload", "value": "bfe47a3e1f0a7050bba6a8d5d7d91d3643822aed6f4fca0e7e49b726c38011decd31d2d8ba33adccf01640c0dd5d9b92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655573347, "uuid": "1dda7498-6811-4cb7-9a25-71b78b995198", "value": "T13DA3BB2529FB40ADF3A79EB25FC8F8FF8969E537260E70B6359107468722D408D52336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655573347, "uuid": "215c0f1f-a7cd-4871-9376-1cd06b609499", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655573347, "uuid": "b341f18f-caf5-4eca-afc4-46cf5b14416b", "value": "1536:lXUhYlEzrCYDBA77SDklKbx+pW/jZRemBH7u7LLTBSjnN76JHIc7fXBK:2uwCyD8r5HIc7vY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655573347, "uuid": "21c5fec1-441b-4f4b-b7cd-c8ba296ee237", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655573347, "uuid": "38743619-1b63-4fac-822d-d2b04927312b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655573347, "uuid": "1fb5c5dc-8736-46ca-95bd-a2a83a77d117", "value": "RblxImageLoggerSploitz.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12162d7f-eedf-11ec-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1655540239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655540239, "uuid": "49b49c28-21d0-402e-933d-32ff7e674b7e", "comment": "Malware payload (AsyncRAT)", "value": "fc42ec801e81672e01fa9008a5fdaa1c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655540239, "uuid": "0d48e25b-3979-49d5-9932-fee241d25847", "comment": "Malware payload (AsyncRAT)", "value": "a337ba6296a4fe02043e43f7f83723e66188727c945a56a770ba6b69f2b06b52", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655540239, "uuid": "dffab71b-2e17-4e56-827f-35a47234f091", "comment": "Malware payload (AsyncRAT)", "value": "bbc9596c03ccf847edc63ca9d4d5fba3996902e9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655540239, "uuid": "f2bd138a-6af1-428b-91f1-520fbdb335d2", "comment": "Malware payload (AsyncRAT)", "value": "c66cb907aa856d26df3d594fa7704c17dc67e48f02ea6060e654f4dfd39ac4e19bf57031c9e706fc1ca181157ddc1ab8", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655540239, "uuid": "f389c38c-9e0f-4b96-87e9-df62d91ba0be", "value": "T1BC04B91225FB905DF3B7DF754FC8F8FE89AAE563160AB1B5299107468722E80CE41336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655540239, "uuid": "03c31b33-a11f-4cb6-b6fa-351ad975e5e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655540239, "uuid": "d76f7994-e35a-4dc1-aeb5-418a0e204f14", "value": "3072:s0hG8Kx12R0tRNrf40Yhez3PoBM6H4oheI69p:ezc0t77nY0z/o29", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655540239, "uuid": "825fdd49-2b4f-4ffd-879e-1f2386356f7a", "value": 176640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655540239, "uuid": "e2b1c2c3-6c29-4044-bf0d-09b6dc57a7fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655540239, "uuid": "ed97d395-04bc-462a-88d1-33c178f56495", "value": "Fatality.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7200e90-ef03-11ec-93bb-42010a9c0043", "comment": "Malware payload (IcedID)", "timestamp": 1655556085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655556085, "uuid": "e2999469-5044-4561-9aee-8db602847f31", "comment": "Malware payload (IcedID)", "value": "a8e776bc7419b94ffe5ae95baa1d78c0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655556085, "uuid": "3c6fbd3b-c9d5-4f1a-ad77-cd238b309c23", "comment": "Malware payload (IcedID)", "value": "a358a13807af29f47e5bd0990fd97f01a8b857ef952766dec98b624b90177ec6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655556085, "uuid": "4fcd60a2-fb45-4947-81ed-b03924b1b513", "comment": "Malware payload (IcedID)", "value": "04fea0b10ac28107307105dba2d055fe3d87e1b5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655556085, "uuid": "d97d02e7-1d1e-4358-90ed-14050978eac8", "comment": "Malware payload (IcedID)", "value": "7e1603c5cd200865633da7faae4822db1b1d75301551fa5f2b80499af8ae9e1ba6785e1fbd82e632cb55f957968c6bbf", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655556085, "uuid": "a248aa8c-4a31-42da-873e-943d42dc6306", "value": "T144D4BFB876047CD6B66F577BCA966CED13B62663CA8BA4CD40647BC305A3371FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655556085, "uuid": "e3c5d1c2-4ce4-40d2-8375-6e9c97a1454a", "value": "12288:EOa5otQOxWeQqZjPnPUAUwsFaH/k1Oe93cA2Bt82AyelVGpZYQqJkEZ1z:Fic5QqZDnPU0b/k1X1c5BaVip2d1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655556085, "uuid": "7817868f-0b0f-4013-a920-6ac88de22109", "value": 614912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655556085, "uuid": "976f2aba-bf59-418c-88d8-a3707aa9f012", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655556085, "uuid": "09ba49ce-bbf0-4a9a-9ad5-5d506cbb5dd6", "value": "a8e776bc7419b94ffe5ae95baa1d78c0.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70efba04-eefe-11ec-93bb-42010a9c0043", "comment": "Malware payload (QuasarRAT)", "timestamp": 1655553712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655553712, "uuid": "79a52cc4-dd72-419e-8f9f-fb00f6e072b6", "comment": "Malware payload (QuasarRAT)", "value": "3995d5e5a6bb28c8ac903c3031f9ea8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655553712, "uuid": "c1846726-2568-49c2-926e-291a71f6fa2a", "comment": "Malware payload (QuasarRAT)", "value": "a6353ed171fcd97d4b896440c003c303ae038bb9f76623516595ed53f704a762", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655553712, "uuid": "9ddc66a9-186b-43ed-8095-d2a1a33916f3", "comment": "Malware payload (QuasarRAT)", "value": "17d33f2f46a0257313d252dd6008b318d9953eb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655553712, "uuid": "55a1bd1d-d932-402c-8c9b-0ff29223d918", "comment": "Malware payload (QuasarRAT)", "value": "0f6d4056901cb0059249f57f55136cc12b6f200d2e36795d5428cbb9b2ffa82a2a5dc4c2003c82b692a2106e1b6f815a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655553712, "uuid": "37c6a803-530e-4d03-95ba-d93e08ebaed4", "value": "T13706383439EA5029F173EFB99BE476EADA5FB6733B06A41D109003464723981EDC163E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655553712, "uuid": "631dffa8-7159-4626-a53a-2008007dfca0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655553712, "uuid": "79aeb62e-582c-40c2-b8a3-3f1808c98a8c", "value": "24576:MFjPvXGctxDi6H3FTUN5Mf2sg2ekFwzaZbgDJBHDDRxg2O+gbG8eUf4CvTvPZfwO:Kvlvi6XiNCfCcmPDRGlVebayXo4qbb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655553712, "uuid": "c9f058a0-27c9-4f44-a550-38c560c49cb4", "value": 3838976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655553712, "uuid": "ce2c787d-66f3-46c1-962d-15fb34a94b8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655553712, "uuid": "40bcd2e0-8b51-43c6-ab33-634d18898b39", "value": "Hwid Spoofe_nls.scr.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33991bd3-ef2c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655573366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655573366, "uuid": "7c33d27f-4629-4c18-9a1f-813f7302b96d", "comment": "Malware payload (Formbook)", "value": "c73687dee2753dd5e4b45a29c2e0e30b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655573366, "uuid": "2ade0f56-7aa2-4803-bbc3-d75666460928", "comment": "Malware payload (Formbook)", "value": "a67a8977a2c5bd54fdb3cbc35c1242b14d44d98e5d12591bd9bb2fb15458ba33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655573366, "uuid": "ac0d777c-26ce-4eba-8bea-7e005ed8e99a", "comment": "Malware payload (Formbook)", "value": "3b065230dd71043cc60949f0bf5245a835b21834", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655573366, "uuid": "be40816f-53af-4097-8474-de1d80ea46d1", "comment": "Malware payload (Formbook)", "value": "fdb904419282ed54d51b499c954b9d82b1b57114b15c95f164e0ce0307208bf2fc1c96e2f70c14fb57176bf7f3435114", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655573366, "uuid": "6ca569bd-694c-44ae-8bf2-0ae049bf8801", "value": "T1CE5633643EB9489BD37A26356AEB3D106724D9E721B5E303B7D01B1E6CA371F4D03292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655573366, "uuid": "661099ca-51db-4faa-8d47-c6108d52b7f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655573366, "uuid": "80358d4a-f355-455c-8d69-6fa7c46e8819", "value": "98304:UBv69ZR6NTADp9L7NMs4bluJrnId84AMX066HD5i9dGno+9rHf15iRE8dWi2XTT4:CvGQTTs4ZIsetUy9Ud8oerHfHWWVT8xN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655573366, "uuid": "67e98b2a-bc4b-4a7c-8899-080fec9c680c", "value": 6155986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655573366, "uuid": "f41e7741-3a93-4a35-b604-e362dce96f37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655573366, "uuid": "58e8d0cf-06bc-4d1e-9ec7-bc6d4f219add", "value": "SifreliDosya.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55e60b80-eee5-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655542929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655542929, "uuid": "2966cec0-84a7-4c70-810f-28b82cc9f260", "comment": "Malware payload", "value": "8cd152255a1c74e539987a84782945fa", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655542929, "uuid": "dedd5105-9d6e-4539-88dc-7cac9a280cea", "comment": "Malware payload", "value": "a6f6bb4406d55b6d3db6411652a59584874906f9f271b9eb8269c01a6880e87f", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655542929, "uuid": "8b41c12d-78b4-467a-a5ac-059e70c8d06d", "comment": "Malware payload", "value": "55f8f787c2aa49fbe41365bee536b55c23f91b9a", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655542929, "uuid": "fa92d48c-28ed-4355-bc69-3dc282dbe5f7", "comment": "Malware payload", "value": "1fde4aa07e3a0b49e13ec7404643de7c937e42424da7a4b3b0b355299e89d8e0a30c4bcd9f3948377e2413fbc397869f", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655542929, "uuid": "5e1d4ce0-fe8e-479f-809d-940c3ddb5b56", "value": "T19DE0E5437403893BC6E136B1622F3329775B0257E0137940B68B846065F2ABFC34A4E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655542929, "uuid": "b3750dff-c84b-4afd-a6bc-2e7413b914d1", "value": "12:BneX0EeX3XkeXZ3Q0MDJFvWkmFKniX1n0MDJFTtAIiXEK/:zcU3Q0Yvjmo+n0YTnl4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655542929, "uuid": "0e984bd6-c761-4111-85c5-73f91f371754", "value": 416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655542929, "uuid": "1d5feadb-2bb8-46ce-acc3-d4c36d099acf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655542929, "uuid": "3693ea7d-3fb3-42e7-b33a-ffa449a297eb", "value": "cock.bat.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c29f4f2a-ef1b-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655566305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655566305, "uuid": "371ccbb9-fb53-4469-960f-59ff0de22110", "comment": "Malware payload", "value": "e2b5c5bd45eff82816ecd4bef9b29a25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655566305, "uuid": "05d21b1e-11ff-4002-ad2a-a8c3b617ceb8", "comment": "Malware payload", "value": "a733e46c1d6d611bcec6420bf46a608d2e987804b7ff2128fb27d153b05826f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655566305, "uuid": "26c5156e-ecd4-473f-992d-1986e56a4a8d", "comment": "Malware payload", "value": "a8bb6c0b839f6e455b886daa389c5a81ae0ff3a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655566305, "uuid": "ab3bb706-5bb7-4559-8b05-0bbc28fa2f95", "comment": "Malware payload", "value": "d87021beec5cf403cfc59ea23046cc96fad8a882ca757ab624b543bae2660e2fab5f2833224cb1a1218c06219e3e8c65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655566305, "uuid": "ac7a646a-d782-4ee7-9086-8a4c1b2b40ea", "value": "T15DC33A4BB3A901F8E2F7A23CC5A24646E77678664771E7CF03A0426A1FA37D09D79311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655566305, "uuid": "ffdb550f-a553-4ea2-805f-8e56ba8b5528", "value": "e136c78efac5157bdb78b75c07967d98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655566305, "uuid": "b96edd52-8538-44d6-b4ae-c3b81f732930", "value": "3072:el0xIHQmEbeliHk29+E8UfjA11NdG/+JXEc67+cK5:M9JXG/+KcjcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655566305, "uuid": "6aa0ed59-2d36-4dd0-9cd9-3143eb497f38", "value": 125952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655566305, "uuid": "8ee04031-e56c-4849-a3b7-26ba18eadaec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655566305, "uuid": "87a879ff-08c9-494e-ac4b-b1d2c2550429", "value": "PW_STEALER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0268ae7-eed9-11ec-93bb-42010a9c0043", "comment": "Malware payload (Amadey)", "timestamp": 1655537927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655537927, "uuid": "853e36eb-265d-4f1f-9b9b-94a903e8b1a7", "comment": "Malware payload (Amadey)", "value": "b51101f5fbe67d2ec30c03f1874e842c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655537927, "uuid": "ce030733-d35f-412a-a969-25642b619c8b", "comment": "Malware payload (Amadey)", "value": "a7709e21e93ff1175ff77cc3d48b8c188b429d0c7acc52815fc6eed9acccebbc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655537927, "uuid": "dafd8426-ec28-445a-b7b9-4e13d59580a2", "comment": "Malware payload (Amadey)", "value": "83d7075a88d0eb86a3dc51b3e42203e325821794", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655537927, "uuid": "36f62484-992c-4cd2-8824-06da27493e55", "comment": "Malware payload (Amadey)", "value": "b7b344e02dd3c9e2fbd857310c11615d63b3b2d3922fb9dd382fb88b6d25774a855ebbd5a42331c3295ab7464a98cbb7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655537927, "uuid": "fd63ae9c-e5c5-4cbd-914d-01a8c1c68230", "value": "T14B44F11137A5C0F2C99713309566CA925B7E78224A39D1CB77941B3D2FB03D1AFB9386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655537927, "uuid": "4bfb39a2-1931-4d79-bd07-2e7e5a0b0463", "value": "c99ad8a6bd42c42af4d281fc572cc9a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655537927, "uuid": "4ed17420-2244-4316-93cc-4d7741aaf6f7", "value": "6144:3jpgH3JTWEz11iyPzpR16bOouuug1QDMqSz:NgH3JTW9yPtTXgvqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655537927, "uuid": "3a7f7ffc-339a-416d-9a16-107bf7f59caa", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655537927, "uuid": "48510ffd-40cc-4aef-9fb0-3bdb3ed800c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655537927, "uuid": "e8667af4-f8ba-48d2-830a-543281b14513", "value": "b51101f5fbe67d2ec30c03f1874e842c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cac720b-eedf-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655540471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655540471, "uuid": "88124e1a-0db2-4daf-a718-9e93316b949d", "comment": "Malware payload (Mirai)", "value": "cd15e38bc0b474b2e816284fecedf1b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655540471, "uuid": "77b458b8-97ed-429e-be10-8d00a7d5a8ae", "comment": "Malware payload (Mirai)", "value": "a7a7684b35964a43cac5f40555b4f65936b9f5c91b56d2655c500f85dc55b00a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655540471, "uuid": "f86bad0b-d001-4487-a023-dd79a4ffbbaf", "comment": "Malware payload (Mirai)", "value": "8d0e1c0c360d5578a74349627cb11783b0111afc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655540471, "uuid": "0089cdc4-b86c-4c39-b520-17378e916c44", "comment": "Malware payload (Mirai)", "value": "e8b8987344d685862c9a71c8bec1ff2508bf82da4ea98dc07a45009c969b74ce8d0b65367566f1a65a44fbe2c991cbe8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655540471, "uuid": "a6796d46-2eb6-44e2-ab95-789664f69f97", "value": "T1F983D516BF610EF7DCAFDD3746A9074138CC650A22A83B767534D428B25B64F45E38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655540471, "uuid": "b730f575-aa7c-4b21-b414-6a0d54f13ba8", "value": "1536:grb6pO38RfE1RjbzYvJ4szoqTcQzZOQ8FMkOR:grb6puvs0qTJz7pR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655540471, "uuid": "a3f6b3f1-b52f-407c-b5c2-4b413d143739", "value": 80772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655540471, "uuid": "f8f4eb4a-322d-4e60-826d-8b7cd8b40797", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655540471, "uuid": "8c3177f7-4c52-4e69-92d8-be981084d602", "value": "crmpsl.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9bb3825-ef13-11ec-93bb-42010a9c0043", "comment": "Malware payload (IcedID)", "timestamp": 1655562961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655562961, "uuid": "fd8038c8-7abb-4e24-8585-0ef9496b4eab", "comment": "Malware payload (IcedID)", "value": "bd6fe020978760b10f421f510a18d594", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655562961, "uuid": "d7202f17-0dfd-47a8-bcee-c69c2c3f8f53", "comment": "Malware payload (IcedID)", "value": "a7c60840e5e0f0b09f073703eb9913a2e170666c624bc993484c48558cd96ca8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655562961, "uuid": "be880912-17b3-4fed-b67d-2ee231870025", "comment": "Malware payload (IcedID)", "value": "8a4e01e28d5e4755584b988e76d273f03074c3d4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655562961, "uuid": "1a46b88c-0362-49c3-94e3-f97629a2e56a", "comment": "Malware payload (IcedID)", "value": "78c47df532aa4f1f64d6a661828fb3c826a23aa7b04bd48cb660690dc64bf8af0969e27e9607dae4426410b80fc51cbe", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655562961, "uuid": "53ecba7f-309e-4952-aea1-b4f7adf20283", "value": "T1C1D4BFB876047CD6B66F577BCA966CED13B62663CA8BA4CD40647BC305A3371FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655562961, "uuid": "9b0c633b-d7f1-4463-be4f-29b1bb718d72", "value": "12288:gVa5otQOxWeQqZjPnPUAUwsFaH/k1Oe93cA2Bt82AyelVGpZYQqJkEZ1z:iic5QqZDnPU0b/k1X1c5BaVip2d1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655562961, "uuid": "4f83db06-cc44-4f4c-beb5-ca306188e34b", "value": 614912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655562961, "uuid": "8156e7f8-1a34-4c61-89d9-0875ca368fde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655562961, "uuid": "96ebbde4-2e9b-4e25-949c-5e6d33d50ef0", "value": "bd6fe020978760b10f421f510a18d594.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "213482c3-ef17-11ec-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1655564316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655564316, "uuid": "71f6417e-655e-43a6-bbee-66189e8a39fa", "comment": "Malware payload (NanoCore)", "value": "c732abc4f49af0d49af2bc33f7b7798f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655564316, "uuid": "01c15513-f62f-459a-bb91-f77bf7bdf4ad", "comment": "Malware payload (NanoCore)", "value": "a7dffd231b3d66a90e59250a15618717e6b6b4a557420b1869811ecd8408be2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655564316, "uuid": "3b8b5ce5-6434-499c-8d07-98db85416e97", "comment": "Malware payload (NanoCore)", "value": "4a1a2b9dc89d93c043dec08cc9cb0e2f2a7dedb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655564316, "uuid": "2629b98f-e104-4573-ac97-12e9dea82ffb", "comment": "Malware payload (NanoCore)", "value": "4a92f8ea4ccfaea2c94d6a1ebba0f7b6e2bc57b631462085a4c16fec2960f1240a5c3ecfc88e9629842b1840bfffc483", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655564316, "uuid": "858982c2-f0ad-40b4-bf67-91fa61fbe5c5", "value": "T1EC14CF5577A88A3FE2CE9679611242139338C2E3A8D3F3DE28D415B79F667E50A070D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655564316, "uuid": "08e2090c-82da-497a-a3e5-1b5438a4920b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655564316, "uuid": "e286f18d-33ff-46bf-9817-abf620f11945", "value": "6144:wLV6Bta6dtJmakIM59SxxV2Pvj3Y+w5Af:wLV6BtpmkP2PvTR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655564316, "uuid": "89de0615-19f8-4da6-b849-c0b6e8214ef9", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655564316, "uuid": "b109b9de-68fc-4f5e-9b30-53933d00f1fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655564316, "uuid": "f42b4cfa-38a2-42bb-b4e9-0f4c4092324b", "value": "spoofer fivem.exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fbc52e9-eefb-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655552287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552287, "uuid": "211188b4-df87-4693-adc5-ca755d24f574", "comment": "Malware payload (Mirai)", "value": "1edea31f1e1ac7810f170f167c4d8fa6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552287, "uuid": "ad04c08a-2b4e-4edc-8f27-00de5392881a", "comment": "Malware payload (Mirai)", "value": "aaa1a0b6dbb79d623a443a0c8d75349e019c5be37f8397046bc3caf035c71899", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552287, "uuid": "35f61a3d-74d9-411d-9c98-5f9af8c3b9ea", "comment": "Malware payload (Mirai)", "value": "95251fccd4f75389d83fb0fbc44c999a6394a1f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552287, "uuid": "82668720-cea9-4989-b071-3e7ddaa88beb", "comment": "Malware payload (Mirai)", "value": "39c3111e23fc4aebd6a8fe4c4bba91834446340b50d1c7db3ba919b615d5803a61dadd4ffc6ed403335ecef58b9fb48a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655552287, "uuid": "9671d41f-087a-4122-aa77-f596384f39f2", "value": "T19B03E795F8D28E5AC1E0627AF76E41AC332063E8D2CF7707CD646B1476CA51E0EA3B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655552287, "uuid": "62ebfa3b-68ce-46b0-8ca6-72ad32f9b954", "value": "768:7EJittc0CnnX2CFqwvSFnO5MCbdFHjlBgP7I+ElgeE0bVdS5AflwS6uNwL1:7lcJ2CFbvS5CbdFHZ20+E5o5AflQL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655552287, "uuid": "5d2231ca-4b01-494c-8195-5e8b43d61a5d", "value": 38348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655552287, "uuid": "a80f748d-f072-42cb-8947-2a79d68dde4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655552287, "uuid": "fdb85b41-ca9b-411d-aeaf-37f435bc9b25", "value": "crarm5.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddee9afb-eee1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1655541440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541440, "uuid": "97aece6e-d5d3-467b-a87e-40a8df497fa5", "comment": "Malware payload (Gafgyt)", "value": "a283a6c661c587ee9a2a840fafdd68f2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541440, "uuid": "d97b92be-d05c-4bd2-ba60-f0984a434a64", "comment": "Malware payload (Gafgyt)", "value": "aba183d85e25aa6ff545c9eb25174796aff3005b6662d61aa623f961fa3bd1fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541440, "uuid": "0d88da5b-2b72-4040-8bf4-9456a76d8d9a", "comment": "Malware payload (Gafgyt)", "value": "fef36819d2e7f1a69f3110efcdc1873ae0f07bc7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541440, "uuid": "c2319fd6-6e5b-48df-994e-2bd0fb3e0245", "comment": "Malware payload (Gafgyt)", "value": "0d9ee079d08cc62715e79cc2d005e2184534d0bda606ca543b29c6795ca8ae2793aaef3a8548cd57169b18c2944b71c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541440, "uuid": "f4d07f71-815a-4ce2-8c02-21e3952cae77", "value": "T19803E152C06E0945DD7C51BA0CE7BB2A5D1CE17B2BCCAAF2D8C9193619EBF19D3011C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541440, "uuid": "b76de3e1-419d-4e13-a508-bf5f0c09c87f", "value": "768:pXKK5Z2mZ4KqK425bTUnosxo6Sne+CDHNVxkZ5ySnbcuyD7UyQRjQmxtsP:r794K425U52E5hVxkCSnouy8yyUhP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655541440, "uuid": "c1c8b615-26ee-4ea9-a59a-466c3e36e8fe", "value": 39032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655541440, "uuid": "785735c2-4803-4770-a3c7-a52ba8fc3e7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541440, "uuid": "6ba9e526-fe20-4eb9-b39d-e1f5fd5d4af2", "value": "a283a6c661c587ee9a2a840fafdd68f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b50b7b8e-ef25-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655570577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570577, "uuid": "e8ff3e71-bccc-418f-84b4-39ec9ad29967", "comment": "Malware payload (Mirai)", "value": "7edffc01cef0f280828e4e46b6142e73", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false }, { "name": "src", "colour": "#6D1CDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570577, "uuid": "2be82cc3-b791-48bc-ba03-830e1593f4d2", "comment": "Malware payload (Mirai)", "value": "ac5f2d8ae7563d81b9488adf6b653d7e933de7bac610817ce555d39da0f5867b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false }, { "name": "src", "colour": "#6D1CDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570577, "uuid": "dfffabb1-887b-4738-ac8c-bc78ee5348bc", "comment": "Malware payload (Mirai)", "value": "09c187d6d2fa2c5831225fdb0533b1a028b33cdb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false }, { "name": "src", "colour": "#6D1CDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570577, "uuid": "1578e560-537a-414a-acb1-893fa39e9258", "comment": "Malware payload (Mirai)", "value": "f030aba156f988e7934f0c0c076bab33ad0d4e84e249dbaf2a8d473c8dc7150d7d0dc5f6e40934816779c4147419fa26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false }, { "name": "src", "colour": "#6D1CDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570577, "uuid": "74dabb92-3690-460c-9bb0-434c5bbbd131", "value": "T11F734B35B9392F13C4D4A03A21FB8716B9E5338E22B4D25E3C711F9EBF506406A166B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570577, "uuid": "dac50b7b-8989-4267-8258-29e4dc106747", "value": "1536:aYUWtDosymhehaJ/QpqJuQcTCc6ovlDDuU8v3FpbK/X:dtXQQcpFvlfufvVwX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655570577, "uuid": "7a364741-e043-482b-b41a-6bf98a191e0b", "value": 80672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655570577, "uuid": "409e2d19-a0f3-46cc-85ee-815f44364359", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570577, "uuid": "5c1200b3-e28e-42ea-94bf-defd4608304a", "value": "irc.spc.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab11e2f4-eee1-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655541354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541354, "uuid": "ed5fccef-84ef-440d-a42b-cdca6c7b4462", "comment": "Malware payload", "value": "6cb696f9f04862dbd1444b6b833aeead", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541354, "uuid": "eab322f8-3df3-4696-95db-36a85f74027f", "comment": "Malware payload", "value": "ac6a4f2e5ae529d8c3d3f1dc51aab9660f7beb11f87334aeea047219073cacda", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541354, "uuid": "a0f38b11-0cbe-4271-bdbd-cf701568776f", "comment": "Malware payload", "value": "4a3d4a612affd4b18854b5c25c286bb526a1ede1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541354, "uuid": "43ebdc34-c6f8-45fa-946b-ecd1d8081102", "comment": "Malware payload", "value": "cca6eefd56d0bdec19bb65f7f7cafd58dde7748d9d8d106a5a68359d2c7a1656ba3e838d35676f0442ded4015216992e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541354, "uuid": "ba85ac18-5fb4-43d7-be5e-1303666e5b75", "value": "T1BF13F27E6D0918BFCA76D2F443C11F80395153D5B992ECC61C84FEA64E459E8393BE80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541354, "uuid": "7408b731-c246-43f0-b9a1-f7393a33a94b", "value": "768:OpcrDEnexKdQFySrHDyeoU4vK7g7vWnSwZGnBmknlMqidPJgGlzDpbuR1JKUJWcg:OCSexKqZrWTU4vqgK3YBgRdNVJubkZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655541354, "uuid": "59831e25-620b-475f-a2e3-820c382a167f", "value": 42440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655541354, "uuid": "afb91950-88ab-4455-91df-00b5c05c834f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541354, "uuid": "19152260-983e-43b3-abf8-93b19125fedb", "value": "6cb696f9f04862dbd1444b6b833aeead", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6caa03f-ef23-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655569774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655569774, "uuid": "24fc0768-f0b9-4c75-a5db-b27c7356eccc", "comment": "Malware payload (Mirai)", "value": "5850ef76a1f777148acc99c66c827ccb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i686", "colour": "#720473", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655569774, "uuid": "07b803b2-b7f9-47cc-890b-9c5a1004205c", "comment": "Malware payload (Mirai)", "value": "ac92bf58e82162e613393f298a7dfcba555398bdad73e9b53c187f527cef9f08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i686", "colour": "#720473", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655569774, "uuid": "6e9cfc82-bb7f-4fb1-8df2-87133ac2586e", "comment": "Malware payload (Mirai)", "value": "8e3e8e590b4d8c543236931cd8c1e74a43529a68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i686", "colour": "#720473", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655569774, "uuid": "2ad4cf01-1e65-4e72-949a-4a739b47db0a", "comment": "Malware payload (Mirai)", "value": "564e8b97752f7baa958b80fe33d0ec30e4c26eece6a789860a4eec7ead8a9a50f5ce1019f08beab55d7f00b9d6da0337", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i686", "colour": "#720473", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655569774, "uuid": "42bfbb2d-c3e0-4aa8-a831-c8142971d555", "value": "T1A8E2F169F4908195D6AE2072697FEF4AC480F1BAE15474F712C0E019CAA136C6E183EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655569774, "uuid": "75d15902-1282-4169-bfcb-dee8c4bf3d15", "value": "768:o/laRQpKYlPbT4wVWJ/Ply6WbY5F36ADGSSUinbcuyD7UHQRjA:IlaYbAabYCADGLUinouy8HyM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655569774, "uuid": "21772225-2c32-4c43-8bd9-258c21d0512e", "value": 32384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655569774, "uuid": "c4f06636-ca5c-471e-8ada-b415949a5f3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655569774, "uuid": "05e37275-f38c-461a-91fb-8886510bebf7", "value": "irc.i686.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "296144eb-ef0d-11ec-93bb-42010a9c0043", "comment": "Malware payload (SilentBuilder)", "timestamp": 1655560034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655560034, "uuid": "f8725a96-b4cc-4e8b-8d33-9b5b6b538554", "comment": "Malware payload (SilentBuilder)", "value": "0b2cd2869b2709dd187ff985c4b5746a", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655560034, "uuid": "0d5823ca-244f-4ae3-a969-0a82df28bea3", "comment": "Malware payload (SilentBuilder)", "value": "adc2a206727188a15c26f5bc057262d7ab27087bb48356efaf9f017bb048f7e0", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655560034, "uuid": "f922d382-b5ec-4b78-a302-491c87c34667", "comment": "Malware payload (SilentBuilder)", "value": "fa32bbc6cdfbc7710586e5c095246e932ecb2c61", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655560034, "uuid": "2ffe66e0-db6c-4cd7-b096-577657da9ebe", "comment": "Malware payload (SilentBuilder)", "value": "440ce16a6af69940009506f5fd0127a631b725a732b75e45934f0938d81a8cfed4f3ce3d5dfdc4506d11d97e0991de4f", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655560034, "uuid": "7516d9e6-540f-48da-9863-e0ba72b93066", "value": "T1BB834A96B659CA9DF925873049D747AA6323FC308F6B07433264B3257FBD9A04B0721B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655560034, "uuid": "e68cb88c-e8de-4c68-9021-a37d8c6bc36b", "value": "1536:ROOKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgFQHuS4VcTO9/r7UYdEJeFK:RBKpb8rGYrMPe3q7Q0XV5xtezEsi8/dn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655560034, "uuid": "1eda88f5-902e-432b-b96b-ecc923c5ae0d", "value": 82432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655560034, "uuid": "6c2f90cf-9664-4e98-8936-ef117308d133", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655560034, "uuid": "60369d8b-11e8-4269-8244-3c2e58c815e4", "value": "DATOS-336182433531.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b914f1b-ef3d-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655580842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655580842, "uuid": "2b7b866a-b16e-4775-9b9d-af1818bc0a15", "comment": "Malware payload", "value": "aea361f0d7f02aa6ea684c21935bce86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655580842, "uuid": "c9abaf34-29c6-45dc-afea-4a8ae0ef4701", "comment": "Malware payload", "value": "b126be6efa4b157952b0cea0d39fbbaadd36e286d3a7e8da8505163a2146263d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655580842, "uuid": "233e570a-9cd6-4850-8873-23f0c4efb027", "comment": "Malware payload", "value": "7730d3037aca1b378c5a65cf8f968f041f2b957b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655580842, "uuid": "f1b675e0-cf21-4f86-a2c8-0a5376effcaf", "comment": "Malware payload", "value": "6dd2ddbbfd24f858a76d9959ab38a98a3c56fd8fb074b9bbdc5852b7d3372c61b449d421937fdad4b3aa93f4127905af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655580842, "uuid": "e355726b-ec19-4e9b-b94c-8132b9c966b2", "value": "T118F48E26F6D08437D1776A3C9C5BA7689839BE502D68244B3BE92C8C5F397C138392D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655580842, "uuid": "d5292cd9-e126-44a7-91cb-6ccb1addc4e3", "value": "18c95a531fa862490a3a99fbcb7080c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655580842, "uuid": "cea70091-3175-4875-b6c7-fe56bc301e49", "value": "12288:sX8qC9IBoS0Z/LNmwB1QpyLLQZtHFJxh11Gt1a+5nZxPR3tgvtit:sMqCLS4moUckzHLmt08TROFW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655580842, "uuid": "f2b02404-8e66-4b1d-a09f-aba892574eaf", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655580842, "uuid": "78bf13b4-c82d-4edd-9507-4e8b205fd780", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655580842, "uuid": "f3eebd0f-d1f0-429f-a703-a3609d33c21e", "value": "learn4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eb5df3e-ef01-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1655555050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655555050, "uuid": "5e0f2c75-aa36-49a2-9dfe-1e91bbf930e8", "comment": "Malware payload (RedLineStealer)", "value": "b66120daff64ce2d70e7fd58d9ae5aa6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655555050, "uuid": "25b0918f-3a7f-434f-b488-1ee566a9b354", "comment": "Malware payload (RedLineStealer)", "value": "b1cf5d3af837306cb1a6833fa1597ff66e31f64669dfbfaba30e6e02475d40aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655555050, "uuid": "05836f13-57b2-4771-bddf-368bb2b21e25", "comment": "Malware payload (RedLineStealer)", "value": "f8b514ad35a64b78d5fdf800aaae4a6779a5c559", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655555050, "uuid": "f7cd1161-e1d2-4065-a439-3c4af1f1aaf6", "comment": "Malware payload (RedLineStealer)", "value": "33238d64567258b8356c7ac7aca3d7b07811bc9e1234b5028d98f39c0a7fc5e1891b771afb95283e0313ebec7c940eb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655555050, "uuid": "4d090e33-d5e9-4ee1-a5af-1c83700f71da", "value": "T12F56333A13D8ED9DD7C4A3FA90033BA18AB1BA403943EFA5115CBBE50A347943D5952F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655555050, "uuid": "cc49014c-2480-4bdb-bc3e-e1f5ec48ca10", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655555050, "uuid": "19e437d4-2008-409f-8ada-8275a45503c4", "value": "98304:r/+2urxzC8XgIaBPQTRkc129SuMzV/mDoSDM+vDlo5ZLMIKde6MIQW7gEi0Vgglc:r/d6QzBYTh129SuM/mUSDTv+M3eXWi0K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655555050, "uuid": "3c8734e9-a145-4fe4-885a-4cda269ca401", "value": 6286848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655555050, "uuid": "d7624f89-71eb-4fbb-8d94-8daebec1a4f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655555050, "uuid": "9aa0e066-0a85-4fd2-9169-2c0bde5662e0", "value": "egor.vmp.exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5efe2c13-eee6-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655543374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655543374, "uuid": "60f3f1dc-700a-4975-b5ef-164c3fb197f8", "comment": "Malware payload", "value": "9c7f574ad4c0e4a394f57d3d50227a58", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655543374, "uuid": "bee51118-4ad1-4b2f-852e-1e1886142295", "comment": "Malware payload", "value": "b242c3eca68edc7c09505570455398cce9b02689287690971762899d1fb2b1a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655543374, "uuid": "bb6c43c7-9e36-45c8-a6d1-647e987de2d9", "comment": "Malware payload", "value": "d148b8051c438d792d2604c6aa69002743503197", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655543374, "uuid": "cb9efdbb-7707-4bfc-847a-108518da4431", "comment": "Malware payload", "value": "f6dcecc67986bf40ce829263247e5873ae17618b7767d426c3c2141f71a07a34194d533f06db456a7217092d35872102", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655543374, "uuid": "3c05f0b6-3033-4c7b-891c-453a2cd7244f", "value": "T1B7D47D06F243EAF7C4970570124BF7BF4230E6318412DF8AB6889D5AB9379F52A4E356", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655543374, "uuid": "4a04d1b9-cc6a-4744-bcb2-b05c7fadf132", "value": "12288:FBXOvdwV1/n/dQFhWlH/c1dHo4h9L+zNZrryT6yF8EEP4UlUuTh1AG:FBXmkN/+Fhu/Qo4h9L+zNNyBVEBl/91h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655543374, "uuid": "74080608-1966-42ba-907c-71c81f869ab9", "value": 625867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655543374, "uuid": "b4c6a6c3-2dae-4ac2-aaaa-3422fb627dfb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655543374, "uuid": "314775a0-5297-4bad-bdd2-9864b7f38c5d", "value": "23.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ba1a998-eefa-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655551905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655551905, "uuid": "34469a02-42ea-4d6d-a21c-070cd8211af6", "comment": "Malware payload (Mirai)", "value": "f38ff679997e14d934e21d36b68bdcdc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655551905, "uuid": "1fbfb745-32b4-4a41-8517-8d987d92f3d0", "comment": "Malware payload (Mirai)", "value": "b25b1f35600488d035200585ff80cab884ff338da37974f90860afea871d6a9a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655551905, "uuid": "e10b69ed-bd4e-4ede-aa0b-6e287bff509f", "comment": "Malware payload (Mirai)", "value": "efd2935d73fcb128f8967367eb0bc5dfd54ba811", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655551905, "uuid": "580ed292-4576-4b1c-9450-94424b3d5b2a", "comment": "Malware payload (Mirai)", "value": "98993629018ffc6c7a18e8bb96489d68076281b287ebdd89ddca7bd2d020c26f694b5ae9effb73c8bf9b29c3bde0ef54", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655551905, "uuid": "70e968d6-b6a5-4734-9c4c-66ad78fc06df", "value": "T13F6329EAF800ED7DFC0EE77A8457060EB130B26546A30F3673A7BD57AD321A45926E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655551905, "uuid": "62328752-ddf2-4033-a87d-84289fb990e2", "value": "1536:JTYU5wYWa+KwL8jCq1FYob6qcBj31JfF2DEy:JnwYNNwlfoOqQVaEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655551905, "uuid": "64bd78ec-98b4-40a7-8f17-55901079ebc1", "value": 68120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655551905, "uuid": "2f78c32e-2734-4259-bd3d-9e6335db67c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655551905, "uuid": "67df5965-4582-40bb-9552-630eb236420e", "value": "ZG9zm68k.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49dd4f6e-eefa-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655551929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655551929, "uuid": "d2ed7881-0b47-4363-a3b4-22529b17d1f1", "comment": "Malware payload (Mirai)", "value": "c1b57ac5f4841c18a4fe1141f47f574f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655551929, "uuid": "c9981c01-e8c6-4ead-8467-6e29028d26a4", "comment": "Malware payload (Mirai)", "value": "b30ce2559b087c4626af055d6bd7e8b025e2b4d199dca9125b53171f3fedef72", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655551929, "uuid": "1c3330d0-cb20-4559-9056-4906b4873b2c", "comment": "Malware payload (Mirai)", "value": "92157b8c0bd004c7f5aa584564b8d71332ea18d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655551929, "uuid": "1e75bdc6-7a7b-4620-8bcc-eef34d792916", "comment": "Malware payload (Mirai)", "value": "13e231b8fbedefd323212d22354615059631b7d0092aab4ec83986916830c412022f38e7adb4eaf26829e59481629efd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655551929, "uuid": "6d2f033c-5db4-44a5-8fb3-d3487d2e7b22", "value": "T1B9339DA2D8355C48E19882F4B82C8BB41773E501DA872FFA556AC27A5003EDCF7193F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655551929, "uuid": "8a148480-05b8-4351-8d64-6e8353c4367b", "value": "768:pasWRPWegSfOK3lzKCWyj2CWwXKG4oNaGoZjmhkUCO71Z5fJRuH1R1hI:pasW0wHsoKG4ogZZYkUCO3RuVl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655551929, "uuid": "690b21a2-ee73-4df4-92e3-67309a8c392a", "value": 54768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655551929, "uuid": "83359359-a76b-49e9-a542-e172ace9e360", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655551929, "uuid": "d7c1122a-3ad4-4e8e-a98e-ca96ea1964ea", "value": "ZG9zsh4.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7de04f42-ef54-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655590670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655590670, "uuid": "fb3b0b64-cfcd-4b1f-9573-01603d247a91", "comment": "Malware payload", "value": "d1e775ada53452f2b57aa8d923a7052c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655590670, "uuid": "69b0f14d-81f3-4d3c-ba40-bb8c3c9f0d87", "comment": "Malware payload", "value": "b3d7318934eff89f2847b40ff8a0cabc47510bf9fffe21b3c64e59a9ebcc8faa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655590670, "uuid": "d731f7d7-b42c-4648-bd89-09c1357aad11", "comment": "Malware payload", "value": "00c847523823f31d128a6fcfbc26f8ea8e2d4f24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655590670, "uuid": "e2c1a1de-a4c9-4afc-93ee-566c5d9f6c79", "comment": "Malware payload", "value": "1cb94afb5466b4e16df74389089fb12ae7e6038e8f37e85ff49ead0c29c5208c9ab1c56751a17b77a53d295df15ca2b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655590670, "uuid": "2851db55-0cd5-4603-8cc7-d5b05f700c89", "value": "T165A4F0003AAC7911C98BCF744092C154513A9D8FBD33F12B5BA77C8FAD75B815BA2A39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655590670, "uuid": "dbc947f4-fad6-4f98-97cf-075ca2634135", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655590670, "uuid": "3b8b8701-ab8e-4aed-ba4c-2fa23a0f0141", "value": "12288:pSdqQswMpfq13CRksrcJvtqsSxIss0p7HTm:pKWT013CBrcJlSesXW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655590670, "uuid": "2a370fb2-b01b-4bf9-9f49-42a3b4278218", "value": 455168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655590670, "uuid": "8755d678-b9d3-4f17-8512-ec7ddbc8314b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655590670, "uuid": "5a4cd879-030e-4b11-8c84-e860fe215356", "value": "NEW PO 801779622.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94269e19-eefe-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655553771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655553771, "uuid": "2fa60a97-1979-416e-a68f-963acadecf1d", "comment": "Malware payload", "value": "9e93e8c234ef9070def43daf14d228f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655553771, "uuid": "dc1a35c2-4d7c-4084-894e-6c1a0069d0b3", "comment": "Malware payload", "value": "b5ba7df01c20405a4b37c285e4734cf13cb30b464458e3dc8067f72a0f1a1cef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655553771, "uuid": "974887e6-14bd-47c9-955f-f1f08454474f", "comment": "Malware payload", "value": "5549beafe22f190965051f332627fe3944e50035", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655553771, "uuid": "3b5c9757-eeff-4049-a488-d61c7d5209c8", "comment": "Malware payload", "value": "b74959fb7823ed4f2ef7791f1f6bea8fec8f8bdd96401a2d2cae068af4f7ce53b2c5e55bddea7f80cf21c3a95923be7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655553771, "uuid": "7989ca89-718c-42a2-a89d-1853c451fc77", "value": "T1E7863301BD90E8F3D4B229379975E774ADB9B9903E70DA9A63E01E2CCCB15C08125F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655553771, "uuid": "4483278f-d017-4cef-9305-31213588f777", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655553771, "uuid": "9221fcb0-2f70-460c-b5a2-bd945cf9b78f", "value": "98304:fPedcvdQ/4mRMHMVtgi0UZ1PYlYpe81XNHpHh91iPiU737fG/YO5cGifyf4G2hQO:urAmRIi5+lENp2OrcGig4ph8n29", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655553771, "uuid": "e751db68-65df-4f96-98ca-2ced47b377ec", "value": 7950227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655553771, "uuid": "1cb69f19-f763-4323-90ba-fec812fe763f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655553771, "uuid": "b34ec032-8562-4c58-a147-0a3cce5b7f27", "value": "lgs.exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09d6c45b-ef4e-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655587899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655587899, "uuid": "11f9a1c3-7fb0-4632-a3cc-955c3588aa4d", "comment": "Malware payload", "value": "7cbd24cbfd5374f210ed79da6e521962", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655587899, "uuid": "9798d58e-846d-4917-bbd3-ac0c1b134bb6", "comment": "Malware payload", "value": "b655ea545bbe069d52ba40aeaec2b4908f62a4d2061ca7c7c955c5f049bd4074", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655587899, "uuid": "70c9abd6-db1c-4050-85bb-b5068b7ef4a2", "comment": "Malware payload", "value": "6c64092bb1b9fdab42f0878464eef8d4cd28a27c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655587899, "uuid": "d32ca8a1-684a-4d90-b2ef-a6ec8b9532ae", "comment": "Malware payload", "value": "16a04604addf255701d1894b7e9ed2e288d2deb104ff296930c903c2da7da9af759dc5f5959d20121f1f383cb888f450", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655587899, "uuid": "1d3ab462-856a-4bad-9d41-6b467b706edf", "value": "T19D0412B6DB37F8D5C71A46B04B28BC51E34342485AF094395E3E8E4FF8FB29501B92A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655587899, "uuid": "79cd2e72-1b5d-41ff-90d6-4638d45586cb", "value": "53a11f55a123a6bba16902988fa07374", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655587899, "uuid": "910f1893-8f91-4ae8-93f8-cf89684b06fa", "value": "3072:0NNwq4g3pvWqYupnkBRYeNksOqR0NS4tCpI3TlwY9vJuHQ6:0sq4gZezQnaRYwymwS4EpI3Zl9vJuHQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655587899, "uuid": "9543cfd0-6785-4fb2-ba97-766396602f4c", "value": 176640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655587899, "uuid": "54b28275-b546-4e25-ac49-c148fb107b42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655587899, "uuid": "e8d54082-15a5-4502-9b58-fcb6c611bc0e", "value": "SecuriteInfo.com.Trojan.Packed2.42880.25221.21595", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e11838c2-ef25-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655570651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570651, "uuid": "3e00e4b1-3422-45e0-bc5c-407c1e202d1c", "comment": "Malware payload", "value": "437dbad817d764c5bee71fa146d8ee71", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570651, "uuid": "6726a4e2-2c69-49d1-998e-2843c83dfcb0", "comment": "Malware payload", "value": "b7634f77d6ef2b22966ba4033ca710f543356a21d30191fb056fa66834b753ac", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570651, "uuid": "e037a39a-85a1-4105-a11e-01b79834dcb9", "comment": "Malware payload", "value": "3ecec36d23368b96dd972cb83088996bb1628816", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570651, "uuid": "dced735e-1b0f-4a68-bf40-4e0c7335bb48", "comment": "Malware payload", "value": "13f79b76265d3cac76565214b3024d3c15a224a7cba33d770c474f4391548ed87043a45e8eae505a932eb3a739fb3e04", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570651, "uuid": "4a330052-ecba-478a-bf34-37f46ced9726", "value": "T1F2326B34C61A0024D15EEEFA14CB41EBE8B5389A52217913E83931DD1D83E9B4F0BFB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570651, "uuid": "f05dc38f-b866-4e9c-b274-025a32d0260b", "value": "192:yKovi08qCounxREfOlxMaoeXQCtvAHHHHHBFO27A08mzMi1uuLLe+l1Dk3/:/K7CouxCGl1FSHHHHHBFO6A/Ri1uuLPo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655570651, "uuid": "b0991b0f-c270-4c28-8aaf-b43872af851a", "value": 11014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655570651, "uuid": "3e62b7de-8cb9-4de8-83d3-3e35b7949863", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570651, "uuid": "3f93188e-0b3e-4332-abda-40c13f3a014b", "value": "xaa.doc.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa3b8586-ef1e-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655567552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567552, "uuid": "77250563-1513-4824-b16d-136152fdb91f", "comment": "Malware payload", "value": "60bf40844a308d2b549a3e620e2081d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567552, "uuid": "da2bd5fe-d552-4729-8588-a0a1f3432be5", "comment": "Malware payload", "value": "b7c20f1bee9b9032845dbca09265005bd0e5634a0603ab479104e8e36e3bcbce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567552, "uuid": "81cfd327-028e-49c8-9248-abeebe71d152", "comment": "Malware payload", "value": "372425d657cff51ec0db5a14c90b0f418b078f46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567552, "uuid": "d637da01-108c-415b-aefd-16eb1fff6fce", "comment": "Malware payload", "value": "0edddb920d0c9d2c60c587efce900a3d2d8f4892b5f15714b88b7190a54d780d9b714b3f0667f7d46e21160bca67b1b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567552, "uuid": "354730b3-49a2-4a98-a4fd-eb8d18fd337e", "value": "T1D7F22B10AAA94132C4718B30AB7266015B73F29768979B9E35BC500A2F3FD47C2737E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567552, "uuid": "a2ff256d-3d3e-45ec-8d50-bc7473510cb8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567552, "uuid": "203ba5aa-af0e-444d-86c1-ccd2964dc575", "value": "768:ehbpxpdAac3SKoE/XhIu5r+GSsBYc3qeUQetYcFwVc6K:ehbpESKoO+WQeUQiwVcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655567552, "uuid": "dbec6d6c-7221-43fe-9b14-1542d8b86ff5", "value": 35328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655567552, "uuid": "bb9ebd30-e861-4aa3-8871-f3ab7971ecc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567552, "uuid": "3f10a1b2-8afc-4248-9b95-45506187af85", "value": "Evox.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7fd22bf-eee1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655541456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541456, "uuid": "28961a2a-6fe0-4ed6-a330-d75fc523fd04", "comment": "Malware payload (Mirai)", "value": "fe6efd3c9aefcca2fbb7b0def8c6a89b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541456, "uuid": "4f85972d-4a8c-4cc3-b05b-ac84da82f5dd", "comment": "Malware payload (Mirai)", "value": "b89029042f98b56bd327d87c82707a60c14cde3f03551952efeb87796e5c287c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541456, "uuid": "5649c707-6771-4e5b-843a-0cd70716885d", "comment": "Malware payload (Mirai)", "value": "bc4e34f1290c136f8b7a4f67fec2e3fa531e5ac9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541456, "uuid": "abeccba8-0b48-42e6-9626-c88dbf8456a4", "comment": "Malware payload (Mirai)", "value": "5e2c6d7855bc05b83d5fef92ed7cc63b712302895ee414acbe33a3b4508cbb3d8dff79829b054b6423e2e7ac1f32f83a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541456, "uuid": "82523203-af93-4ce4-b113-b4a2699abca2", "value": "T1A1E3A51AB7619FB3D81ECE3706AA4601108DE55A02ED6F6FB6B4C51CE78B84F08E3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541456, "uuid": "9c612482-a7d9-4610-ba24-02821f29e733", "value": "3072:C2ttgUm6Oq+lozQ5hdCNzhsURxuZq+1uPNd5R:C2ttgxq++zQ5hdC8URxuZq+1uPNd5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655541456, "uuid": "e50a4021-510d-417b-830d-db13e1094fd1", "value": 154480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655541456, "uuid": "277d7f4c-3e2e-4fba-8ae6-1e9edf73eb85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541456, "uuid": "c2b3fc5a-c979-444e-bb33-b9137a8e7d95", "value": "fe6efd3c9aefcca2fbb7b0def8c6a89b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c3d6025-eed5-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655536014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536014, "uuid": "cdcadcb0-d0b6-466b-8b99-8a5fb9ec42cc", "comment": "Malware payload", "value": "d4d951f703ac679f90142638d115d095", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536014, "uuid": "5621a543-e22e-44ee-a5ec-f0160431da67", "comment": "Malware payload", "value": "b8a7878a993d7bede41b2563ab4548851c29734870903e80b873120d0dd2c677", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536014, "uuid": "2d358985-aa02-4107-a2e2-bb257d3d4872", "comment": "Malware payload", "value": "dd875fe927ad1e7d30257bde8069c64ef5802ed4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536014, "uuid": "e850d149-58dd-4886-88ef-2abb8fe94be7", "comment": "Malware payload", "value": "48bf54ca7d25915b3adbf8789398fa88bab6946baa1c09254781939b93388264745f9d2ec5ab3b21d82d6a669a249853", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655536014, "uuid": "c34c287c-53ea-4008-80ff-280a032f2ce7", "value": "T1DB7438EC7620B6DFC95BC973CAA81C64AA60747B570BE203A45316EDD90C99BDF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655536014, "uuid": "33153ad0-3d78-48a3-8967-81f03af57153", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655536014, "uuid": "7e0c586e-3a93-4b2c-a174-1fe76718fd90", "value": "6144:jkad8qJgMlytYMaUfB5MYF2f6F4GZB2TOUHqVbSPe2/LqIdWeBPnqH4slzqPRfXV:jld8qJ0OMa+B5OyF4wB2TOYtPecLqLqN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655536014, "uuid": "99ecc252-5838-4a54-a392-cc3117ff384a", "value": 347136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655536014, "uuid": "4318e691-42e0-49b3-8949-ab63957dedc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655536014, "uuid": "68fed67d-2129-42bc-bd9d-88188eb99188", "value": "d4d951f703ac679f90142638d115d095.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3b4d7e7-ef28-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655571917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655571917, "uuid": "10f40eb9-eabf-4b1b-9791-3fc522f07bc7", "comment": "Malware payload", "value": "9bd92ce7c18ba22444bb7ec376998338", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655571917, "uuid": "999e7da4-ed0e-49c4-8c44-c3100929037e", "comment": "Malware payload", "value": "ba023c19b82ebeac40b2302a3d0e1b5894228be474c97963343715f805d81853", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655571917, "uuid": "2aee1a5e-f946-424c-9b87-a88a736870a1", "comment": "Malware payload", "value": "cbe2b143142de9d6f9b572cac538fec83bfe8578", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655571917, "uuid": "c43f5eeb-2a21-4ea5-9f83-df77ab023c0c", "comment": "Malware payload", "value": "0719912872df7e02b4b6d8651869ba3c31c99536434458c3cf2342bec5e32947688f7f5c89f0ba6910d534b570724ac1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655571917, "uuid": "4f12b360-b0f7-4e30-9ad2-64ad849cf765", "value": "T1650302D12D41A657CD9310BDE9AC854AD42CC2672DFC2E36FA7C328741FA25C2557833", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655571917, "uuid": "0507d6ce-d9e1-403f-940a-b975b85bfd3c", "value": "768:9qVRqzZT0vQOf7dSasbsRvwyhqDlDBYBTXRpk2QpRETfwjcTBmDJqI1ofywJ:8V6l0FfBSajU5IRpCpRItTA4lfyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655571917, "uuid": "402dbaa1-6b2c-40b1-b3fc-59c11d7cd055", "value": 38917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655571917, "uuid": "a86942bf-c286-40d8-897e-cbf22d4fb4bf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655571917, "uuid": "e3677f6d-4a96-417b-b98d-606a97f9ef1d", "value": "7589076125.zip.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0878f3e-ef1f-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655567965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567965, "uuid": "2f23aed8-266b-409e-b0ba-89dcd7d977a7", "comment": "Malware payload", "value": "9cccafb92315f78e88bb761d45cdebb9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567965, "uuid": "5a28e91c-ebe5-44bc-ac73-5adee42edd69", "comment": "Malware payload", "value": "ba62d362bd0ab32a16d2934b64640d50bd882e80271dcb12d611bdae5040a97d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567965, "uuid": "f14cd3cb-fb76-4a14-bc10-9e59935def0b", "comment": "Malware payload", "value": "11e1cc9d077a6cad2549e81a509c7be502df3b0f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567965, "uuid": "a90c8108-a60f-4283-929b-5f82821432e5", "comment": "Malware payload", "value": "67e8c288802ee7f578b0ff8e4f886e8feae424d321d30ba1ec03bc0ac3f195cfd613b49909243129780b862e0b23b91a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567965, "uuid": "9cba7801-dab2-4789-9d79-56617f32528e", "value": "T1CA237E27E14280FCCEB9C1715AAEB239E537B43D0366B1C86BD4ED227E5AD111F2E580", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567965, "uuid": "d6e93844-9e83-4c07-8414-d0914058a0a2", "value": "768:Z82vAFQdbEVDa2okSxdzaAlpzX6eS5S+Wo3Zuk9gL3kxIOee:WbQdAVDa2opTaAl1dS5S+d9gLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655567965, "uuid": "e31717e7-2d2b-48fe-937d-9b202764cabb", "value": 47944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655567965, "uuid": "4fdf8092-23a7-4471-ba83-afeb8a76d7fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567965, "uuid": "63678a37-8576-4830-85e1-184c4ac9c57b", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "820fa3c0-ef1f-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655567914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567914, "uuid": "f081a2db-3d70-45ad-bce3-5dfa67174dd1", "comment": "Malware payload", "value": "ec106063c01ead187f603e0abf2bdeea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567914, "uuid": "f91da089-38db-4102-8e0a-52c1acf376cf", "comment": "Malware payload", "value": "baf68a25bb482d0e503ec0740257107f573c5034615009863ae7f7b05cc9888d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567914, "uuid": "2c0942ba-68d2-407b-bf2e-c6f172db35d6", "comment": "Malware payload", "value": "bd61e207d59adbef6ea315f8e94fbaf67d643e34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567914, "uuid": "32356182-811b-40c0-b2b1-6795931984ab", "comment": "Malware payload", "value": "9775319ac1bb57b81dd58281ce6292b6491d2976258be061bafed4981ec7b91bc3c0b2298360d036a7d7dcad369bea52", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567914, "uuid": "e5559f0f-6784-49d8-aeb8-db07926ad4d3", "value": "T12B135C37B40390FCC9EED6B1165AB2359533703E02567159F7D8ED259EEAC221F2EA80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567914, "uuid": "e89acb5a-a6d9-43dc-a3f5-48ef993c23a5", "value": "768:kYmm4SrCQKRrVk2VWrCXrTQLMid7A/b33Pkes3kOI91Cds4BmD:Ve/RrVh+CXrkd7A/gzr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655567914, "uuid": "8419e553-4178-4696-8970-f5f055de8d29", "value": 45320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655567914, "uuid": "c6e1fe9b-91a6-43f5-b157-b68f34e530a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567914, "uuid": "3f6cfd05-bd34-41d2-8be4-57cab4ed1b5d", "value": "s.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f43ad614-ee9e-11ec-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1655512701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655512701, "uuid": "c07131bc-b9ac-4499-97d8-f75b6b39f6dc", "comment": "Malware payload (njrat)", "value": "7c4de9b785ee176c88795a3f927d00cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655512701, "uuid": "2afe372f-976d-4769-9269-8ec27a1dd2f5", "comment": "Malware payload (njrat)", "value": "bca921880652f332d0cd1ad37c88af2dbb85b78e98b671ea8587f9cc678df01f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655512701, "uuid": "a4a4c124-08b0-4eb1-9b3e-6c2ac9068c65", "comment": "Malware payload (njrat)", "value": "6b02003126055c6f59a9fa743c09ef6bdfed319f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655512701, "uuid": "e890f97f-3489-435c-a3df-55f2eaca9f2d", "comment": "Malware payload (njrat)", "value": "86315107df8d1e733054266a64f23848aac14a245a3a93d42c6bc8a9f80c1a355f913c8338cf75ba0e5f9c9d11dd750c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655512701, "uuid": "f45deda4-e3bd-4473-b00e-5130ff32a2c1", "value": "T17A13E88CB794E174D5FF8BF0B492B2890B719017A906D30F99F154D98BB3AC09611EEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655512701, "uuid": "a119558f-8fc2-4385-a1f7-cffffb264464", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655512701, "uuid": "920cf60c-5b3e-4c79-ad86-24fb2030fc9f", "value": "384:DZyqHwYz/wpa9GP4Uy2FBygE+Ms5wVh+rl9D9O5UE5QzwBlpJNakkjh/TzF7pWnT:tzwKR4gh2vyFGwgwvQO+9O+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655512701, "uuid": "e59d90a2-8f89-4dec-9d11-7c1f4eccafc5", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655512701, "uuid": "ab80c749-1dfe-4c57-9da2-fa13c6f12787", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655512701, "uuid": "cf8b0196-d963-4875-b624-df6a2c8342fe", "value": "7c4de9b785ee176c88795a3f927d00cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6429795f-eebf-11ec-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1655526632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655526632, "uuid": "87c83e47-0106-4abf-8b69-1294e67c3af8", "comment": "Malware payload (RemcosRAT)", "value": "efeba7f2ad9e480a350a233d56cc73da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655526632, "uuid": "a2778733-19e2-4c23-b967-9b2a7582d55b", "comment": "Malware payload (RemcosRAT)", "value": "bcd6760cbe3e60cf46b59fc77125f99ee08f37e39cf5fd13cd6bc3ed3c19bf05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655526632, "uuid": "c5185efc-cedc-4656-8e67-b4e530268283", "comment": "Malware payload (RemcosRAT)", "value": "36427b6e74430e2b04a68b2c17e4781b97d904e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655526632, "uuid": "e5355f0a-cea6-40cd-9658-946d7a8d0c52", "comment": "Malware payload (RemcosRAT)", "value": "311c896868c80151067a1e5d6041bd7e03416561e0d000d53d3ca4662f2d10931aea850e841be943c9b2a15671e283fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655526632, "uuid": "85fa91d6-62af-4aa7-b964-fd55aa367a40", "value": "T14125F11262F08F15D9BD0BF905A9021C17F4266A6166E3BEECD060DB5EF1B424A2F74F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655526632, "uuid": "6384d666-9af1-4748-9e04-5e3427a5ea35", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655526632, "uuid": "c1bcf6e3-9c4c-4325-bf15-daeedc36101c", "value": "24576:LI+OP9NTI4yUOGHCVxQK1JOuxHZVozLwx8FLFoPQ:LI+OP9NTI4yUOpkK1JOuOzZLFoP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655526632, "uuid": "87e26c1a-8ab7-4aa0-801d-ce5154f266a9", "value": 984064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655526632, "uuid": "3d8c1b8f-e7ce-4e2f-9753-456a7e5ac5c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655526632, "uuid": "8963ba28-aa8c-4416-8bf9-07a07e097605", "value": "SecuriteInfo.com.W32.AIDetectNet.01.15177.14552", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42f42b10-ef1f-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655567808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567808, "uuid": "81cffb5c-ac49-478e-a301-c96b06b2338f", "comment": "Malware payload", "value": "9888807a8140d109d278152dfecf6c56", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567808, "uuid": "d41a9c7e-e59c-42ec-ad7f-92da1b635e2e", "comment": "Malware payload", "value": "be76c7d796f52f21353455aca9a098e863de56819fc5437da70bb35e3fe88b78", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567808, "uuid": "2e15bafd-8850-49fd-baa5-b1a0fe1aa206", "comment": "Malware payload", "value": "766932991f1bd334762ade03c8025508fc60914a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567808, "uuid": "23233233-f369-4939-8e77-c7da9959ec3c", "comment": "Malware payload", "value": "f557a1c59b72cd81e7d0e2181ea22d2ff93a20d1bd1833d7c84362a67683c4e75fedc51a56a1f045ddb09555f304b0cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567808, "uuid": "7d1eb5cd-91e1-487a-9487-8bff7ce6a6de", "value": "T108232A42F9419A03D6C10677FB1F428C7B2B4369D2EE3203AE295F6177939570A3B591", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567808, "uuid": "3bfd5e19-a021-4815-a1f1-b84b0427ad24", "value": "768:meAuil6E59/vCilPMmm+rItg76MXBVnlXpvqX0xI:mN6E3SLmmI36MxfXpvq4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655567808, "uuid": "fe32db24-154b-4e2d-b239-fa6ec1b7907e", "value": 47676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655567808, "uuid": "4cfe1c9f-830f-418f-a952-ff485b86d3d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567808, "uuid": "32b45132-a1c2-4849-8895-c249dea83a95", "value": "s.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eebacd4b-ef1c-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655566808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655566808, "uuid": "665de810-b388-4e6b-8595-cb8a720bcefb", "comment": "Malware payload", "value": "e37bc209fdb0f6c576b81f727980c953", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655566808, "uuid": "666b929f-8432-4cc2-810e-45caf4f94049", "comment": "Malware payload", "value": "be7775668330b2e04c5d81bd12b4a0911c61e55ec1b1cbb15d05cc1a9d821c12", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655566808, "uuid": "1c01577c-689c-4e4c-bea6-9fe177e3ac03", "comment": "Malware payload", "value": "4f13faf5823e1b3ca66c4b4cdafba2b1ed10964c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655566808, "uuid": "82f1fd48-767e-4412-bde6-fb8d9fd5ee4a", "comment": "Malware payload", "value": "10639f1fdf0a7f8469e4c2c825babe57416104252d56a3c0cf8849815da4d5bb6f5453956db4cdee21224cf127242c58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655566808, "uuid": "a99ee606-d134-4a73-a39b-5d4f9df893fd", "value": "T1B6D2E261A18B64B2C4684CB27CEC8A47600E1AB9D1FE317DCBD882B6678215673FD1D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655566808, "uuid": "21bd53af-0190-48c0-b962-064ceb12975f", "value": "768:hci2ti4KSWpk/wEwynJ6rxBIajaMY1Ms3UozC:2JLKcohSJKBPjanfzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655566808, "uuid": "31045e72-7ba7-467d-9ae2-ed4df1a3aa34", "value": 29588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655566808, "uuid": "4ba8fffa-fb28-4cfa-ae27-ec3b916002da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655566808, "uuid": "37a40f01-c034-4348-8a5c-7a5703efa2d4", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6595e1c-eee1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655541400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541400, "uuid": "f18b03c4-bfac-480f-9e67-33eb59df3ec3", "comment": "Malware payload (Mirai)", "value": "a2cf946e0a9ac0fbf970cc494bf70ea2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541400, "uuid": "022bb367-669c-430a-9d04-8767804198af", "comment": "Malware payload (Mirai)", "value": "c0108296886a1026fe1f7f3683195e1bf76044ce3d66bfed3608221b3133e22e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541400, "uuid": "40aeaf64-c452-40b1-8213-4668952694d9", "comment": "Malware payload (Mirai)", "value": "c237271d604e8dcbf7dd761c83ebabdf1afe5820", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541400, "uuid": "94371110-f34c-43f0-9a04-0d9bdf727f21", "comment": "Malware payload (Mirai)", "value": "b52d6f0a0223281871d7cff5e7063e409559b2dbfd18a9e92833ff2e35f2ed624135330fa164dfb55bb0c4b1cb5a7940", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541400, "uuid": "c77d33df-7393-4937-a28f-0f352fecdd92", "value": "T16EB33A57671C0B43C58B5AF12C7B37F187ADEA7112E225C5A40EBFC01B72A701626FA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541400, "uuid": "1aa9bbd1-1f44-41be-b8fc-b2054cb34e51", "value": "3072:JHXrsU7PNZMHNrONBbsQM5hkqu4CK2QnI0PDG4gQNcR:J3LTMHNrOwQM5hkqH2QnI0PDG4gQNcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655541400, "uuid": "ec9bd755-d162-44e6-9cc4-9e3985049019", "value": 116369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655541400, "uuid": "ff979e6b-9ebf-410b-89d4-28a61c0dde31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541400, "uuid": "7edf7c6f-51c7-4394-8211-bc19c6285cb7", "value": "a2cf946e0a9ac0fbf970cc494bf70ea2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d34ba2d-eecb-11ec-93bb-42010a9c0043", "comment": "Malware payload (AllcomeClipper)", "timestamp": 1655531721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655531721, "uuid": "4a1f6295-c5d5-416d-942f-7672094a8ea5", "comment": "Malware payload (AllcomeClipper)", "value": "c5f7337c0ca765f66e5a554b9577a24d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AllcomeClipper", "colour": "#A2067C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655531721, "uuid": "0e44a7a8-28f5-4144-a8bb-507c2f9ec869", "comment": "Malware payload (AllcomeClipper)", "value": "c0668d2148121454c7f365718da7553410448818b57909b0873c3889d703bac0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AllcomeClipper", "colour": "#A2067C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655531721, "uuid": "dabbefab-11c0-4026-978a-958f1a66a000", "comment": "Malware payload (AllcomeClipper)", "value": "e4870e9a620fc758b8a3fb7bc467e896a96af331", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AllcomeClipper", "colour": "#A2067C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655531721, "uuid": "b397c8b4-8213-445b-a32e-5e18715be7ee", "comment": "Malware payload (AllcomeClipper)", "value": "7c1113243038d634ac8d5b50fdc3e4ea9533c913615427d7a557a8507b9ee3b6a6bb5998a1e7fe640ebd42342b734478", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AllcomeClipper", "colour": "#A2067C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655531721, "uuid": "5dda207f-6c61-4552-a79e-574058965285", "value": "T137C37D1075D0C872E572193148A4EAF19E3DF9750F646EEBB3C8067A1F342C19A26DBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655531721, "uuid": "24ee95b1-8657-4375-be16-8355bbcb139a", "value": "ed5e7a68bd9d3fcbe4fc8ca66473351b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655531721, "uuid": "51d3cfa5-c153-4084-9496-ed13799d62e8", "value": "3072:DR3SeEc7YUAcHW3RBzJ9wUZBva7oRrAD3eYQLei8aGjfNansxfu:D1mc7ucHWBBUUy7o/YjfEwfu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655531721, "uuid": "6fb76554-f9ae-4e20-8058-62e3b709cdb5", "value": 125952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655531721, "uuid": "f8ed2247-5fee-4856-8582-913bf5623719", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655531721, "uuid": "9e67eb5b-429b-4bbe-9370-16b76ace5b0f", "value": "c5f7337c0ca765f66e5a554b9577a24d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3caf1f66-eecc-11ec-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1655532150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655532150, "uuid": "fb84993e-8738-4b73-9f91-a8d70317e598", "comment": "Malware payload (RemcosRAT)", "value": "1b0fcb758db13bbc5233239bae1de2b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655532150, "uuid": "d4caeff6-8475-4626-8a27-72909dc54633", "comment": "Malware payload (RemcosRAT)", "value": "c08098b520974157b4304ad0abbeb09b0956fd229533cf7f5921cee92137229a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655532150, "uuid": "06ce30f2-aac4-4a11-afee-981fe0f75ca2", "comment": "Malware payload (RemcosRAT)", "value": "43ad91af0cc46edd58945370a6cb9d0e58d1df97", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655532150, "uuid": "592042bb-dcaa-4829-9469-864565fe7277", "comment": "Malware payload (RemcosRAT)", "value": "ba1e137065d90b38b55886717df445e91a546db3df02f144a9b2609f5a28627e08101db7220a49afae3451217a47c5ab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655532150, "uuid": "e4b9b7a1-1457-43a3-9c6c-9c2e862ff906", "value": "T1AEA4BE11BAD2C072D97251340D29EB35DEBCBD202935857BB3E61D5BFE30180A72A6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655532150, "uuid": "95fd819c-53a6-4cec-8def-bed8ffd2c47e", "value": "029a987f21e33b48f24d21b6f9ff1129", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655532150, "uuid": "417e23af-4496-4001-9f58-1c4759090942", "value": "6144:hOFBH/FMNjt18F+9a/NgAeDB4CcOtKp03b13a4LJ+sAOZZPWXbTcUwyg:hOFtiNBuFgawDB4NOmuwsfZPjyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655532150, "uuid": "7ac25e3f-7edf-4ea4-90e5-b302e1cb69c8", "value": 474112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655532150, "uuid": "0f575c47-f749-4ee6-abf8-ed7b9798ff39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655532150, "uuid": "d418dd5e-47b2-4146-a021-c884512947d7", "value": "1b0fcb758db13bbc5233239bae1de2b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33af1170-eefa-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655551891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655551891, "uuid": "d9f1c9e7-7527-4bde-b254-7990196830e9", "comment": "Malware payload (Mirai)", "value": "5949dd6e9bb89bb672ff91e23311f2ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655551891, "uuid": "7b80a504-196c-4275-b806-4724e0f26b77", "comment": "Malware payload (Mirai)", "value": "c3bbba95a9d0eeca216a5a88aea65f7421c5720bb2d9f6f7fb285089cb701bd8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655551891, "uuid": "2c088dcd-c57f-4f67-a174-6144fa23e70c", "comment": "Malware payload (Mirai)", "value": "2ec66103dd44fb181e9213ef323bc0fc120050e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655551891, "uuid": "e9202911-af44-4911-988d-81b02098c7ae", "comment": "Malware payload (Mirai)", "value": "c258c6825c03a19c8853e92497107681fa062b1589f37ff70db8b6271db9ae8c229b21aff46a635cc77d152c5b8bcc63", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655551891, "uuid": "d3241af7-993d-421f-91a9-2f37b267de5e", "value": "T13263185AB8C19F05D5C112BAFA1E118E33131BACE3DE72239D24AF20378796B0E7B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655551891, "uuid": "5b12dd17-92f8-42f1-a051-0893e1f2d64f", "value": "1536:N/nZGGDAU6cZOhibLNq4R78xaPUxQGMiiwxaADDaoqmXV5NYa+gD1:t0Uv34Soxa6aADDaoqmXVX5+21", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655551891, "uuid": "c940990e-d831-4680-b6d9-469c6452d87f", "value": 72620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655551891, "uuid": "d7e44e61-5534-4422-81c6-8c905f245484", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655551891, "uuid": "de8eef3c-79e8-4eba-8e4f-0a4ee9090588", "value": "ZG9zarm6.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eb2da56-eee7-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1655543857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655543857, "uuid": "8c7b436b-2d58-4bb8-a376-9b055f6d759a", "comment": "Malware payload (RedLineStealer)", "value": "a33ffa539d35983e470e67e722b80c38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655543857, "uuid": "4bf7bd81-6b3c-4d57-897f-559c93ef48cd", "comment": "Malware payload (RedLineStealer)", "value": "c3dd01734e71fb98a201ee38d6dffb724ccb79c2041aa5ba68811c9b5693ae86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655543857, "uuid": "7d1038d6-35c3-4606-bfed-d7ca93d7edb7", "comment": "Malware payload (RedLineStealer)", "value": "42568a103dfce00691c6177772cb74c1683cad10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655543857, "uuid": "53f89189-44d8-43ae-a557-7e5c34783939", "comment": "Malware payload (RedLineStealer)", "value": "1b02583f626eed3b86d3253864951256a2cf8221f28c489fb8e0a24bfad9213895a2cb7ca4471bdb5e58ad02ce72471c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655543857, "uuid": "0abc8f12-f8fb-4566-9d11-a6489c4bba51", "value": "T1C115CECA73A49053D8635A304E9383CA1729FCD1BA34719B3366F72E1B3AED26D25711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655543857, "uuid": "c3005ace-2e05-4fa8-8e07-edfa6e362333", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655543857, "uuid": "1a6d451e-ff92-45a8-89e9-e981d5122f42", "value": "6144:nahOTp0yN90QEYfxKp5L3FHg8aBRXpc0pev8YQkMlK1jvv:nijy90/39bajPxlksmvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655543857, "uuid": "7b60a096-6bde-4be5-afba-0b97cb696f75", "value": 892416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655543857, "uuid": "04d43d60-9d65-4e9b-8a6a-5db9dc6e248c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655543857, "uuid": "ad5d6074-b106-478d-913f-52900f383ec2", "value": "c3dd01734e71fb98a201ee38d6dffb724ccb79c2041aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4097b2ea-eeff-11ec-93bb-42010a9c0043", "comment": "Malware payload (DarkComet)", "timestamp": 1655554060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655554060, "uuid": "5604ddf8-a467-467b-b319-5aa2ace87819", "comment": "Malware payload (DarkComet)", "value": "90c81ca8e5fa6c309cf8233a19bdb8fb", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655554060, "uuid": "f6fab37a-3cb1-4b2e-b10e-e45f75eadf4d", "comment": "Malware payload (DarkComet)", "value": "c4143a984fd0752755c8075e9ae767964b62f357dc442533220e82344c91af99", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655554060, "uuid": "ce23e0f8-07dc-4a30-9b69-6156b8177a96", "comment": "Malware payload (DarkComet)", "value": "8c93c0e1f1a9a4da936b5c8574cf2a5658a94b6d", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655554060, "uuid": "af3e0c16-2fb6-42d0-9506-b3a4ab139b06", "comment": "Malware payload (DarkComet)", "value": "2d07af3da46a814b7c5f24c0c56b7e034751249dae09d19beb58c7c78600af6241b834792d37ec304c0721ee4b94153c", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655554060, "uuid": "18f59d91-6b20-4aa6-a754-a25b57fe3a4f", "value": "T1E5E48E31F1808837D97219789C5F92E6982A7E202E39754B3AE62F4C5F3D6C239193D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655554060, "uuid": "a13d3425-ee7d-464f-9b8a-ea838d69bce3", "value": "e5b4359a3773764a372173074ae9b6bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655554060, "uuid": "ec8a851d-103a-4a6f-9063-ab903c793074", "value": "12288:y9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hI:eZ1xuVVjfFoynPaVBUR8f+kN10EBW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655554060, "uuid": "5d87fa3e-b6e9-4649-b3ac-82a5ec8055e9", "value": 674304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655554060, "uuid": "6e9c2b0a-b2ca-4d47-b13f-8fa3ac82d8fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655554060, "uuid": "b8fd70b4-eeea-4c3b-b63c-f9e35cf6649b", "value": "vir_sstubd_r.exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9ed40d0-eed9-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655537916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655537916, "uuid": "258fb1bb-cd03-4aa1-a9de-d1bd34ae9292", "comment": "Malware payload (Formbook)", "value": "bb156d23f810a0e69125992b7b47ab6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655537916, "uuid": "a0a8a869-4cc0-4990-b7f7-7a7bbe1b563e", "comment": "Malware payload (Formbook)", "value": "c69a8cae5c55eb104275465b7e243114b151f49a54997cb496aebb747b4bfc50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655537916, "uuid": "8f88c9ff-c5d6-4ce0-8b85-ee79671d05b0", "comment": "Malware payload (Formbook)", "value": "6f58ab0d9db6ca2b7a930ed02dc79ab10c2bfb06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655537916, "uuid": "d67a400b-8e19-4976-9b7b-71c4ec816a39", "comment": "Malware payload (Formbook)", "value": "eaee78e982f1d2254701e69996ff027019bb4101d2704a4012b03415f9f22d70d4303b8d26d5072cf5aa23e936a7825f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655537916, "uuid": "c706261d-247c-43df-b78f-03eef7b745b1", "value": "T14494BF67B65D9F4DC34496B0B0FB923007A1EFA71672DA657DC4FE3C4A7222E26002D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655537916, "uuid": "7498414a-e403-4a6e-9a23-cf428a63e01f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655537916, "uuid": "0f4d8c7b-8ad8-4001-a8aa-983c9e0406a4", "value": "6144:8PFz2bSCgAHTL2t5Pc4Fw05WRTUA9/SftPc8Jyck2iLTliB8L:Lv2tYuRABSftPHcck2iLTd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655537916, "uuid": "ffe0e618-c2fb-4819-af30-d9c29ceaf258", "value": 420560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655537916, "uuid": "652a3dde-0e3d-4a27-b898-0b2778a5fb83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655537916, "uuid": "160330fc-a19d-4557-bd37-65491202c9bf", "value": "bb156d23f810a0e69125992b7b47ab6e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3121f7dc-ef25-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655570355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570355, "uuid": "392aa9c5-c5e0-43f8-91dd-9006d7fc408f", "comment": "Malware payload", "value": "37e7f226ea001cc8ef0dc836a0bc61df", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570355, "uuid": "048076d3-5a77-4386-b0ff-edc3bce2b86a", "comment": "Malware payload", "value": "c802a0e59e1ad1e452a97a5b960c00e89abf28e3c3a85bfb0eb7b1eac42a8c82", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570355, "uuid": "e80cc21c-67ab-400c-95ec-a0770df5390e", "comment": "Malware payload", "value": "1739638df517b5836182b868a80d96d1be439f01", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570355, "uuid": "30eab010-9926-48f8-9080-bd8882f9133e", "comment": "Malware payload", "value": "80c22c470086ad49e09a5f0713a4d8c32f1a0d293874ec4cc377d57ddb14174e1e4496a814adf49428ad06ebe899deb9", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570355, "uuid": "516a8351-f2ce-41f8-99b1-275542026514", "value": "T1852175B0E8E55990C07F447ED6AF9AB8F72575962EC0530B049C1BD033468129A7ADE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570355, "uuid": "1097e287-a398-434b-9b85-72b9a318d996", "value": "24:7KEOfn29udgfdnI96EtWZuaadykwQy2V1BmltcGnY:eP28e6/1wQO3ceY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655570355, "uuid": "b0137413-af88-4f4c-be4d-e389427c7cf9", "value": 1116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655570355, "uuid": "1b4b1e58-cb72-428b-ad2f-e26eb427bd09", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570355, "uuid": "811551b1-3c64-48c6-820b-91b7a6f57bfb", "value": "Copy3126.zip.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69787263-ef1c-11ec-93bb-42010a9c0043", "comment": "Malware payload (SVCReady)", "timestamp": 1655566584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655566584, "uuid": "700fd04a-6ee7-4b18-9b09-2958981d8bff", "comment": "Malware payload (SVCReady)", "value": "e7840be7da4d0e757ed42ad60602758a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655566584, "uuid": "124a49fb-afe2-4005-828c-6e27eb205916", "comment": "Malware payload (SVCReady)", "value": "c82a3eb6254a9b502f57e4dd0235b6d4e265ecb7bc0f5eae61870702bd8405dc", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655566584, "uuid": "41affd80-dfea-48bd-b790-f106a20bdf39", "comment": "Malware payload (SVCReady)", "value": "5c446151310436d45bf8578608f8b0d556a64f87", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655566584, "uuid": "06e4bfe8-27a2-4044-b4b1-c68c3b2ece4c", "comment": "Malware payload (SVCReady)", "value": "4843c2d3f2fe4e28f98ab156eb8eabc0480f56e048816179db1fe9dabf25a9dbb9f230ff83432b64fcb088919d422f0e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655566584, "uuid": "619a97ce-cd69-4797-8ff8-f9ff7a9e14a9", "value": "T15A95337281306AFFB75A16BF3D2D81A542707F387A07C74E2855C9AEAD4C8D6C6C0E49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655566584, "uuid": "7e045c8e-c033-4688-9c51-5148fdee6aa6", "value": "49152:TEWmVGCzsjmN0yBAYt9AJjqlgN/SIRyyxbGGtNb:TEWGGJmN0yGYt9AJjTxuGtNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655566584, "uuid": "3b23b89b-ec05-4c4a-bfa1-c9a24e6ac605", "value": 1986653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655566584, "uuid": "582f21d6-dacc-4293-a3f8-afa4a219b144", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655566584, "uuid": "68a1ca5c-cbe5-4caa-ae87-9ce1653a509f", "value": "assorestauro file 17.06.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1892e29-eee1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1655541392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541392, "uuid": "3553f56b-1010-4608-875d-87eae41e697d", "comment": "Malware payload (Gafgyt)", "value": "3d74293c73f79d25656745088e8aff04", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541392, "uuid": "49dde9b4-ad41-473c-bf47-eb274eba4f04", "comment": "Malware payload (Gafgyt)", "value": "c82f9b583bf07d65ec603593e39e621afcd6870f0777a8e524296e3a87f5ccdc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541392, "uuid": "549afac7-75eb-40bb-9861-3b4caff2431f", "comment": "Malware payload (Gafgyt)", "value": "267cb824189f2a167ea33580ddec91aa26ae2d26", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541392, "uuid": "3cd17f4d-41f0-4c3d-8de3-77e816bdba0d", "comment": "Malware payload (Gafgyt)", "value": "0c1e8210f520eda73ba158b737f3f331c5596fab1f9de6069f70f1cfff4ff499901f03a9ad3d54c0d5ca278cd172ec23", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541392, "uuid": "7ca20b66-784f-48f6-a089-d97cba4433b5", "value": "T18903F15B31C1A228F5B831B8CC7F399A24D1E23E0455CFEB6DC0FC785295F2A3A24184", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541392, "uuid": "c5c0cda3-8612-4257-873f-bde45046d8e6", "value": "768:FWzvnYeZl/98xtho1eFgiwfkfuIshD+sQBPJVXIZMA+nbcuyD7UGQRjuIlPNgy/k:FW7YeZl/98xEU3qD+sQVJ8MA+nouy8GJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655541392, "uuid": "bbb45960-651e-4582-bf0e-4bfd378173d8", "value": 39340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655541392, "uuid": "ec80b531-8e54-4215-a08e-7db4de4318ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541392, "uuid": "b97e3c7b-3211-43e7-981a-1bb72d98f34b", "value": "3d74293c73f79d25656745088e8aff04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad39f03c-eed9-11ec-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1655537922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655537922, "uuid": "403f2f78-2a71-4f41-a204-62441701f37c", "comment": "Malware payload (ArkeiStealer)", "value": "372bb087fafd405f8f998b132ba5eb92", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655537922, "uuid": "56dd2937-6cb7-4f96-bc0a-7a9e85ca788c", "comment": "Malware payload (ArkeiStealer)", "value": "ca67d33f052ae7145d32b4e88d27ade827a2bc0ce8e2bc22e5e6b6339f03c276", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655537922, "uuid": "5278c993-ab28-4ed1-9722-8196d396f099", "comment": "Malware payload (ArkeiStealer)", "value": "7f69e8614c82a274414923d14952a14736cef1ea", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655537922, "uuid": "1cb21b3c-841e-43fd-a9af-b8d2f20a0d23", "comment": "Malware payload (ArkeiStealer)", "value": "48e5a18b88a34d2f2ee30b6a3f7458dbd6304c4cc5163fba5d0933d9540432b55d3c92f5c806c9fdd55d391864a6b157", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655537922, "uuid": "5f9579a8-9a3d-490c-852c-8c59656e2a0c", "value": "T11E64F12173B0D032C7A70232DE75C6526E7E396206759987BFA80B392F703915EF935A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655537922, "uuid": "b5a5914b-1624-4d57-afbe-9e055a39aeb2", "value": "c99ad8a6bd42c42af4d281fc572cc9a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655537922, "uuid": "44bd55f4-e099-484d-a0cf-c101c71146a3", "value": "6144:JGSQ8i9M0Yr+0wXXlFT3GJXm5KSQZgbEfD5K3ECg+8QRuNDqPoXz:lQ8i9M0ECZGJATYK3ECgf7qoD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655537922, "uuid": "23ef455a-1250-4298-bb5c-74a7a61f4c5b", "value": 316928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655537922, "uuid": "89f1c130-6c24-4f7e-bbd6-3ee358ce7d50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655537922, "uuid": "d4e361f4-a29a-436b-86f4-7cda5ff45a64", "value": "372bb087fafd405f8f998b132ba5eb92.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87f9dae3-ef20-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655568354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655568354, "uuid": "2a53ef14-a76c-473b-b7ce-5be707c7ee9c", "comment": "Malware payload", "value": "d296cffbd144af03272fd9dd109056d2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655568354, "uuid": "127b9d55-9c63-4801-84c2-13d6bb1382fa", "comment": "Malware payload", "value": "cba3af0c1c60679191b04edd33153255717d09f501e5e087d96735224477e64b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655568354, "uuid": "a7083927-193f-44fb-b1e4-599cef7fcaee", "comment": "Malware payload", "value": "c336a9f9f1769ee0c48d787a2e00046fb26d231b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655568354, "uuid": "800dbe24-d396-456c-887c-992655c973c4", "comment": "Malware payload", "value": "8cb9a24a31a56afb646ed6885e804fee0fc7458ec828bed702d9d37c77f7483aada9bf93deef4bdc6d52c08902f955c4", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655568354, "uuid": "1adfd77d-ed0c-4328-8949-9620a3fbf8e9", "value": "T1D421303AC68C0585C20EF037AEDF65496B62CE3F4081B51926043BA0741756767612D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655568354, "uuid": "e6eadda8-2c65-4a3a-ac89-92af443da462", "value": "24:dC+SnSpANIpCtv/oabUoa7BnzdQvRv22O5+g:0Zn6QaCd/x2xzdQ522O1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655568354, "uuid": "5deb8432-49f1-491c-9034-709274359c3c", "value": 1137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655568354, "uuid": "c8e3bbb0-56de-46ed-96e1-561d00ced253", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655568354, "uuid": "36539e4f-2eb8-4d48-98d7-f0f70f56e227", "value": "Items8023.zip.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a7c4c30-eeff-11ec-93bb-42010a9c0043", "comment": "Malware payload (DarkComet)", "timestamp": 1655554050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655554050, "uuid": "126c88df-0a21-4832-9b27-8fa57f03b1f0", "comment": "Malware payload (DarkComet)", "value": "f167768f34cbb9038920cbae648326ce", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655554050, "uuid": "2093219d-8fb1-454f-a7b4-ce8be6c52ed9", "comment": "Malware payload (DarkComet)", "value": "cbc3194979a225ee53b973dc1abb0972f9bbc4bdb57d5d8056ba1a441dddd6ea", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655554050, "uuid": "5aba58fe-7953-4edb-820a-622b41bbd8c1", "comment": "Malware payload (DarkComet)", "value": "f3a4989b36a889a9abc640c31b107f37a7f6a2a4", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655554050, "uuid": "df187142-e0b4-4601-af9f-81ea02bbdf1f", "comment": "Malware payload (DarkComet)", "value": "f0c5972a2acd32bf0cb072b2c227008effae3fcbc7b045cff07905f16e418d676f255b6ee18df7af1bc2abc31876bb04", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655554050, "uuid": "9c1de050-9ed0-41c7-b4a5-b3bb5ca744b6", "value": "T10DE48E31F1808837D97219789C5F92E6982A7E202E39754B3AE62F4C5F3D6C239193D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655554050, "uuid": "1e1219dc-840f-4124-baa7-e25df3a61697", "value": "e5b4359a3773764a372173074ae9b6bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655554050, "uuid": "ed5fd84c-f3a3-49d5-a1d3-85cb4302d299", "value": "12288:y9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hG:eZ1xuVVjfFoynPaVBUR8f+kN10EBA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655554050, "uuid": "ab802a47-38aa-4fd1-8964-9420c6526e69", "value": 674304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655554050, "uuid": "907183a3-56ec-4541-89ca-100a1de3b22b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655554050, "uuid": "3b7c6893-7c03-421e-ab27-8861d9844fb3", "value": "vir_sstub.exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c49eb06c-ef25-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655570603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570603, "uuid": "8180c4f7-0752-4b6b-ab2a-fcf5f45bea00", "comment": "Malware payload (Mirai)", "value": "5fbfad3592fdccd7cb6200c4c5ffbf9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false }, { "name": "x86_64", "colour": "#DD69A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570603, "uuid": "714270ae-699b-4ddc-ae4f-606c35b89d62", "comment": "Malware payload (Mirai)", "value": "cbd2bf808e96794477216721baab98119f801c40cd5c2c07a0bba71cca6c653f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false }, { "name": "x86_64", "colour": "#DD69A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570603, "uuid": "d2d610f2-a206-4aaf-bdf3-325c72fc8438", "comment": "Malware payload (Mirai)", "value": "525fd2317c81e9413ce0d91bcfe9992fe1970968", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false }, { "name": "x86_64", "colour": "#DD69A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570603, "uuid": "2a642792-6b9d-4614-8fd3-229ba43e93d1", "comment": "Malware payload (Mirai)", "value": "38de9698c6e0870e8eb2330924b31c17518d3516223d3ee2c5b6dccc02cd6f7d3dcdc0cc7d5e87fab181534d6ed3da81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false }, { "name": "x86_64", "colour": "#DD69A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570603, "uuid": "d96f5fd8-f00a-4b7d-872d-39fd23e479a7", "value": "T128E2E1EE067FE9F4D25BE431845EA6C05E82940FB56466BB40D233BEDC50A94BA217F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570603, "uuid": "304839b3-7075-4e5e-8a6c-1e9c092d0d1d", "value": "768:MKhmUaJYNvaGYU04R0K4nxfOA89kBHZgKx0sI:hpSK4nxfOA8SBHptI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655570603, "uuid": "41bb705e-acc6-4136-9e92-cc0c7e48d13e", "value": 32136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655570603, "uuid": "4e62da88-781a-4fe0-9454-4a1d8567e3dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570603, "uuid": "055b9993-d9e5-4ec6-b640-71408682cc6f", "value": "irc.x86_64.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b31a302-eedf-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655540388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655540388, "uuid": "46797900-ccd4-4222-8e23-226ac7c3671c", "comment": "Malware payload", "value": "b5b6068ca2fd202e11948e467b671cad", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655540388, "uuid": "3dcc491a-5175-4482-9b71-d8c2d3d76add", "comment": "Malware payload", "value": "ccb5d19d2956b8cb1d89766c1a6174fdcddf4dfd46335ed1b878a771962ce323", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655540388, "uuid": "51fe3e00-9f91-4b37-8eec-4d84b51d61ee", "comment": "Malware payload", "value": "ed2634563dde20c7386fdc6a7408a2d5c4987731", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655540388, "uuid": "960b1c53-d07a-40dd-b51f-f55187401672", "comment": "Malware payload", "value": "f6b0a1b99e4467600d00bc4a39a5da7244a841fea8520c4bd9f15acd2bf6e69005fb0c8fb6eb9d151ce1c0f2230fedcb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655540388, "uuid": "ab9d59d9-30e0-4a89-91bf-68078ba46880", "value": "T1C641218A61A248B06E60B9EF72698C8432C0D0A67CC5EFF45CFCB8D515ADE9478707D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655540388, "uuid": "662e7add-5217-4eb2-9643-6652255f4344", "value": "48:v4ysb0hE4ysoJdel4yLk4yoP4yGLJ4yYb4yg4yyd4ysUNuV4y5MJ4yc4yOL4yl2z:vHAH8HLkH0H0HAHgHsHsH5WHcHOLHl2z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655540388, "uuid": "8b522361-796a-4434-a528-e6f9055e3b2f", "value": 2288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655540388, "uuid": "c83b1576-1eda-438e-993b-116eaa69239d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655540388, "uuid": "e7c390f5-7bff-4b06-afe5-5be0b237f7ad", "value": "bins.sh.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77fc2933-ef49-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655585936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655585936, "uuid": "49bb86d5-15bb-451c-98f4-363709014d3c", "comment": "Malware payload", "value": "d601277c253bd5fc83a052c4325b3f68", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655585936, "uuid": "e1410769-a679-4e47-89a5-410d14ce827d", "comment": "Malware payload", "value": "ccce5cf6341443605451d0b4a722a337b7a8c28087e2b473088728705dee9c3e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655585936, "uuid": "45c2d480-12ea-4dbd-bbe5-fdd7e936c537", "comment": "Malware payload", "value": "aabb1aec6171244dbca875c85007ed9749ae5169", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655585936, "uuid": "2b288d2d-d20f-4d6a-8b42-2bc8700d5723", "comment": "Malware payload", "value": "9d4d643f28f0e60bbb1956cb55572a5b2845f5651e1f61936112464a9af7ca7eaf85608c5b70b8903a398367036077db", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655585936, "uuid": "4abbce06-7e99-4a80-bff9-540c04e60cb3", "value": "T1B175AFB876047DE6E66F477BDA96ACEC13B616239ACBA4CC406477C305A3375FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655585936, "uuid": "5d8d464b-4595-478a-8f85-67b1e10f5b97", "value": "24576:SX7vRM8Lc3718l5QuhAYx2SBaNNK9NlZWsKY+LBdJf4BdBwFxuhaVbrXr5++/w1h:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655585936, "uuid": "c23d3acd-337a-4828-9cea-83b67c8e383b", "value": 1632297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655585936, "uuid": "8496d870-b9d3-445d-97d5-27e5a8a9fd32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655585936, "uuid": "2a4213bd-a8e3-487d-93ad-0b929c127444", "value": "ccce5cf6341443605451d0b4a722a337b7a8c28087e2b473088728705dee9c3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "428e705a-eefa-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655551916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655551916, "uuid": "0261ba8d-14ef-49a4-b228-f3f1630e5d3b", "comment": "Malware payload (Mirai)", "value": "5d3ef6f4db89500ec414344648208aaa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655551916, "uuid": "12d42773-5c93-46ff-9447-9a1e50fe3d21", "comment": "Malware payload (Mirai)", "value": "cd33eecb003be1dcd2e16ad3353080194b328cb294a82ba450b47f16da062ccf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655551916, "uuid": "32f3cc5a-138b-4966-9063-c567545966ab", "comment": "Malware payload (Mirai)", "value": "23f2d3542a2465d181780ba15f3f8d1561bd0a00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655551916, "uuid": "88d53a1e-3873-4875-9d38-5de07054811e", "comment": "Malware payload (Mirai)", "value": "6d9b04154a717da078a50ef3ee72605aeae7e1bb092241c7d2c311cbcfd1e32738c20229b9c68ab32f21040f91eaa04c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655551916, "uuid": "c7f099b3-ea4e-4890-84d6-0f90b819f91b", "value": "T10383E506BF611EF7D8AFCD3346A9074639CC650A22A43B767934D428B25B64F49E3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655551916, "uuid": "e176b171-2a6b-4c31-b2ad-65e6e6eb17bd", "value": "1536:Lrb8v77tEX9Ym8IH64G10DrbrZxKoFKkFOj:Lrb8v76taj0DvroSOj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655551916, "uuid": "cffbbff8-1ba6-4ce2-9299-adc033098c21", "value": 80772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655551916, "uuid": "dff4a238-665c-4465-8f04-268b72cb090d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655551916, "uuid": "31e4337a-3e4f-4a48-b3b8-4554ac940c40", "value": "ZG9zmpsl.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e25064c-ef1f-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655567908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567908, "uuid": "5cd1297c-967d-4516-8ea2-4a08d19edf3a", "comment": "Malware payload", "value": "6b4c5f4689adebcb3f4248c773f61a91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567908, "uuid": "b3e0b264-d9bd-40c0-ba85-872716bfbb36", "comment": "Malware payload", "value": "cd8f5fc0493aec7e27c71848f8fbc10a0829b2d7aad2f9dbc255d86199849a1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567908, "uuid": "919c7e94-a8f3-47a2-b365-e539af24c370", "comment": "Malware payload", "value": "4494f68e51d5e03c8e16c854c81862298337eeba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567908, "uuid": "3be9096e-d9e0-45d6-99ee-91ff5fab2068", "comment": "Malware payload", "value": "f3c11f6ffc88b78de37ad9cab76d7e14d92113daf7fd663a018ef6a14978a7b1a958ac2cc1bf810f2f003feb463b31e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567908, "uuid": "7ace00bf-b4b8-4fbc-821c-211bee7bc5e6", "value": "T1AFF24A47E743D4B6E81204B1123B67B19B73E57E0099DB82CB58A936ED6281267277CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567908, "uuid": "53adddb0-716f-4174-bcbd-92764d888213", "value": "768:RP0ui3Ler3zMd3V0bH74cptxaI+68SgrbKOsI4:Rsu+6r3zmlE4c9p+sgrO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655567908, "uuid": "51d036f9-d19a-43fa-a737-fb2a78736cea", "value": 35284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655567908, "uuid": "cbf3cbbc-75c5-4c7b-b118-c191a016f13b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567908, "uuid": "ac54f189-0b75-4bb8-9975-c5d443d1242f", "value": "s.x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37f8306c-ef25-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655570367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570367, "uuid": "4b6cd510-83fe-47f5-8b57-aeaefa9db06f", "comment": "Malware payload", "value": "4f28864c39e0bbce4e330430d243f3a1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570367, "uuid": "54eb26ba-acde-4d8f-a00a-62f57f82063a", "comment": "Malware payload", "value": "ce02af931a5a5e2c81380c65f1b9613bd6b5f4567a09bd19bec4ab7247d20706", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570367, "uuid": "4263ad20-5d71-4cca-8b15-9f3a9bd3acb4", "comment": "Malware payload", "value": "595389423b3e5817fc1b91a4a37697d3170c0487", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570367, "uuid": "31e58480-4fc9-4b28-8bf9-456f8dbc0e2b", "comment": "Malware payload", "value": "70e91e104e763896f5a21f91f29b42c8fdcc8dc37f969c4160eb523a205500ea9dbac9ba4578f5dc1f8ce4341f7fa1be", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570367, "uuid": "ad4ea06b-6426-452f-8277-66de96c44a06", "value": "T12D21B56DCE0436C5C8FF05FDB0FA9ED90926308485C66D4B0CD408D97BA9C282730DC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570367, "uuid": "8d90cf03-ca6b-420c-ad7f-e1bde9185c26", "value": "24:7KEO5Ii3GozRe7c9ObZTZvdb5aUPqaw6iMVWrHwAosIKk:e5D9Re49STXfiaWMsHwAos0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655570367, "uuid": "c098f4ba-aa1f-4fb9-8d2b-862164997e06", "value": 1125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655570367, "uuid": "eb9469ec-9667-45fe-beea-c1195bb7f4c2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570367, "uuid": "c322b01a-0162-49ef-b30a-e08e59d6a0a5", "value": "Copy3604.zip.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "091a5756-ef21-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655568570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655568570, "uuid": "62b36995-1384-472a-9d05-4e184d36b52d", "comment": "Malware payload", "value": "9f98a3541a3938c0eba3ed4b101284f4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655568570, "uuid": "d9d65910-3c5e-49e7-b795-5ebcebba57df", "comment": "Malware payload", "value": "ce853505a7e9685412f17fbe95a6bb3cb8caab1aeb1603bee9da38573e5a01f2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655568570, "uuid": "ce4a4c73-e87b-4d88-901f-061ded28aa13", "comment": "Malware payload", "value": "10df2a8176d7d6b4e7ca2b2ae2d1c93a06c7e504", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655568570, "uuid": "f001da29-096c-429a-bbcd-bd210c01dde0", "comment": "Malware payload", "value": "f0204b303cac8c980568bebc0bfd5fcfe2e224b038520befbbaa7742b78e256a324f5ca1045d0b40a5ce56feea421447", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655568570, "uuid": "673fffbe-4049-4fb9-827e-37f512b91fac", "value": "T1292412A1A3D9FFE39FB848946DA0E23D86E7D0D43035CF05C668EE667A075B51391843", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655568570, "uuid": "71d8ac93-35e7-46a5-a5ba-1ba86199d24e", "value": "6144:p5CWD0UtcGdNyD30kISArkh43j9VE6s/2VeFiKg/YRe0pebKI:p5ooYXArEUjbPs/2VH9w8VKI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655568570, "uuid": "36f663de-304f-45c0-bd85-e72d58ba5324", "value": 214592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655568570, "uuid": "0d8422f0-53c8-4d72-8572-ee53801cfdc0", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655568570, "uuid": "b8ded319-fda3-4715-8a03-b1d0b3d566ac", "value": "BOMBAV_GwZigU255.bin.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62e670a0-eefc-11ec-93bb-42010a9c0043", "comment": "Malware payload (VirusRAT)", "timestamp": 1655552830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552830, "uuid": "78e3dd8e-0d2d-4d15-a046-d3e21b15d449", "comment": "Malware payload (VirusRAT)", "value": "a3f36ab4d0d4e6c0f0e2e402865df2cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VirusRat", "colour": "#35CDB4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552830, "uuid": "ad10b5dd-5d02-473e-ab17-cd2753f51009", "comment": "Malware payload (VirusRAT)", "value": "cfbd53a9587259a67182a6847ce7e81381227dc142f942197a7e5e2a7d8eaf58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VirusRat", "colour": "#35CDB4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552830, "uuid": "cf2489cc-3f14-41f7-93bb-bdc88896fcdc", "comment": "Malware payload (VirusRAT)", "value": "2da6e8563f21829367fd0d776d15d8ffc99889b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VirusRat", "colour": "#35CDB4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552830, "uuid": "d494bc73-345d-4cf2-8b48-d65a5187a16e", "comment": "Malware payload (VirusRAT)", "value": "56353f8559a0578cfe8c280438c5ccd7d648f61747b2d7b2aa4993009a9cffa9cbedc1b3517c0b0339185640bb723ea1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VirusRat", "colour": "#35CDB4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655552830, "uuid": "bbfb35f1-8fb2-415b-96d0-4a49683c1665", "value": "T130045B0D7BE0CA15E0BE46BA88F347045775E146A643D74A0EF458F8AD733808A5A7BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655552830, "uuid": "e76e6f71-abb1-40b9-8d19-dfcfe2883175", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655552830, "uuid": "a1e6c89c-a4f7-49fd-978f-3af109cf9d99", "value": "3072:LA1wctAHKZRX9k8KvdoItwUeQzpnGlRuu4KXIzPCyZXK0lNOzzzzzYZt1xrWfex:M1ltAHKZRX9YmuVeopnGh4zRZ/FZRdx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655552830, "uuid": "14184bd9-ed87-40a8-ac66-34f3ab5d79ef", "value": 188575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655552830, "uuid": "315c5715-c909-46eb-b485-f6ed7fb88f9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655552830, "uuid": "0045f868-0fb5-477d-b3a6-1800faa9ab99", "value": "12 (2).exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "603b500e-ef30-11ec-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1655575159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655575159, "uuid": "6bbb2b85-2228-4c71-b6e0-076e1527a87c", "comment": "Malware payload (AveMariaRAT)", "value": "e3d9f3cbd2374e86f00c9246ba156276", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655575159, "uuid": "c2b4449d-91f3-4d1e-a1ca-e14f91a79afb", "comment": "Malware payload (AveMariaRAT)", "value": "d09da8ac7c76a3bc51b551a5109f112c1bc6d7d6b66013a62abeafdb2ada7323", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655575159, "uuid": "416abdb4-514f-436e-8a2d-29c1990b6d63", "comment": "Malware payload (AveMariaRAT)", "value": "40bc0f72b7aa311ef1273e52037739c952fa8927", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655575159, "uuid": "1718502c-142b-4fac-9b93-cd987ba35de3", "comment": "Malware payload (AveMariaRAT)", "value": "a5b2bd342d777f46a78977186a384e55aaf665828ea27247f903b259477986b3d3b4dae10b19df282d38048a4b2a0d63", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655575159, "uuid": "683de626-08ee-4553-a3d4-c966e3aede4c", "value": "T188353380BEAFD8418E9FD1D238A0B036ED55EB475B428FC1FA9CFC5C6FB60421559894", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655575159, "uuid": "861a02eb-a2ea-4f37-918a-e8d851b7ffe7", "value": "24576:nTd+PRWAndgRjYqOQBXQjt5FIHiUTLLvvJDh9LHW:Td+PkAnojYqhCjt5F6Lrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655575159, "uuid": "e26d0479-860e-41d1-8842-217f4c53e4c1", "value": 1075051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655575159, "uuid": "11f3591a-b1a6-4a13-b9db-afea1121c95d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655575159, "uuid": "75d8fcda-aa12-4342-8330-86cbb93a3f7b", "value": "Doc12389904938_payment advice.xls.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9840ff3-ef28-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655571926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655571926, "uuid": "473d0c9a-6d34-4160-ac0a-ec8f6f3a517e", "comment": "Malware payload", "value": "a519e0e79b0445c9e70ad9fe1a5b72fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655571926, "uuid": "2707c85f-fca2-4942-9b95-bbd6f7d96f74", "comment": "Malware payload", "value": "d2ccf2ebdb4877055fc84b44b0a10e490125f114a67e84262f126ff446eec4e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655571926, "uuid": "74eba964-f3ec-4f47-b38a-3bec194ea6be", "comment": "Malware payload", "value": "cb6952fa46f600ca808218beee11e7dd32529d94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655571926, "uuid": "46e60470-a4b4-4ec7-842e-c105e3193345", "comment": "Malware payload", "value": "7d7375e3aa4bd4eeaec09765eb47cf3c912146f80cef70f09130a4e14f0759331446e3352044ad76ab1465fbe7f4f2b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655571926, "uuid": "fd463f1f-2ecf-42e5-b1fc-5210a143d4d9", "value": "T1A6E512109D02AA55DB7428B4BC32E6F8203EEEA0A7908257CFE87D9B7779CC55C51263", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655571926, "uuid": "f219857e-3282-4088-990c-9a30dfb3d498", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655571926, "uuid": "03ecaa3c-a644-49a7-b109-d5f7efb3216f", "value": "49152:JbA3JyMP+Cj3puFzwnFd42vztNSJxmBcmn9xsvIDe0t0ZvKuVSXSNyx9Swu:JbbC+CjZWwnxYJacmn8AKpv2t4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655571926, "uuid": "4755afd1-aad0-4bb0-a725-0a7687529087", "value": 3160174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655571926, "uuid": "619471b0-5fa6-4107-8283-b01ab62d20e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655571926, "uuid": "ba94ca0e-0b11-434e-b999-77294e76819a", "value": "AutoHotKey.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf3367a5-ef26-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655571023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655571023, "uuid": "4e8481b9-8210-47f5-9b7f-46ddcb6c0b9f", "comment": "Malware payload", "value": "5af7be147f486c6739a1f175f52737da", "object_relation": "md5", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655571023, "uuid": "66d0b0e2-7e78-4743-8395-025cc9fbf6b7", "comment": "Malware payload", "value": "d2e63536e4547158cc019056ac97239038b13af0a91e997c1ac55bd46abc9b79", "object_relation": "sha256", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655571023, "uuid": "32cc56ee-e23a-4011-a388-f6af6dae0266", "comment": "Malware payload", "value": "a7cdb99886053bdf38f2b7ed2126f2313ecb1e80", "object_relation": "sha1", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655571023, "uuid": "8f8c3d42-ef40-4c97-8294-fd239f2d2576", "comment": "Malware payload", "value": "c4527bc1f0446d7b4fe4a032265b5bfeac8f6eff27b2b79d0ad584218028b384db5beeab30b763230a788f6b93fa0798", "object_relation": "sha3-384", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655571023, "uuid": "67ccef15-965e-44a8-9c55-94faa8401281", "value": "T132C353ED7DBDC9AD52591A6E51C7411E132A021694821CCB12E03DBC7EFBAF52F8E18C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655571023, "uuid": "e0329382-6d88-4b9a-9ce2-22cb2b2766a1", "value": "768:8PVgNoU5mqXcBh++cGxDrfGQ+bM0TjekzwIo5a0CpQZHBRJSRuRFVWHEMHtQNBLB:hWAnQVBcp7knbJKNglBPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655571023, "uuid": "5456f29d-d2f7-490f-a681-9850f0ee17e7", "value": 121196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655571023, "uuid": "c3931b7f-2cb3-4060-b3d7-9fbee5552c6d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655571023, "uuid": "e1ea861c-a1a5-4ee9-8f19-e125d7debd7e", "value": "Peraro.txt.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d762645-ef1f-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655567745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567745, "uuid": "59656ebf-6de6-4555-a1b7-8c750a16c9ee", "comment": "Malware payload", "value": "b121b054e6f59aaebb3773668d7a9b60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567745, "uuid": "1eeeba88-2a5d-4701-9930-c75fdfbafa1b", "comment": "Malware payload", "value": "d34134acf663ebec96d61d77fa7f9e5f83759bcf1751a9ec87391272c00a32b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567745, "uuid": "04497d36-e212-4fa4-8a56-052e5532db92", "comment": "Malware payload", "value": "fd82e617c3f24697b71fa0bcc642b42dc674c2f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567745, "uuid": "15187481-4a2d-4008-b80b-6d465a8ca8a1", "comment": "Malware payload", "value": "cdf88040d9a1cf9b0055162adfd6a183a548be7fbba2900598c77f249e907b2368e363e395da3dd991b2cb05a61c086d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567745, "uuid": "cab083fc-3c9a-4a07-bc37-6e37999f85d2", "value": "T1E653E60AEF904EB7DC6BDE3702A9171235CC551B12B83B367934D828F55A54B4AE3CB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567745, "uuid": "e0963121-8f92-4e79-9f44-12cd004764cf", "value": "768:h9G9TOScNu882gA6NvtwYeBFcZYmB1XiMNeWfb6HefenilMJY8X0+I1:h9gBc488HA6M3cZYmB3H6HGJlMZvU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655567745, "uuid": "e39e1a1c-7c75-4527-b72b-13727f18c5ae", "value": 60676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655567745, "uuid": "f9f37295-cf99-4251-b17e-def6462d8583", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567745, "uuid": "68a1d316-93a8-45af-aa56-c39cfe9b8999", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19e73b45-ef1f-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655567739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567739, "uuid": "1ab07c63-5349-4c87-9d70-58c6ca3a0837", "comment": "Malware payload", "value": "8aca79296a07bc3a429cd404594b2b36", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567739, "uuid": "89adaac7-844c-4d9c-b3c1-5bb5f227373d", "comment": "Malware payload", "value": "d4d1c171bc0a06f57e0592ce2d118cda753a8d14bda70ebb9392c712f14673b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567739, "uuid": "cca938eb-19f0-479e-926e-a24ec578a970", "comment": "Malware payload", "value": "f10cc47a9f08b9558ec271fd04857d4edb89b761", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567739, "uuid": "6351ec7a-c644-4a03-80a4-266f7bfb99a6", "comment": "Malware payload", "value": "567fe8e187dcaab18ea1c9266dc1ba01185c41b212d434955c1b899bb80c784143006511ae1843824ec314931fe25a6e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567739, "uuid": "d405ae12-539f-4aae-b323-a4fcbfd52de7", "value": "T10A53A65A7E319FEDF66CC63007B34A21A39963DA22E1D2C5E25CC1056F7024E652FBE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567739, "uuid": "2a247523-5679-4959-84b4-8e50b8e8e67f", "value": "768:67CTM69x4QMOoqZv7RoCR5rf76ZQUF3zWNATVUyUlEemr8DhaX0aIKo:bM5qZeCrv6ZVl7TVJe1DhaHlo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655567739, "uuid": "a3d6f41a-8ef7-4ca7-8fc3-6ba453992238", "value": 60676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655567739, "uuid": "d1420438-7a1b-40e9-b9a2-dae94a6fb65d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567739, "uuid": "5f1cba27-5244-45b4-a5d8-84650921f6f0", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c3425a5-ef00-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655554429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655554429, "uuid": "c4b18b56-4bc2-47fe-871e-6a08202ee606", "comment": "Malware payload", "value": "06ccac1ece8ef8948ee261f34e6cab3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655554429, "uuid": "d1a0a72a-23d8-4486-a7e9-c9089237c40f", "comment": "Malware payload", "value": "d4f96bf21fba6ed6b7405d7d6e7fbd8becae98c1ecb062ca5f882d092437da45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655554429, "uuid": "1a1e31e8-ddcb-499a-aa9e-57c86f091c37", "comment": "Malware payload", "value": "092201bd10c753082e586cd8112633426a3b34ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655554429, "uuid": "89324660-2517-49aa-840c-3a4fa2823216", "comment": "Malware payload", "value": "9f1f6401c8a56d9477cd72b09dc2a49ffdca443b8c137aa3bc1970846240163329a5eedbe55f9feaaf6a8f0c5f923986", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655554429, "uuid": "8f97ab43-8d72-43ec-819e-cf9092d94cf8", "value": "T18F6402133D6A9672C05C0E3509F2CB29F669BC962D169B5FB62436BADD703C43B5328C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655554429, "uuid": "d003aa22-7fc2-46cc-bfe1-1a6fae13e0cf", "value": "2e617e493fe56f5d85bc653115a984fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655554429, "uuid": "f4cb9780-049a-4b9a-9624-522b2fda8afe", "value": "6144:TfAEOTeHyKq/JgjffrIjjeHZvsoj8y8tixAXJerOI6tJlsZ7WbcVmZmjLdSsaq6A:jAHTeHL7fcjUvGtzX++U7WbcVmZmjwsZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655554429, "uuid": "6526d873-5a92-4514-835c-0e399105c787", "value": 323584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655554429, "uuid": "b30a0298-6e61-423f-a210-7b8c22f2e40b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655554429, "uuid": "7edbe53d-67ff-4ecb-90ed-35697f99b072", "value": "Interlagos.exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a9ffd8a-ef5a-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655593296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655593296, "uuid": "5fce098f-903b-4598-ac04-a4f663c580d9", "comment": "Malware payload", "value": "56f201492a46706399960ef06aae538f", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655593296, "uuid": "7f4d3a0b-2657-4014-a769-e28c568eb8cf", "comment": "Malware payload", "value": "d527cb1e5cad4419a81bb57db72e0522af87f90e9e139fb3c7c84cfc4155ce50", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655593296, "uuid": "d43721bd-a17a-44f4-b405-2b5fbd768818", "comment": "Malware payload", "value": "bc097d6428d24e514f94968d9d20913e20e51983", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655593296, "uuid": "6ee150dc-e177-4d46-a6ca-9989de8e4c2b", "comment": "Malware payload", "value": "7a22ef028b85074dadc35897d780c735b27b772853281d0402fd8ff7633e5f5c378d7bf8ab329cecadf79c995976aeeb", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655593296, "uuid": "2daac2e7-41eb-48a7-9cff-17e50e979577", "value": "T12D4590DA96853AA5E71CE53DE617844D703AF28CEEA3C72363F4A8DF07344982529F11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655593296, "uuid": "21f07815-1c85-4573-b9cc-834cfee05cc0", "value": "384:nq+U1f+f+fxj+f+fFOxvX6omLRM3VZlfF+H0yjNNH+f+f+f+fMBQLmlfOKtp+iKm:n5hu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655593296, "uuid": "f6e7ff62-d6b0-4dc0-9690-ecf490602fe5", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655593296, "uuid": "534e00c1-1142-4de2-9fdf-0520b79aed72", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655593296, "uuid": "889b8415-47cf-4404-8a5d-a0e9f10e4d85", "value": "devoluci\u00f3n+de+pago.pdf.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66e0e7f1-ef59-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655592779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655592779, "uuid": "6813ab56-f908-43ac-b66c-50936657a4d7", "comment": "Malware payload (GuLoader)", "value": "6979435bedf75d488e0c98080e4d3557", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655592779, "uuid": "ae309dbc-7b49-44a5-8b3c-20d7ee379dae", "comment": "Malware payload (GuLoader)", "value": "d58f5e5b01729ba14b5dfbf9b3500e1262b4b0b1ec2c2451ea735a6c99c773ba", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655592779, "uuid": "7fdeef7c-85a2-41b3-9df5-ea4f52eef12f", "comment": "Malware payload (GuLoader)", "value": "908c55315ca3627e1d1499751a8af094f0625763", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655592779, "uuid": "e0f044af-2786-4e72-a586-780d4e45d68c", "comment": "Malware payload (GuLoader)", "value": "5ec95a439104938a8e32add990ce7a6b7f6de1d2f11acc638b0622aa425f1eb919ba4daabdfeeb7de0bd76a4e12aaa57", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655592779, "uuid": "89e8c68e-37f8-44aa-bca7-ddc5918ab49a", "value": "T16E3412D5B82014CE70A8FCE8606B492CD781C5DEC77ADF576970B1081945B833B9E9EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655592779, "uuid": "1f90cd99-3e74-49f0-875d-779e76a2ff7e", "value": "6144:xhsBAp3N2fQQAKJslu7PooqmwGqlFQpfezQUP7fwysaVk:xhOnj+/oqVbDQVGBP7fwom", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655592779, "uuid": "eda9d21e-839f-4f65-afb3-357090f4acdb", "value": 249383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655592779, "uuid": "ab171402-4ce2-4c0e-8d8d-bc7d90fa19b8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655592779, "uuid": "6c83bfb4-9783-450d-9dbb-2fca06afaec9", "value": "454611358_6735469256_20220613_2150111.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "465c5ac6-eefa-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655551923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655551923, "uuid": "0eb76fb1-2a15-41c2-8520-a70c9e6c4632", "comment": "Malware payload (Mirai)", "value": "fb696bb05c247800d706f542143f8a79", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655551923, "uuid": "099035e8-4009-4632-b692-4a8bd3c25297", "comment": "Malware payload (Mirai)", "value": "d6fa3be1b4cc53cee28c63fb2eceacfde6caa4acec34aadda8f2495f79646d1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655551923, "uuid": "330ebf16-0442-4730-8065-888a7d16da43", "comment": "Malware payload (Mirai)", "value": "47764daa1b75e34649c60274324008163de7b6a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655551923, "uuid": "ea185c3f-7893-4eaa-97c8-3f16764d0e51", "comment": "Malware payload (Mirai)", "value": "9814434c373b77486b07a3de990802bc861f03f1376805fa7efaadd682e9762a3245357a732ed724fa0e1611b515da6f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655551923, "uuid": "da1298da-e228-4d05-888e-6a187cabcc11", "value": "T1B3535C02731C0947D1A36EF03A3F1BE193AFED4121E5F684691FFB8A5232E724585E99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655551923, "uuid": "092abaec-1b92-4f52-bbbc-d2fa4ede31ed", "value": "768:BVUF2nKe3rR4NuEOdBpBS6qG/qLpTpYm98LaJBuWAjszLRKcIr2zPFPGtPoU1JIl:sFWXDAH9SQ8+j/AjszLEcIrEpGloGIB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655551923, "uuid": "116f4341-9b69-430f-86f9-641f0cd2f169", "value": 61092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655551923, "uuid": "988ecc78-3d00-4f00-9a0a-918e1ef3df91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655551923, "uuid": "8c203fa2-3624-4f6d-86bb-394461ca4f62", "value": "ZG9zppc.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "313d5a36-eea5-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655515380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655515380, "uuid": "cbaf1235-5d25-4203-9a9a-666509fde4e6", "comment": "Malware payload", "value": "b294b1f7b72d347c7154568bcbd05ffc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655515380, "uuid": "c9e4f735-3b2f-4b44-ae0b-79b80c1a8a56", "comment": "Malware payload", "value": "da1f5dc2a20c22328845e242339b5fe881439a0e54e0c8f005078f4360c506ac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655515380, "uuid": "9f4a0747-3d99-4a3b-a95f-583b8efbc93a", "comment": "Malware payload", "value": "9f1f9761e1a4000507551d54149f57365b7a1806", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655515380, "uuid": "69626b6f-01d7-48c2-b036-28b43c37b41f", "comment": "Malware payload", "value": "c59f1c7c6ada710a5915c036a48a681e440281a2e77a677a37474c74740f89e8606e6b0262750232fca2f90df7dd38ab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655515380, "uuid": "3c64e83b-10f2-4db0-9fa4-f5e7f8c9b732", "value": "T1A0057D35EB80F125EAE3553E87D84A5A167D027337A443CBBF498468853F2DAB43439E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655515380, "uuid": "c53a564c-3369-4156-b569-c1ec5e508101", "value": "c84c1027327b354a17f1cc3cd5f25f3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655515380, "uuid": "d36c3af8-b82e-4ca1-a1a5-8dbb38d16306", "value": "24576:lXncfLXfRI/gA2AUOfrFQpbswwwwwYs82ugb3tdL:lXnczXfRI/rHFQpbswwwwwYszuybL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655515380, "uuid": "d28e6b8a-70ef-4c74-8219-dbdda0c49490", "value": 848913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655515380, "uuid": "f5beeba6-ef38-4014-b0b2-1edfac9624fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655515380, "uuid": "673d1d80-a24e-4bbc-b386-a8525a2da5e4", "value": "b294b1f7b72d347c7154568bcbd05ffc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1534a87-eea3-11ec-93bb-42010a9c0043", "comment": "Malware payload (IcedID)", "timestamp": 1655514736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655514736, "uuid": "67bd96d0-1902-4b6a-a592-d7be79e5fafc", "comment": "Malware payload (IcedID)", "value": "7e17e485a26a60f785dbf9bd995a493d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655514736, "uuid": "3ef7264f-6701-4620-abd4-4829cf783d02", "comment": "Malware payload (IcedID)", "value": "dd636623af52a3708dc43af228ff5bd12f874acb6d9be92ed58642c515ba8fe2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655514736, "uuid": "f62a3a8c-5792-447b-a26a-f7301da718ef", "comment": "Malware payload (IcedID)", "value": "26edfd27e192d0f4167f7f051d6b8129a1214b0e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655514736, "uuid": "fb9d514b-337a-464a-aec5-539b6db1548c", "comment": "Malware payload (IcedID)", "value": "db596a3f295fc7770f8e429dda11ce3ef414f85edc007577f26c0f94e26a6e2e4c767100ec1f61a15b53b8f9789a3974", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655514736, "uuid": "13a4d04c-eb13-4696-b7e8-f2660057f810", "value": "T1DFD4B0B875047DD6AA7E477BCD96ADE813B627628EC7A4CD806877C305B3375EE02804", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655514736, "uuid": "c6ecfd45-dcdc-45f6-adb4-56af5bb07dcc", "value": "12288:mYYdoSYW7bMLxiVhUeim1ZZxqgroRNIj2ce/epyzHfTJ2I91ajZ:ZYdoSYW7WGURYrxqGiij2ceGIzHrJnfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655514736, "uuid": "741feff1-43ac-4597-84ff-1f9529012a4c", "value": 614400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655514736, "uuid": "13a44b09-ae75-4d4b-a2e8-7abf6b8c93b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655514736, "uuid": "ab14b3f1-ea42-4ac3-9a47-37bb3a41a7b4", "value": "7e17e485a26a60f785dbf9bd995a493d.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34082b74-eecc-11ec-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1655532135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655532135, "uuid": "d528c7cb-eba6-4488-bb20-d0d8daad67dc", "comment": "Malware payload (RemcosRAT)", "value": "f1b55410ed2dbb79bc832cc8dcafd047", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655532135, "uuid": "adf4c8cf-24c0-4164-9d32-316906e2de13", "comment": "Malware payload (RemcosRAT)", "value": "ddd0b4c53ed49d8aafc200274c5072b4a42558930f86364a4b29b73e830a427f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655532135, "uuid": "4b7b75f2-2ba5-4dba-94a2-144df472cbb7", "comment": "Malware payload (RemcosRAT)", "value": "a6d808de9f076d1d540bea68cf47c46b26884f5e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655532135, "uuid": "092e39f9-378b-4ebe-9cc5-fbb9a06eec85", "comment": "Malware payload (RemcosRAT)", "value": "a645a725d9bcf16d660feee591356ae83fe0dcb340652a8fc5814314d5e0ed3c76663b11bd94c2c85ffe81b2fbf35291", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655532135, "uuid": "f3124878-6e9c-4c24-8503-1b3e486984e0", "value": "T129A4BF11BAD2C072D97251340D29FB35DEB8BD202935857BB3D61D5BFE30180A72A6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655532135, "uuid": "8cb3f199-7bc2-4dcc-8cf5-3a28b447a7fc", "value": "029a987f21e33b48f24d21b6f9ff1129", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655532135, "uuid": "c6c6548d-da09-4f47-ba66-5d0b76afc999", "value": "6144:JOFBH/FMNjt18F+9a/NgAeDB4CcOtKp03b13a4LJ+sAOZZPWXbTcU1/yg:JOFtiNBuFgawDB4NOmuwsfZPK/yg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655532135, "uuid": "55a1178b-9243-4c79-a34a-d0d3628a6f0e", "value": 474112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655532135, "uuid": "c993a9f2-eec6-4687-a2e6-80cc9820262b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655532135, "uuid": "4187f240-58e5-468e-9895-90db6c43af25", "value": "f1b55410ed2dbb79bc832cc8dcafd047", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7bde7ba-ef48-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655585667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655585667, "uuid": "4483bd57-cc66-4662-aa15-7d366ab29c84", "comment": "Malware payload", "value": "1c34d0c6964ad975af3dd63fa9282e2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655585667, "uuid": "ab4a797c-10d0-42be-a1c9-66aa9df56e1b", "comment": "Malware payload", "value": "dde7dcf2831fc86f74315f05353ed60908fda5e8c8f2620fe160d63b266db471", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655585667, "uuid": "5cf87162-d9f0-4156-ac1a-ccd1841b88b3", "comment": "Malware payload", "value": "4b1a295f48590c84880a458bbedeafc1512641ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655585667, "uuid": "1b405a76-3455-4379-8923-e1fe2c67737f", "comment": "Malware payload", "value": "96e7ac3c8d0029e9b89d8dc605f5c84f026989c7bdb786ae326dd989b72f2821b724adb4cd683d19967ad57beda1fb8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655585667, "uuid": "b75fdeb1-97f0-4a5c-8663-8ae900325d7c", "value": "T138032A4D7FE18168D5FD067B05B2D41207BAE04B6E23D90E8EE164AA37636C58B50EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655585667, "uuid": "8a771a0a-1d2c-4d89-8f8a-053da6059a34", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655585667, "uuid": "60b98c57-dd83-4f16-a4a4-70318cb1b290", "value": "384:BDmK3hUidksXR21cGMy8PIU5fHkFlacpMrAF+rMRTyN/0L+EcoinblneHQM3epzA:FmK3bLGv8PIU58KcarM+rMRa8NuLet", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655585667, "uuid": "e757e5e7-2523-4803-91c7-9fe8e4b7071d", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655585667, "uuid": "72a7e7b3-a4ea-4dd8-912b-364059fab2f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655585667, "uuid": "b15e6151-ac9a-416d-88f5-08cd35ff1309", "value": "forvm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3e1a056-ef26-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655571004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655571004, "uuid": "26f560b4-014a-4e55-896a-83e61aba3195", "comment": "Malware payload", "value": "c47aa7777419e396c0b7e0f8f6047f4d", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655571004, "uuid": "cbeae637-f86f-4e2d-be74-6d91516971f7", "comment": "Malware payload", "value": "df9ff33718bab1bc71c2736165731d3ef59d8164fa2637b93a386e1f27503bd8", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655571004, "uuid": "0c56de19-7e3d-4c0e-a42b-1b25d026960e", "comment": "Malware payload", "value": "1291279df79bd96fa606ff7ec62002cafebc31a7", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655571004, "uuid": "42ab6feb-d7ba-4015-a0e9-f961ef10646e", "comment": "Malware payload", "value": "3c1b3bf43abd069d3c31e207b741478c9d38221a66e92b25d5969ebc9329cb4aa03c4b4c5d24619b9aa08853feb3fe3d", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655571004, "uuid": "92d29372-4a78-4e8e-9f28-40e9d7f9055a", "value": "T1302419313AB5A008B1707FF78A5BF5E2973FD387BE49699D105502B54FE068482FA362", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655571004, "uuid": "4e1acadb-fae3-49e6-acca-d71d0a7b3daa", "value": "6144:P8888888888888l888k88888888888888888888888V88888888N881884Rb8A8i:P8888888888888l888k888888888888/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655571004, "uuid": "a5877087-f6ce-4188-a7a2-4a93d3dc6133", "value": 216068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655571004, "uuid": "b42c8f6b-4d38-44df-9cbf-5774fb6b551a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655571004, "uuid": "50d7d3cc-5957-48bc-b74d-17c4b1658369", "value": "CrpFRaNCVOp0.vbs.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c93c61e8-eed9-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655537969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655537969, "uuid": "8d1b10bd-2c3f-4694-a04b-d14dcb289698", "comment": "Malware payload (Formbook)", "value": "a1940359e7f3b65274ed812444bdab61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655537969, "uuid": "bd2e1676-af0b-42b8-82bf-a0f7917b8b72", "comment": "Malware payload (Formbook)", "value": "dfee2b9c0f7706842861045a4c2de48d276591f3d530a7434a05d6fce72575a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655537969, "uuid": "dedf460f-27e0-4783-96f0-5ccf6fba9fb3", "comment": "Malware payload (Formbook)", "value": "9a8a24a106c3983d1665f6d5f6a25d6b781463e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655537969, "uuid": "713d4e39-dabd-4f7c-870d-df6d5cd98331", "comment": "Malware payload (Formbook)", "value": "44a187d07eed595396a802c2c1f78f51c1a8859d8acfce8c65258554ca9e5478bc57084c09e885122e600a54426e309b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655537969, "uuid": "b5af3581-22a0-46c1-90a0-0def64988c81", "value": "T131D2CF07F7A84D36E9710B716E7343414B787463CC13EB2FA9806A59BE623B10993BB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655537969, "uuid": "a39952ec-1bdd-444c-ba0f-a03f7d3392d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655537969, "uuid": "3deb96f1-93b8-4237-9b78-c277daff74ae", "value": "768:g6yd+jz69Nf7oSFYwQTXvLWRgcL0ST8iNxy2c:Qd+2f97gWRgcL9HNxvc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655537969, "uuid": "aebaaf07-1748-4c4e-b87e-99089d4cbaaa", "value": 30208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655537969, "uuid": "c817d505-b888-4148-a3df-bb00ed737e19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655537969, "uuid": "dd009bec-8b4d-42d6-9881-29f0f23b1179", "value": "a1940359e7f3b65274ed812444bdab61.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4bad4da-eee1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1655541424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541424, "uuid": "612f2e0b-507e-4b5e-b610-a3ab909b567a", "comment": "Malware payload (Gafgyt)", "value": "79a7f4732672ba1fe8b4ef752cac11eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541424, "uuid": "1a4951eb-2c7f-4970-baa7-89365e99dfe7", "comment": "Malware payload (Gafgyt)", "value": "e264c41ff744918afdc3746a85d9dcb540e039d2c9b71678d298e491d0345fe1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541424, "uuid": "ddbfbe25-8c2e-414b-8005-052d85bd0748", "comment": "Malware payload (Gafgyt)", "value": "fbaed95e691ad3ccb2bdb587a7109381c040ebdf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541424, "uuid": "630ac887-c84f-4521-baf7-7e0b5c84cfb8", "comment": "Malware payload (Gafgyt)", "value": "ce9e89171d03545e67eb3139f4ad6dc1abdee3b2a46fc33c15d975cab0fb29cb7fbaaa9d5c1e8bda48359a4fc267357b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541424, "uuid": "4bc45820-fe2f-406f-9fa9-09911a612950", "value": "T1A7B33A0798615F77C045ADB529AB5530072BBA120F8F1F99B57CAAF4074F8CEB40EBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541424, "uuid": "87fc7fd0-0032-4897-ab21-08457e10a8be", "value": "3072:btTQn622oNI8zpUx5hLwtOCwLkY0Px9gQNfR:btc6Vs/Ux5hLwtOLLkY0Px9gQNfR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655541424, "uuid": "9ff86b9c-b8af-4aec-b2a1-512ba9ff07c6", "value": 108415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655541424, "uuid": "a50065da-b59e-46e1-a164-2fb33724e5cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541424, "uuid": "7f0ec737-6e3e-4df4-9f36-d2047e73500e", "value": "79a7f4732672ba1fe8b4ef752cac11eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "993e31ab-eeee-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655546908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655546908, "uuid": "b4fadea4-ffc0-4147-8ca5-eeea7511ea3f", "comment": "Malware payload (Mirai)", "value": "4ccaa55a619c85792224afe54c93df77", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655546908, "uuid": "41b79394-d05f-44c9-921a-65141f7ff2f4", "comment": "Malware payload (Mirai)", "value": "e3158d8fe483a0a118ee2fbff8ddb80470af24d44e1a71050367d4ed159b45f3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655546908, "uuid": "98c50d7e-5a58-4a85-b3f2-11da7fe96612", "comment": "Malware payload (Mirai)", "value": "656e1b4442820d0d754ed72b03d7620a1f82f683", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655546908, "uuid": "6773e168-c564-42e7-92f8-8e9e013f82c1", "comment": "Malware payload (Mirai)", "value": "b947c00f0941d2083b6bcda38068de109953d60d8924decdb7c88e9a5411146eb91841b76372ac0f44e2faefc60fdd7c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655546908, "uuid": "c3fa6500-6c3d-47f0-b521-a4aefdbe2a62", "value": "T109433955BCC19A12C5D4667BFB2E428C3B2553E8E2EF3313AD296F10378782B0E67651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655546908, "uuid": "066d43f5-a8f6-4186-a572-19644a5ac794", "value": "1536:z7yUazgxzZjg2FzSzBoLa+mJCReEKTPgkAX:PyQ9bzYka+6CPoPYX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655546908, "uuid": "95a73984-0b49-4d57-aacd-2654ba87b906", "value": 60500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655546908, "uuid": "58e75444-cb35-43a6-a432-a369b437ec46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655546908, "uuid": "c04ef04f-0aff-43b3-a7fa-2e572e081d9c", "value": "4ccaa55a619c85792224afe54c93df77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8e74a94-eee1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655541431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541431, "uuid": "91fd2890-00f3-4bf9-93bc-e42f5705ad74", "comment": "Malware payload (Mirai)", "value": "534724cc63a4cfbe0643323e94116c67", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541431, "uuid": "a3c129c0-bd23-45d5-9480-445edbf4acf0", "comment": "Malware payload (Mirai)", "value": "e3d957aea75b79dc4939936bf710f69193653a7b04830ac6e95d0165b285d254", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541431, "uuid": "45a5d3e2-c6f8-47cc-abfd-da0d7d565cf0", "comment": "Malware payload (Mirai)", "value": "1dbab4ce132971aab73a968f220fa29786ad4d1b", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655541431, "uuid": "ddf195e8-7476-4257-a32b-b6bc5a886ddf", "comment": "Malware payload (Mirai)", "value": "4ab8f6f4f2920ae8c8981c55bc44a98079211ee9fbc691f30909579f24e2a1aa56ac6514488990abda18fa9e5d544711", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541431, "uuid": "84925977-78eb-48ff-b5d2-2637a154ea71", "value": "T127B36C176692C5FAC08342B92BDBA1618823F67D0B36331773D5BDA43F158CA6E6E740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541431, "uuid": "e9c47111-cd19-406f-9a78-0e5c7e08569d", "value": "3072:Ft2nlia9qRBFZm4z1EYfcbJ5phawfWJv03CKPCNVOXinYuM8R:gsVm4z6Yg7phasCcFPCNVOXinYuM8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655541431, "uuid": "751db744-5a50-474f-ba9c-ebe21def0b67", "value": 112336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655541431, "uuid": "6f340193-5fd8-4241-badf-1c4501f0c04e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655541431, "uuid": "15ae89ba-9e00-4820-9750-17e085d1b7f7", "value": "534724cc63a4cfbe0643323e94116c67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06a3d8c2-ef17-11ec-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1655564271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655564271, "uuid": "22589e17-696d-421f-be11-8c852c8ce844", "comment": "Malware payload (RemcosRAT)", "value": "d2a371a5c67e0e72ced69d6d1a98b34d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655564271, "uuid": "8c7a9d6d-50a5-4f00-89a9-0f21245ea9ef", "comment": "Malware payload (RemcosRAT)", "value": "e525994939ff88fb049c0e50fc7fcd0104bbd7052510edbf4f659252b0d12e06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655564271, "uuid": "df5eeb67-13b5-4128-8658-6e47a7eeb3ad", "comment": "Malware payload (RemcosRAT)", "value": "b9d57c582d12c2fda72d436d318e6b4adc9d8fe6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655564271, "uuid": "0fde5071-849c-4a29-aaeb-f127490998d0", "comment": "Malware payload (RemcosRAT)", "value": "0c332294b0c23b1e0bf920447b6804261e7ee877295eebb24969a21f5c69001b5ea12c511ed7565491443b3d7a0098ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655564271, "uuid": "1ae9ca44-a873-44bd-98e6-0a84b3af1ab3", "value": "T18FD49E23B2918476F0A21D399C5F4B585C2DBED32D2CA84E2EF91E0F7E356D13625293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655564271, "uuid": "146f6a98-8cca-4f6b-a551-60be23dde06d", "value": "b4210e74695e0d4da1bc759e66ed1d00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655564271, "uuid": "39b03f4b-48b7-4aac-9786-66d246e91643", "value": "12288:J1CXL1IGvGiwQyDUQq5TxtfB84KRrDJnAEc5GIrZx:J1oxIGRwvDUTTxXfKNBAEcZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655564271, "uuid": "a258bef8-e3b5-423c-a88a-8ad721e46911", "value": 604672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655564271, "uuid": "c47fcb73-792e-4540-b690-877e03401b6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655564271, "uuid": "7a6832af-86d0-41db-90f9-5bcf27afcfe6", "value": "Delivery report.exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86c5831d-eefe-11ec-93bb-42010a9c0043", "comment": "Malware payload (OrcusRAT)", "timestamp": 1655553749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655553749, "uuid": "5306fa73-7bbc-4d36-889f-45c8200f8335", "comment": "Malware payload (OrcusRAT)", "value": "1557a74487c9a87068200ed57aa4f41c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655553749, "uuid": "4d3b0cf2-db55-4a3c-a707-158c2e01798f", "comment": "Malware payload (OrcusRAT)", "value": "e672d73cf01f809e167c3b42609d6eb719ae187313f083e4e0ce522d6e6d8f3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655553749, "uuid": "be443ff1-69bf-44ea-8afa-3d6281f411f4", "comment": "Malware payload (OrcusRAT)", "value": "21c6fe977ffe351442dde5a67302d934448c2798", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655553749, "uuid": "31bfbacf-7275-40ab-a67e-7205f194da0e", "comment": "Malware payload (OrcusRAT)", "value": "9c1c5f8b45c85b5fb887c34cd6720be888268a547d3768d1866f3657ef9904274dc46df83fbc2426f62554acaa46c9ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655553749, "uuid": "027cf0e5-c69f-49d5-bd4c-5853004c3784", "value": "T16545AD003BECAE06D1FE67B9E27316C547B5F826A46AFB4E086460ED1C6B740BD11367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655553749, "uuid": "1acbed4f-b1ed-46f1-bef2-859f3490582e", "value": "d59a4a699610169663a929d37c90be43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655553749, "uuid": "9ad40ed9-3165-4708-8478-099fdd01b839", "value": "24576:/IY4MROxnFrrrcI0AilFEvxHPiooPJACH6FIc:/aMi9rrcI0AilFEvxHPy2I65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655553749, "uuid": "0f420cb5-65a4-402e-ba23-c98b5678eaf2", "value": 1241088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655553749, "uuid": "de8c02a6-783c-440f-82a8-df6a5531aacc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655553749, "uuid": "5ddc78c3-ffb3-4f87-a15b-b0ec9343a9bc", "value": "Kogtervan.exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06d2c9d3-eee5-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655542797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655542797, "uuid": "32cc4d92-6ca3-470b-b7e1-1152153015ef", "comment": "Malware payload", "value": "bfc8e2ff6ad09cebe7d741920f44e74f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655542797, "uuid": "f66481f6-f5e2-4f86-a40b-4c1251b52f9b", "comment": "Malware payload", "value": "e6ceeb3b3d04147e295570755639b65d711b366f0ec5871b15503bf79ebfd72e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655542797, "uuid": "dcfadd32-e1ba-4b84-9f87-ee2e72f11edb", "comment": "Malware payload", "value": "fe4e6e30cb8593c4bea6689f047ac928df5a09c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655542797, "uuid": "e0eff216-15b8-408e-bd33-b73d2f559727", "comment": "Malware payload", "value": "bd6014c799b19d0d2df69f65a02068fb31e7d633112d7b44bce0f8ed9c2cae0df5acfa05bf60248049e1d2bcc9f23e70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655542797, "uuid": "2f55ee47-6cb6-4f1d-8cfc-f9fac7d204cb", "value": "T1C47623235128915DE0E1DC398537BDE032F70E9ACE81EC7855E7BCD2253A9A4E237993", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655542797, "uuid": "b09027b4-f571-4cee-8361-af06732909fd", "value": "ac9f9903da25e30d9ef7a4c4a0bac686", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655542797, "uuid": "37e78d8d-cd17-485b-972f-dc246dae5c90", "value": "196608:xtI6UJf0WmslXdwTtycsaoiLuScJYbLEGZZvqny4qkn:s6Q0X4XdwXLuvYnvqyen", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655542797, "uuid": "3b32c199-1c26-46c4-b353-797b75acab60", "value": 7792254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655542797, "uuid": "f86013b1-97cb-4f43-a489-c5dfe5d4bf18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655542797, "uuid": "b2f49039-28df-4dc2-ab3b-9272603dcd65", "value": "KHbrQL.exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28d91004-ef17-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655564329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655564329, "uuid": "f8b369bf-350c-4596-884f-4deaf93c61ed", "comment": "Malware payload", "value": "fcb4a6f299be7168bea772af871e203e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655564329, "uuid": "c7430ca0-b346-4f24-a9e6-583615f5c91f", "comment": "Malware payload", "value": "e907ec4b1da6b2fa4e2fcff5b80d8c004f3b8922fcf62a76988a5a16036dcf8f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655564329, "uuid": "09d625cb-cfd6-4157-8fb8-651de0ff9af0", "comment": "Malware payload", "value": "26428cb21220443643e53c619a98dac6d35acae6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655564329, "uuid": "837b92ff-1079-4698-b50c-de79853ec27c", "comment": "Malware payload", "value": "5095301f027a00fc4011ab06eb8705b993593c1f315b9dfba54abb0521bb6334aaab227f617d75016d528607a54df942", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655564329, "uuid": "49b20ee4-d849-47fe-8bba-9d7ab5a9e3e4", "value": "T194528F27CB0AE470C65A11BD00EA03F6E20C8549C694FBAEAD15F1DD52D4ACB0B777C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655564329, "uuid": "cb10a3a1-e030-4b41-8afe-e450b78ea36d", "value": "384:/+jY8hC78L88KAv3qYBN7LXQ/2j8YYB5LUY/:Si8L81AS41LXg2wbn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655564329, "uuid": "72bd9df6-e5c6-4a0b-9402-384eb60a88c9", "value": 13714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655564329, "uuid": "a5c89258-def9-4edd-bd15-1036931133eb", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655564329, "uuid": "b10a6ee4-1ec0-4ce0-878b-89aa7ca3292f", "value": "test_exploit.docx.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d83a4cff-eee8-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1655544436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655544436, "uuid": "35b9f0c2-2f05-424d-b21f-ea20af147490", "comment": "Malware payload (RedLineStealer)", "value": "91758485b44f8e3d4c88e0b1987f3802", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655544436, "uuid": "4167698a-9544-4faa-b353-729e3e507a74", "comment": "Malware payload (RedLineStealer)", "value": "ead481a414dca39f2006c90a2eca35494089189630913f412502db079e5343c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655544436, "uuid": "180c2c92-d243-4013-84b9-a7caa16c03ef", "comment": "Malware payload (RedLineStealer)", "value": "59982a0c816cd509e6a99d53c419c5a4ff90a095", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655544436, "uuid": "cc53bb0e-4dd0-4781-84fa-c845a5f30c3d", "comment": "Malware payload (RedLineStealer)", "value": "d9ba49c9b8ac2d36e9cde4458b8f3bd856a9e959c9d3fba58ce9c90daacf9d306159affb52ac876d62b06c776c9d8c73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655544436, "uuid": "cd8c19cd-5bc3-4d98-b4e6-3923494406b8", "value": "T144B51A035A8B0E75DDD23BB461CB633B9734EE30CA2A9B7FF609C53599532C4681A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655544436, "uuid": "a4b28e21-4dbb-4ccd-87a2-9b60998c3d97", "value": "173f21264bb93a9594f52769c5258a5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655544436, "uuid": "98f63abc-dfd5-47b1-bd36-d69a0b03e4ee", "value": "24576:nQC3JfjlG/DnkxC6016rIJFCHxlEcfy4s3EGuQ5p3h3u1qc:L5G3ErIfCRlE83qc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655544436, "uuid": "b597ccfe-4532-4777-abf3-465d1951faf3", "value": 2395216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655544436, "uuid": "700109cc-c012-420a-be8b-b01acddcd1b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655544436, "uuid": "8dd24910-25d6-47ff-965d-41a761deee00", "value": "91758485b44f8e3d4c88e0b1987f3802.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68859611-eefe-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655553698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655553698, "uuid": "d279a3c5-358c-4e83-8126-ab0e490cd518", "comment": "Malware payload", "value": "e97d9da16a0e7f538d0b317e9863ce3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655553698, "uuid": "175bd5cf-294b-4d5e-9fe0-13962bb6858d", "comment": "Malware payload", "value": "eaf08f6d20670daa716352b18fbc7801d4dbba9e26f986cec4234947e83bba0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655553698, "uuid": "ba4a5446-e3f1-45c4-9e91-366a6479972c", "comment": "Malware payload", "value": "d432365f43c862ea2c9a8d2fab3417697f49ceb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655553698, "uuid": "6817c10f-9902-493d-89fe-00e356e40d95", "comment": "Malware payload", "value": "f841adc9d326d2d0809651b5d14375d35ffe38eb5cce553bcc42bc88711c0dd97013d5df6553ecb440713b2c4cb4c1d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655553698, "uuid": "70b8aaff-d3ac-4b79-b6b1-feda759e7054", "value": "T1ABB39D41F2E242F7EAF2053100A6622F973663389764E8DBC75C3D529913AD1A63D3F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655553698, "uuid": "cafa7926-faf4-433f-9335-75e3a663222a", "value": "2c5f2513605e48f2d8ea5440a870cb9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655553698, "uuid": "90a7d3c0-3206-4c99-acdb-1dffd36906b4", "value": "3072:S7DhdC6kzWypvaQ0FxyNTBfCSru6pOILaufaz:SBlkZvaF4NTBKKfaz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655553698, "uuid": "6ca5c8ef-1c52-4395-b694-6bcb5ad6f0fc", "value": 117760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655553698, "uuid": "4caae739-2527-4918-8d80-a7ef6a5de575", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655553698, "uuid": "7db89349-a3d4-4985-b7f7-ea1438e4418e", "value": "Hackstore.exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88166e35-eed5-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1655536142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536142, "uuid": "87aa8bb9-9007-4265-83d6-695a766d7b70", "comment": "Malware payload (RedLineStealer)", "value": "6d1f65daa4a16f5c3c84ab52c8dc79c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536142, "uuid": "da0f056c-3eff-4d93-8931-0f3e71d41b36", "comment": "Malware payload (RedLineStealer)", "value": "eb77f25f7167c48edcbd42397a41e865056a0fa3352e687ec3dbeee23ae9f329", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536142, "uuid": "bd15fe53-572a-4138-8030-90dbfdb092fa", "comment": "Malware payload (RedLineStealer)", "value": "c80276fd55528476270b1908d531c7678b0443a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655536142, "uuid": "63b3deb0-af80-40b3-a814-48d85b2698ff", "comment": "Malware payload (RedLineStealer)", "value": "b43ae40805176d4056658998cb797203f665ce6aa53057a0454284845aa8c660b864b8880d9874dcca50984483bfd907", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655536142, "uuid": "1d3b204a-b0f4-490e-a090-1dbbd7cbf65e", "value": "T17084F1227270C433D1A326708965C6A27EBD79334574969BBB94077E6F607C01EFA38E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655536142, "uuid": "7b48a18e-834f-4a5a-9d61-146925993b61", "value": "bc5f8227f4a685283adb5a1e533d1252", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655536142, "uuid": "4c5fe6c4-e654-4307-948f-5b5907b50f85", "value": "6144:NFNjxe4896hB/2Aeh2/clYpnxBt5awDzJaHz:NHxe4896vOAe8/clqxBt5awDtaT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655536142, "uuid": "120caea0-212a-4b9e-8c11-8ebae5dc9708", "value": 386560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655536142, "uuid": "42113fb4-9d44-4a1e-bae9-c21f45312812", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655536142, "uuid": "d60a8450-7a77-4dbb-9d97-0dde1efdff8a", "value": "6d1f65daa4a16f5c3c84ab52c8dc79c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64c675f8-ef30-11ec-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1655575166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655575166, "uuid": "00546ac5-8249-40bd-b2f6-0e8ca7ca9cb2", "comment": "Malware payload (AveMariaRAT)", "value": "0bd9ae0e9b8d5f93301641aa9ac75222", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655575166, "uuid": "0a2b19b9-df5c-4bce-b73c-3351e76d8f1a", "comment": "Malware payload (AveMariaRAT)", "value": "eca95813284ae60bad441556bded4c5eaea3d6c6b2169422999e32e0da7221de", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655575166, "uuid": "b69715ae-15f7-4896-801b-b53f27e3a5d5", "comment": "Malware payload (AveMariaRAT)", "value": "74486d932c565dc54d53c5b5de408d2dcf95f0aa", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655575166, "uuid": "38778f2f-574c-4360-aa6c-d9343ce31ac3", "comment": "Malware payload (AveMariaRAT)", "value": "2b4829b1557e1f963aa6b7484ec7385de96fa1acca94fd61db74acf247b7657aab10955fae96ba4e8faffa9d79fac037", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655575166, "uuid": "4a9c724f-886c-44b5-9a6b-8aa74c9a5522", "value": "T19E459A915D388048FDEE8EB1645862D35AD2DD436A6184AFD3587F0AD23239CFDCA2F0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655575166, "uuid": "604dab78-2302-4162-b791-2ee31fa1a747", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655575166, "uuid": "26f1d85c-a1da-496a-a5d1-ff4cb4eac42a", "value": "24576:k9Tx+LRWC/dgLvYqOQ5X6j5/FIH+ArLLbLbJzjx31:klx+LkC/kvYqhIj5/FWLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655575166, "uuid": "9cc08c5f-5145-440f-956c-c0dc44a4e7e0", "value": 1240064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655575166, "uuid": "cc39a2de-0247-465f-9054-fb798a392bf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655575166, "uuid": "e2ca00e2-1018-4c8e-ad80-11f2f2b4c15f", "value": "Doc12389904938_payment advice.xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b012cf09-eefb-11ec-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1655552529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552529, "uuid": "354a79fe-2951-4571-b33a-a9dbd8320954", "comment": "Malware payload (AsyncRAT)", "value": "db363177ae165f7619c8b00177a2f679", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552529, "uuid": "bb8f09ba-a53f-484e-8eea-8b432fca28c0", "comment": "Malware payload (AsyncRAT)", "value": "ecdd51b1e2598f2e9619dde588fe90f446750c019a322b7d7f99de6853c1942a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552529, "uuid": "4512f61d-1bb5-48b2-8587-949e419a293d", "comment": "Malware payload (AsyncRAT)", "value": "a5415c6e9c853fa8b826a678cff87cf841619a1e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552529, "uuid": "0b79bd8b-9de6-49f6-b07d-5a6d2104be3c", "comment": "Malware payload (AsyncRAT)", "value": "51126f45d2a2c927d807c196bebb3d02b7c6b47b95e0ac707d6769752431568c67c83223778a9ab82d5cb92965ea5c25", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655552529, "uuid": "b521f619-9a22-4291-a35b-c21669d7a395", "value": "T1C4235B403798C136F2BD4BB4A9F3A2458675D2676903CB8D6CC464EA1F13BC59A036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655552529, "uuid": "6bf623b3-a2ba-44b5-bc05-e2e96623f354", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655552529, "uuid": "804e8525-a016-4ec8-bf49-3313256b9f58", "value": "768:k7GDMmILyCe++biOnSKOilU8YbsgD30KDYjvEgK/J7ZVc6KN:k70MWSOnSKIzbj4eonkJ7ZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655552529, "uuid": "32c42fab-d834-40c0-beb2-65e901379dae", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655552529, "uuid": "96ed63a6-449e-45ae-bdcc-d4f1aee84863", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655552529, "uuid": "8474293a-caa3-49f4-a380-7bf74e218fcc", "value": "wtfman.exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "773464b9-eedf-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655540408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655540408, "uuid": "3baab843-8464-46a5-a259-67a23a90a24b", "comment": "Malware payload (Mirai)", "value": "13392fedf4360019604e6a9ddbc888a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655540408, "uuid": "e33047d3-1849-4885-b7f9-fed7cc26b2a6", "comment": "Malware payload (Mirai)", "value": "ed45cca17ca7abf7855ebe9e1e1a753bfa02e0fa3a54fb2461fc35e176bd57fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655540408, "uuid": "f37c97ee-f129-4284-b138-722449ca3916", "comment": "Malware payload (Mirai)", "value": "b47c27c8e74bfb94701ff39d31ad9005a11eed8e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655540408, "uuid": "8650f128-db51-4157-8dd6-76f23a031cab", "comment": "Malware payload (Mirai)", "value": "7f276b742829dca8393dce46a2b0bf45bae1fd802245bef453e30d7278538ac17f275fb74dfea34ab2b120979bdeb52a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655540408, "uuid": "148d38d2-7fde-4cd8-bdbd-b8de698413a8", "value": "T1C483C90E2E319FEDFB6D823487B74A219799339536E1C684D29CEA011F7034D641FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655540408, "uuid": "1de17258-fe8a-49a1-876f-b50817cf5f3b", "value": "1536:szQesgksJ6EMAjw+nJFy8fOJvfWecl+h1:sz5wsON+nJFy8fOJvfU+h1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655540408, "uuid": "e5b0b585-cbca-49cc-a05b-778e5f29864d", "value": 80772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655540408, "uuid": "2838489c-1cda-4241-b3aa-cf6a0b7584e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655540408, "uuid": "081eedc4-382d-4b37-be9e-f881a3648768", "value": "crmips.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72fbf2a3-ef20-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655568318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655568318, "uuid": "1294ccdf-5ede-472a-9bf7-31aab26bc407", "comment": "Malware payload", "value": "1a94aacbd41b27142078f21ab3d611c7", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655568318, "uuid": "65914092-adbf-4a69-8e04-3b43eebcf1d3", "comment": "Malware payload", "value": "ed6c7c9a1e5710c99219113029f3ae674aa7d496b40fc82d6cdce42fdb85c2da", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655568318, "uuid": "d1ef7d33-89d7-4e3a-8e5a-00c33372f01d", "comment": "Malware payload", "value": "95fea3b30698eba130a8ccdec5848f91620b3b9b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655568318, "uuid": "a5ec6613-d43b-4c52-8795-6d009231cef1", "comment": "Malware payload", "value": "d6d0f88f90db29f512d7f3b0618d360eda607e7d06ed7715d69cadf711e0c70592ac6431c57b678696d4611ff07ce51d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655568318, "uuid": "7e22e156-f053-4ce9-9998-7207c093792e", "value": "T1EA218657C7BA4D1EC11F2CB74189B2ABE99360ED1182BDAA136C133E1E05181E338ED5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655568318, "uuid": "b024ac00-6546-4f1f-901f-0d4d4baf2b43", "value": "24:dCAE8W+ffSlicy9LkaHTOLaTm1LUM3RaQpfnGuhmAmuO5Qq:0TsS4XJ1HiWKNxbhDbOx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655568318, "uuid": "8729f298-8466-4482-aaa0-e1e8269af155", "value": 1135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655568318, "uuid": "af348ad3-ba75-4336-90da-abf0df1a6c13", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655568318, "uuid": "5edb9780-0082-48d7-a9fe-75e990e83852", "value": "Items3579.zip.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51788ddf-eedf-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655540345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655540345, "uuid": "5c793904-22bf-4874-923f-5d4fa3301b28", "comment": "Malware payload", "value": "e22fb44c1db93a2f208adc172e055825", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655540345, "uuid": "2b26025f-05ae-444b-9d5e-7df0e0517270", "comment": "Malware payload", "value": "ed84ff97d5a66d88fcb20797f05b6a390299730eeb35c60c7deb65482764812b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655540345, "uuid": "56450497-8763-4a2a-8bd1-585897b1b809", "comment": "Malware payload", "value": "2ab95d3f98b9c29fb547342d590b2dcc7a7080a6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655540345, "uuid": "64d91899-d83c-4e43-a34d-993506b66db6", "comment": "Malware payload", "value": "ece99de3fcc19eb139cbb2799b39e977f9be62c8f75604d905a805e2fd1c1b93fb8f887dbcc810ab8b6575570fe59806", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655540345, "uuid": "fc9d07f8-454c-456d-a4a3-7a1712816d55", "value": "T1424147C691B34D31AC52E963B1BA45B0B9C4E1D705D9BF066AEC78F518CCE28E490B53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655540345, "uuid": "8e79472e-37a0-470d-88f9-042f1ce17d3f", "value": "48:vKZRUxKZ9gKZUOgKZiKZ0JKZiKZuKZKgGKZeKZUnJKZ+KZQLKZfqKZB:vK8KwK+OgKEKgKkKYKQgGKQK+JKQKyLQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655540345, "uuid": "9043fd2c-ea6b-455b-b036-d3147b7e0577", "value": 2072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655540345, "uuid": "05e9355a-b2ce-43e4-b3de-001b3d617563", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655540345, "uuid": "981ddb84-ea9d-4c6f-bff9-2a63e9de3a40", "value": ".ferb.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09093b3e-ef49-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655585750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655585750, "uuid": "0b081c7d-4287-4698-a7f1-3f83ff942e9d", "comment": "Malware payload", "value": "73196f394725a9623d84a512cdddf6ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655585750, "uuid": "47485342-7ef9-42f9-9b65-a7aa8cd05e33", "comment": "Malware payload", "value": "ee4ab4017c6e9c0883b2c1e42d0f0264f178ad2c6416e07d77169fdf94d1b1a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655585750, "uuid": "533b917d-16ff-4a85-abf1-4e03310fde56", "comment": "Malware payload", "value": "4d24d92f70b2cbce52b1b173162b8f504ee7752f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655585750, "uuid": "22e4b098-894e-4f62-b7e1-59fdbcc91700", "comment": "Malware payload", "value": "1c504fd61b03de825dad67f5266ee8a84db2f5816f88956afb3d6bef6d432fb0f098149872e1b16b6b288008f5aeff6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655585750, "uuid": "8ef23231-974a-4916-bc4e-23cf413abc30", "value": "T131033A4D7FE1816CC5FD057B05B2D01207BAE04F6E23D90E8EF664AA37636C58B54AE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655585750, "uuid": "26ec30a9-5d27-4993-b896-7c2063763718", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655585750, "uuid": "7b13a048-9432-45a2-900f-57ad9889369e", "value": "384:QAFDylgibfjpPu7w9qyMTIvfTSs2EWfbrAF+rMRTyN/0L+EcoinblneHQM3epzXX:nWNN9ZMTIvWVEIrM+rMRa8Nuj8it", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655585750, "uuid": "b969524e-e7fd-4b3b-ae9a-85cfcd955e22", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655585750, "uuid": "256274ca-4e2f-4483-b4f3-be0ffc529294", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655585750, "uuid": "397102f6-855b-4bad-bab2-0a82a4f2e680", "value": "tmpE1B.tmp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21a204e8-ef25-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655570329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570329, "uuid": "3d8cb91b-2cb9-4ac4-a4ea-72239da84df9", "comment": "Malware payload", "value": "0a7039eae47eb42b5d3f34fa25f0a4de", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570329, "uuid": "2dec3937-3936-4957-aa40-cce5b759d2ad", "comment": "Malware payload", "value": "efe614ca8c25e404594a43020aa2c613badd160a8d9582ab1baa85eca19bdd12", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570329, "uuid": "27995bdf-4a91-4845-b2de-b8b1d7f8156e", "comment": "Malware payload", "value": "fbcfa4cfe06d72e24c78e63c3336138e00a1bd6d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655570329, "uuid": "047e4e2b-1c4d-4af8-8750-d9e09421126b", "comment": "Malware payload", "value": "2f174112a1cf7973324659ce996ba11c0df35d4df08c6859dc4c1965fdc0e3b2cd20e26859abd71b24225ef4e0a89085", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570329, "uuid": "6b167ed5-a44b-4709-bd9c-6c420ed9d102", "value": "T19821B5579302DA41E91F7D79C0FF4B934D98D180A9E17A032DCD6C14A60CCA69B771DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570329, "uuid": "3bbbf81a-b47e-46ce-883a-0bba3cd32a76", "value": "24:7KhTck8ykLluS0ob4HlbPnlMgdmKyRVjzg5HRsKb:O+/b4BPnlVmnRJzg5HRXb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655570329, "uuid": "434da0ba-d7f9-4040-8a94-4eb48ebbc611", "value": 1126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655570329, "uuid": "72b5ebcc-7697-4ec5-919e-b120e1516bbc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655570329, "uuid": "da9c9340-be95-4432-ab5b-656f88d6652b", "value": "Copy1746.zip.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e116bdc8-ef1b-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655566356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655566356, "uuid": "17d14208-c56a-4f3c-8598-31fe0f24e306", "comment": "Malware payload", "value": "a3a280750b92faba35ab7b6a9236ce0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655566356, "uuid": "b75cc43b-a664-45cc-a0cf-b668f7820ec4", "comment": "Malware payload", "value": "f1b27436b93fc710bd8966d93538f814023cb013afac4c3f16e07a2c6886868c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655566356, "uuid": "8348ec17-e972-4803-bc41-9ffdda324b2f", "comment": "Malware payload", "value": "21aa3c60707f7670641e2853efa44c9f2baf6e42", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655566356, "uuid": "c38bb2f5-ea42-4306-bfe8-e47eecf2452e", "comment": "Malware payload", "value": "e6b480431990fa5b2ae7e87a4e718eb0868f6df2bb0eed7c9fbf169bad53591852507c90ae2101b7825f14d4ce8575d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655566356, "uuid": "b8aa74fc-157e-4574-bcff-a41e6da3c438", "value": "T1B1C32A46EB418B13C0922BB5BBDF52113323DB5497EB33065928BFF43B8279A4E27516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655566356, "uuid": "b59f58fd-f9a8-4e81-ae00-295cea04f1af", "value": "3072:nyaNR9xzChWvo+ItQ3KSdxV9+nW3nmjwh0vqk:yaNR9dChu+Q3KSdxVYnmnmjwhQqk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655566356, "uuid": "9a967106-2bbe-4eff-b786-c5a603cd4c1e", "value": 128214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655566356, "uuid": "03f675d1-3d8f-4633-b29b-7f1675d738e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655566356, "uuid": "3f7a2126-d7a4-4b36-99f0-4a9ec19675b5", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfe4bded-ef1b-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655566327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655566327, "uuid": "791d6832-75f9-4753-9628-768fa5c2c868", "comment": "Malware payload", "value": "2f60eb8b448550519668cca231348cf6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655566327, "uuid": "f78ae84f-f8bf-471c-9701-10a754dbc223", "comment": "Malware payload", "value": "f27a99963b0b586ee07c99764907ad53688958335501f733f2c1d687ba137d1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655566327, "uuid": "11a4e958-fc93-4887-b833-4ca3589fab3d", "comment": "Malware payload", "value": "5bed8fcff1300b68634a33552072de8117ab1bdc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655566327, "uuid": "043752e7-d86f-4bc1-a942-b149d25337c3", "comment": "Malware payload", "value": "becef966b403816bf01c7ab60e1f8170f0e14f8e9ef6a21e152197226f7d6a464441a1f502fa9c075084094273696fb7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655566327, "uuid": "cab46649-a464-40ea-9c19-954184f09dc8", "value": "T1DD938C9BF24B1890C8128BF00BC35BDD3E2322619E5798F77C0E1ABA29751DB4E167D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655566327, "uuid": "b1815ad1-010c-4091-b23b-45d285e736fd", "value": "768:s/SHSNbwKafyLHU2pupYuXkP81kOrBq58AAZrJpfJj88ekMagAXLdwI554RZh7I2:sqHuaa02paUPgBqWNfphjSOgAg/LWm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655566327, "uuid": "57409fa1-d837-48b3-89b1-0f7930a24a86", "value": 91884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655566327, "uuid": "f82bf41a-d009-4f14-99f7-88b66662421f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655566327, "uuid": "6da81888-9013-4286-98b4-5be1502ef5b4", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02a552fa-ef17-11ec-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1655564264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655564264, "uuid": "01e69666-b3cb-4d67-9653-3368f641b991", "comment": "Malware payload (AveMariaRAT)", "value": "3953d3fa4fc9bb0b56ca8ab21cd10c02", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655564264, "uuid": "1fe3d8c7-bf95-4f4e-a9dc-8e8a91d47229", "comment": "Malware payload (AveMariaRAT)", "value": "f39b59ac3799b134b02f8030b5658ef8c0d459fed07a914c5c58918a13d85a69", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655564264, "uuid": "c35038ff-1c6c-4c1b-983f-c90414516b81", "comment": "Malware payload (AveMariaRAT)", "value": "ddd6a2fe621297cf98d5f8e49fb73cc16de3a12b", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655564264, "uuid": "49485205-89f7-407a-8855-9a923edd274c", "comment": "Malware payload (AveMariaRAT)", "value": "24f77adfd9126ce5ccdf3c0c9761bde9e23029606aa50c069cfc1b0056883db58fd2e6afe69de7577fb5ec5b08d7a694", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655564264, "uuid": "791770b2-9482-4ba7-9128-07bff9da47c6", "value": "T132C39D03B7E44474F3F205BC1AB97A39CBBFF9701875849B9364658A2D7198AEA30347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655564264, "uuid": "140ff087-8c2d-42ca-a40f-acba396c2f56", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655564264, "uuid": "bd258b03-01dc-4698-9729-4b6b92cbd3a6", "value": "1536:MhkhP+S//71vb1WcHhjtm99B8006cuhNC+noBIb0OVE01p:0SF1L299+0lfk+otOVE0D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655564264, "uuid": "d0e7d45e-93a7-4c42-be16-843c6ae471d0", "value": 120832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655564264, "uuid": "222c6118-4546-4e21-905f-a38761f83c89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655564264, "uuid": "ea007ba0-24e2-4cf7-b01a-025187a167e5", "value": "ConsoleApp1.exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb74f817-eefe-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655553944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655553944, "uuid": "1083e278-0ab5-48e5-91c2-8a8b4fd72e05", "comment": "Malware payload", "value": "e95f6905e005d69bb7fc6ea78cec08d8", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655553944, "uuid": "88b89e02-d16c-4631-9a00-49e1270bcf5a", "comment": "Malware payload", "value": "f441d3118bfd774b59a00c4653004e1dd6573bcc126bccf6cc9809754fa81f5b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655553944, "uuid": "d6b50da4-579a-49c2-9ada-6f835c354d4e", "comment": "Malware payload", "value": "19444100a96bc946f1dbf0aeaff1eca1f28a5155", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655553944, "uuid": "0bfa8a89-1def-4350-9870-897a115c53f1", "comment": "Malware payload", "value": "bdc98e7e367b02bfbae8402f38796f459212b6d4b788489967bd697be66e01b78fec31b22912156a0a075cdaa592d812", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655553944, "uuid": "274652a0-abe4-4659-bfd4-94a5ec6c9ae8", "value": "T11E773397F7A8982EC4F393B6897A43B6044B0D1A8743DBA36818737C29B79D41F45BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655553944, "uuid": "1c90d8fb-3558-437b-8b9a-17fa7b8321c7", "value": "786432:AlnUf4rG0EQhaJUkQPyZKca19EAL2ZQT1:A1UQrG0hLka119E6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655553944, "uuid": "508b2717-7e97-4a0d-86c4-920e9cbbc3ba", "value": 32946384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655553944, "uuid": "3fd13a4d-5225-4654-93b8-e4d8cb2c5d68", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655553944, "uuid": "ecc8d2d2-d802-4a32-82ab-cd4b33bf92a4", "value": "Cool Wallpaper SMS_1.0.7.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f023ecf6-ef1e-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655567669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567669, "uuid": "ea798f0d-ca10-43a3-b887-f277e27c9073", "comment": "Malware payload", "value": "81d5f132ef944c67b4de5a1711559b04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567669, "uuid": "34bcfb91-5c14-45be-abfc-20ba941c85ed", "comment": "Malware payload", "value": "f4592dbf939ded09c09585dcb8d54c02e7403a1124c9c24f96c423029e9e8658", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567669, "uuid": "c762b308-e071-4dda-a148-5f505901218b", "comment": "Malware payload", "value": "cbe841d5388337d6482f71f75994fed31239ce05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567669, "uuid": "96becce5-1c40-46a1-9c71-887645fabd13", "comment": "Malware payload", "value": "bb96cea9f7f7200a875254f779b6fef154690eba7f6b0f55ebe90a4cac748a72b9637d8ac87f07942e189a714a237a86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567669, "uuid": "9b50d247-bd64-4f35-9fc3-f177cd03ee5b", "value": "T19F456C32F1D1D537C1AB2A38CC47C5D95826BE246E38684B7BE55F0C9F392827A291C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567669, "uuid": "4174b21b-fe82-4d20-84b3-645c584e08e2", "value": "5743ab31f9da70c21edd8fca256c8236", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567669, "uuid": "ac697aa5-2550-4d32-a9f5-220cc14503fb", "value": "24576:YeXI4XluwIh5mFLMvoLQ/1z1nc1bW976qdHhlAoeg:Yp5mdiyGck99Aod", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655567669, "uuid": "129e385d-25fe-4bb1-bcf8-2bfab56ad94a", "value": 1169920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655567669, "uuid": "7ce8be65-a627-4764-bfb5-497dcca7a999", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567669, "uuid": "87d60aa6-6312-4a58-a290-23bd423dbe30", "value": "Project1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21f8f902-ef17-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655564317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655564317, "uuid": "ce24f84f-9827-490c-a5cf-a33fe4d13f45", "comment": "Malware payload", "value": "07096d79bbb771fdc64afd55defb34a0", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655564317, "uuid": "9529bae1-b5c4-4a02-b8d4-07881c2dc4a4", "comment": "Malware payload", "value": "f62b3b300e5499695892415e43d7a6e536671a9a9e1f8cf6a5f5b240f0c5084c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655564317, "uuid": "ac5bd866-431d-4738-86c4-55ea59edfb82", "comment": "Malware payload", "value": "74f1acbe3a7ce878218ec895219f832e63e33cf4", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655564317, "uuid": "ed3fe820-fee1-4314-adf8-745b09b9a67f", "comment": "Malware payload", "value": "a7deebdfa75d0a9ebd7696064c7e7ac5deecde2b9660523e99df1c745e57a5c53720453858b6170a34f16d09a21cc949", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655564317, "uuid": "044289f6-4cf0-4961-8a13-9b97f57858e8", "value": "T103D533861417E9F592C0F1EA8B6A310F550C1AC3FAFD62B623346B6C9744BC2765F8B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655564317, "uuid": "202d3501-f6d6-4ca8-ad31-dab104a515ab", "value": "49152:N4Hj21fASm7chbO563Khxn6tCcrjksI8rSYqP6+Ytgwf0iNEEacMC1o:+Hj+14GJKoxACrSYe6+UgwMiNEECCG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655564317, "uuid": "622e392a-9130-41a3-9dc1-d5ff4b8c5b73", "value": 2748384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655564317, "uuid": "c79b31ba-aadb-4d8d-8af2-53cdc333e6f4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655564317, "uuid": "bdf8371a-daf5-4e1f-ba55-2cfe0b6d8696", "value": "agsolbiatearno-doc-17.06.22.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b18e39ed-ef57-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655592046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655592046, "uuid": "2f73f996-dd1b-416d-a287-fee8767cd62c", "comment": "Malware payload", "value": "8ff709cb8fed0155fc1c77c7af4d1d08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655592046, "uuid": "05e5d4fc-cad1-4fe1-af7f-b6ef64abb4aa", "comment": "Malware payload", "value": "f62cebe556bf3cdac1deae1af87712ad928f25e95b6630973511903fcf889c37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655592046, "uuid": "7e4f020e-a826-4c62-a60f-d6d127dbdf1b", "comment": "Malware payload", "value": "654d0436fc8e0042c9dcd9597a1bf4ba60d629b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655592046, "uuid": "0e6ad0d4-5d31-4322-a341-4b0e91781703", "comment": "Malware payload", "value": "ec79c2792b82d51eec5fb778f7f4c4562db9884ad7c6bedfd75df108a507f26619b2ceccba32f5173846f69cf213962b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655592046, "uuid": "64423b34-b111-44c6-8017-5b1da67ac56e", "value": "T17A159F613DC1C171DDF220B581ECB924427DE5B00B275EE79BC897EEC6206D63B3A986", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655592046, "uuid": "f588cc32-7035-43a7-9c35-9904a75ee4fa", "value": "08a024e881cfeb4e54ac3c8a2ca94678", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655592046, "uuid": "52ec253e-c9fc-4e92-92b1-bb58825d668a", "value": "12288:lS7+S/4i+Sr54tlkSo5FDUFco4PwgOC0yxJQi7XLZF/Uhunnc6vD6ZeqQ:lS75/4Ir54tlkMGxJQinZF/Ui7s9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655592046, "uuid": "df377862-42ac-4835-b8df-2c3f7da56a42", "value": 901120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655592046, "uuid": "ce40625a-39ce-433f-92b4-b65dc85cba66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655592046, "uuid": "b1ce528d-69af-4d1e-915d-a23814a48dff", "value": "main.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09300259-eefc-11ec-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1655552679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552679, "uuid": "44e4af53-4c1e-4631-9f93-c3007a07b017", "comment": "Malware payload (njrat)", "value": "ce3044a356e524e452818a3f10fc7e2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552679, "uuid": "f863acc2-fca6-4d0f-9a94-d8623c78d8ff", "comment": "Malware payload (njrat)", "value": "f648a5b82618f7d7d5a29a99ee26ea5872ab1e7321935ae08ca6676d6b7f6427", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552679, "uuid": "29b5beea-c1dd-4de2-a252-bec1227e3b16", "comment": "Malware payload (njrat)", "value": "3091620a3440608d47b663bb198b01b2a6e595fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552679, "uuid": "74452762-e61b-4aab-8f26-1e4deb0e1e88", "comment": "Malware payload (njrat)", "value": "78fc5034346cc2d7c86347b2f29b2d2823385923cf19fa06e361234e5bc030c16b63d704fbb2521d8fce42c671e72e2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655552679, "uuid": "2bf934eb-3db3-475b-9449-f373efeabdaa", "value": "T1D4F3399A778A4B15D67C0D74D0EB5A3403F1DB831632E7C92E88259D8F022E35E4D7EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655552679, "uuid": "7343d3e3-2271-4a5e-9701-03832054c477", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655552679, "uuid": "18aef5d2-77cd-4d46-96b2-9ffe20a6cc5f", "value": "3072:ij2w/g1rz/UozowfB85clLEAZVPE0LVy9b/O2Z9h7erg:ijpuB85clZVcOVWb3er", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655552679, "uuid": "8f9c9ba6-aa4c-452c-aeeb-fcaeafa527bc", "value": 168960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655552679, "uuid": "ea604863-86c8-448d-a020-456101377793", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655552679, "uuid": "ccd36d14-ab1d-41b4-904d-ec93c51d1700", "value": "New Client.exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "909bcd8b-ef20-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655568368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655568368, "uuid": "e4a5c488-602d-453b-bf1d-33bc33430a51", "comment": "Malware payload", "value": "fa526426e51677d032cd8e2ae86802df", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655568368, "uuid": "2eb7ec30-0d22-4a59-b382-9026c37a3924", "comment": "Malware payload", "value": "f6efadde807618a43b0ffe907c213ba2a8eaf464badc0ffc92232504bcf14e73", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655568368, "uuid": "65d5d536-d8ee-40b4-ba15-63a40ed8085a", "comment": "Malware payload", "value": "45c5322b8f1a029c067a975c862f8af54af45243", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655568368, "uuid": "3a796b13-c2b1-4fa4-9a42-91a04544d5ae", "comment": "Malware payload", "value": "ad8dd31ea26753c2b4f3f037f59cb531df7717b490419b9d2dfdb3c13efbc6f2b3d67a03300b5d81ae6e8ffcea8f6015", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655568368, "uuid": "fae21dfc-278b-4229-9423-3aa74f425747", "value": "T15721B957D1581989F71F1C7BF08F33181771372E10C8BB4357557565310A3272E354A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655568368, "uuid": "a1c10932-ef38-44e9-a494-079a96295c1f", "value": "24:BC4UZkMLw8vsf/UCi+yhBWX6g/cUjtW+q3KQKLxSQL0FhUvOw8BDD:w4Ue4Xs3m+IQX6g/vqlKNSQLvvOZBn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655568368, "uuid": "1f6bc225-7cd3-4878-9243-93350aec60f5", "value": 1136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655568368, "uuid": "746a206a-d2c1-42c2-9374-4102f11ecfbb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655568368, "uuid": "ad9fbd83-08a2-4e9a-9d9c-df89e5b74080", "value": "Items8837.zip.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe69dc35-ef16-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655564257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655564257, "uuid": "bbff922f-69eb-42f0-8224-31815813125b", "comment": "Malware payload", "value": "c7dc6501b412426f49c1243904da2552", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655564257, "uuid": "8407bc91-2a78-42c2-a6d6-061e7ac77efb", "comment": "Malware payload", "value": "f76d647e8e6a336cfb10868aa45e2db6af9b09a7cdbb99bbaf32d6700fbff464", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655564257, "uuid": "6f02a7df-28d8-4ad0-8e47-a60f4468c171", "comment": "Malware payload", "value": "6ee18349579d2be3faa05b2ed77aa4aac39764f4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655564257, "uuid": "196d5cfa-467c-43c1-8b5a-e05458d70d62", "comment": "Malware payload", "value": "7a0a561472bc8b95c1b74d75eb41991580d16369821de92b939ef17746347f98a460e95a72e93ec7d35ff6a7f1586ed1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655564257, "uuid": "4c265ebf-d2de-4b17-be64-dd9ca4eb4eab", "value": "T10265330E6A40BECB806F11B3BB7949036640B2906AD55FE248D015FADA5771F79C0BEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655564257, "uuid": "9543fa85-15e0-489f-b9d7-949a701f0d70", "value": "24576:/axSx7RRICKTOqvjZskGhH684h9urlJNcahZdtkatcR6e5em6YOQCygAh2xu83xD:/7PICvqbZskGhHqkFcYkatcRn5zGQ5gR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655564257, "uuid": "c34a7ca0-1c73-41b9-9ca5-cfb60c7cfe97", "value": 1509323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655564257, "uuid": "8e494d79-bd02-41ee-98ce-4b4a26eacb94", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655564257, "uuid": "68b5ab88-6556-4750-80e3-3a1d27aaa14b", "value": "Comet IMG Logger.zip.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8c5676c-ef1b-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655566342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655566342, "uuid": "f2dbfa85-88ad-47d0-a68f-5491f5b21576", "comment": "Malware payload", "value": "6b33513c4d621281e14a2f51a3893013", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655566342, "uuid": "a0b51986-670c-49a5-a95d-20d0046d05b7", "comment": "Malware payload", "value": "f7e63585dd04ee5af164c2f9d5e5ec30f3259ce175e55c79a15d5f019a2a46dc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655566342, "uuid": "5121d66f-b629-43a6-a690-255fa882f5a7", "comment": "Malware payload", "value": "acc24df5cfb03ac940fd9437265a04d4a753ad8a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655566342, "uuid": "e577f1d0-27a8-4540-9764-63c63937e210", "comment": "Malware payload", "value": "eeacaa594a648640a2408e698e6ae7d161d90ea273f1c172dcd8495d56d665414ada54ae67db0eb8e05375802dcbf057", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655566342, "uuid": "3040ecee-c51d-4238-8da2-76ed62a36ef5", "value": "T1F0D052AA376212C7082DCE0CF16089D46249A7C5A275876AE0ECB61A246980171B2F51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655566342, "uuid": "d1a84b4f-b9c0-4094-bce2-42a675fcaef8", "value": "3:GRF93gWSK3fDOdVvuvGT3gWSK3VKzOdVXt3gWSK3hNIOOdVsK+ueKt3gWSK33GNV:ShT5hujT5vxT5hNIhTxT53aKLKiw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655566342, "uuid": "56577e87-29bf-457c-8246-f91e6bae948d", "value": 221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655566342, "uuid": "d8d9bab3-da5e-430c-af2e-6a6a71293b7c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655566342, "uuid": "429459d2-d57b-4100-bd18-7867e5eb6abd", "value": "arm.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14b7bdae-ef17-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655564295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655564295, "uuid": "9e6cc635-ca0a-4c4b-9f69-da42ed4839c4", "comment": "Malware payload", "value": "d25e6018794262f2410f911513dbeccc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655564295, "uuid": "1a755781-2aa8-4a8d-8838-b021ac25549c", "comment": "Malware payload", "value": "f83a161ef69ac7ab92c5386f3a7ab7528095a9926b2f89f0d95632a37c76d0b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655564295, "uuid": "ae4b5cfd-1c0a-4242-be4c-9913fa3ebc88", "comment": "Malware payload", "value": "2c5b55ccbf5d2faa9c10d4edcb409ba58d557168", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655564295, "uuid": "024ec3f3-cf1c-4be6-ac27-7aedac33ba6f", "comment": "Malware payload", "value": "82a677d101d03b70fa578f51384dcd36f5cbb8366f273a94a2872394cf5272dedf39308d8afb7057013ab04fbc4beb56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655564295, "uuid": "6bbd2df8-f850-47cc-a818-992ea1e55da9", "value": "T1A363AE7A22F60DA0F2D5093549B34D0AD761BC59F99FBF1B2FC0001956DFACD4662D22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655564295, "uuid": "b524d170-22ac-4a23-8bd4-01c85f287efe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655564295, "uuid": "b2f1a05f-6621-4dcc-9062-0eb2563bf414", "value": "768:IkJHwsU0mGzNiGGPEIapx80Ksuldw5VsGnxGMFD7iuw1VxbNEene7K+9fLs:BObGzNiGm8IlWiSDw1V57nev9fLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655564295, "uuid": "9e5c0604-fc97-44c2-9993-95c85b2fac42", "value": 69632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655564295, "uuid": "270cc802-3bb2-45f0-bf88-ec39ec019f16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655564295, "uuid": "864811d5-257a-4ebc-9878-76506a4e5486", "value": "Ou5tput.exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99038ce3-eefa-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655552061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552061, "uuid": "73390c82-0b06-4051-a5cc-52d3f0ff20ff", "comment": "Malware payload (Mirai)", "value": "1b435aa96210fdd2ae1727516409910d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552061, "uuid": "ee3ccf3e-8cb9-44ef-99bd-2003d66cc620", "comment": "Malware payload (Mirai)", "value": "f87cd3f56ea2bd0a2247d87579a0857bf55b3ead75e866756fd58d6e9327ed03", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552061, "uuid": "b5ccdad3-0a6e-4899-a857-dbeb17754cf1", "comment": "Malware payload (Mirai)", "value": "5749ea1bbcbd5127ceeb0ce78d8722e1f4d4bec2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655552061, "uuid": "8fa256bc-eae4-45b8-a831-710138a59517", "comment": "Malware payload (Mirai)", "value": "a71794207fef03f6d67b56b99c12c4cdc3ed2ff7594c8bf7fd8fcdc336e9e0231fc8686f091035d00d4785efb6d5df48", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655552061, "uuid": "f5f70e31-74ee-4e24-94ae-6ea7dc53f3e0", "value": "T126532855BCC1AF12C6D0127BFB6E428D372613A8E2EB33079D256F21378792B0E67651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655552061, "uuid": "fc5dfc11-bec8-4be4-b868-5ff03c012a1f", "value": "1536:PCEsPxlElhly2lz89oTYt0p+Ykcyb8vHX:PCUvz+kYt0v1zHX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655552061, "uuid": "9c778ef6-7e02-47ca-97be-a271d8e3ebed", "value": 63692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655552061, "uuid": "2a61b909-8222-4e59-bbc9-e2a7410fda72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655552061, "uuid": "430ebd8f-ddef-4ef5-9427-40b819c5da85", "value": "crarm.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2664b007-ef54-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655590524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655590524, "uuid": "337e407e-e09c-445d-8fe9-8bfeba2de5de", "comment": "Malware payload", "value": "47a998a7efae3efe3619c9707748de03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655590524, "uuid": "bdefb85b-e444-48a0-bff2-a85776130bac", "comment": "Malware payload", "value": "f906d33be62c5707e7e2eaa3a25392ead4e9d4da71c717cb5d34c5924afed129", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655590524, "uuid": "8eed4bd3-dc59-489e-93cc-a541757bb26d", "comment": "Malware payload", "value": "3aaca045716a947aefea0c62c0371625a1081f65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655590524, "uuid": "e40f5616-4e45-48bb-932e-7f71c3eee58c", "comment": "Malware payload", "value": "b9f7c2e1a1e03401bd65c9e4be88b98e91120fc38d781b3e1b2923d2bf6f706c6a93cbcc36b4c43fa2a9aec0c7f481b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655590524, "uuid": "f870dde4-4342-4fc1-b06a-e3f5e1aaf016", "value": "T1C4E533606104C4B2E4431D381EE17B34A26D0F6926DACF078237398EDAD9B57BF2AD75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655590524, "uuid": "b336cbf1-8ced-40c7-a0ad-50a8e3cc489a", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655590524, "uuid": "636b8ec1-4e04-48ea-8e10-e34aefe525eb", "value": "49152:kRUj44qJc3tzuVQlnevTAAzi7kbYhJ0Delg1Y6PQr5bJvwM2MJmWYKXXvv:kF4qSMWlRAWxHz64tVZ2MZv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655590524, "uuid": "301576cb-bbc8-4a22-aa52-a507f4f41054", "value": 3139047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655590524, "uuid": "ce275a4d-9d7d-4101-a4d4-277e0533f968", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655590524, "uuid": "d75026ee-56ff-4659-ab31-caaaaff76229", "value": "Install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dd07c80-ef20-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655568363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655568363, "uuid": "a89b4161-431f-4c4e-8a90-df4b0dbc1f5b", "comment": "Malware payload", "value": "dbc9eb573d0f0d6e5d826a7752656fce", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655568363, "uuid": "8ed09b51-22f3-4304-88f3-673a0269ce52", "comment": "Malware payload", "value": "f9aff505dd28eea81dc405c0bdc10843649fb95a592374b641381f62828668dc", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655568363, "uuid": "d0948ce4-5014-4c42-9305-b3051353e37b", "comment": "Malware payload", "value": "d5274843a4f8e9285a07070b6f137c62031101ef", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655568363, "uuid": "6a268a17-9950-4b4b-be6d-7b5b9d4ef308", "comment": "Malware payload", "value": "2abe4819fe3c0f09220a97b687bfa158bdd27a72bef21479b4cfba9d6e39e3f939db6ddcf2049d82790d559750d48c9c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655568363, "uuid": "71e4bfbf-2996-469a-9143-602b251fe61c", "value": "T15A21822DDA050E4FC35F5A7594C36B0803867B3F14CE7349B62027492A162962A347E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655568363, "uuid": "6df63e08-611b-4bf9-996f-9ed3c83060d1", "value": "12:5ps4Zlk0WjxZlky7Q9VM3ReVLUjo9+TGVhx0D+axE5vp0j04yiW7RJX6KG2uk6r+:dCVw23I0kN0b6HWdW7HIK6OH0y3O5dq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655568363, "uuid": "9aa879a1-ca7f-4a3f-a56c-9218fc3013a1", "value": 1135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655568363, "uuid": "ae7e8c29-cb4a-4d23-a824-74e695fcdf5c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655568363, "uuid": "7d5f0b3c-2a32-405d-a2cf-0bb29d2dc9f6", "value": "Items8639.zip.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "072bf401-eec6-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1655529483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655529483, "uuid": "416a6197-59b0-4b39-9e94-6bd7e468f2ec", "comment": "Malware payload (RedLineStealer)", "value": "881a184af047bda6af683da596210dff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655529483, "uuid": "5bc27a79-077a-4e71-a4d3-185fd213cb26", "comment": "Malware payload (RedLineStealer)", "value": "f9edcdd66c37e637308fcf3bb12ffb42eb691f896bea334c6bc1264a38faf144", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655529483, "uuid": "1782ff7a-1157-41a1-88b4-00a176d9a314", "comment": "Malware payload (RedLineStealer)", "value": "0b4a19e1e1d30e026496c5c67477ddb33d1bc1a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655529483, "uuid": "813b26f2-a497-44fd-81cb-f5e45f413ba0", "comment": "Malware payload (RedLineStealer)", "value": "fdc58641d842880ca4e7fa5a1ccbe472e0bdbd4a16f50ab132e38ae46e8e3e1da1a1fe2fdfb81a81afbf06ea3c754b72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655529483, "uuid": "79a36e4d-2281-4098-a171-d543638ae4f1", "value": "T12DB5F8139A8B0E75DDC27BB461CB633B9734EE30CA269B7BF708C53559532C4681AB42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655529483, "uuid": "c53a3d70-1a1d-40f9-8ac4-9d9fcfd72372", "value": "4abe00f9bb2c9be2a818a94bb7c50882", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655529483, "uuid": "409f2d88-394d-4ff5-acff-ec1b9ef7ee89", "value": "24576:T4ZkZ2RNoul3+/4Em+iwJJWYQa23yqQvZJBwVAAM9GmRuQ5p3h31S:T4ZkZ2RNoul3+/oXk3TJBHAM2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655529483, "uuid": "c931974d-1d1b-40f0-bbaf-1ec3a58004f9", "value": 2377418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655529483, "uuid": "340fd5a8-3de6-45b9-9a20-be689483dd02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655529483, "uuid": "0a7f114f-0cae-4df9-925b-e186ef7b58a2", "value": "881a184af047bda6af683da596210dff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "694f3a95-ef20-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655568302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655568302, "uuid": "bb615996-e63f-4e37-9911-af06b49b21aa", "comment": "Malware payload", "value": "b27baf70ed2dec908fa4515195c2d462", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655568302, "uuid": "450ba5af-473e-4ef0-b512-7058320a7d10", "comment": "Malware payload", "value": "fa578ae728b89ea61901dac2758613aff3135027f8a6bc17a3b8f20316d541a8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655568302, "uuid": "7a9fcdcd-c835-4517-b668-20c51e3a5c23", "comment": "Malware payload", "value": "e83d7890f66a0a7d3b9f03beb9eda70b3ed420f5", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655568302, "uuid": "04471643-f190-4b9a-bc19-936597a3bb19", "comment": "Malware payload", "value": "9a87ed0d6375ed6555ab029631212c3440e6e6b71165a07e6d8f3c48ba25d0d0846c6f7b756bdf0c7a304f6e69f43817", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655568302, "uuid": "b334c3d8-af24-4d48-a1a0-397921a24398", "value": "T14121B9F2D5CE3E5FF23D6C3DC9CA144A0313521129D93E4158B060386D8C555FC3D996", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655568302, "uuid": "3ab090d6-3d94-4bb5-aa99-2ddcc6b821f5", "value": "24:BC7/8alLHtS6I1xsEGRfYg/GwjELYQWGEk8mOwS3:wQEHCkRfb/djlQaJmOd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655568302, "uuid": "ffdedccd-4ce6-4be1-b283-48088abbe85e", "value": 1124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655568302, "uuid": "9855658e-d412-40cf-bcd9-c90e62a810f5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655568302, "uuid": "d89c6ab0-89e6-41e4-bb5f-816b55c5a362", "value": "Items2059.zip.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aecfb2d1-ef1e-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655567560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567560, "uuid": "f2406ffd-7a5b-4513-bb2d-d443aed0570c", "comment": "Malware payload", "value": "a5cb840cf89cb7fc480356b74ff0b6af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567560, "uuid": "b15d0116-8413-4ba3-aa02-fd4cace67b81", "comment": "Malware payload", "value": "fb5e86843b7fb086617c0a5f6eda401f467aa866ef78222f7c66f8765aa4a14c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567560, "uuid": "8645a2c9-54a6-4715-8898-afc8c0c23f1e", "comment": "Malware payload", "value": "4073b4ab10ca6dc75db498312ca9199d349dea6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567560, "uuid": "8c2195b0-81a4-4cfe-82df-26937709dd35", "comment": "Malware payload", "value": "7a494c96379919cb61fa726b5f2ad5a74dd6964661f26136d2926848cccc866d8e40a2db7e19857c012ab14f697c977c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567560, "uuid": "8f0e64f1-6b00-4f7d-8083-651240758d51", "value": "T1ED35F1027FD5C872E1731D769931E360A97CBD602F3A866BB3D43E6D98B03816925363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567560, "uuid": "3d36bef1-b31d-46c5-bc4d-3a402a8db28a", "value": "9222d372923baed7aa9dfa28449a94ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567560, "uuid": "3b2bb8f0-fe3c-4a07-8c66-c3e49aa6af41", "value": "12288:L4+fAv6B8azBwdmiX+tGAH5aIyeEEAUICtBBdgxtuNZJt3urAeGqcrLUUX6p6ptR:Lvk6+c2dm2Akhc33gevJU0qhUX61fmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655567560, "uuid": "5d271c33-e7cc-4b4b-8913-b41cb0dc7bef", "value": 1107968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655567560, "uuid": "13be2c49-66a3-4474-8266-c4b3e845a2d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567560, "uuid": "a3c534f0-62c4-445d-965b-cacd4a5350aa", "value": "Hesap Makinas_.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbca82b9-ef58-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655592492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655592492, "uuid": "f3182f76-ede6-445d-8c71-15da0603c151", "comment": "Malware payload", "value": "e8025c9a93be7a808f5778a19673f169", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655592492, "uuid": "ddab3916-75e8-4db4-884d-7fa6f4a7ab03", "comment": "Malware payload", "value": "fc5bee68e8477015d3c70284e8f0a7ee14265d5fda454f6ab473a8305f1853e3", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655592492, "uuid": "9da783cf-368e-4dfb-99fc-bba4859803d5", "comment": "Malware payload", "value": "435acf0d56937d1276ac95eb3b797dc80ca391b3", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655592492, "uuid": "697087c6-ace8-4d9f-bc0c-b08e8577f6c3", "comment": "Malware payload", "value": "92714bdee5dc14a937a2eaab4328ebec63f5f8834a95c4afbaca338f07989c42d2f9a272bfdc5cdbc472debc26959dd9", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655592492, "uuid": "92adad05-f187-4337-9545-63a199238331", "value": "T1B834239E793BCDEFE943969C0943A9AD3C592445C06B41F2AB40EDC1BAA4D4F01873E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655592492, "uuid": "977dd6be-9811-42e9-81db-a488a334543f", "value": "3072:iur3nFwAtyNzbbiEP4UFuaXebiPZTPSW8uh9AE/mao9eM1r/CaE2ucFhmkXhB01D:iurS1BqEPR0ctS79fx/CaRzlwmUqe/B9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655592492, "uuid": "e0087709-638f-40fb-8447-f32ec74b7635", "value": 239417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655592492, "uuid": "df83b9ec-4ede-4c39-9ac4-e12ffabd04ce", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655592492, "uuid": "4e7247b4-f77c-446e-ac78-6c3b2807d355", "value": "justificantePago_ca_180210321449.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3bdcde3-ef1e-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655567568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567568, "uuid": "ba7aec30-a5fa-4eef-bb17-f0a469b48a34", "comment": "Malware payload", "value": "cb813cf969f59defd05a77ff0343df30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567568, "uuid": "0b1a9f49-8e94-4f00-9c81-b923b657dfa8", "comment": "Malware payload", "value": "fce1030962997ccaf65a9ac2fcb94e4f834ff6f9b007f757773202a0ebdc5ebb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567568, "uuid": "daddce70-3847-4480-8dfa-49fc47a1f404", "comment": "Malware payload", "value": "37ac6be035c625de98d57832853bc65f7a2bdc1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655567568, "uuid": "9071908f-1380-48e0-be70-bf3a9b2dadde", "comment": "Malware payload", "value": "e2f21598ff1b64179615058d1fce4e02ce7a333e56bebebaff2fd1ba3d89b4cadcc3e8ffa2ebba4097e222ea6385adce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567568, "uuid": "ef377f30-a37b-4d13-b070-72b9f6dd9216", "value": "T1E1D589102E7E8426F462863C495CA277C5BBBBDCBB1F499722B4667B1B23381452D733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567568, "uuid": "d7de52bd-9b64-471b-935b-e9f4f3f555c7", "value": "e744e739eeab312fc7533618533b13e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567568, "uuid": "3cfddbf5-97de-485b-a33c-8f042aad7a16", "value": "49152:D47Nlau3Z9JvDr+O1vHRF51BrB9YM9GGiY6NlLKTn2TBql8dWtYb8:DeNlau3bJ+O1vHxLxFn6NlOq1qCkY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655567568, "uuid": "c3b23379-8efa-4045-94c6-c82e1c72a727", "value": 2761552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655567568, "uuid": "b1eee803-402a-46ea-a67c-69e3cb90ff92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655567568, "uuid": "01a4ec10-5b2f-4510-9198-a880d7ff1faa", "value": "kav21.3.10.391ro_25688.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68bcbf02-eee3-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655542102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655542102, "uuid": "acab4b77-761e-4e80-83a7-0741041a1862", "comment": "Malware payload (Mirai)", "value": "0564526a4672c28d817ac907db559736", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655542102, "uuid": "caf83b93-9b16-4c9d-8f7f-6f698671bdb9", "comment": "Malware payload (Mirai)", "value": "ff304ed0bf507f57e0b0957eba7815a5422e0827e2b18cb62a7fc37e64c16bc2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655542102, "uuid": "2b88a761-8519-4b0b-8c87-edb7eca8aaa3", "comment": "Malware payload (Mirai)", "value": "a87f788ac907b531ed02ebf4c7950a371e48e3d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655542102, "uuid": "11d9be54-95bc-4af5-9d7d-3e99a4023453", "comment": "Malware payload (Mirai)", "value": "ab3fbfe777ca274037871fbad3bbc90c7c7892fd931e367251944e18441f66789b8655ce3208fdb22b8f69ad08d63c8f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655542102, "uuid": "a621f7e8-317e-49ce-a3c6-b34b8cd8c792", "value": "T18BA35B82D642C2F3C4430AF1029F965A0532FB3A8E3B9EAAF75D7CF49B129D53115B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655542102, "uuid": "6debf0be-99b1-4a5f-890d-a4393540179a", "value": "3072:aPaqjPQP39VjGWX98732V7kGyNVV5heTe7FXnf0OzTyoQQub:ahQP39VjGWXW9NVV5h+0FXnf0OzTyoQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655542102, "uuid": "c8b8ecae-136a-4631-b797-9a59b01f3f74", "value": 99709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655542102, "uuid": "b7c6b659-80bd-4664-b74b-2cb1cbc1c4ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655542102, "uuid": "ea1747d6-32fc-4150-8e82-6f98b2603917", "value": "0564526a4672c28d817ac907db559736", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76056dc2-ef20-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655568323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655568323, "uuid": "1e3a816d-dd5b-45ab-abf1-8f22cfb02354", "comment": "Malware payload", "value": "c4ff53e64ac173c193a24d0e86bd3f2c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655568323, "uuid": "1415b338-080e-41ee-959e-740ede0ef341", "comment": "Malware payload", "value": "ffb7aa4d8b5b9d646d5a0b07e6768a1ada834aeb99fa1c100dcc7e51004635ae", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655568323, "uuid": "5f1c64c1-559d-4f03-b9b3-cd9b12199956", "comment": "Malware payload", "value": "4567c92561a31db9c249d24d87df82b89cb590ae", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655568323, "uuid": "81d3eb35-b20e-4b54-b54d-44d11a57e645", "comment": "Malware payload", "value": "819f8d168083bc62366577f7a9569e76563cd03f4260056f27e3a7a0fbdcf4c7b9992211b7b12266050576e798011257", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655568323, "uuid": "0749fc22-8eef-4091-8ab4-596069d258ec", "value": "T1942186A3C7A14D5EC10F9DB9604E138F50F9E19E01C677667708B38518E549F5D206B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655568323, "uuid": "e9859e4d-b375-4928-b580-7ef5f5272c5a", "value": "24:dCOLLmyDCXd/oq1Yy4buNcGL5Y8AdFEXO5CF:0SmldggY9pGL5Y8hOE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655568323, "uuid": "d03e629c-9c61-4340-a23c-a739d4b9d079", "value": 1134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655568323, "uuid": "e5a64a2f-1f29-4272-9f55-d336af52dbaa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655568323, "uuid": "f1c8b01c-7dff-4147-876d-de37e862432d", "value": "Items4115.zip.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }